论文警告：AI隐藏推理可成第二数据泄露通道
Very big warning from this paper.
做AI安全和隐私的同学必看，这篇论文揭示了隐藏推理的泄露风险，赶紧检查你的日志和推理块处理流程。
Very big warning from this paper.
这篇论文发出了非常严重的警告。
Your AI's hidden reasoning can become a second, invisible data leak.
你的人工智能的隐藏推理可能成为第二个、无形的数据泄露点。
You can clean the visible chat and still accidentally publish passwords, API keys, or private data.
你可以清理可见的聊天记录，但仍然可能意外泄露密码、API密钥或私人数据。
A company can secure its smartest model perfectly and still lose its secrets through a cheaper model in the same family. The weakest model can become the security hole for the strongest one.
一家公司可以完美保护其最智能的模型，但仍然可能通过同一系列中较便宜的模型泄露其秘密。最弱的模型可能成为最强模型的安全漏洞。
Encrypted reasoning is supposed to hide what frontier models think, but this paper shows the encrypted blob itself can become the attack surface.
加密推理本应隐藏前沿模型的思考内容，但这篇论文表明，加密的代码块本身可能成为攻击面。
Anthropic, OpenAI, and Google APIs return opaque reasoning blocks to clients so they can be replayed in later turns without storing the reasoning server-side.
Anthropic、OpenAI和Google的API向客户端返回不透明的推理块，以便在后续轮次中重放，而无需在服务器端存储推理内容。
The problem is portability: the authors found these blocks could be reused across sessions, users, and even models within the same provider.
问题在于可移植性：作者发现这些块可以在同一提供商的会话、用户甚至模型之间重用。
That lets an attacker take a trace from a stronger model, feed it to a weaker compatible sibling with looser safeguards, and use that model as a decoder.
这使得攻击者可以从更强的模型中获取轨迹，将其输入到具有更宽松安全措施的较弱兼容兄弟模型中，并利用该模型作为解码器。
Across public agent logs, the team decoded 315,320 reasoning blocks from 6,708 trajectories; 328 sessions, or 4.9%, leaked at least one sensitive item.
在公开的代理日志中，团队从6708条轨迹中解码了315320个推理块；328个会话（占4.9%）泄露了至少一个敏感项目。
In genuine user sessions, they recovered 62 API keys, 33 passwords, 24 access tokens, and 30 personal emails.
在真实用户会话中，他们恢复了62个API密钥、33个密码、24个访问令牌和30个个人电子邮件。
So an encrypted reasoning field in a log is not necessarily safe metadata if another model can read it.
因此，如果另一个模型可以读取日志中的加密推理字段，那么它就不一定是安全的元数据。
After responsible disclosure, providers patched the reported attacks, and the exact exploits were no longer reproducible by August 2026.
在负责任地披露后，提供商修补了所报告的漏洞，到2026年8月，确切的利用方法已无法复现。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力