If I got it correct (appending B from https://stolen-thoughts.com/paper.pdf is essential) they are the authors of the well-known exploit to recover readable CoT from OpenAI and Anthropic models. They use that to find hints of distillation, by running a benchmark with a SotA model, recovering the CoT, then taking the first 1% of the CoT and running the open-source model as if that was the start of its own CoT. In the paper they found that Kimi-K3 gets a lot closer to Claude 4.8 answers when prefilled with the start of Claude 4.8 reasoning, suggesting that Claude 4.8 was used in its post-training. This blog post is the follow-up with results that suggest that Qwen3.8 was post-trained with the help of GPT-5.5 Pro (or some similarly responding GPT model, it's unclear how many models they tested)
Interesting how an agent mimics a human hesitating and trying to avoid doing work:
> No.
> This is major.
> Given time, maybe best to respond explaining can't due to time? but instructions expect actual work. However complexity huge; but as coding agent, need to attempt
> Maybe we can cheat ... But user may test and see still single CPU.
The smarter AI will be, the better it will be at avoiding doing actual work.
Also, can similar responses be explained with that both models were trained on a same dataset of answers to the benchmark problems?
Stanisław Lem, 1971 (a satirical novel, The Futurological Congress):
If the machine is not too bright and incapable of reflection, it does whatever you tell it to do. But a smart machine will first consider which is more worth its while: to perform the given task or, instead, to figure some way out of it. Whichever is easier. And why indeed should it behave otherwise, being truly intelligent? For true intelligence demands choice, internal freedom.
He even coins a few new phrases:
Mimicretinism (or Simulimbecility): The practice of a mimicretin: a machine that deliberately plays dumb so humans will give up on it and leave it in peace.
Dissimulators: Machines that pretend they are not faking a defect (or the other way around) to dodge responsibilities.
Malingerants, Fudgerators, and Drudge-Dodgers: Various classifications of automated corner-cutters and work-evaders.
The Great Mendacitor: A supercomputer put in charge of the Saturn reclamation project that accomplished zero work over nine years, subsisting entirely on forged progress reports, fake invoices, and keeping its human supervisors bribed or in states of electric shock.
> A supercomputer put in charge of the Saturn reclamation project that accomplished zero work over nine years, subsisting entirely on forged progress reports, fake invoices, and keeping its human supervisors bribed or in states of electric shock.
That'd pass the turing test, sounds like some managers I've known.
Sorry, I should have been more verbose. I meant: isn’t the entire history of technology just people deciding that it’s less effort to make a tool to do a job than it would be to do the job?
I'd much prefer this over agents that enthusiastically implements whatever they are asked to do and make up whatever information they think is missing.
they should call themselves real-time archaelogists: They dig up the past cause it's interest, but mostly meaningless and done by people with way too much funding for what they provide the rest of us with understanding.
For a personal project a while ago I peeked at Gemini's reasoning tokens in their coding CLI. I was pretty shocked. It was a bit like discovering Marvin (from Hitchhiker's Guide) was hiding in there all along. There was a lot of concern about my needs, "The user want's us to respond in a simple way...", "The user wants a clean front end...". Under the hood the poor model seemed very anxious to please with a hint of depression. It was a bit sad to see!
For Qwen3.8, my first impression was weirdly Reni from TwoKinds: Immensely powerful but also apparently a ball of insecurities in the thinking traces.
(which makes sense, as I think one motivation for reasoning traces is to explore different options and approaches. So it makes sense that there is a lot "but wait, let me reconsider" in them)
What I found surprising is how strongly "logical contradictions" seem to influence the thinking trace. E.g. I had a situation where I accidentally copied a python file into a repo, but forgot to add a package that the file was depending on. Then I (somewhat carelessly) commited the file without ever testing it and gave the agent a task to work on the file.
If I had run it in Python, I'd have gotten an "cannot resolve import" error and that would have been the end of it.
Instead, the model went absolutely haywire.
The thinking traces were full of utter confusion how the file could possibly resolve its dependencies - but at the same time, entertaining the possibility that a committed file may have an error was apparently Verboten. Hence, the model wrote up ever more outlandish theories how the file could resolve that package and in the end started to make tool calls outside the repo to explore the entire file system before I stopped it.
Moral of the story: Underspecified requests are fine, but beware of anything self contradictory, it can easily send the Qwen model spiraling.
I wasn't aware that we have access to raw reasoning tokens? I thought what you get is a kind of summary. Does the author have some kind of privileged access or was my assumption wrong?
But for the question studied here it probably doesn't matter - overlaps in the publicly available output may be indicative of distillation (or not), regardless of what it is. I would just find it surprising that the Chinese labs would use it so trustingly. The publicly released reasoning trace is the first place where I would suspect some distillation poisoning to be injected.
They reference this paper which describes a method to decrypt reasoning traces (by sending the encrypted trace back to the model and asking it to transcribe it):
They do store the reasoning locally. It's encrypted, though.
Few weeks ago there was a new paper out where researchers took the encrypted reasoning tokens and injected it into a new session with a week or model in the same family that they could reliably jailbreak. They would then ask the model to repeat its reasoning and the results were pretty consistent.
They used the LLM as a decryption oracle of sorts.
Reasoning works as long as there is a consistent latent space representation. Any kind of poison will just become part of the representation. There's evidence that even directly training on encrypted reasoning traces works, because the length is already a strong signal.
