You don't necessarily need to see how a powerful AI thinks to copy some of its reasoning ability.

Its final answers can contain enough signal to manufacture new reasoning traces for training another model.

The paper's attack, Trace Inversion, only needs the model's question, final answer, and optionally its short reasoning summary.

A separate inversion model learns from an open reasoning model, then turns those sparse black-box outputs into long synthetic reasoning traces for training a student.

The crucial point is that those traces do not have to match the victim's true internal reasoning exactly.

They only have to be good enough supervision.

And the paper estimates $173.28 to collect 10,000 GPT-5.4 mini queries.

So the defense problem now shifts: hiding or obfuscating chain of thought can reduce transparency without reliably preventing capability transfer.

The attacker can manufacture the missing training signal after the API call.