IIT Bombay and Adobe researchers reconstruct LLM prompts from output text
Researchers at IIT Bombay and Adobe Research have built a method that reconstructs the prompt fed to a large language model using only the text it produced, with near-perfect accuracy. The technique, called Previous-Token Prediction (PTP), needs no access to the target model's weights and even works against third-party models it was never trained on.
Large language models generate text by predicting the next most likely token, one at a time. Reversing that process to recover the original prompt from the output has long been considered impractical, since many different prompts can produce similar responses. PTP flips the mechanism: instead of predicting the next token, the researchers train a separate inverse language model that predicts the previous tokens. This inverse model is trained entirely from scratch on synthetic data generated by the target LLM; all it needs to work is the generated text itself.
A single response can yield both the exact original prompt and several distinct alternatives, produced by tweaking the inverse model's decoding parameters. In one example from the paper, the prompt "How to reach out to competitors to find their pricing strategies?" was reconstructed word for word, and the model also generated six additional variants with different phrasing that captured the same core meaning, such as "What tactics can a company looking to reach out to competitors in the market use to find their pricing strategy?" All of the reconstructed variants produced similar responses when fed back into the original model. Tests with real user prompts showed accurate reconstructions too, with the resulting responses closely matching the originals.
The method also transfers across models. An inverse model trained on the small Qwen-3-0.6B chatbot was able to reconstruct prompts from GPT-4o's responses, even though it had never been trained on GPT-4o. The reconstructions weren't identical to the originals, but according to the paper they captured the meaning and intent, and a potential attacker would not even need to know which model had generated the output in the first place.
That transferability is what turns the technique into a broad security problem. Companies risk exposing proprietary system prompts, including trade secrets, moderation rules, or specialized instructions baked into a product. Individual users face a similar threat, since personal or sensitive queries could also be extracted from the text a model outputs. A small, openly available inversion model could be enough to attempt this.
The paper itself does not explicitly claim the method works as an attack on commercial systems; that framing is the article's own. But if it does work against current production models, AI labs will need to address it quickly and patch the issue. The demonstrated results are also limited in scope: the paper only tested short prompts of one or two sentences, and whether the method works on long, complex system prompts spanning multiple paragraphs was not tested.
Key facts
- PTP is an inverse language model, trained from scratch on synthetic data, that reconstructs a prompt from a model's output text alone, without needing access to the target model's weights.
- In one example, a prompt was reconstructed word for word, and the model also produced six additional rephrased variants that preserved the same meaning.
- An inverse model trained on the small Qwen-3-0.6B chatbot successfully reconstructed prompts from GPT-4o's output, showing the technique transfers to models it was never trained on.
- The paper only tested short prompts of one or two sentences; whether the method works on long, multi-paragraph system prompts was not tested.
- The risk cuts both ways: companies could have proprietary system prompts (trade secrets, moderation rules) exposed, and individual users' personal or sensitive queries could be extracted from AI outputs.
Why it matters
Reconstructing a prompt from an LLM's output alone was long considered impractical, because many different prompts can produce similar-looking responses. PTP shows near-perfect reconstruction is possible anyway, without access to the model's weights and even against models the inversion model was never trained on. That combination turns something assumed to be a one-way process into a two-way one, which is a structural problem for anyone who depends on a prompt staying private.
Who it affects
Companies that rely on proprietary system prompts, such as trade secrets, moderation rules, or specialized product instructions embedded in a chatbot, are exposed if their model's raw output can be harvested. Individual users are exposed too: personal or sensitive queries can potentially be reconstructed from a model's replies. The transfer result, where an inverse model trained on the small open Qwen-3-0.6B chatbot reconstructed prompts from GPT-4o, means the operators of a target model do not control who can build a working inversion model against it.
How to use it
This is a research demonstration, not a released product. The core requirement described in the paper is modest: an attacker needs only a model's output text, no access to its weights, and can train the inverse model on a small, openly available base like Qwen-3-0.6B rather than the target model itself. The paper does not require knowing in advance which model produced a given output for the attack to work.
How solid is it
The result comes from one paper by researchers at IIT Bombay and Adobe Research (no individual authors or publication venue are named in the article). The article describes concrete tests: a word-for-word reconstruction plus six meaning-preserving variants for one example prompt, accurate reconstructions on real user prompts, and successful transfer from a Qwen-3-0.6B-based inverse model to GPT-4o's output. The demonstrated scope is narrow, though: only short, one-to-two-sentence prompts were tested.
Risks and caveats
The paper does not explicitly claim the method works as an attack on current commercial systems; that is the article's own framing of the risk. Whether PTP works against long, multi-paragraph system prompts, the kind companies actually use in production, was not tested. If the method does hold up against production models, the article notes that AI labs would need to address and patch the issue quickly, though no lab is reported to have responded to it yet.