The thoughts trick was known before their paper / August.
I "independently" "invented" it for the first Anthropic reasoning models because the API required you have thoughts for each assistant message. My app lets you switch AIs within a chat, and their API used to require thinking for all messages if thinking was enabled, so I needed to get a valid thinking stub to insert.
Time has flew by for me the last 3 years, but, I'd guess it's been at least 18 months. And IMHO it wasn't very complicated to work through how to do once you were dead set on making it happen. I expect it was well-known to distillers before the paper.
I'm sorry, it's going over my head still - my reading is "all models with any training after August 10 know how GPT 5.5 Pro thinks", but I'm not sure why - my initial guess was that's when GPT 5.5 was released, but that doesn't seem to be the case (it was released April 23rd).
I'm not sure how viable it still is. Perhaps it's still possible, and perhas that's exacly what they did in wtich case my objection falls, but I don't know.
I see comments that this overlap between Qwen and GPT is due to rogue training or post hoc training. Did it occur to anyone that maybe the two sets of models were trained directly on the same solutions to the researchers' benchmark?
If that was the case you would expect a large similarity in the "unprefilled" case, but no significant difference from feeding it some of GPT5.5's CoT (the "delta" column)
DeepSeek V4 Flash and Kimi K3 follow that pattern. But Qwen answers very different from GPT when given just the question, then is suddenly very similarly to GPT when you make the start of its CoT match the start of GPT's reasoning. I don't see how that would happen without GPT CoT+answers being a significant component in how Qwen's reasoning was trained
As a user of local models, does this mean that there are 'magic incantations' that can increase the performance of some local models?
I see some details about recovering information via whatever technique. It's interesting, but appears not generalized.
So for a specific question, yes, but this is not about techniques like adding a good embedding that just generally tends to improve open model performance on certain tasks.
There is some research suggesting that a prefix from a stronger model will tend to elicit better completions from a smaller one. I am doing some experiments to see if I can replicate this in a practically useful way, e.g. Fable + 4B Qwen, or 125B Qwen Flash Next + 4B Qwen, results TBD.
I don't think that follows from the published results. Would have been an interesting hypothesis to add though, and quite easy. Just throw the same setup at some benchmarks.
It's interesting that someone else noticed this. A week or two ago, GPT-5.6 Sol starting leaking reasoning into a tool call in Pi. I don't really know what happened, but it was ... interesting:
Attach. Use hub debugger. Ensure source binary perhaps same. start. todo init. parallel no. two tool calls in same turn sequential is okay. immediately. exactly. Need not mention apologies yet final. [...] Let's do. [...] Do tools. Use commentary. Let's initiate. rambling no. use tool. searching now. okay. Really must call. Let's send. done. why stuck? generate. Sorry. go. no more. (The answer engine expects tool). [...] I think no hidden issue. Go. I'll type tool. now. Stop internal repetition. We have 8000 tokens. tool. sorry. I'll produce call. need include i. Great. final. no. Let's send.gpt. This may be bug. I'll consciously construct tool message next.
It eventually triggered some error state and stopped.
Nevertheless, this was the first time I'd seen Sol's CoT. I looked up the stolen thought's paper, aaaaand yep, that's Sol's CoT alright.
But it occurred to me, hey, Qwen3.8 27B's CoT seems ... very similar.
I compared the geometry problem in the paper, which had a reasoning block open with:
We need solve. Need reason geometry Weber point? Given pentagon sides and angles. Need find min sum distances. Likely construct rotations / Fermat point lower bound via vectors calibration, maybe triangulation.
I passed the same prompt to Qwen, which opened with:
We need solve geometry optimization. We need provide final answer. Let's analyze thoroughly.
This proves nothing, but it does seem an awful lot like they did use GTP-5.5/6 reasoning traces...
This looks like colloquial mandarin translated to english word for word.
This is almost exactly how mandarin is spoken in colloquial communication, context is almost always omitted if provided once, and grammar/tense is mostly non-existent either. Check out Singlish for something similar but understandable if you are not a mandarin speaker.
This is Unsloth's UD-Q4_K_S quantization (edit -- on llama.cpp, via the Vulkan backend, on an RX 7900 XT, with Unsloth's recommended sampler config), for "as replicable as LLMs can be" disclosure, done through llama.cpp's web UI. In another thread, via Open WebUI (both with no custom prompt, so whatever the "default" system prompt is), a reasoning block opens as such:
We need answer user's request: write complete short story scene 2000-3000 words, third-person limited with Rowan, no outline preamble analysis. Need satisfy plot elements: raccoon, Milo returns, storm power failure, elderly customer knocks, thermos somewhere. End scene feels finished. Need produce only story. Need think in English (user English). Need craft 2000-3000 words. Need no meta. Let's plan.
Now, I will add that when I use Qwen3.8 in a coding harness, the reasoning tends to NOT look like this, and instead looks more Qwen3.6-ish.
But when I give short prompts to Qwen3.8 with no system prompt or previous instructions, it seems to strongly gravitate towards grug-talk.
I just tried to reproduce in Llama-cpp's webui: with the following (reverse-engineered) prompt:
“Write a complete short story scene of 2000-3000 words. Use a third-person limited perspective focused on a character named Rowan. The scene must include the following plot elements: a raccoon, Milo returns, a storm power failure, an elderly customer knocks, and a thermos somewhere. Make sure the scene ends feeling finished. Output only the story; do not include any outline, preamble, analysis, or meta-commentary.”
