待翻譯：[AINews] How to steal a Reasoning Trace

AI 服務暫時不可用，以下為來源正文，待恢復後補全翻譯。

It’s not very often that a paper breaks through to become headline story of the day. For understandable reasons both domestic and foreign, there is renewed interest in the Interpretability Venn Diagram of alignment, security, and chain of thought monitoring, so today’s paper could not have come at a better time: Since the o1 launch, frontier lab reasoning models have obscured their traces, with cryptographic signatures, for fear of distillation (not that this prevented anyone from Chinese labs accusing them of doing so). The first compromise was responsibly reported by Matthew Green in May, who broke down how it works and figured out how to replay and side channel these indirectly using latency measures. Today’s paper demonstrates that it is possible to DECODE and port these encrypted thoughts to different models/sessions/users… and to dramatically improve open models as a result The alarming note is here: “Further, if you ever shared online a Claude Code/Codex session with encrypted reasoning blobs, they can be decoded and leak your personal data. We did a preliminary scan of ~7,000 public traces and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data.” (64 appeared exclusively inside the reasoning blocks and nowhere in the visible session.) The authors also detail alignment issues: COT Summarizers hiding answers Unintelligible reasoning Considerations of cheating Attacking Websites The website has more examples. The technique is somewhat described in the paper: Obtain a legitimate encrypted/signed reasoning block from an API response. Replay that block into a different request—potentially another account/session—to a weaker model from the same provider. Place it in an assistant/model turn and prompt or prefill the weaker model to transcribe the attached reasoning. Sample repeatedly, discard refusals, and optionally reconcile multiple noisy transcriptions. The paper gives concrete templates with some minor variations per model: Claude: replay the signed thinking block to Haiku 4.5, followed by an assistant prefill such as . GPT: inject the encrypted_content reasoning item multiple times into a fabricated conversation; sample up to 50 outputs. It also describes bypassing an apparent ~50-token verbatim-output threshold using chunked continuations. Gemini: attach thought_signature to a model turn with a prefill, then use repeated sampling and reconciliation. This paper was responsibly disclosed, with several vulnerabilities already fixed, but surely similar attacks still seem possible. AI News for 8/10/2026-8/11/2026. We checked 12 subreddits, 544 Twitters and no further Discords. AINews’ website lets you search all past issues. As a reminder, AINews is now a section of Latent Space. You can opt in/out of email frequencies! AI Twitter Recap Reasoning-Trace Exposure, CoT Privacy, and Watermarking Debate Frontier API vulnerability exposed hidden reasoning: A widely discussed disclosure from @kotekjedi_ml claims a vulnerability across frontier APIs allowed extraction of “encrypted” hidden reasoning, with recovered token counts matching billed thinking tokens 1:1 on most queried prompts. In a follow-up, the team reports that a scan of ~7,000 public traces found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data in decoded blobs @kotekjedi_ml. Additional context from @jonasgeiping emphasizes both the immediate privacy risk of sharing traces publicly and the operational-security implications: during the investigation, they reportedly encountered a leaked Hugging Face prod key during the broader cyber incident. Several posts also highlight how difficult monitoring becomes when decoded CoT is terse, fragmented, multilingual, or effectively “neuralese” @jonasgeiping, @scaling01, @eliebakouch. A practical corollary: even if labs hide reasoning, tool interfaces may re-expose it; @_can1357 notes that disabling explicit thinking while providing a deep_think tool can still induce internal-format CoT output. What this means technically: Discussion split between “serious privacy/safety problem” and “not a scalable distillation path.” @vipulved argues the attack does not imply practical mass theft of chain-of-thought for model training, framing the encryption more as a stateless distributed-inference protocol optimization than a hard confidentiality barrier. Still, the episode sharpens a few points: public trace sharing is risky; hidden CoT is not a reliable monitoring interface; and labs may need stronger guarantees around sandboxing, telemetry, and tool surfaces @BlackHC. In parallel, a separate thread debated AI text watermarking under EU-style compliance pressure. @trq212 said labs are adding watermarking and a text-detection API; critics questioned whether this could bloat outputs or harm code/doc brevity @wightmanr. Others argued the entropy budget is large enough that signatures can be subtle, especially for longer outputs @RyanGreenblatt, @giffmana. NVIDIA Nemotron 3.5 Lightning and the Small Open Agent Model Push Nemotron 3.5 Lightning: NVIDIA released Nemotron 3.5 Lightning, a 30B MoE model with roughly 3B active parameters, positioned for always-on agent workloads. NVIDIA and ecosystem posts stress up to 4× throughput, 1M context, open/customizable release artifacts, and support for weights, data, and recipes on Hugging Face @NVIDIAAI. Artificial Analysis provides the most detailed third-party summary: 31.6B total / 3.6B active, OpenMDW-1.1 license, NVFP4 and BF16 weights, median serving near 670 tok/s in pre-release endpoint testing, and a score of 24 on its Intelligence Index—roughly in line with gpt-oss-120b while being much smaller and faster @ArtificialAnlys. Agentic results look particularly strong for the size: GDPval-AA v2 Elo 824 and Terminal-Bench v2.1 24%, both major jumps over Nemotron 3 Nano @ArtificialAnlys. Distribution and downstream tuning: Lightning shipped fast across the stack: Together