Privacy Must Work Both Ways

Frontier AI is sold under an uneven privacy contract. Customers contribute prompts, proprietary data, memory, and evaluations. Providers protect weights, system instructions, and hidden reasoning. This arrangement is familiar, but it is not inevitable.

The paper Stealing Reasoning Traces from Proprietary LLM APIs exposes a failure inside the protected half of that contract. A valid reasoning artifact can sometimes be moved into another conversation and replayed to a compatible, weaker model. The attacker never decrypts the artifact or breaks its cryptography. The receiving model acts as a probabilistic decoder and reveals information influenced by the hidden reasoning.

The fair endpoint is not mutual disclosure. It is mutual confidentiality.

A fair intelligence contract

Customers paying for frontier intelligence deserve a useful, auditable deliverable: answers, citations, tool receipts, evaluation evidence, and any reasoning summary included in the contract. Providers do not need to export model weights or unrestricted hidden traces to deliver that value.

The reciprocal rule matters just as much. Customers should not have to expose raw business context to remote infrastructure simply because providers keep their own intelligence private. Customer inputs can remain encrypted, provider internals can remain protected, and the agreed result can be released at the customer boundary.

The threat model

The attacker is an ordinary API user. They do not need provider infrastructure access, model weights, encryption keys, or a cryptographic vulnerability. They need an opaque reasoning artifact, access to a compatible model endpoint, and the ability to place that artifact into a new request or transcript.

The artifact may come from the attacker's own session, a leaked log, an application database, or another tenant where isolation failed. The attack crosses a user, session, model, or conversation boundary that the artifact was not bound to.

Inference, not cryptographic decryption

The weaker model does not recover a cryptographic plaintext in the conventional sense. It has learned enough of the originating model family's representation to produce text correlated with the hidden state. Repetition, prompt shaping, and sampling can improve extraction.

This is why rotating a cipher, hiding a wire format, or blocking one prompt string is insufficient. If the artifact is accepted outside its original context, it can be abused outside that context.

Why encryption alone does not solve it

Authenticated encryption can prove that an authorized key created an artifact and that its ciphertext was not modified. It does not automatically prove which user may replay it, which session owns it, which model may consume it, which turn it follows, or whether it is expired or revoked.

The missing property is contextual authorization. A secure reasoning object must behave like a bounded capability, not a portable bearer token.

Mirror's two protection paths

Conventional provider APIs and native FHE inference have different execution boundaries. Mirror keeps them separate and applies one shared policy: hidden reasoning is internal model state, not an application data product.

Path one: make provider state non-portable

For conventional provider APIs, Mirror acts as an endpoint-side security boundary. It keeps OpenAI encrypted_content, Anthropic thinking signatures, and redacted-thinking data inside a bounded vault. The application receives a CSPRNG-generated mre_v1_... handle instead.

The handle is bound to the registered local client and service credential, application identity, optional authenticated actor, stable session, and exact model. Unknown, expired, raw, cross-user, cross-session, and cross-model values fail closed with reasoning_envelope_unbound or reasoning_envelope_context_mismatch.

provider reasoning envelope
          |
          v
Mirror endpoint vault
          |
          +-- raw value stays inside Mirror
          +-- mre_v1_... handle reaches the app
                           |
                           v
               actor + session + model check

This is the direct mitigation for the paper's replay primitive. The app cannot leak a provider block that it never receives, and a copied Mirror handle is useless outside its bound context.

Path two: remove remote plaintext with FHE

For supported mirror/* models, Fully Homomorphic Encryption changes the remote inference boundary. The customer endpoint tokenizes and encrypts locally. The remote service computes over ciphertext without the customer's secret key, then returns an encrypted final result for local decryption.

customer endpoint
  tokenize + encrypt
          |
          | ciphertext and public evaluation material
          v
Mirror FHE inference
  compute without the customer secret key
          |
          | encrypted final result
          v
customer endpoint
  decrypt final answer

The interface returns only a final answer or validated tool call. Hidden intermediate reasoning is not returned, including as client-decryptable ciphertext. This removes the portable reasoning artifact from the application contract.

FHE still needs context

FHE solves a confidentiality problem. It does not automatically solve authorization, replay, or lifecycle management. A protected request should still bind actor, session, exact model, FHE public-key fingerprint, turn identifier, predecessor hash, policy version, expiry, and nonce.

Compute on ciphertext, release only policy-approved ciphertext, and authorize every continuation in context.

What the customer is buying

Paying for frontier-model intelligence buys a clear result contract: the answer, citations, tool receipts, evaluation evidence, and any reasoning summary the provider has agreed to supply. It does not automatically transfer model weights or an unrestricted hidden scratchpad.

If detailed reasoning is part of the purchased product, it should be released explicitly, scoped to that customer and task, and protected like any other sensitive output. It should not arrive as a reusable opaque artifact whose security depends on nobody discovering how to replay it.

Mutual confidentiality

The durable end state protects both parties. The customer encrypts prompts, proprietary context, memory, and evaluation data. The model provider keeps weights and hidden reasoning private. Protected computation releases only the contracted result and evidence to the customer endpoint.

Privacy cannot be a provider-only privilege. Mirror gives both sides control over what they reveal.

What Mirror protects

Mirror protects provider reasoning envelopes from entering ordinary application logs and traces. It rejects cross-context reuse, explicit hidden-reasoning channels, unsupported protected routes, and silent plaintext downgrade. Strict FHE additionally removes prompt and result plaintext from the supported remote inference operator.

The remaining boundary

Mirror does not make a compromised customer endpoint safe. The endpoint sees the prompt before encryption and the result after decryption. When hostile local software is in scope, encryption must move further toward the user, such as a browser, mobile client, hardware-backed environment, or another trusted client boundary.

The product contract

1. Customer-owned confidentiality. Supported strict-FHE inference computes without remote prompt or result plaintext.
2. Contextual authorization. Private model state is tied to its actor, session, model, key, and permitted continuation.
3. Fail-closed behavior. Invalid handles, unsupported models, disclosure channels, and plaintext downgrade paths are rejected.

The lesson is simple: an opaque artifact can remain dangerous when another model knows how to use it. Mirror's answer is equally direct. Protect customer intelligence with encrypted computation, keep provider state inside its authorized context, and release only the result and evidence both parties agreed to exchange.