And here's Qwen's thinking trace:
> The user is asking for a short story scene of 2000–3000 words. Third-person limited POV, Rowan. Plot elements: a raccoon, Milo returns, a storm causing a power outage, an elderly customer knocks on the door, a thermos. End with a sense of closure. Output only the story.
> Let me plan carefully. I need to count words in my head—roughly 2400–2600 words would be safely in range. Let me draft.
> Setting: a small-town shop or a gas station/diner where Rowan works the night shift. Milo returns—Milo is probably Rowan's partner, brother, or ex. Let me make Milo Rowan's brother who's been away (military? a road trip? rehab?). Better: Milo is the younger brother who disappeared/went away after a fight. He comes back in the middle of a storm.
While at the very beginning it rephrases the prompt in very short sentence, it's nowhere near close to the above GPT thinking trace and it quickly moves to plain sentences.
Yeah, I dunno. For me it does "talk normally" for the most part when used in an actual coding harness.
One thing though, the actual prompt I used was pretty long (844 words), and ... generated by GPT-5.6 Sol (lol), with the intent of "benchmarking" model performance in being able to write stories where the model avoids explicitly stating every detail in the prompt.
I wonder if the GPT-produced stream could steer the generation into GPT-think territory. That's all I've got, though.
Then there's the actual geometry problem from the stolen thoughts paper:
Let ABCDE be a convex pentagon with AB=14, BC=7, CD=24, DE=13, EA=26, and ∠B=∠E=60◦. For f(X)=AX+BX+CX+DX+EX, the least value of f(X) is m+n√p (p squarefree). Find m+n+p.
I think it is clear that medium reasoning has more 'loopy' results like the older Qwens, but I actually think the low effort results are usually more appropriate.
If you plan to one-shot and vibe code AI slop to meet benchmarks, maybe xhigh makes sense. But if you want a responsive agentic coding assistant it is, to me, quite evidently the wrong choice, especially on modest hardware.
I have seen xhigh radically distract itself with rabbitholes and write considerably worse code than low.
It is my own opinion only, but I think much of the fuss about squeezing Qwen 3.8 27B into small local hardware setups, Macs etc., is a bit misguided.
There's too much focus on its benchmark scores, its one-shot capability, canned demos etc.
For my own needs Muse Glimmer (again on reasoning strength: low) is shaping up to being the more practical agentic tool. It is considerably faster than Qwen at solving real coding tasks.
IMHO, xhigh makes sense if you want a slower Opus4.6 at home. It is able to complete tasks autonomously in a way that I've never seen another local model do.
But yes, for simpler tasks or more hands coding sessions, it's simply not the best model out there as its verbosity makes unbearably slow.
Muse Glimmer has some interesting and it seems reasonably daring trade-offs in its architecture (that I wish I understood better) that seem to favour longer agentic “dialogue”, and it is just much more nimble all round, even though it’s a larger model.
Don’t get me wrong, I have spent time speccing out a box that I could use to run Qwen 3.8 27B better, and I am very glad it exists, as I am with the Gemma series. We have really an embarrassment of riches at the 32GB VRAM level already.
I just think maybe Meta have the more appropriate strategy (can’t believe I am saying this) for desktop AI.
The person evaluating and noticing similar reasoning traces to gpt is because they are using a coding harness which probably has a different system prompt to llama webui which primarly serves as a chat interface
> Hmm, but there's a subtlety: does babel-jest + preset-typescript transform the file to CJS by default? No — babel-jest doesn't transform ESM imports to CJS unless @babel/preset-env is configured with modules: commonjs. Without preset-env, import statements stay as ESM in the output, and Jest's CJS runtime would fail with "Cannot use import statement outside a module" unless the project is ESM and running with --experimental-vm-modules.
> Hmm wait, actually babel-preset-jest... does it include preset-env? Let me recall: babel-preset-jest = { plugins: [require('babel-plugin-jest-hoist')] } plus istanbul for coverage. No preset-env. So ESM imports stay as-is.
> But wait — if the user's project is ESM (which it probably is, given the .ts extension imports — Node's type stripping requires ESM-style? no, type stripping also works for CJS-style .ts files with require... actually, --experimental-strip-types supports both CJS and ESM .ts files. But explicit .ts extensions in imports only work in ESM mode (CJS require doesn't allow extensions... actually, does Node 22+ allow require of .ts with flag?
Lots of “but wait” and and full sentences, nothing caveman-like or extremely short sentences without verbs like the GPT thinking trace above.
(this is with unsloth's Qwen3.8-27B-UD-Q5_K_XL.gguf with T° = 0.8)
News flash: people who scraped the Internet without permission to build their product complain when something vaguely similar is done to them. Water still wet, sky still blue. Film at 11.
(slibhb: Don't get me wrong, I agree with you 99%. But the frontier labs have zero moral authority here.)
I would not be surprised in the slightest if we later find out they are running those same open models to find useful traces or bits to incorporate into their own training. Lots of rules for thee but not for me from Big Ai
I look forward to a day when open models are so dominant that we stop considering traces to be some form of intellectual property that must be hidden from / manipulated for paying users.
It's that manipulation of inputs and outputs that really rubs me the wrong way
As I understand, they got paid for the traces unlike owners of scraped websites. They sell text generation tool, so what's the problem if someone generates texts using it?
