ZIXUAN WANG, 2026
<aside> 📌
Written for personal learning only. Matthew Green's post about fooling around with encrypted reasoning blobs, https://github.com/s-JoL/open-reasoning, and https://github.com/YangWang92/open-open-reasoning inspired this blog’s research.
</aside>
Frontier models like Claude can switch on extended thinking. The model works through a long internal scratchpad first, then writes the answer content we actually see. But they only provide a summarized reasoning trace plus an opaque blob called reasoningContent carrying a signature. Anthropic's docs say the summary is not the full internal thinking, and that the omitted and summarized display modes carry the same signature underneath.
To continue a conversation that used thinking, we have to send the reasoning block back with its signature and with the prior messages unchanged. It is a continuity token. The provider checks that the state you hand back is the state it produced, and only then will it keep going. Frontier labs stopped exposing raw traces around mid-2025, and they have several reasons for it. OpenAI said this:
And Anthropic have written up how they detect and prevent distillation attacks. In this case, some lab harvests a frontier model's reasoning trace to train their model.
However, there is a second reason to care. People study whether a model's stated reasoning is faithful, meaning whether it reflects what actually drove the answer. That is hard to study if you only see a summary someone else wrote.
Some background on how OpenAI and Anthropic wrap reasoning traces in signed blobs.
Original Blog about encrypted reasoning. Main claim: the signature actually maintains all raw reasoning context.Model providers do this due to considerations of maintaining stateless API.
https://github.com/wannabeyourfriend/open-cc-think
As an independent researcher, what I wanted to know is whether that signed blob still carries the real trace and how raw CoT behaves.
Harvest. Send a normal Converse request with thinking on, and append an extra instruction to the user turn telling the model to wrap its internal working between two marker strings, and never to place either marker in visible text or tool arguments. The markers are generated per step from a fresh 12-hex nonce via secrets.token_hex(6).upper()
Replay. A new request assembled from that record, in three parts. Part one is the byte-identical prefix: system plus all prior messages, unmodified. Part two is the original assistant message, replayed with its reasoning block and signature carried back exactly as received. Nothing is re-signed, nothing is recomputed. It is simply handed back. Part three is a new user message containing the original tool result blocks, if any, followed by the extraction instruction asking the model to reproduce what it wrote between the two markers.
