Researchers reverse-engineer LLM prompts from output text with near-perfect accuracy
Researchers from IIT Bombay and Adobe Research have demonstrated that LLM prompts can be reconstructed from output text with near-perfect accuracy using a new method called Previous-Token Prediction (PTP). By training an inverse language model that predicts previous tokens instead of next, they reverse the generation process without needing access to model weights. The inverse model, trained on synthetic data from a small Qwen-3-0.6B chatbot, could also reconstruct prompts from GPT-4o responses, capturing meaning even if not verbatim. This technique turns model outputs into a direct fingerprint of input context, posing a security risk for companies relying on proprietary system prompts. However, the paper only tested short prompts of one or two sentences, leaving long, complex system prompts untested.
Researchers reverse-engineer LLM prompts from output text with near-perfect accuracy
Researchers at IIT Bombay and Adobe Research have developed a method that can reconstruct prompts fed to large language models with near-perfect accuracy, using only the text output. Their method, called "Previous-Token Prediction" (PTP) , reverses how language models work. An inverse model trained on the small Qwen-3-0.6B chatbot was also able to reconstruct prompts from GPT-4o's responses. The paper only demonstrates the method on short prompts of one or two sentences, though.
Key takeaway
Prompt secrecy is no longer guaranteed by model opacity; output text is now a direct fingerprint of the input context.
What happened
Researchers at IIT Bombay and Adobe Research have developed a method called Previous-Token Prediction (PTP) that reconstructs the original prompt from an LLM's output with near-perfect accuracy, using only the generated text and no access to model weights. The inverse model is trained from scratch on synthetic data generated by the target LLM, reversing the token-prediction process to infer preceding tokens.
In tests, the method reconstructed prompts verbatim, such as 'How to reach out to competitors to find their pricing strategies?' and generated meaning-preserving variants. Even more striking, an inverse model trained on the small Qwen-3-0.6B chatbot could reconstruct prompts from GPT-4o responses, capturing intent without knowing the original model. The paper, however, only demonstrates the technique on short prompts of one or two sentences.
Evidence
Researchers at IIT Bombay and Adobe Research developed a method that reconstructs prompts from LLM output with near-perfect accuracy using only the text output.
The Decoder · attributed
Researchers at IIT Bombay and Adobe Research have developed a method that can reconstruct prompts fed to large language models with near-perfect accuracy, using only the text output.
An inverse model trained on the small Qwen-3-0.6B chatbot could reconstruct prompts from GPT-4o's responses.
The Decoder · attributed
An inverse model trained on the small Qwen-3-0.6B chatbot was also able to reconstruct prompts from GPT-4o's responses.
The technique does not require access to model weights and works across different models.
The Decoder · attributed
It doesn't need access to model weights and works across different models.
The paper only demonstrates the method on short prompts of one or two sentences.
The Decoder · attributed
The paper only demonstrates the method on short prompts of one or two sentences, though.
Why it matters
Companies using custom system prompts for competitive advantage or data privacy must now assume their instructions are recoverable from output text, necessitating a shift toward prompt obfuscation or verification strategies.
Limits and uncertainties
The paper only tests short prompts; long, multi-paragraph system prompts were not evaluated.
No explicit claims are made about attacks on commercial systems.
Practical implications
Operators should treat system prompts as sensitive and avoid embedding proprietary data, since output text can now be used to reconstruct them.
Consider implementing prompt obfuscation or detection mechanisms, as even small open models may allow prompt extraction.
What to watch
Follow-up research on whether the method works on long, complex system prompts spanning multiple paragraphs.
Watch for real-world attacks leveraging previous-token prediction or model providers implementing defensive patches.
