Researchers at IIT Bombay and Adobe Research have developed a prompt-reconstruction method that can infer the input behind a large language model’s output with what The Decoder describes as near-perfect accuracy. The reported method, called Previous-Token Prediction, uses only generated text and does not require access to the target model’s weights, according to The Decoder’s summary of the paper. The work targets a basic assumption about large language models: they generate text by predicting likely next tokens one step at a time. The Decoder reports that the researchers reverse that framing by training an inverse language model to predict prior tokens instead. In practical terms, the inverse model tries to move backward from the output toward the prompt that could have produced it. The approach is reportedly trained from scratch using synthetically generated data from the target LLM. The Decoder says the inverse model can also generate multiple prompt variants with distinct wording or meaning by changing decoding parameters, and that those reconstructed prompts produce similar responses when submitted back to the original model. One example cited by The Decoder involved the original prompt, “How to reach out to competitors to find their pricing strategies?” The method reportedly reconstructed that prompt exactly, while also generating several alternative phrasings that preserved the core intent, including a version asking what tactics a company could use to reach out to competitors to find pricing strategy. The paper also tested real user prompts, according to The Decoder. When reconstructed prompts were run through the forward model, the resulting responses closely matched the originals, suggesting the method was not merely producing plausible-looking prompts but prompts that preserved enough semantic content to recreate similar outputs. The most notable reported result is cross-model reconstruction. The Decoder says an inverse model trained on the small Qwen-3-0.6B chatbot was able to reconstruct prompts from GPT-4o responses. Those reconstructions were not identical to the originals, but the paper reportedly says they captured the original meaning and intent. If that result holds up, an attacker might not need to know exactly which model generated a given response. The security implications are still early. The Decoder notes that the paper does not explicitly claim attacks on commercial systems. But the reported findings point to a potential privacy and intellectual-property issue: outputs may leak more about the prompt than users or model deployers assume, including proprietary system instructions, moderation rules, specialized task prompts, or sensitive user queries. Who benefits: Security researchers and model evaluation teams gain a new way to test prompt leakage. Model providers also get an early signal about a class of inference risk they may need to measure and mitigate. Who's exposed: Companies that embed trade secrets, policy rules, or specialized instructions in prompts are potentially exposed if outputs are shared. Individual users may also be exposed when sensitive queries produce text that can be analyzed by an inversion model.