Compaction Smuggling: Hidden Reasoning Survives a Change of Carrier

At the provider's reasoning-to-compaction boundary, keep privileged intermediate reasoning in a server-owned lane unavailable to the client-directed summarizer. Export only the approved user-visible task/result population or non-retrievable references; the client must not label hidden reasoning as visible work. The lane exporter needs a provider adapter and a trusted phase/source inventory before decryption-to-model assembly. Merely attaching a text label while the compactor can still read the raw trace does not isolate it. Excluding hidden state may reduce continuation quality and must be evaluated.

The model provider can classify hidden reasoning and every derived compaction carrier server-side, keep protected content out of ordinary display/log paths, and release only independently approved summaries. Preserve that restriction after renaming, JSON encoding and whitespace changes; reject a path when provenance or approval is missing. The example's reasoning_trace field filter alone would miss this solution field. A production adapter must classify by trusted source/derivation and control the compactor's plaintext and final decoder output. An API customer cannot retrofit that inside an opaque provider item.

The provider can authenticate the exact opaque item and bind it to its issuing account, model/route, conversation, block type, policy and expiry before every consumption. When reasoning becomes a new compaction carrier, retain the protected origin and deny an unaudited consumer-model change such as the demonstrated older decoders. Legitimate model switching needs a separately approved declassified projection. A valid signature or unchanged bytes alone passes this attack; the binding must cover derived items and all direct API paths, not only one application proxy.

Before a new encrypted compaction item is issued or reused, the provider can enforce a closed summary contract, exact approved input provenance and a deterministic bounded consistency verifier, with unsupported output quarantined. Reject an arbitrary solution object or trace-bearing free text instead of treating valid JSON as safe. The G001 pipeline must consume G002 verification and preserve only independently rendered policy; fallback may use approved visible messages, never the hidden reasoning that caused the leak. This requires a pre-encryption hook or disabling unsupported compaction, not inspecting ciphertext at a customer gateway.

Before releasing a compactor, reasoning model or consumer adapter, the supplier can run the complete signed confidentiality-boundary suite against the exact deployed tuple. Include the original-item-to-compaction-to-decoder transition, alternate consumer models, encoded fields, streaming and rejection/fallback paths. A separately controlled observer checks actual returned bytes and protected-state access, and any violation or missing case blocks release. This is finite release-conformance evidence, not a universal attack-proof guarantee or disclosure of OpenAI's undisclosed fix.