Can Hidden Reasoning Stay Hidden? A Survey of Chain-of-Thought Extraction Attacks on Large Reasoning Models

Providers of large reasoning models withhold the chain-of-thought (CoT) that their models generate, returning an answer, a short summary, and, in some APIs, an encrypted copy of the trace in order to prevent distillation and keep sensitive intermediate content private. Five studies published between March and September 2026 show how API clients can recover existing traces or obtain useful reasoning despite this restriction. This survey organizes that work at the level of threat models, mechanisms, and evaluation protocols. We formulate CoT extraction, compare the attackers that the studies assume, and group the attacks into three families according to how they obtain the trace: reconstruction from visible outputs, elicitation into a visible channel, and replay of the trace that the model has already produced. We then summarize how the attacks are evaluated, map the proposed defenses onto the families they address, and identify open problems. The surveyed evaluations establish that no single defense is effective across all three families, and comparing attacks requires a shared trace reference and separate measures of textual fidelity, task preservation, and downstream utility. We conclude by identifying several research gaps and open questions for future research.