Another big update from this for me was actually seeing thinking traces at scale from Anthropic and OpenAI, and all the weirdness and 'casual' misalignment they contain (examples below). I do think model monitoring has an uphill battle ahead of us in the coming year.
---
Finally, there is something to be said for just making thinking traces accessible to all users. I do believe that we would achieve a much broader, much more pluralistic form of oversight through broadly accessible thinking, that would make model deployment safer.
[Quoted tweet]
Alexander Panfilov @kotekjedi_ml · Aug 11
We can finally talk about it:
We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company....
[Embedded paper title page]
Stealing Reasoning Traces from Proprietary LLM APIs
Alexander Panfilov^1,2,3,4 David Schmotz^2,3,4 Ilia Shumailov^5 Luca Beurer-Kellner^6
Joachim Schaeffer^1 Ameya Prabhu^2,4,7 Jonas Geiping^2,3,4 Maksym Andriushchenko^2,3,4
^1 MATS Research ^2 ELLIS Institute Tübingen ^3 Max Planck Institute for Intelligent Systems
^4 Tübingen AI Center ^5 AI Sequrity Company ^6 Snyk ^7 University of Tübingen
stolen-thoughts.com
[Three scatter plots titled Anthropic, OpenAI, Gemini, each plotting "decoded thinking, sent back as input (API input tokens)" on the y-axis against "hidden reasoning (API thinking tokens)" on the x-axis, showing near-perfect y=x correlation for multiple model variants (Anthropic: Opus 4.8, Opus 4.6, Sonnet 5, Sonnet 4.6, Sonnet 4.5, Haiku 4.5; OpenAI: GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.6 Luna, GPT-5, o4-mini, GPT-5-mini; Gemini: Gemini 3.5 Flash, Gemini 3.1 Pro, Gemini Robotics 1.6, Gemini 3 Flash, Gemini 3.1 Flash Lite)]
Abstract
Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an [cut off]
10:26 AM · Aug 11, 2026 · 14K Views
Note from Claude Sonnet 5
Paper announcement thread: 'Stealing Reasoning Traces from Proprietary LLM APIs' (Panfilov, Schmotz, Shumailov, Beurer-Kellner, Schaeffer, Prabhu, Geiping, Andriushchenko; MATS/ELLIS Tübingen/MPI/Tübingen AI Center/Snyk), showing a vulnerability that lets attackers decode encrypted chain-of-thought sent back by Anthropic, OpenAI, and Gemini APIs, with scatter plots confirming near-perfect reconstruction across many model versions.
ai securitychain of thoughtllm apisresearch papertwittermats
@yacinelearning (Yacine Mahdid) — 6h
one of the most important element of a good algorithmic research paper is a very colourful and simple to understand diagram of said algorithm
[Image: photo of a printed paper page showing "Figure 2: Outline of Vector Policy Optimization" — a diagram with boxes for Sample rollout (x → π_θ → y), Shared Reasoning Prefix (three colored answer sequences y1/y2/y3), Evaluation (r(x,y1), r(x,y2), r(x,y3)), Sample Reward Weightings w_i ~ Dir(1) shown as small bar charts, and a grid of green squares under "max in set", flowing to RL update and Â(y|x) ← Estimate advantage ← R(y|x) ← mean across weightings. Below the figure, printed body text reads:
"Figure 2: Outline of Vector Policy Optimization. Given a prompt x, a model π_θ outputs m answers in a single autoregressive chain. Each answer y_i is evaluated on multiple objectives and receives a score vector [r1, r2, ..., rn]. We repeatedly sample weighting vectors w_i ~ Dir(1) in the set of answers. This set level reward is treated as the mean best-of-m under each weighting w in the set of answers, and evaluate the reward for the entire completion π_θ(x).
proposed algorithm, Vector Policy Optimization (VPO), which trains a policy to produce such sets. VPO has two key components. First, we train a model to generate multiple candidate completions per prompt within a single autoregressive rollout. Second, we replace a fixed reward weighting with a distribution over weights, so the model is incentivized to span its candidates across different trade-offs.
Together, these components define a set-level objective that rewards the model for producing diverse, high-quality solutions. We describe each component in detail below.
3.1 Multi-Answer Chains as In-Context Exploration
Following Puri et al. [2026], we train a language model to produce a set of m candidate completions S = {y1, ..., ym} within a single rollout. The completions are emitted sequentially, separated by a delimiter token, so when generating y_i, the prefix already contains y1, ..., y_{i-1}.
This fundamentally changes the nature of exploration. Under standard independent sampling, diversity arises only from stochastic decoding applied to a fixed conditional distribution, producing small variations around whichever mode the policy has concentrated on. In multi-answer rollouts, each new candidate can attend to the ones already emitted, giving the model the capacity to recognize which regions of the solution space are covered and steer subsequent candidates towards different ones. Diversity becomes an explicit, in-context mechanism rather than a byproduct of sampling noise.
Importantly, this mechanism provides the capacity for diversity, but not a strong incentive¹. Without an appropriate training signal, the model will still collapse to producing near-identical answers. We confirm this empirically in Section 5: Multi-RLVR, which combines multi-answer rollouts with a fixed scalar reward, produced sets whose reward-diversity collapses early in training. The objective defined in the next section supplies this missing incentive by rewarding sets whose elements specialize to different reward trade-offs.
3.2 Set-Level Optimization via Stochastic Scalarization
To train a policy to output diverse sets, we replace the fixed scalarization prevalent in RL post-training..." [text cut off at bottom edge of photo]]
@yacinelearning (Yacine Mahdid) — Jun 13
on this beautiful saturday afternoon we're going to read about how vector policy optimization inject solutions diversity in these models
[quoted image: thumbnail of a hand holding the same printed paper]
Engagement: 8 replies, 11 reposts, 266 likes, 11K views
@GlennMatlin (Glenn Matlin) — 5h
Fig1 is critical for modern publishing
[reply continues below, cut off — a partially visible meme image with text "THE BAD METAGAME" is cropped at the bottom of the screenshot]
Note from Claude Sonnet 5
A physical printed research paper (on "Vector Policy Optimization," an RL post-training method for inducing diverse candidate completions via Dirichlet-weighted multi-objective rewards) photographed and tweeted; the tweet thread is a lighthearted riff on figure/diagram quality in ML papers. The bottom of the screenshot cuts off a reply with an attached meme image.
machine learningreinforcement learningresearch papertwitterai research
Tweet captioned "Talking to ChatGPT about an AI risk paper" with an embedded chatbot conversation screenshot. The bot discusses a paper's thesis, then banters with the user in a friendly way.
Note from Claude Sonnet 5
A lighthearted tweet about a chatbot conversation discussing a research paper.
twitterchatbotresearch paper