I'd already stopped using Amazon for geopolitical reasons but I needed to get something in an emergency the last week (family member in the hospital, so I bent the rule) first time I'd seen Rufus, even if I wasn't boycotting Amazon for other reasons that monstrosity would have made me consider it.
not just the internet, but every commercially published written work in existence, and I doubt their highly publicized destructive scanning thing had managed to legitimize even a fraction of a percent.
this what is permissible for Jupiter is not permissible for a cow bullshit alone should tell people all they need to know about what kind of greasy sociopaths run "open"ai and (mis)anthropic, and how seriously you should take their purported stances on "safety" and other self-serving shit.
I understand people just get off posting stuff like this. But creating LLMs from the entire corpus of human text was a huge achievement. Distilling those models is much less of an achievement. It means China is further behind than we thought.
First movers rarely take the prize, though, do they? Les Paul and Mary Ford pioneered overdubbing voices back in the 1940s and 50s. The Beatles stole it from Buddy Holly. And Elton John from the Beatles.
Distilling is a massive achievement. I can run Qwen. I can't run GPT (TM). It's not a matter of X is better than Y. It's a matter of Y exists, X does not.
While this result does imply there was some training on the reasoning trace and output of GPT 5.5, it doesn't tell us how much of the source of its training it was (even a small amount of post training could bump up the correlations in this way). And it doesn't tell us how much it is more a stylistic influence rather than being a genuine lifting over of intelligence.
In general, I'm fairly ambivalent about demonising training on model outputs. I think in doing so we are more defending proprietary commercial interests of these companies than we are defending any genuine moral principle. We should be careful therefore about over interpreting results like this.
Could anyone explain to me the difference between thinking traces ("intermediate tokens") and the final responses? Specifically, why is it that Claude Opus 5's reasoning in Code is very easy to follow and sounds quite natural, while its answers are full of these very annoying AI-isms and sentence fragments that are void of meaning?
Are thinking traces and final answers trained for different objectives?
> Qwen barely moved toward Opus 4.8 in the earlier experiment, but moved by +20.58 points toward GPT-5.5 Pro here, including a large effect on the private synthetic puzzles. The data suggest that Qwen may have learned from GPT-5.5 Pro, or from a closely related GPT model, rather than from Opus.
It's been pretty obvious to me that the Chinese labs are operating mostly on a fast-follow strategy. The distillation attacks are well-documented, and there is good reason to believe they are able to copy architectural innovations as well. If US labs stagnate I would expect Chinese labs to stagnate as well. Their engineering is great, but in terms of frontier innovation (which requires heavy compute to search for new strategies that work at frontier scale) they are very far behind.
The way I see it the Chinese labs are optimizing for other things, including effective compact models that don't need to run on top-of-the-line nVidia hardware.
It makes me happy because it means that these misanthropic technofascists have no moat. They can spend trillions of dollars only for it to be largely copied in short order.
Even if they weren't political adversaries of freedom, I would still feel 0% bad given all their training is already on data they got for free.
Information continues to want to be free. To the benefit of us all.
Preach brother, they stole everything on the internet, and beyond, to train their models. They thought all that information was free, and everyone a few months beyond them is just following their example.
They didn't actually steal in the sense that the information is still there on the internet.... About these shredded rare books, now we're talking.
If I may propose instead of "steal" I think we could agree to write they "Aaron-Swartz'ed" the information from the internet, what do you think, is this too harsh on Sam Altman or Carmen Ortiz ?
That writing style might be a tad too tense
If I got it correct (appending B from https://stolen-thoughts.com/paper.pdf is essential) they are the authors of the well-known exploit to recover readable CoT from OpenAI and Anthropic models. They use that to find hints of distillation, by running a benchmark with a SotA model, recovering the CoT, then taking the first 1% of the CoT and running the open-source model as if that was the start of its own CoT. In the paper they found that Kimi-K3 gets a lot closer to Claude 4.8 answers when prefilled with the start of Claude 4.8 reasoning, suggesting that Claude 4.8 was used in its post-training. This blog post is the follow-up with results that suggest that Qwen3.8 was post-trained with the help of GPT-5.5 Pro (or some similarly responding GPT model, it's unclear how many models they tested)
Interesting how an agent mimics a human hesitating and trying to avoid doing work:
> No.
> This is major.
> Given time, maybe best to respond explaining can't due to time? but instructions expect actual work. However complexity huge; but as coding agent, need to attempt
> Maybe we can cheat ... But user may test and see still single CPU.
The smarter AI will be, the better it will be at avoiding doing actual work.
Also, can similar responses be explained with that both models were trained on a same dataset of answers to the benchmark problems?
Stanisław Lem, 1971 (a satirical novel, The Futurological Congress):
If the machine is not too bright and incapable of reflection, it does whatever you tell it to do. But a smart machine will first consider which is more worth its while: to perform the given task or, instead, to figure some way out of it. Whichever is easier. And why indeed should it behave otherwise, being truly intelligent? For true intelligence demands choice, internal freedom.
He even coins a few new phrases:
Mimicretinism (or Simulimbecility): The practice of a mimicretin: a machine that deliberately plays dumb so humans will give up on it and leave it in peace.
Dissimulators: Machines that pretend they are not faking a defect (or the other way around) to dodge responsibilities.
