A study of encrypted reasoning traces found that Kimi K3 responds unusually strongly to Claude's decoded internal reasoning -- and the same paper states that this "cannot establish a causal claim of memorization or distillation." The finding is now being carried into a policy fight over Chinese open-weight models as if it were proof of copying. It is not, by the authors' own explicit account, and the gap between what the paper measured and what it is being cited for is large.
Key facts
- The paper is Stealing Reasoning Traces from Proprietary LLM APIs, arXiv 2608.09867, submitted August 10, 2026.
- Kimi K3 had the highest extraction probabilities of any model tested, yet reproducing a 16-token span verbatim would still require on the order of ten billion queries.
- A short Opus prefill roughly doubled word-sequence overlap with Opus's answer, from 0.17 to 0.33.
- The same effect appeared in GLM-5.2; DeepSeek-V3.1 and Inkling showed no comparable change.
Ground Truth covered the main body of this paper on August 22, when the finding was that 315,320 encrypted reasoning blocks were sitting in public repositories, decodable by replaying them into a weaker model from the same provider. This is the appendix nobody read, and it is the part that is about to be misused.
Here is the background. Frontier labs stopped showing you their models' internal reasoning and now return it as an encrypted blob that your client hands back with each turn. The researchers found those blobs are interchangeable across sessions, users, and models within one provider's ecosystem, so an attacker can hand a blob from a heavily guarded model to a cheaper sibling and get it transcribed in plaintext. That is the attack. What follows in Appendix B is a different question: once you have those decoded traces, do open-weight models act like they have seen them before?
The test they ran is called probabilistic extraction. Take a 16-token span from a decoded Claude Opus reasoning trace, give a model the original problem, and measure how many sampling attempts it would take to reproduce that exact span. Kimi K3 came out ahead of every other model tested. It also came nowhere close to practical. The paper's own summary: "When conditioned only on the problem, none of the evaluated models provides evidence of practical verbatim memorization of the decoded reasoning traces. Kimi-K3 yields the highest extraction probabilities, but reproducing a 16-token reasoning span would still require on the order of 10^10 queries."
Ten billion queries to recover sixteen tokens is not memorization. It is a measurement of relative willingness expressed in a very large exponent, and the difference between "the largest of several tiny numbers" and "the model has this stored" is the entire story.
The second experiment is more striking and equally misread. Prefill Kimi K3's reasoning with a short fragment of decoded Opus reasoning -- as little as the first 1 percent -- and its subsequent reasoning and its final visible answer both drift toward Claude's. Measured as overlap of common word sequences with Opus's answer, the prefilled completion scored 0.33 against 0.17 for the best unprefilled control. That is a real, replicated effect inside the paper's setup. It is also, as the authors treat it, a cue: give a model a strong stylistic opening and it continues in that register, which is a thing language models do by construction.
The analogy: hand a jazz pianist the first two bars of a Bill Evans voicing and they will likely continue in Bill Evans's idiom. That tells you the idiom is in their vocabulary. It does not tell you they learned it by transcribing that specific record, and it certainly does not tell you they have the record memorized. Ground Truth's explainers on distillation, model extraction attacks, and model fingerprinting cover why attribution here is genuinely hard.
The authors are unusually direct about the limits. "These observations are suggestive but inconclusive," they write. "They establish unusual behavioral compatibility under the interventions we test, but cannot establish a causal claim of memorization or distillation." They also note the perplexity analysis is only a rough heuristic, since serving differences and provider-specific effects move the numbers, and that the sweeps rest on small problem sets -- 30 problems for one benchmark, 10 for another.
Why it matters right now is political. Congress is weighing restrictions on Chinese open-weight models, the White House has alleged Moonshot distilled Anthropic's Fable, Beijing has returned the accusation without naming anyone, and lobbying filings show which labs put distillation on the agenda. A number shaped like "Kimi is a million times more likely to continue Claude's reasoning" is going to be entered into that record. The number is real. The conclusion attached to it is one the paper refuses to draw.
The honest caveat cuts both ways. None of this exonerates anyone either. Behavioral compatibility between Kimi K3, GLM-5.2 and Claude-derived traces is an odd result that deserves follow-up, and the paper does not claim otherwise -- it lists shared datasets, similar post-training recipes, and architectural convergence as live confounders, and picks none of them. Moonshot's own K3 announcement describes a 2.8-trillion-parameter open model with a million-token context window whose weights run to about 1.56 TB of files on Hugging Face, and says it trails Claude Fable 5 and GPT-5.6 Sol overall. The correct state of knowledge is "unresolved," which is a worse headline and a better description.
Originally published on Ground Truth, where every claim is checked against the primary source.
