The raw reasoning block remains inside the protected endpoint.
It does not enter ordinary application state, logs, or cross-session payloads.
A response to new reasoning replay research
Encrypted reasoning can still travel.Mirror binds it.
The paper shows that a valid opaque reasoning artifact can be replayed in another context without breaking its encryption. Mirror makes that state non-portable by binding it to its original user, session, and model.
Source paper Stealing Reasoning Traces from Proprietary LLM APIs 315,320 public reasoning blocks decoded
CHECKING LIVE SERVICE
Can private reasoning leave its session?
The paper shows that opaque reasoning can become portable. Mirror replaces the raw artifact with a context-bound handle, then this live test tries to move it.
ORIGINAL SESSION
session-original
Mirror issues
mre_v1_...
SAME HANDLE
Copied into another session
WRONG SESSION
session-unauthorized
Attempts to continue the reasoning
READY
Does the copied handle still work?
Run the live GPT-5.4 request
Waiting to test the session boundary.
A private artifact should not be portable.
Mirror keeps raw provider state inside its authorized context.
The application receives a scoped handle, not the provider envelope.
The handle is safe to retain because it carries no reusable raw reasoning state.
User, session, and exact model must still match.
A changed binding invalidates the handle before another provider request is made.
The missing threat window
ZDR protects what remains. Not what runs.
Zero Data Retention is valuable: it limits logs, storage, and secondary use after processing. It is not a complete security boundary because conventional inference still receives usable plaintext.
The flow map shows the uncovered runtime, state, safety, and tool boundaries. The matrix verifies each claim against the same primary-source dataset.
PRIMARY-SOURCE REVIEW · 16 AUG 2026
Five platforms. One request lifecycle.
Start with the flow to see where data branches into inference, safety, state, and tools. Switch to the matrix for an eight-boundary audit. Both views use the same sourced facts.
Flow explains. Matrix verifies.
Follow one input through product eligibility, agent inference, and every retention branch. Width is not traffic volume.
APPROVED ZDR
OpenAI API
Follow one request into every place the privacy promise can change.
Safety review, caches, stateful APIs, grounding, files, vector stores, and external tools can each create a separate retention boundary.
AWS can deny incompatible models through IAM. Azure exposes its content-logging state. OpenAI and Anthropic expose organization-level eligibility and configuration.
They govern training, storage, access, and deletion around conventional inference. They do not state that the remote model evaluated ciphertext.
THE MISSING COMPUTE LAYER
Mirror starts where retention policy stops.
Mirror does not replace provider ZDR. It adds cryptographic boundaries before selected workloads reach remote infrastructure, then keeps residual-data controls as defense in depth.
Local encryption, ciphertext compute on supported models, encrypted egress, and local answer release.
Local protected observe and recall requests, with an encrypted-response option for client-side release.
Client-side vector envelope encryption keeps vector contents out of SDK telemetry and ordinary payload capture.
Sealed datasets, encrypted case results, version bindings, and verifiable evaluation receipts.
Scoped authorization, entitlement, metering, and protected state movement between independently operated agents.
ZDR asksWhat remains after the request?
+
Mirror asksWhat did remote compute receive?
REQUEST AT INFERENCE SERVICE
{ "input": "private strategy…" }
Plaintext is processed
- 01
TLS protects the network hop.
- 02
The conventional service receives usable plaintext.
- 03
Policy and configuration govern storage afterward.
PROTECTS DATA IN USE?
No
ZDR is not a claim that inference ran on ciphertext.
REQUEST AT REMOTE INFERENCE
{ "ciphertext": "a93f…7c11" }
Only ciphertext is processed
- 01
The customer endpoint encrypts before sending.
- 02
The remote service computes without the secret key.
- 03
The encrypted result is released locally.
PROTECTS DATA IN USE?
Yes
For supported FHE models and operations.
LIVE TRUST-BOUNDARY TEST
A ZDR response cannot prove deletion. This run can prove what crossed the inference boundary.
The ZDR lane above is an architectural comparison grounded in provider documentation. The encrypted lane below makes a real mirror/glm-5.3-flash request and checks the protected envelope before remote inference.
READY
Test what the remote service receives.
The live run will report the ciphertext envelope, remote compute mode, encrypted response, and local release.
No claim inferred before a successful run.
Encrypted inference wins the data-in-use question.
Use ZDR as defense in depth for logs and residual data. Use FHE when the remote inference operator must not receive prompt plaintext.
Read the sourced analysis →See the replay boundary execute.
A real GPT-5.4 request creates protected reasoning state. The test moves its handle to a different context and verifies that Mirror blocks it before another model runs.
Checking replay protection
Checking the live Mirror endpoint now.
Mirror replay blockCHECKING
Strict FHE inferenceCHECKING
LIVE MIRROR
Mirror blocks the copied reasoning before the model runs.
A real request uses a safe Mirror handle bound to the user, session, and exact model.
Test a changed context:
READY
Run this path to collect evidence from a real model request.
RESULT
Waiting to run
View technical proof Request, evidence, and trust boundary
The raw provider reasoning envelope is never returned to this page.
- 315,320
- public reasoning blocks decoded
- 367
- PII artifacts recovered
- 182
- credentials recovered
- 3 providers
- Anthropic, OpenAI, and Google
The problem in one sentence
Encrypted did not mean bound to one context.
The block was valid, but the system did not verify whether it belonged to this user, session, model, and turn.
- OriginVictim model creates an opaque block
- CopyAttacker moves the valid artifact
- AcceptA compatible decoder accepts it
- DiscloseHidden information reaches plaintext
One handle. Four enforced boundaries.
Mirror keeps the raw reasoning envelope out of application state, then verifies the actor, session, exact model, and permitted continuation before reuse.
PROVIDERRaw reasoning envelopeNever enters application state
→
MIRROR ENDPOINTLocal reasoning vaultRaw value remains bounded
→
APPLICATION
→
mre_v1_... handleSafe to retain, useless elsewhereCONTINUATIONActor + session + model checkMismatch fails before provider
CUSTOMER ENDPOINTTokenize and encryptPlaintext begins and ends here
→
MIRROR FHECompute over ciphertextNo customer secret key
→
REMOTE RESULTEncrypted final answerNo hidden reasoning artifact
→
CUSTOMER ENDPOINTDecrypt locallyFinal answer only
Paying for intelligence is not buying a private scratchpad.
Customers are owed the agreed output: answers, citations, tool receipts, evaluation evidence, and any contracted reasoning summary. Providers can keep weights and raw hidden traces private.
Fairness is not both sides revealing everything. It is both sides controlling what they reveal.
Why a portable artifact matters.
The live proof tests Mirror's protections. The attack findings below remain sourced paper evidence, not a public attack tool.
Private-data extraction
Reasoning blocks in shared logs can contain sensitive values that never appeared in the final answer.
Model extraction
Recovered traces can bypass anti-distillation controls and expose proprietary reasoning behavior.
Hazardous disclosure
Hidden reasoning can retain unsafe information that the visible response correctly withheld.
Invisible prompt injection
An opaque block can carry instructions that application reviewers and logging systems cannot inspect.
Keep provider state inside its authorized context.
The application receives the agreed result and a safe continuation handle, not a portable private reasoning artifact.