# 研究人员实现从输出文本近乎完美逆向还原 LLM 提示词

- 来源：The Decoder：AI News（RSS）
- 作者：Matthias Bastian
- 发布时间：2026-08-13 01:32
- AIHOT 分数：60
- AIHOT 链接：https://aihot.virxact.com/items/cmsqdxw310054rolif6l8rfo1
- 原文链接：https://the-decoder.com/researchers-can-now-reverse-engineer-llm-prompts-from-output-text-with-near-perfect-accuracy

## AI 摘要

印度理工学院孟买分校与 Adobe Research 提出“Previous-Token Prediction”（PTP）方法，仅凭模型输出文本即可近乎完美地重建原始提示词，无需访问模型权重，且适用于第三方模型。

## 正文

Researchers at IIT Bombay and Adobe Research have developed a method that can reconstruct prompts fed to large language models with near-perfect accuracy, using only the text output. The approach works without access to model weights and even applies to third-party models.

Large language models generate text by predicting the next most likely word, token by token. Reversing that process and reconstructing the original prompt from the output has long been considered impractical, since many different prompts can produce similar responses.

A new paper from researchers at IIT Bombay and Adobe Research shows it can be done with surprising accuracy. Their method, called "Previous-Token Prediction" (PTP), reverses how language models work. Instead of predicting the next token, the researchers train an inverse language model that predicts the previous tokens.

This inverse model is trained entirely from scratch on synthetically generated data from the target LLM. All it needs is the generated text.

A single response yields the exact prompt and multiple alternatives

The inverse model can also generate multiple prompt variations with distinct meanings by tweaking the decoding parameters. All of these reconstructed prompts produce similar responses when fed back into the original language model.

In one example from the paper, the prompt "How to reach out to competitors to find their pricing strategies?" was reconstructed word for word. The model also generated six additional variants that captured the core meaning but used different phrasing, such as "What tactics can a company looking to reach out to competitors in the market use to find their pricing strategy?"

From a single LLM response, the inverse model reconstructs the exact original prompt (No. 3) along with six semantically similar variants. | Image: Suhail et al.

Tests with real user prompts showed accurate reconstructions as well. When the researchers fed the reconstructed prompts back into the forward model, the responses closely matched the originals.

For real user prompts, the reconstructed phrasing differs in wording but captures the semantic core of the original input. | Image: Suhail et al.

Attackers don't even need to know which model produced the text

An inverse model trained on the small Qwen-3-0.6B chatbot was also able to reconstruct prompts from GPT-4o's responses. The reconstructed prompts weren't identical to the originals, but according to the paper, they captured the meaning and intent. A potential attacker wouldn't even need to know which model generated a given output.

This creates a broad security problem. Companies risk exposing proprietary system prompts containing trade secrets, moderation rules, or specialized instructions. Individual users face a similar threat, since personal or sensitive queries could also be extracted from the output. A small, open inversion model could be enough to pull this off.

The paper itself doesn't make explicit claims about attacks on commercial systems. But if the method works on current production models, AI labs will need to address it quickly and patch the issue.

Read on for the full picture. Subscribe for hype-free coverage.

Full access to every article on THE DECODER

No ads

Join the comments and community discussions

A weekly AI news recap via mail

6x/year: "AI Radar" — deep dives on the AI topics that matter most

Daily AI news, always up to date

Our full ten-year archive

Covered by a team with 10+ years in AI