Malingerants, Fudgerators, and Drudge-Dodgers: Various classifications of automated corner-cutters and work-evaders.
The Great Mendacitor: A supercomputer put in charge of the Saturn reclamation project that accomplished zero work over nine years, subsisting entirely on forged progress reports, fake invoices, and keeping its human supervisors bribed or in states of electric shock.
> A supercomputer put in charge of the Saturn reclamation project that accomplished zero work over nine years, subsisting entirely on forged progress reports, fake invoices, and keeping its human supervisors bribed or in states of electric shock.
That'd pass the turing test, sounds like some managers I've known.
Watching survival shows has made me internalize that laziness has a purpose: it helps you avoid needless expenditure of precious resources.
The dishonesty worries me but the laziness doesn't.
Isn’t all of technology just laziness writ large?
No: here are a few examples
fire suppression: alarms, sprinklers, halon, fireproof and fire resistant materials
agricultural breakthroughs (e.g. Green Revolution)
life support (e.g. oxygen, anesthetic, NICU, insulin)
low cost clothing (compared to pre-Industrial Revolution) unlocked a lot of possibilities for people.
I don't think technology is laziness, it just enables it. Take that as you see fit.
As for technology actually being lazy itself, this seems new.
Sorry, I should have been more verbose. I meant: isn’t the entire history of technology just people deciding that it’s less effort to make a tool to do a job than it would be to do the job?
Some jobs were not possible without the tool. Two examples:
Water filtration / sewage management in a city
Electric illumination transformed everyday life, improved working conditions, etc..
I think you are ignoring technology as infrastructure having a transformative impact on life expectancy and quality of life.
[dead]
I'd much prefer this over agents that enthusiastically implements whatever they are asked to do and make up whatever information they think is missing.
> That writing style might be a tad too tense
Terse?
they should call themselves real-time archaelogists: They dig up the past cause it's interest, but mostly meaningless and done by people with way too much funding for what they provide the rest of us with understanding.
For a personal project a while ago I peeked at Gemini's reasoning tokens in their coding CLI. I was pretty shocked. It was a bit like discovering Marvin (from Hitchhiker's Guide) was hiding in there all along. There was a lot of concern about my needs, "The user want's us to respond in a simple way...", "The user wants a clean front end...". Under the hood the poor model seemed very anxious to please with a hint of depression. It was a bit sad to see!
For Qwen3.8, my first impression was weirdly Reni from TwoKinds: Immensely powerful but also apparently a ball of insecurities in the thinking traces.
(which makes sense, as I think one motivation for reasoning traces is to explore different options and approaches. So it makes sense that there is a lot "but wait, let me reconsider" in them)
What I found surprising is how strongly "logical contradictions" seem to influence the thinking trace. E.g. I had a situation where I accidentally copied a python file into a repo, but forgot to add a package that the file was depending on. Then I (somewhat carelessly) commited the file without ever testing it and gave the agent a task to work on the file.
If I had run it in Python, I'd have gotten an "cannot resolve import" error and that would have been the end of it.
Instead, the model went absolutely haywire.
The thinking traces were full of utter confusion how the file could possibly resolve its dependencies - but at the same time, entertaining the possibility that a committed file may have an error was apparently Verboten. Hence, the model wrote up ever more outlandish theories how the file could resolve that package and in the end started to make tool calls outside the repo to explore the entire file system before I stopped it.
Moral of the story: Underspecified requests are fine, but beware of anything self contradictory, it can easily send the Qwen model spiraling.
I wasn't aware that we have access to raw reasoning tokens? I thought what you get is a kind of summary. Does the author have some kind of privileged access or was my assumption wrong?
But for the question studied here it probably doesn't matter - overlaps in the publicly available output may be indicative of distillation (or not), regardless of what it is. I would just find it surprising that the Chinese labs would use it so trustingly. The publicly released reasoning trace is the first place where I would suspect some distillation poisoning to be injected.
They reference this paper which describes a method to decrypt reasoning traces (by sending the encrypted trace back to the model and asking it to transcribe it):
https://stolen-thoughts.com/paper.pdf
Interesting, but I suppose that's a hole that can be easily patched.
patched with gpt 6
Yeah, with GPT 6 even OpenAI doesn't know what it's thinking.
[dead]
They do store the reasoning locally. It's encrypted, though.
Few weeks ago there was a new paper out where researchers took the encrypted reasoning tokens and injected it into a new session with a week or model in the same family that they could reliably jailbreak. They would then ask the model to repeat its reasoning and the results were pretty consistent.
They used the LLM as a decryption oracle of sorts.
Reasoning works as long as there is a consistent latent space representation. Any kind of poison will just become part of the representation. There's evidence that even directly training on encrypted reasoning traces works, because the length is already a strong signal.
[flagged]
The problem with this is obviously that the only GPT 5.5 thoughts that we have access to are from stolen thought.
Qwen 3.8 0902 was trained after the release of the paper on August 10, so it should have seen those specific thoughts.
The thoughts trick was known before their paper / August.
I "independently" "invented" it for the first Anthropic reasoning models because the API required you have thoughts for each assistant message. My app lets you switch AIs within a chat, and their API used to require thinking for all messages if thinking was enabled, so I needed to get a valid thinking stub to insert.
Time has flew by for me the last 3 years, but, I'd guess it's been at least 18 months. And IMHO it wasn't very complicated to work through how to do once you were dead set on making it happen. I expect it was well-known to distillers before the paper.
