Researchers at IIT Bombay and Adobe Research have developed a method that can reconstruct prompts fed to large language models with near-perfect accuracy, using only the text output. The approach works without access to model weights and even applies to third-party models.

Large language models generate text by predicting the next most likely word, token by token. Reversing that process and reconstructing the original prompt from the output has long been considered impractical, since many different prompts can produce similar responses.

A new paper from researchers at IIT Bombay and Adobe Research shows it can be done with surprising accuracy. Their method, called "Previous-Token Prediction" (PTP), reverses how language models work. Instead of predicting the next token, the researchers train an inverse language model that predicts the previous tokens.

This inverse model is trained entirely from scratch on synthetically generated data from the target LLM. All it needs is the generated text.

A single response yields the exact prompt and multiple alternatives

The inverse model can also generate multiple prompt variations with distinct meanings by tweaking the decoding parameters. All of these reconstructed prompts produce similar responses when fed back into the original language model.

In one example from the paper, the prompt "How to reach out to competitors to find their pricing strategies?" was reconstructed word for word. The model also generated six additional variants that captured the core meaning but used different phrasing, such as "What tactics can a company looking to reach out to competitors in the market use to find their pricing strategy?"

Tests with real user prompts showed accurate reconstructions as well. When the researchers fed the reconstructed prompts back into the forward model, the responses closely matched the originals.

Attackers don't even need to know which model produced the text

An inverse model trained on the small Qwen-3-0.6B chatbot was also able to reconstruct prompts from GPT-4o's responses. The reconstructed prompts weren't identical to the originals, but according to the paper, they captured the meaning and intent. A potential attacker wouldn't even need to know which model generated a given output.

This creates a broad security problem. Companies risk exposing proprietary system prompts containing trade secrets, moderation rules, or specialized instructions. Individual users face a similar threat, since personal or sensitive queries could also be extracted from the output. A small, open inversion model could be enough to pull this off.

The paper itself doesn't make explicit claims about attacks on commercial systems. But if the method works on current production models, AI labs will need to address it quickly and patch the issue.

Read on for the full picture.
Subscribe for hype-free coverage.

• Full access to every article on THE DECODER
• No ads
• Join the comments and community discussions
• A weekly AI news recap via mail
• 6x/year: "AI Radar" — deep dives on the AI topics that matter most
• Daily AI news, always up to date
• Our full ten-year archive
• Covered by a team with 10+ years in AI