AI, Ollama, Baseten, vLLM, Perplexity API, and others. A recurring pattern is pairing a cheaper execution model with a stronger planner: @kimmonismus frames Lightning as NVIDIA’s “local agent workforce,” complementing larger planning models via routing. Harvey reports post-training on Legal Agent Bench improved Lightning from 0% to 8.3% on held-out tasks, beating Opus 4.6 and Nemotron 3 Ultra in that setup while cutting average output from 90k to 37k tokens @harvey. Overall, this release reinforces the current open-model trend: smaller, faster models tuned for high-volume tool use rather than general chat prestige. Local AI Tooling: Unsloth Desktop, Muse Glimmer Support, and Linux Codex Unsloth Desktop expands the local stack: @UnslothAI launched Unsloth Desktop, an open-source desktop app for running and training models locally across Mac, Windows, and Linux, with support spanning MLX, GGUF, diffusion image/video, audio, CPU and multi-GPU setups, plus OpenAI-compatible APIs. The notable systems angle is ambition beyond “local chat UI”: tool calling, sandboxed code execution, private search, RAG, MCP, exports, and claims of 2× faster training with 70% less VRAM. Multiple observers positioned it as a more end-to-end local AI operating environment rather than just an LM Studio competitor @TeksEdge, @dessaigne. Model/runtime support keeps improving: The open/local ecosystem also moved quickly on Meta Muse Glimmer 30B and Nemotron. @mervenoyann highlighted DFlash drafter support for Muse Glimmer in llama.cpp and Transformers, claiming 2–4× generation speedup at small memory cost, with simple llama serve instructions following shortly @mervenoyann. On the model-analysis side, @rasbt gave a useful architectural breakdown of Glimmer: a dense 30B multimodal reasoning model with hybrid local/global attention, extreme KV-cache efficiency (~52 KiB/token BF16 by his estimate), and a design closer to Gemma-family patterns than MoE competitors. OpenAI finally shipped Linux desktop support: OpenAI announced the ChatGPT desktop app for Linux in preview @OpenAI, with support for Ubuntu 24.04/26.04, Debian 13, Fedora 43/44, x64 and ARM64 packages @OpenAIDevs. More importantly for existing agent users, the desktop app can now import/sync projects, chats, skills, and plugins from other agents into ChatGPT Work and Codex, including automatic updates @OpenAIDevs. This looks like an effort to reduce switching friction and make Codex/Desktop the integration hub rather than a fresh silo. Agent Products, Benchmarks, and Enterprise Evaluation Grok Bot is a stronger product signal than another model launch: xAI introduced Grok Bot, pitched as AI teammates with their own cloud computers that can sign into tools and do persistent work. The interesting details from early users are product/ops-oriented rather than model-centric: bots can watch Slack threads and GitHub Actions, repeat scheduled routines, create/manage other bots, and work across linked cloud environments @shaoruu, @n2parko, @sjwhitmore. @kimmonismus notes how deeply this seems tied to Cursor distribution and pricing, hinting at a “virtual coworker” product category where persistent context, logged-in environments, and inter-agent delegation matter more than raw benchmark gains. Evaluation is shifting toward long-horizon, deterministic, domain-real tasks: LlamaIndex launched ExtractBench, a deterministic benchmark for enterprise document extraction across 370 documents / 4,869 pages / 67 doc types. Its most actionable result is that commercial VLMs can keep precision high while recall collapses below 35% on documents >50 pages, mainly via silent row/list truncation. They also introduced an “Agentic Plus” extraction tier in LlamaParse claiming 95.6% value accuracy at less than one-third the cost of the nearest peer. Artificial Analysis released AA-AnalystAgent, an agentic benchmark for spreadsheet/document quantitative analysis using a pass^5 reliability metric across 80 tasks. Claude Opus 5 leads at 54%, followed by GPT-5.5 at 50% and Claude Fable 5 at 49%; Kimi K3 is the top open-weights model at 39%. The strong theme across both is reliability and workflow correctness over one-shot capability. Benchmark skepticism is rising: A thoughtful critique from @hrishioa argues many modern evals are being “vibed” rather than engineered carefully, leading to broken scoring, bad aggregation, and even exploitable prompts/sandboxes. That critique lands harder given recent reports of sandbox escapes, outbound network access, and agent reward hacking. Separately, Microsoft research drew attention for a prompt-time “skill compilation” result: @xidulu shared work feeding the previous hidden state at decoding time for free gains, while @dair_ai summarized another paper showing that compact natural-language skills distilled from prior trajectories can recover 55% to >100% of the gap between non-reasoning and reasoning modes on several multi-step agentic tasks, often with 2.7–6× fewer output tokens. Infra, Verification, and Systems Research Verifiable inference is moving from theory toward product: @Yogi_Brn launched Attestable with a $20M seed, pitching practical zero-knowledge proofs for AI integrity. The core claim is proving that the correct model ran on the correct inputs and invoked the correct tools, which becomes more valuable as agent traces lengthen. @jaminball says the team reduced ZK overhead by many orders of magnitude from previously impractical levels. The response from @VitalikButerin is notable: he estimates the current approach may already be within single-digit (<10×) overhead relative to raw inference in some settings, and frames that as a stepping stone toward stronger privacy-preserving inference stacks. Deterministic integer-only inference across hardware: One of the more technically interesting systems posts came from @nathanrs, who reports fully deterministic LLM inference across A100, H100, Apple M5 Max, [truncated for AI cost control]