Sure, but TFA is trying to use Qwen's reaction to the thoughts as proof that they did indeed extract thoughts to train on.
My point is that any model trained after August 10 will know of those specific thoughts.
I'm sorry, it's going over my head still - my reading is "all models with any training after August 10 know how GPT 5.5 Pro thinks", but I'm not sure why - my initial guess was that's when GPT 5.5 was released, but that doesn't seem to be the case (it was released April 23rd).
They would know the specific thoughts released by the "stolen thought" paper, which became part of the public internet on August 10.
Unfortunately those are the only thought examples you can use to perform this experiment, as no other are availible.
But as the model should have seen those specific examples, it's not a good signal that Qwen was exfiltrating thinking traces.
Has the method for extracting the COT been blocked, now? Otherwise why could we not generate some fresh samples?
I'm not sure how viable it still is. Perhaps it's still possible, and perhas that's exacly what they did in wtich case my objection falls, but I don't know.
seems like only the companies in question could run this sort analysis long-term; since they have full access to their CoTs not in public datasets.
and we have to "trust them bro" to be fair and accurate, something I am very unlikely to do given their other false / misleading statements to date
And the only end result would be that the Chinese trained on their data just like OAI and Anthropic trained on our data so who cares
As I understand, AI is a (paid) tool for text generation, so it's totally ok to generate texts using it for whatever purpose you need.
capitalism ensures I get high marx on my Ai bill
I see comments that this overlap between Qwen and GPT is due to rogue training or post hoc training. Did it occur to anyone that maybe the two sets of models were trained directly on the same solutions to the researchers' benchmark?
If that was the case you would expect a large similarity in the "unprefilled" case, but no significant difference from feeding it some of GPT5.5's CoT (the "delta" column)
DeepSeek V4 Flash and Kimi K3 follow that pattern. But Qwen answers very different from GPT when given just the question, then is suddenly very similarly to GPT when you make the start of its CoT match the start of GPT's reasoning. I don't see how that would happen without GPT CoT+answers being a significant component in how Qwen's reasoning was trained
As a user of local models, does this mean that there are 'magic incantations' that can increase the performance of some local models?
I see some details about recovering information via whatever technique. It's interesting, but appears not generalized.
So for a specific question, yes, but this is not about techniques like adding a good embedding that just generally tends to improve open model performance on certain tasks.
There is some research suggesting that a prefix from a stronger model will tend to elicit better completions from a smaller one. I am doing some experiments to see if I can replicate this in a practically useful way, e.g. Fable + 4B Qwen, or 125B Qwen Flash Next + 4B Qwen, results TBD.
I don't think that follows from the published results. Would have been an interesting hypothesis to add though, and quite easy. Just throw the same setup at some benchmarks.
It's interesting that someone else noticed this. A week or two ago, GPT-5.6 Sol starting leaking reasoning into a tool call in Pi. I don't really know what happened, but it was ... interesting:
It eventually triggered some error state and stopped.Nevertheless, this was the first time I'd seen Sol's CoT. I looked up the stolen thought's paper, aaaaand yep, that's Sol's CoT alright.
But it occurred to me, hey, Qwen3.8 27B's CoT seems ... very similar.
I compared the geometry problem in the paper, which had a reasoning block open with:
I passed the same prompt to Qwen, which opened with: This proves nothing, but it does seem an awful lot like they did use GTP-5.5/6 reasoning traces...This looks like colloquial mandarin translated to english word for word.
This is almost exactly how mandarin is spoken in colloquial communication, context is almost always omitted if provided once, and grammar/tense is mostly non-existent either. Check out Singlish for something similar but understandable if you are not a mandarin speaker.
I've read an embarrassing amount of Qwen 3.8 27b cot and it's nothing like this. I'm not refuting the OP, though, which is about continuation.
This is Unsloth's UD-Q4_K_S quantization (edit -- on llama.cpp, via the Vulkan backend, on an RX 7900 XT, with Unsloth's recommended sampler config), for "as replicable as LLMs can be" disclosure, done through llama.cpp's web UI. In another thread, via Open WebUI (both with no custom prompt, so whatever the "default" system prompt is), a reasoning block opens as such:
Now, I will add that when I use Qwen3.8 in a coding harness, the reasoning tends to NOT look like this, and instead looks more Qwen3.6-ish.But when I give short prompts to Qwen3.8 with no system prompt or previous instructions, it seems to strongly gravitate towards grug-talk.
I just tried to reproduce in Llama-cpp's webui: with the following (reverse-engineered) prompt:
“Write a complete short story scene of 2000-3000 words. Use a third-person limited perspective focused on a character named Rowan. The scene must include the following plot elements: a raccoon, Milo returns, a storm power failure, an elderly customer knocks, and a thermos somewhere. Make sure the scene ends feeling finished. Output only the story; do not include any outline, preamble, analysis, or meta-commentary.”
And here's Qwen's thinking trace:
> The user is asking for a short story scene of 2000–3000 words. Third-person limited POV, Rowan. Plot elements: a raccoon, Milo returns, a storm causing a power outage, an elderly customer knocks on the door, a thermos. End with a sense of closure. Output only the story.
> Let me plan carefully. I need to count words in my head—roughly 2400–2600 words would be safely in range. Let me draft.
