# Stealing Reasoning Traces from Proprietary LLM APIs — Ilia Shumailov & Alexander Panfilov

Page: https://stenobird.com/podcast/machine-learning-street-talk/stealing-reasoning-traces-from-proprietary-llm-apis-ilia-shumailov-alexander-panfilov
Text version: https://stenobird.com/podcast/machine-learning-street-talk/stealing-reasoning-traces-from-proprietary-llm-apis-ilia-shumailov-alexander-panfilov.md
Podcast: [Machine Learning Street Talk (MLST)](https://stenobird.com/podcast/machine-learning-street-talk)
Published: 2026-08-22T20:29:11+00:00
Episode link: https://podcasters.spotify.com/pod/show/machinelearningstreettalk/episodes/Stealing-Reasoning-Traces-from-Proprietary-LLM-APIs--Ilia-Shumailov--Alexander-Panfilov-e3nonlk
Audio file: https://traffic.megaphone.fm/APO1270776138.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/machine-learning-street-talk/episodes/stealing-reasoning-traces-from-proprietary-llm-apis-ilia-shumailov-alexander-panfilov
Duration seconds: 2940

## Resource

Tim Scarfe speaks with Ilia Shumailov and Alexander Panfilov about their paper, Stealing Reasoning Traces from Proprietary LLM APIs.The core bug sounds deceptively simple: providers return encrypted reasoning state so conversations can be resumed or forked. But those blobs can be replayed across users and sibling models. A smaller model can ask the provider to decrypt the trace, then repeat the hidden reasoning in plain text. The discussion covers leaked private data, a broadly reusable jailbreak, poisoned agent traces, chain-of-thought monitoring, responsible disclosure, and possible defenses.Ilia Shumailov is an AI and security researcher, formerly at Google DeepMind, who completed his Cambridge PhD under Ross Anderson. Alexander Panfilov is a PhD researcher at the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems, working on AI safety, adversarial machine learning, and LLM red-teaming. They close by separating the demonstrated jailbreaking threat from ordinary benign distillation, and by arguing for controlled experiments over sweeping claims.---TIMESTAMPS:00:00:00 Intro montage00:01:33 Portable encrypted thought and decoded reasoning00:24:55 How the attack works and what it means00:39:04 Doom, defense, and scientific restraint---REFERENCES:paper:[00:00:00] Stealing Reasoning Traces from Proprietary LLM APIshttps://arxiv.org/abs/2608.09867[00:09:22] Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safetyhttps://arxiv.org/abs/2507.11473[00:11:30] Reasoning Models Don’t Always Say What They Thinkhttps://www.anthropic.com/research/reasoning-models-dont-say-think[00:37:22] PostTrainBench: Can LLM Agents Automate LLM Post-Training?https://arxiv.org/abs/2603.08640[00:41:02] Large-scale online deanonymization with LLMshttps:…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/machine-learning-street-talk/episodes/stealing-reasoning-traces-from-proprietary-llm-apis-ilia-shumailov-alexander-panfilov/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/machine-learning-street-talk/stealing-reasoning-traces-from-proprietary-llm-apis-ilia-shumailov-alexander-panfilov.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.