# Trace Inversion 攻击：无需可见思维链即可复制模型推理能力

- 来源：Rohan Paul (@rohanpaul_ai)
- 发布时间：2026-08-12 08:20
- AIHOT 分数：69
- AIHOT 链接：https://aihot.virxact.com/items/cmspde4dh0fbkrort3gh7e2hq
- 原文链接：https://x.com/rohanpaul_ai/status/2087333464748212484

## AI 摘要

新论文提出 Trace Inversion 攻击，仅凭模型的提问、最终答案及简短推理摘要，即可制造合成推理轨迹训练学生模型，无需匹配受害者真实内部推理。收集 10,000 条 GPT-5.4 mini 查询仅需 $173.28，隐藏思维链无法可靠阻止能力迁移。

## 正文

You don't necessarily need to see how a powerful AI thinks to copy some of its reasoning ability.

Its final answers can contain enough signal to manufacture new reasoning traces for training another model.

The paper's attack, Trace Inversion, only needs the model's question, final answer, and optionally its short reasoning summary.

A separate inversion model learns from an open reasoning model, then turns those sparse black-box outputs into long synthetic reasoning traces for training a student.

The crucial point is that those traces do not have to match the victim's true internal reasoning exactly.

They only have to be good enough supervision.

And the paper estimates $173.28 to collect 10,000 GPT-5.4 mini queries.

So the defense problem now shifts: hiding or obfuscating chain of thought can reduce transparency without reliably preventing capability transfer.

The attacker can manufacture the missing training signal after the API call.

### 引用推文

> Rohan Paul：Very big warning from this paper. Your AI's hidden reasoning can become a second, invisible data leak. You can clean the visible chat and still accidentally pub...