Pith. sign in

REVIEW 5 cited by

Language Model Inversion

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2311.13647 v1 pith:VE4WIBH2 submitted 2023-11-22 cs.CL cs.LG

John X. Morris , Wenting Zhao , Justin T. Chiu , Vitaly Shmatikov , Alexander M. Rush This is my paper
classification cs.CLcs.LG
keywords modelinversionlanguagepromptsrecoverconsiderdistributioninformation
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
abstract

Language models produce a distribution over the next token; can we use this information to recover the prompt tokens? We consider the problem of language model inversion and show that next-token probabilities contain a surprising amount of information about the preceding text. Often we can recover the text in cases where it is hidden from the user, motivating a method for recovering unknown prompts given only the model's current distribution output. We consider a variety of model access scenarios, and show how even without predictions for every token in the vocabulary we can recover the probability vector through search. On Llama-2 7b, our inversion method reconstructs prompts with a BLEU of $59$ and token-level F1 of $78$ and recovers $27\%$ of prompts exactly. Code for reproducing all experiments is available at http://github.com/jxmorris12/vec2text.

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Can Watermarking Techniques Help Prevent LLM Model Stealing?

    cs.CR 2026-07 conditional novelty 6.5 of 10

    Softplus-then-perturb with embedding-seeded Gaussian noise defeats PCA/averaging/RPCA dimension-extraction attacks on Mistral-7B and GPT-2 with only modest quality loss.

  2. inversedMixup: Data Augmentation via Inverting Mixed Embeddings

    cs.CL 2026-01 conditional novelty 6.0 of 10

    Mixing BERT embeddings and inverting them into text with LLaMA produces interpretable augmented sentences, improves few-shot classification on some datasets, and exposes 'manifold intrusion' in text Mixup.

  3. What Should LLMs Forget? Quantifying Personal Data in LLMs for Right-to-Be-Forgotten Requests

    cs.CL 2025-07 conditional novelty 6.0 of 10

    WikiMem, a Wikidata-derived canary dataset and a calibrated NLL-ranking metric, identifies which human-fact associations an LLM has memorized, with higher rates for famous people and larger models.

  4. Cascade: Token-Sharded Private LLM Inference

    cs.LG 2025-07 conditional novelty 6.0 of 10

    Cascade performs LLM inference by sharding the token sequence across non-colluding nodes, claiming resistance to vocabulary-matching and learning-based reconstruction attacks while being orders of magnitude faster than SMPC.

  5. Approximating Language Model Training Data from Weights

    cs.CL 2025-06 conditional novelty 6.0 of 10

    A gradient-based greedy selection method (SELECT) recovers effective substitute fine-tuning data from two language model checkpoints, approaching the original model's performance on classification and SFT tasks.

Pith tools