IIT Bombay's trick can rebuild your ChatGPT prompts from output alone

A team from IIT Bombay and Adobe Research has cracked a problem most people assumed was practically unsolvable: reconstructing the exact prompt someone fed into a large language model, using nothing but the text that came out the other end. Their technique, called Previous-Token Prediction (PTP), flips the standard autoregressive setup on its head. Instead of predicting the next token, they trained an inverse model that works backward, predicting the tokens that likely came before. The model was built entirely on synthetic data generated by the target LLM — no access to weights, no API internals, nothing privileged.

The results are striking. In one example, the prompt “How to reach out to competitors to find their pricing strategies?” was recovered word for word. The system also produced six semantic variants that all generated similar responses when fed back into the original model. That’s not just retrieval — it’s a kind of prompt-space exploration. And the cross-model results are arguably more unsettling: an inverse model trained on Qwen-3-0.6B, a tiny open-source chatbot, successfully reconstructed the intent of prompts that produced GPT-4o outputs. The attacker doesn’t need to know which model generated the text. That lowers the barrier dramatically.

For enterprises, the threat is obvious. System prompts often encode proprietary business logic, moderation policies, or trade secrets. If a competitor can point an inversion model at your public-facing chatbot and extract those instructions, you’ve got a leak that no DLP tool catches. Individual users face a quieter risk: personal queries, medical questions, financial details — all potentially recoverable from outputs that look innocuous. The fact that a small, openly available inversion model could pull this off makes it a practical concern, not an academic hypothetical.

Now, the caveats. The paper only demonstrates success on short prompts — one or two sentences. Long, multi-paragraph system prompts with nested instructions remain untested. That’s a significant limitation, and it’s worth being honest about. I’ve seen plenty of prompt-injection papers that crumble when you move from toy examples to production systems. Still, the cross-model transfer result suggests the underlying principle is robust. If I were running security at an AI lab, I’d want to know whether output-level defenses — paraphrasing, noise injection, fixed response templates — actually blunt this attack. The paper doesn’t answer that. But the fact that researchers had to ask is itself a signal.