A research team from IIT Bombay and Adobe Research announced on July 31, 2026, a method called "Previous-Token Prediction (PTP)" that reverse-engineers input prompts from large language model (LLM) responses. The method doesn't require access to the target model's weights, logits, or internal representations—it generates candidates from just a single observed text response. In an experiment where Qwen3-0.6B Chat was examined using an inverse model of the same lineage, 64.77% of 100 ShareGPT-derived samples produced token sequences that exactly matched the original prompt. However, this figure cannot be interpreted as a "near-perfect reconstruction rate" applicable to any LLM.
64.77% Exact Match from a Single Response
The 64.77% exact match rate was obtained under conditions where Qwen3-0.6B Chat generated the responses, and an inverse model trained from scratch based on the same Qwen3-0.6B was used to reverse them. The research team selected 500 prompts from ShareGPT, using 400 for fine-tuning and reserving the remaining 100 for evaluation. Each prompt was approximately 25-30 tokens long. The exact match rate had a variance of ±4.54 points, while Token F1, which measures word overlap, was 63.64±4.61.
Here, "exact match" is a strict metric that determines whether the reconstructed prompt is identical to the original input at the token level. Meanwhile, cosine similarity, which measures overall semantic closeness, was 86.13±2.11, and BERT F1, which matches words while considering context, was 80.66±2.70. Even candidates that don't match verbatim may still preserve the original intent.
In a closed-loop evaluation where the reconstructed candidates were fed back into Qwen, 61.79±4.60% of the generated responses exactly matched the original responses, with cosine similarity reaching 88.08±1.90. Even without pinpointing the exact original question, alternative questions that elicit similar answers can be found. PTP exploits the property of LLMs that prompts and responses don't have a strict one-to-one correspondence by generating multiple candidates.
The preceding black-box method, Output2Prompt, had also demonstrated that inputs could be recovered from ordinary text responses. However, according to the PTP paper's comparison, while Output2Prompt uses approximately 64 responses to the same hidden prompt plus external data at the scale of 30,000 samples, the trained PTP only reads a single response at inference time. This "single response" figure doesn't mean attack preparation is unnecessary—a dedicated inverse model must be built beforehand.
The Mechanism of Learning Next-Token Generation in Reverse
PTP reverses the mechanism by which ordinary LLMs "predict the next token from the preceding text." First, each token in the target LLM's vocabulary is placed at the beginning, and the model generates continuing text. The experiments tried lengths of 64, 128, and 256 tokens, with the main results using 256-token sequences. The generation conditions were top-k of 5, top-p of 0.95, and temperature of 0.9.
In the generated sequences, the order of tokens—not characters or words—is reversed. Training Qwen3-0.6B on this data produces a reverse language model that outputs the preceding token based on the following context. At inference time, the observed response is also reversed at the token level, and the inverse model generates what comes "before" it. The resulting sequence, restored to its original order, is estimated to be the prompt that preceded the response.
The research team trained the inverse model from scratch using synthetic sequences generated by the target LLM, rather than fine-tuning it from an existing text generation model. Afterward, they performed additional training using the 400 ShareGPT prompts to align the output with realistic question formatting. Therefore, the paper's claim of being "data-free" refers specifically to the synthetic pretraining phase—it doesn't mean external data is never used throughout the entire process.
This design allows multiple candidates to be generated by varying the sampling conditions at inference time. In the paper's example, the question "how to contact competitors to investigate their pricing strategy" was completely reconstructed, along with candidates expressing the same idea differently. Rather than committing to a single hidden original text, the reconstructor searches for the set of inputs that could plausibly have generated the observed response.
Only 11.36% Exact Match with GPT-4o
When 100 GPT-4o responses were fed into the inverse model trained on Qwen3-0.6B Chat, the prompt exact match rate dropped to 11.36±2.79%. Token F1 also fell to 10.20±2.77. When the model architecture, vocabulary, and tokenizer differ, the ability to reproduce the exact same string is significantly diminished.
Even so, the cosine similarity of prompts remained at 63.01±1.71, and BERT F1 was 82.26±0.06. When the reconstructed prompts were fed back into GPT-4o, the exact match of responses was a mere 1.71±0.43%, but cosine similarity was maintained at 81.57±1.2. What survived transfer to a different model was the topic and intent of the question, rather than a precise reproduction of the original text.
Llama-2 7B Chat showed the same trend. With Qwen's inverse model, exact match dropped to 17±2.4% and Token F1 to 12±1.9, while cosine similarity remained at 84±1.0. Furthermore, in a cross-dataset evaluation where the model was fine-tuned on 30,000 samples from Instruction-2M and transferred to ShareGPT, exact match was 11.03±2.19% while BERT F1 was 91.34±0.57. High semantic similarity and high exact match rates need to be read as separate metrics.
This gap also has implications for defenders. Even if the recipient of an output cannot exactly reproduce the original confidential text, there remains a possibility of inferring the subject and intent of the question. However, the PTP paper doesn't address real-world attacks aimed at extracting hidden system prompts from commercial services. Nor does it measure recovery rates for long, multi-paragraph instructions or inputs containing personal information.
An Upfront Cost of 38 Million Tokens
Exploring Qwen3-0.6B's vocabulary of approximately 150,000 entries in 256-token increments requires approximately 38 million tokens' worth of queries per epoch of synthetic data generation. According to the paper, generating one epoch's worth of data on a single A100 GPU takes approximately 1 hour. Since text is regenerated for each epoch, the total query volume scales proportionally with the number of training iterations.
While small models that can be run locally allow for parallel processing, the paper doesn't evaluate the costs, rate limits, or detection by providers when applying the same exploration technique to commercial APIs. Achieving strict token-level matching also requires the target model's tokenizer. The authors explain that for semantic recovery, the inverse model's own tokenizer can be used instead. In other words, calling this a "complete black-box attack"—including exact reconstruction—isn't entirely accurate.
Additionally, the questions in the main experiments were limited to approximately 25-30 tokens. While the paper states that training could be extended to sequences up to 4,096 tokens, the actual main results were derived from 256-token synthetic sequences. There are no measurements yet demonstrating high recovery rates for long system instructions. The paper is a pre-peer-review arXiv v1, and the main text doesn't include a link to publicly available implementation code.
What PTP has changed is the assumption that inputs are safe simply because only the response text is visible. The next test for this research will be third-party reproduction once the implementation is made public, along with how well the exact match rate holds up for long system prompts and diverse commercial models. Until those results are available, 64.77% should be regarded as a significant warning sign—not proof that the secrets of any LLM can be read with near-perfect accuracy.