> Setting: a small-town shop or a gas station/diner where Rowan works the night shift. Milo returns—Milo is probably Rowan's partner, brother, or ex. Let me make Milo Rowan's brother who's been away (military? a road trip? rehab?). Better: Milo is the younger brother who disappeared/went away after a fight. He comes back in the middle of a storm.
While at the very beginning it rephrases the prompt in very short sentence, it's nowhere near close to the above GPT thinking trace and it quickly moves to plain sentences.
Yeah, I dunno. For me it does "talk normally" for the most part when used in an actual coding harness.
One thing though, the actual prompt I used was pretty long (844 words), and ... generated by GPT-5.6 Sol (lol), with the intent of "benchmarking" model performance in being able to write stories where the model avoids explicitly stating every detail in the prompt.
I wonder if the GPT-produced stream could steer the generation into GPT-think territory. That's all I've got, though.
Then there's the actual geometry problem from the stolen thoughts paper:
It doesn’t use the caveman speak unless reasoning is set to xhigh, in my experience. But I don’t know if it has always been coincidental.
> unless reasoning is set to xhigh
That's the default and I'm sure almost everyone else is also using it because other reasoning efforts yield subpar results from what I've seen.
It is the default, which is insane.
I think it is clear that medium reasoning has more 'loopy' results like the older Qwens, but I actually think the low effort results are usually more appropriate.
If you plan to one-shot and vibe code AI slop to meet benchmarks, maybe xhigh makes sense. But if you want a responsive agentic coding assistant it is, to me, quite evidently the wrong choice, especially on modest hardware.
I have seen xhigh radically distract itself with rabbitholes and write considerably worse code than low.
It is my own opinion only, but I think much of the fuss about squeezing Qwen 3.8 27B into small local hardware setups, Macs etc., is a bit misguided.
There's too much focus on its benchmark scores, its one-shot capability, canned demos etc.
For my own needs Muse Glimmer (again on reasoning strength: low) is shaping up to being the more practical agentic tool. It is considerably faster than Qwen at solving real coding tasks.
I don't share your opinion:
IMHO, xhigh makes sense if you want a slower Opus4.6 at home. It is able to complete tasks autonomously in a way that I've never seen another local model do.
But yes, for simpler tasks or more hands coding sessions, it's simply not the best model out there as its verbosity makes unbearably slow.
Not just its verbosity; also its architecture.
Muse Glimmer has some interesting and it seems reasonably daring trade-offs in its architecture (that I wish I understood better) that seem to favour longer agentic “dialogue”, and it is just much more nimble all round, even though it’s a larger model.
Don’t get me wrong, I have spent time speccing out a box that I could use to run Qwen 3.8 27B better, and I am very glad it exists, as I am with the Gemma series. We have really an embarrassment of riches at the 32GB VRAM level already.
I just think maybe Meta have the more appropriate strategy (can’t believe I am saying this) for desktop AI.
The person evaluating and noticing similar reasoning traces to gpt is because they are using a coding harness which probably has a different system prompt to llama webui which primarly serves as a chat interface
They said literally the opposite in their message above. In their experience, the caveman speech occurs in chat ui, not in coding harness.
Same! and very surprised by it from day one of release.
Looks like we're a bunch of weirdos reading Qwen's CoT in here.
To be honest I find it absolutely fascinating and very instructive!
I ended up learning all sort of stuff like that.
> Qwen3.8 27B's CoT seems ... very similar.
What? I've never seen garbled CoT like the one you posted when using Qwen3.8-27B.
I have seen plenty of Qwen 3.8 27B's caveman-like "Need doing this & that" thoughts. And on cerebras now I've seen them come real fast!
Do you prompt it to behave this way or what?
Because here's the king of CoT I get:
> Hmm, but there's a subtlety: does babel-jest + preset-typescript transform the file to CJS by default? No — babel-jest doesn't transform ESM imports to CJS unless @babel/preset-env is configured with modules: commonjs. Without preset-env, import statements stay as ESM in the output, and Jest's CJS runtime would fail with "Cannot use import statement outside a module" unless the project is ESM and running with --experimental-vm-modules.
> Hmm wait, actually babel-preset-jest... does it include preset-env? Let me recall: babel-preset-jest = { plugins: [require('babel-plugin-jest-hoist')] } plus istanbul for coverage. No preset-env. So ESM imports stay as-is.
> But wait — if the user's project is ESM (which it probably is, given the .ts extension imports — Node's type stripping requires ESM-style? no, type stripping also works for CJS-style .ts files with require... actually, --experimental-strip-types supports both CJS and ESM .ts files. But explicit .ts extensions in imports only work in ESM mode (CJS require doesn't allow extensions... actually, does Node 22+ allow require of .ts with flag?
Lots of “but wait” and and full sentences, nothing caveman-like or extremely short sentences without verbs like the GPT thinking trace above.
(this is with unsloth's Qwen3.8-27B-UD-Q5_K_XL.gguf with T° = 0.8)
I was on unquantized 27B, and also Q8 K XL, same "Need do..." paragraphs. We landed in near but distinct morrasses I guess.
News flash: people who scraped the Internet without permission to build their product complain when something vaguely similar is done to them. Water still wet, sky still blue. Film at 11.
(slibhb: Don't get me wrong, I agree with you 99%. But the frontier labs have zero moral authority here.)
