Claude Non-Distillation or Ineffective: Small Model Can Directly Extract Large Model Thinking Chain

According to Insight Beating monitoring, large model manufacturers, in order to prevent their capabilities from being distilled, will hide the complete reasoning chain and only provide users with a summary. However, a recent study has found that this layer of protection may not be as robust as imagined: by transferring the encrypted reasoning chain of Opus to a weaker model within the same manufacturer, such as Haiku, and then jailbreaking Haiku, it is possible to have it directly reproduce the original reasoning of Opus. Researchers have successfully demonstrated this on Claude, GPT, and Gemini.

This development has actually been brewing for several months. In May, cryptographer Matthew Green discovered that these encrypted reasoning chains could be replayed across sessions and accounts, but at that time, a stable method to read the content had not yet been found. The new paper has filled in the final piece: instead of breaking the encryption algorithm, one can directly use the manufacturer's own model to "decrypt" it.

Back in March, John X. Morris, co-founder and head of research at the current Engram, and others demonstrated another approach: even if the original reasoning chain is completely inaccessible, by only observing the answers and reasoning summaries, a detailed set of synthetic reasoning can be reverse-engineered and used to train smaller models.

This has also shed new light on the previously circulated claim that "domestic AI companies have long found ways to obtain the original reasoning of Claude and Codex and then use it to train models." However, this only proves the feasibility of the method and does not prove that any domestic AI labs have actually done so.

The paper also tested Kimi K3. By simply inserting a few Opus reasoning tokens into it, the reasoning behind K3 will significantly align with Opus; extracting segments of the original reasoning from Claude and GPT from Kimi K3 is up to 6 orders of magnitude easier compared to other models, but the authors explicitly state that this cannot be used as evidence of distillation.