Rep2Text: Decoding Full Text from a Single LLM Token Representation
Authors: Haiyan Zhao, Zirui He, Yiming Tang, Fan Yang, Ali Payani, Dianbo Liu, Mengnan Du
Organizations: New Jersey Institute of Technology · National University of Singapore · Wake Forest University · Cisco Research · The Chinese University of Hong Kong, Shenzhen
Large language models represent text as hidden numerical patterns, but what information these representations actually contain remains a mystery. Can we recover the original text from just one of them? In this paper, we introduce Rep2Text, a method designed to answer this question by reconstructing text from a single hidden representation. We find that these representations preserve much more information than we might expect. For short texts of about 16 words, Rep2Text can recover roughly half of the original words while preserving their overall meaning. As the text gets longer, recovering the exact wording becomes harder, but the main ideas can still be recovered. These findings offer a new way to understand what language models store internally and highlight potential privacy risks, as hidden representations may reveal parts of the original input.
Figures & tables
Figure 1: Overview of Rep2Text. The last-token representation obtained from the l -th layer of the target model M is projected into the embedding space of the decoding model M′ via the adapter. The projected embeddings, together with those of the system and the user prompts, are then fed into the decoding model to reconstruct the corresponding text sequence.
Figure 2: Examples of structural and entity preservation scores. S and E denote structural and entity similarity, respectively, rated on a 0–5 scale using an LLM-as-a-judge.
Figure 3: Adapter-only tuning versus full fine-tuning. Decoder fine-tuning improves token recovery but yields limited gains on semantic and LLM-judge metrics.
Target Model
Decoding Model
Layer
ROUGE-1
ROUGE-2
ROUGE-L
BERTScore
Structure
Entity
Topic
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(A) Fixed Llama-3.1-8B decoder, best layer per target: target invertibility
Gemma-7B
Llama-3.1-8B
L26
0.64 (0.24)
0.42 (0.30)
0.61 (0.25)
0.80 (0.14)
0.71 (0.22)
0.64 (0.27)
0.86 (0.22)
Mistral-7B-v0.1
Llama-3.1-8B
L15
0.55 (0.25)
0.35 (0.28)
0.53 (0.25)
0.81 (0.13)
0.70 (0.23)
0.75 (0.25)
0.92 (0.17)
Llama-3.1-8B
Llama-3.1-8B
L10
0.48 (0.23)
0.28 (0.24)
0.47 (0.22)
0.78 (0.11)
0.66 (0.22)
0.74 (0.23)
0.91 (0.14)
Llama-3.2-3B
Llama-3.1-8B
L9
0.46 (0.22)
0.25 (0.22)
0.44 (0.21)
0.76 (0.11)
0.64 (0.22)
0.72 (0.24)
0.89 (0.16)
Table 1: Performance comparison of representation inversion across target and decoding model combinations. Group (A) uses the best layer of each target model, which is the layer with the highest ROUGE-1 in the layer-wise sweep. Groups (B) and (C) fix layer 10, so that all decoders invert the same representations. Bold marks the best score in each column within each group.
Figure 5
Figure 6: Human evaluation sanity check for GPT-4.1-mini semantic scores.
Target model/
Data
Inversion Model
R1
R2
RL
Token F1
BLEU
BS
SS
ES
TS
decoding model
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
(0-1) ↑
Mistral-7B-v0.1/ Qwen-2.5-14B
Wiki
Rep2Text (Ours)
0.41
0.19
0.38
0.42
0.15
0.73
0.57
0.66
0.86
Vec2Text Base
0.38
0.17
0.35
0.31
0.15
0.71
0.53
0.53
0.80
* + Corrector (50 Steps)
0.38
0.17
0.35
0.31
0.15
0.71
0.53
0.55
0.79
Clinical
Rep2Text (Ours)
0.37
0.15
0.34
0.26
0.10
0.74
0.59
0.48
0.64
Vec2Text Base
0.14
0.02
0.13
0.13
0.04
0.53
0.17
0.16
0.21
Table 2: Inversion comparison between Vec2Text and our method with input sequences of no more than 32 tokens.
Method
Ground-truth Sequence
Inverted Sequence
Token F1
BLEU
In-distribution, Llama-3.1-8B target
Ours
Phil LaMarr Phillip LaMarr (born January 24, 1967) is an American actor, voice actor, comedian and writer.
Phil LaMarr Philip LaMarr (born January 24, 1967) is an American actor, voice actor, comedian and writer.
