A new prompt reconstruction method challenges a basic assumption about large language models: that the input prompt is effectively hidden once only the output is visible. Researchers at IIT Bombay and Adobe Research show that generated text can carry enough signal to recover the prompt behind it with near-perfect accuracy.
The method is called Previous-Token Prediction, or PTP. Instead of asking a model to predict what comes next, it trains an inverse language model to work backward from the generated response.
How prompt reconstruction works
Large language models produce text by predicting the next likely word or token, one step at a time. That forward process is familiar: a user writes a prompt, the model extends it, and the visible result is a response.
Reversing that flow has usually looked impractical. Many prompts can lead to similar answers, so the original input might appear lost among many possible alternatives. The paper described in the source shows that this assumption is weaker than it looks.
PTP trains an inverse language model to predict previous tokens rather than next tokens. The inverse model is trained from scratch using synthetically generated data from the target LLM. According to the source, it does not need model weights. It only needs the generated text.
That matters because access to model weights is a major boundary between ordinary use and deep technical access. A method that works from output alone changes the risk profile. It means the response itself may contain enough information to reconstruct what the user asked.
One response can point back to the prompt
The source describes a case where the prompt "How to reach out to competitors to find their pricing strategies?" was recovered word for word. The same system also produced six additional variants that preserved the central meaning while changing the wording.
One of those variants was "What tactics can a company looking to reach out to competitors in the market use to find their pricing strategy?". That example is important because prompt recovery is not limited to exact text matching. A reconstructed prompt can also be valuable if it captures the same intent.
The researchers also tested real user prompts. When they put reconstructed prompts back into the forward model, the resulting responses closely matched the original outputs. In plain terms, the recovered prompts were close enough to reproduce the behavior that mattered.
This creates two related concerns:
- Exact recovery: the original prompt may be reconstructed directly.
- Meaning recovery: even when the wording changes, the user’s intent may still be exposed.
For prompt privacy, the second point is just as significant as the first. A system does not need to recover every word perfectly to reveal what a user was trying to do.
The model behind the output may not need to be known
The source also highlights a broader finding: an inverse model trained on the small Qwen-3-0.6B chatbot was able to reconstruct prompts from GPT-4o responses. Those reconstructions were not identical to the originals, but the paper says they captured the meaning and intent.
That result suggests a potential attacker may not need to know which language model created the text. If prompt reconstruction can transfer across models in this way, then published or shared AI output becomes a more general source of leakage.
The attack surface is therefore not limited to one model family or one deployment. The source specifically notes that the approach can apply to third-party models. It also says a small, open inversion model could be enough to carry out this kind of reconstruction.
This is why the finding is broader than a technical curiosity. It raises questions about what information remains hidden when AI output is copied, stored, analyzed, or shared outside the original interaction.
Why companies and users should care
For companies, the most obvious concern is proprietary prompting. The source points to system prompts that may include trade secrets, moderation rules, or specialized instructions. If those instructions can be inferred from outputs, then the output becomes a possible window into internal operating logic.
For individual users, the issue is more personal. A generated answer may reveal the sensitive or private query that produced it. Even if the response itself looks harmless, prompt reconstruction could expose the request behind it.
The concern is not only about prompts that are copied into public spaces. Any setting where generated text is accessible to another party could become relevant. The source does not claim that commercial systems have been attacked, but it does describe a method that could create a security problem if it works on current production models.
That distinction is important. The paper itself does not make explicit claims about attacks on commercial systems. Still, the implication is clear: if the method generalizes to deployed AI products, AI labs will need to respond quickly and patch the issue.
A new privacy question for AI output
The central lesson is simple: generated text may not be separate from the prompt that created it. PTP shows that output can contain enough structure to work backward toward the input, sometimes with near-perfect accuracy and sometimes by recovering intent rather than exact wording.
That changes how prompt security should be discussed. The prompt is not the only sensitive object. The model’s answer may also become sensitive because it can help reconstruct what came before.
For large language models, this is a reversal of the usual privacy framing. Instead of asking only whether a model reveals training data or internal instructions directly, the new question is whether ordinary output can leak the prompt indirectly. Based on the source, researchers at IIT Bombay and Adobe Research have shown that the answer can be yes.