I would not be surprised in the slightest if we later find out they are running those same open models to find useful traces or bits to incorporate into their own training. Lots of rules for thee but not for me from Big Ai
I look forward to a day when open models are so dominant that we stop considering traces to be some form of intellectual property that must be hidden from / manipulated for paying users.
It's that manipulation of inputs and outputs that really rubs me the wrong way
They are copying useful parts of open models 100% especially from deepseek.
Evidence?
As I understand, they got paid for the traces unlike owners of scraped websites. They sell text generation tool, so what's the problem if someone generates texts using it?
I'd send them the worlds smallest violin but Rufus is getting in the way of me finding it.
I had to install an add-on in Waterfox to stop Rufus from following me around and interjecting every 2 minutes.
I'd already stopped using Amazon for geopolitical reasons but I needed to get something in an emergency the last week (family member in the hospital, so I bent the rule) first time I'd seen Rufus, even if I wasn't boycotting Amazon for other reasons that monstrosity would have made me consider it.
not just the internet, but every commercially published written work in existence, and I doubt their highly publicized destructive scanning thing had managed to legitimize even a fraction of a percent.
this what is permissible for Jupiter is not permissible for a cow bullshit alone should tell people all they need to know about what kind of greasy sociopaths run "open"ai and (mis)anthropic, and how seriously you should take their purported stances on "safety" and other self-serving shit.
I understand people just get off posting stuff like this. But creating LLMs from the entire corpus of human text was a huge achievement. Distilling those models is much less of an achievement. It means China is further behind than we thought.
They're using competitor output as additional training input. Shrug.. It's not like they have access to the weights.
First movers rarely take the prize, though, do they? Les Paul and Mary Ford pioneered overdubbing voices back in the 1940s and 50s. The Beatles stole it from Buddy Holly. And Elton John from the Beatles.
Distilling is a massive achievement. I can run Qwen. I can't run GPT (TM). It's not a matter of X is better than Y. It's a matter of Y exists, X does not.
How is China further behind if distillation cannot stop? I think it's a reasonable strategy to follow, even if they could train from scratch.
distillation results in a worse product than the actual teacher model iirc
Nobody care if Chinese models are only 99%, 95% or 90% as good as SotA US models.
Because we only have weights and able to self-host Chinese ones. Gemma 4 and GPT OSS are nice to have, but nowhere close to that.
For some reason, what China is doing seems worse. Part of it is that I want the US to stay ahead of China.
While this result does imply there was some training on the reasoning trace and output of GPT 5.5, it doesn't tell us how much of the source of its training it was (even a small amount of post training could bump up the correlations in this way). And it doesn't tell us how much it is more a stylistic influence rather than being a genuine lifting over of intelligence.
In general, I'm fairly ambivalent about demonising training on model outputs. I think in doing so we are more defending proprietary commercial interests of these companies than we are defending any genuine moral principle. We should be careful therefore about over interpreting results like this.
Could anyone explain to me the difference between thinking traces ("intermediate tokens") and the final responses? Specifically, why is it that Claude Opus 5's reasoning in Code is very easy to follow and sounds quite natural, while its answers are full of these very annoying AI-isms and sentence fragments that are void of meaning?
Are thinking traces and final answers trained for different objectives?
> Qwen barely moved toward Opus 4.8 in the earlier experiment, but moved by +20.58 points toward GPT-5.5 Pro here, including a large effect on the private synthetic puzzles. The data suggest that Qwen may have learned from GPT-5.5 Pro, or from a closely related GPT model, rather than from Opus.
How does this suggest anyting of the sorts?
Appendix B of https://stolen-thoughts.com/paper.pdf discusses this
> moved by +20.58 points toward GPT-5.5
Score go up. Probability go up. Conclusion.
I wonder if that’s why 3.8 got so much better? Mixing the reasoning traces from both sides seems to be effective.
[flagged]
[dead]
[dead]
This makes me very sad
If Qwen and other Chinese labs are just copying reasoning traces, then those labs are more than a year behind the frontier.
It's been pretty obvious to me that the Chinese labs are operating mostly on a fast-follow strategy. The distillation attacks are well-documented, and there is good reason to believe they are able to copy architectural innovations as well. If US labs stagnate I would expect Chinese labs to stagnate as well. Their engineering is great, but in terms of frontier innovation (which requires heavy compute to search for new strategies that work at frontier scale) they are very far behind.
Japanese electronics started off the same way post-war.
well then theyll be do better post war, just in time for fallout timeline
The way I see it the Chinese labs are optimizing for other things, including effective compact models that don't need to run on top-of-the-line nVidia hardware.
It makes me happy because it means that these misanthropic technofascists have no moat. They can spend trillions of dollars only for it to be largely copied in short order.
Even if they weren't political adversaries of freedom, I would still feel 0% bad given all their training is already on data they got for free.
Information continues to want to be free. To the benefit of us all.
Preach brother, they stole everything on the internet, and beyond, to train their models. They thought all that information was free, and everyone a few months beyond them is just following their example.
They didn't actually steal in the sense that the information is still there on the internet.... About these shredded rare books, now we're talking.
If I may propose instead of "steal" I think we could agree to write they "Aaron-Swartz'ed" the information from the internet, what do you think, is this too harsh on Sam Altman or Carmen Ortiz ?
Is anything too harsh for these new robber barons?
Oh, we got a real rebel among us.
Well, yeah? I didn't think anybody seriously thought otherwise?