0.94
0.89
Vec2Text Base
David A. Smith David A. Smith (born December 16, 1964) is an American actor, voice actor, writer, and voice actor.
0.43
0.32
Vec2Text + Corrector (50 Steps)
David A. Smith David A. Smith (born August 24, 1964) is an American actor, voice actor, writer, and voice actor.
0.49
0.33
In-distribution, Mistral-7B-v0.1 target
Ours
List of submissions to the 37th Academy Awards for Best Foreign Language Film The following 18 films, all from different countries, were
List of films submitted to the 80th Academy Awards for Best Foreign Language Film The following 14 films, from 14 different countries,
0.77
0.46
Table 3: Inverted examples of the three methods on the same inputs. Bold marks the best Token F1 in each group.
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
Figure D.1: Training dynamics of both Vec2text and our methods.
Figure E.1: Performance comparison under different representation–text correspondence settings. The baseline uses correctly paired representations and original input sequences, Reverse uses word-level reversed input sequences as reconstruction targets, and Random randomly pairs representations with unrelated target sequences. The strong degradation under Random indicates that Rep2Text relies on representation-specific information rather than only decoder language priors.
Layer
ROUGE-1
ROUGE-2
ROUGE-L
BERTScore
Structure
Entity
Topic
Llama-3.1-8B (32 layers)
L5
0.46
0.26
0.44
0.76
0.62
0.69
0.88
L10
0.48
0.28
0.47
0.78
0.66
0.74
0.91
L15
0.48
0.28
0.45
0.77
0.62
0.75
0.91
L20
0.44
0.24
0.42
0.74
0.56
0.72
0.91
L25
0.42
0.21
0.39
0.72
0.54
0.71
0.89
Appendix
Table F.1: Layer-wise inversion performance of four target models with Llama-3.1-8B as the decoder. Bold rows mark the layer with the highest ROUGE-1, which Table 1 uses. The L10 rows of Mistral-7B-v0.1, Gemma-7B, and Llama-3.2-3B come from the main runs in Table 1 .
Tokens
Model
ROUGE-1
ROUGE-2
ROUGE-L
BERTScore
Structure
Entity
Topic
8
8B
0.62
0.42
0.59
0.83
0.78
0.77
0.93
16
8B
0.48
0.28
0.47
0.78
0.66
0.74
0.91
32
8B
0.40
0.18
0.36
0.72
0.57
0.68
0.86
64
8B
0.36
0.13
0.28
0.68
0.49
0.60
0.82
16
3B
0.46
0.26
0.45
0.76
0.64
0.69
0.88
128
3B
0.30
0.08
0.22
0.63
0.37
0.41
0.72
Appendix
Table G.1: Inversion performance across input lengths. 8B denotes Llama-3.1-8B and 3B denotes Llama-3.2-3B. Each model serves as both the target and the decoder.
Emb Model
Dec Model
Max Len
nvecs
#GPU
Mini batch
Grad Accum
Eff. Batch
LR
Warmup Ratio
Transfer experiments
Gemma-7B
Llama-3.1-8B
16
16
2
32
16
1024
1e−3
0.15
Llama-3.2-3B
Llama-3.1-8B
16
16
2
32
16
1024
1e−3
0.15
Mistral-7B
Llama-3.1-8B
16
16
2
32
16
1024
1e−3
0.15
Mistral-7B
Llama-3.2-3B
16
16
2
64
8
1024
1e−3
0.15
Mistral-7B
Qwen2.5-14B
16
16
2
32
16
1024
1e−3
0.30
Appendix
Table I.1: Experiment-specific hyperparameters for transfer, token-length, and layer-sweep experiments. All unspecified settings follow the shared default configuration described in Appendix I . The Qwen2.5-72B run uses a tensor-parallel size of 4, so its 8 GPUs form 2 data-parallel replicas.
Figure J.1: Inversion performance on different number of inverted embedding tokens.
Figure J.2: Inversion Performance on varying expansion factors.
Figure K.1: Dataset size ablation across eight metrics. Increasing the number of training examples consistently improves Rep2Text inversion performance: loss and perplexity decrease, while token-level and semantic reconstruction metrics increase. The gains remain positive from 320K to 640K examples, but become smaller, indicating diminishing returns at larger data scales.
Train Size
Epochs
Per-GPU BS
Grad. Accum.
