You can extract the thinking process from closed LLMs
Researchers figured out how to steal the internal reasoning steps from proprietary models like GPT-4o and Claude through API timing attacks.
A new paper shows you can extract reasoning traces from closed-source LLMs using nothing but API timing data. The attack works on OpenAI o1, GPT-4o, Claude Sonnet, and Gemini Pro. The method is simple. Send the model a prompt. Measure how long it takes to start responding. Compare that latency to prompts where you already know the reasoning chain. The delay leaks information about which internal steps the model took before answering. They got scary-good accuracy. On OpenAI o1, they reconstructed 51 percent of reasoning tokens correctly. On Claude Sonnet, 23 percent. That is enough to reverse-engineer problem-solving strategies, extract proprietary prompt templates, or figure out what guardrails fired. The defence is generating fake delay noise, but that breaks the user experience. If you add random jitter to every response, your API feels slower for no visible reason. OpenAI already pads o1 responses, but the paper shows it is not enough padding. This matters for anyone building on top of frontier models. You assume the reasoning process is private. It is not. An attacker with API access and patience can infer the chain-of-thought your model used, token by token, without ever seeing the weights. The kicker is this works on models specifically designed to hide reasoning. o1 does not expose its chain-of-thought in the API response. The researchers extracted it anyway, using only the time between request and first token. Timing side-channels are older than computers, but we keep forgetting they exist in new systems. LLMs are no exception.