bayes-song
Joined 3 years ago
Joined 3 years ago
Prefix token oracle: Given a string s and integer n, return the string decoded from the first n tokens of tokenize(s).
The first oracle (token count) is straightforward. The second oracle's main purpose is to resolve ambiguities in merge order. For example, without it we couldn’t distinguish between the segmentations (a, bc) and (ab, c). By leveraging the model’s ability to repeat text in a controlled way, we can construct this second oracle from the regular chat interface.
With only these two oracles, is it possible to reconstruct an equivalent tokenizer — one that produces the exact same token boundaries/segmentation on any input (up to token ID remapping)?
After some experiments, I think I may have found a way to get the original reasoning from signature.
I built a verification test. The idea is simple: you generate a random secret locally, make Claude place it only inside private reasoning, extract only the returned signature, and then submit only that signature. If the secret comes back while the visible answer never contained it, that is evidence that I am correctly recovering content from the encrypted CoT, rather than guessing or re-deriving it.
Another signal that makes me take this seriously: in most cases, without giving the recovery side any hint about the hidden reasoning, the recovered CoT has exactly the same length as the CoT reported by the API.
some examples: https://github.com/s-JoL/open-reasoning
If it’s real, it seems important.