Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

How to Steal Reasoning Without Reasoning Traces

Tingwei Zhang, John X. Morris, Vitaly Shmatikov

TL;DR

It is shown that traces synthesized by trace inversion have high overlap with the ground-truth reasoning traces (when available), and fine-tuning student models on inverted traces substantially improves their reasoning.

Abstract

Many large language models (LLMs) use reasoning to generate responses but do not reveal their full reasoning traces (a.k.a. chains of thought), instead outputting only final answers and brief reasoning summaries. To demonstrate that hiding reasoning traces does not prevent users from "stealing" a model's reasoning capabilities, we introduce trace inversion models that, given only the inputs, answers, and (optionally) reasoning summaries exposed by a target model, generate detailed, synthetic reasoning traces. We show that (1) traces synthesized by trace inversion have high overlap with the ground-truth reasoning traces (when available), and (2) fine-tuning student models on inverted traces substantially improves their reasoning. For example, fine-tuning Qwen-2.5-7B-Instruct on traces inverted from the answers and summaries of GPT-5 mini, a commercial black-box LLM, improves its performance from 56.8% to 77.6% on MATH500 and from 11.7% to 42.3% on JEEBench, compared to fine-tuning on just the answers and summaries.

How to Steal Reasoning Without Reasoning Traces

TL;DR

It is shown that traces synthesized by trace inversion have high overlap with the ground-truth reasoning traces (when available), and fine-tuning student models on inverted traces substantially improves their reasoning.

Abstract

Many large language models (LLMs) use reasoning to generate responses but do not reveal their full reasoning traces (a.k.a. chains of thought), instead outputting only final answers and brief reasoning summaries. To demonstrate that hiding reasoning traces does not prevent users from "stealing" a model's reasoning capabilities, we introduce trace inversion models that, given only the inputs, answers, and (optionally) reasoning summaries exposed by a target model, generate detailed, synthetic reasoning traces. We show that (1) traces synthesized by trace inversion have high overlap with the ground-truth reasoning traces (when available), and (2) fine-tuning student models on inverted traces substantially improves their reasoning. For example, fine-tuning Qwen-2.5-7B-Instruct on traces inverted from the answers and summaries of GPT-5 mini, a commercial black-box LLM, improves its performance from 56.8% to 77.6% on MATH500 and from 11.7% to 42.3% on JEEBench, compared to fine-tuning on just the answers and summaries.
Paper Structure (22 sections, 3 equations, 5 figures, 6 tables)

This paper contains 22 sections, 3 equations, 5 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Threat Model
  4. Problem Setting
  5. Attacker’s Goal
  6. Attacker’s Capabilities.
  7. Method
  8. Stage 1: Training the Inversion Model
  9. Stage 2: Inverting Victim's Outputs
  10. Stage 3: Student Distillation
  11. Evaluation
  12. Experimental Setup
  13. Datasets.
  14. Inversion (With Summaries)
  15. Stealing Reasoning Capabilities (With Summaries)
  16. ...and 7 more sections

Figures (5)

  • Figure 1: Trace Inversion example against GPT-5 mini. Given only the input, final answer, and reasoning summary from a commercial black-box model, Trace Inversion synthesizes a detailed reasoning trace that can be used for supervised fine-tuning of a student model.
  • Figure 2: Trace Inversion pipeline.
  • Figure 3: Student accuracy vs. victim query budget.Qwen trained on traces synthesized from GPT-5 mini using an R1-based inversion model.
  • Figure 4: Trace inversion against R1. Zero-shot inversion versus trace inversion with R1-Distill as the surrogate model.
  • Figure 5: Trace inversion against R1. Ground-truth reasoning trace versus a trace synthesized with R1-Distill as the surrogate model.