Researchers at IIT Bombay and Adobe Research have demonstrated a method to reconstruct prompts sent to large language models with near-perfect accuracy, using only the resulting text.
The technique functions without access to the model’s internal weights and applies to third-party systems as well.
Large language models generate text by predicting the next likely word, token by token. Reversing this process has long been seen as impractical because many different prompts can produce similar responses.
A new paper shows this is possible with surprising accuracy. The method, called “Previous-Token Prediction” (PTP), trains an inverse language model that predicts the previous tokens instead of the next.
This inverse model is trained entirely from scratch on synthetically generated data from the target LLM. It requires only the generated text.
A single response yields the exact prompt and multiple alternatives
The inverse model can generate multiple prompt variations with distinct meanings by tweaking the decoding parameters. All of these reconstructed prompts produce similar responses when fed back into the original language model.
In one example from the paper, the prompt “How to reach out to competitors to find their pricing strategies?” was reconstructed word for word. The model also generated six additional variants that captured the core meaning but used different phrasing, such as “What tactics can a company looking to reach out to competitors in the market use to find their pricing strategy?”
Tests with real user prompts showed accurate reconstructions as well. When the researchers fed the reconstructed prompts back into the forward model, the responses closely matched the originals.
Attackers don’t even need to know which model produced the text
An inverse model trained on the small Qwen-3-0.6B chatbot was also able to reconstruct prompts from GPT-4o’s responses. The reconstructed prompts were not identical to the originals, but according to the paper, they captured the meaning and intent. A potential attacker would not even need to know which model generated a given output.
This creates a broad security problem. Companies risk exposing proprietary system prompts containing trade secrets, moderation rules, or specialized instructions. Individual users face a similar threat, since personal or sensitive queries could also be extracted from the output. A small, open inversion model could be enough to pull this off.
The paper itself does not make explicit claims about attacks on commercial systems. But if the method works on current production models, AI labs will need to address it quickly and patch the issue.
