Trace Inversion Extracts Hidden Reasoning From GPT-5 mini

A quiet paper posted to arxiv reframes a question the big labs thought they had answered: how do you protect a proprietary reasoning model when you have to expose *something* to users? The answer from Tingwei Zhang, John X. Morris, and Vitaly Shmatikov, in a preprint categorized under cs.CR, is that hiding the full chain of thought and only showing the final answer plus a brief summary does not actually protect the reasoning behind either.

The authors call the technique trace inversion. Given only the inputs a target model saw, the answer it produced, and, optionally, the short reasoning summary it exposed, an inversion model generates detailed synthetic reasoning traces that, in the authors' words, "have high overlap with the ground-truth reasoning traces" when those are available for comparison. The interesting part is what those synthetic traces are good for downstream. Fine-tuning a small open student model on them transfers real capability from the target.

The headline experiment uses GPT-5 mini as a commercial black-box target. According to the abstract, fine-tuning Qwen-2.5-7B-Instruct on inverted traces lifts its MATH500 score from 56.8% to 77.6%, and its JEEBench score from 11.7% to 42.3%, compared to fine-tuning only on the answers and reasoning summaries. That is a specific claim about one student-teacher pairing, and the abstract is the piece of the work publicly circulated so far; two experts in our Who's Who directory have already passed the link around. The listing was revised in May 2026 and sits in the security category, which is the register the authors want.

The abstract does not, on its face, say whether inversion still works against a provider that hides the summary as well as the trace, whether output perturbation or watermarking can break the attack, or how the gains hold up outside of competition math. Those are the questions defenders will have to answer.

For anyone selling reasoning as a product behind an API, the practical read is that summary-only exposure is not the moat it looked like. For anyone building on open weights, this is a cheap way to close a real gap on math and competition-style problems using an existing frontier system's outputs.