PTP: Previous-Token Prediction based LLM Inversion for Near-Exact Prompt Reconstruction

2026-07-31

AI Summary

This work addresses the challenge posed by the autoregressive nature of large language models, which induces a many-to-many mapping between prompts and outputs, thereby hindering precise prompt inversion. To overcome this, the authors propose a black-box functional inversion method that requires neither model weights nor external data. Instead, it leverages only synthetic data generated by the target model itself to train an inverse language model from scratch. Notably, the approach formalizes inversion as a previous-token prediction task, establishing a symmetry between forward and inverse generation processes. Without any fine-tuning or auxiliary information, the method achieves high-fidelity, semantically consistent, and diverse prompt reconstructions, outperforming existing techniques across multiple token-level evaluation metrics and demonstrating strong generalization across datasets and models.

Abstract

Large language models (LLMs) generate text by auto-regressively sampling the next token. This inherently leads to a many-to-many mapping between prompts and responses, complicating the task of inferring prompts from observed outputs. Prior work on LLM inversion frames prompt recovery as a semantic reconstruction task. They rely on fine-tuning pretrained sequence-to-sequence models on large external datasets--and requiring access to model weights or logits--to generate semantically plausible prompts. In contrast, we present a functional approach to inverting a given LLM in a black-box setting, without auxiliary aids. We train an explicit inverse language model entirely from scratch on data synthetically generated from the target LLM itself. Analogous to forward next-token prediction, our inverse model is trained using previous-token prediction, establishing a generative link between the forward and inverse processes that enables faithful prompt reconstruction. Moreover, it naturally supports diverse prompt reconstructions through sampling, whereby all such prompts induce similar responses under the forward, target LLM. Our approach generalises across datasets and exhibits transferability in reconstructing prompts from responses generated by different LLMs. Further, across the set of token based evaluation metrics for prompt and response reconstructions, our approach outperforms prior work.

Problem

• prompt reconstruction
• LLM inversion
• black-box setting
• previous-token prediction
• near-exact recovery

Innovation

• previous-token prediction
• LLM inversion
• black-box prompt reconstruction
• inverse language model
• prompt recovery