GPUs
Eff. BS
LR
10K
15
32
2
1
64
3×10−4
50K
6
32
4
1
128
4×10−4
100K
5
32
4
2
256
5×10−4
320K
4
64
4
2
512
7×10−4
640K
3
64
8
2
1024
1×10−3
Appendix
Table K.1: Training configurations for the dataset size ablation.
Tokens (#)
Ground-truth Sequence
Inverted Sequence
R1
R2
RL
BS
SS
ES
TS
8
in the Centre-Val de Loire
in the Centre-Val de Loire
1
1
1
1
1
1
1
is the second era of the Hade
is the third era of the Hade
0.86
0.67
0.86
0.99
1
0.8
1
who enforce New Zealand’s regulatory building control
the enforcement of New Zealand statutory building control
0.63
0.29
0.63
0.77
0.4
0.6
1
Tyler, the Creator production discography\n\n
Metro Boomin production discography\n\n
0.44
0.29
0.44
0.77
0.8
1
1
biologist \n Stanley Fields (actor) (
:\n\n John Allen (actor) (born
0.25
0
0.25
0.78
0.6
0.8
0.8
16
species within the genus Conus, these snails are predatory and venomous.
species within the genus Conus, these snails are predatory and venomous.
1
1
1
1
1
1
1
Appendix
Table 18
64
Rush Hour 2\n\nRush Hour 2 is a 2001 American action comedy film directed by Brett Ratner and written by Jeff Nathanson, based on the characters created by Ross LaManna. A sequel to Rush Hour, it is the second installment in the Rush Hour series and stars Jackie Chan,
Rush Hour 2\n\nRush Hour 2 is a 2001 American buddy cop action comedy film directed by Brett Ratner and written by Jeff Nathanson. It is the sequel to the 1998 film Rush Hour and the second installment in the Rush Hour film series. The film stars Jackie Chan,
0.84
0.67
0.78
0.91
0.8
1
1
hull length of, a beam of, a height of, and a draught of. The submarine was powered by two Germaniawerft F46 four-stroke, six-cylinder supercharged diesel engines producing a total of for use while surfaced, two AEG GU 460/8\u201327 double-
. The U-boat had a displacement of when at the surface and while submerged. The U-boat had a total length of, a pressure hull length of, a beam of, a height of, and a draught of. The submarine was powered by two Germaniawerft F46 six-
0.61
0.48
0.49
0.8
0.4
1
1
the same rights of audience as members of the Bar of Northern Ireland.\n\nThe Advocate General was created as a separate office upon the devolution of policing and justice powers to the Northern Ireland Assembly on 12 April 2010.\n\nUnlike the Advocate General for Scotland, the position is not supported by a distinct government department.
the Scottish Parliament. The office was created in 1999, and is the equivalent of the Parliamentary Under-Secretary of State in the United Kingdom Government.\n\nThe office is not a ministerial post, and the holder is not a member of the Scottish Government. Responsibility for the office is held by the Scottish Secretary.
0.41
0.08
0.24
0.66
0.4
0.4
0.8
producer Thom Wilson and released in 1982 as catalog number VIRUS 10. Singer Jack Grisham credited himself as Jack Ladoga on the sleeve, following a tradition of using a different pseudonym on each release both to confuse audiences and to hide his true identity from the police. Drummer Todd Barnes credited himself
the band’s first album, and the first to feature the band’s new lineup. The band members used pseudonyms on the album, with the exception of guitarist and vocalist John "Baz" Bascaran, who used his real name because he was the only member of the band with a driver’s license. Drum
0.21
0.04
0.15
0.59
0.8
0.6
0.8
Linux kernel.\n\nXC3018\nIt is a variant that only supports analog reception and DVB-T digital reception.\n\nTechnical specification\nOutline Dimensions: 7 x 7 x 0.85\u00a0mm\nSupply Voltage (DC): 1.8V, 3.3V\nSystem setting time:
Large language model (LLM) interpretability studies how internal representations and computations produce outputs, and how they can be explained or controlled.
Recent work shows that distinct inputs produce distinct hidden representations in LLMs, so the input can in principle be recovered from them. Yet, no existing method can reliably do so from the model's output text or logits alone. We introduce Sparse One-hot Discrete Adam (SODA), a white-box search-based algorithm that reconstructs textual inputs from partial knowledge of the output. Given output logits, SODA recovers natural sequences of up to 17 tokens with zero false positives and achieves a 4x improvement in exact-match reconstruction over the strongest prior method. We further show that input length and vocabulary size matter more for inversion difficulty than parameter count, with SODA inverting models from 33M to 3B parameters. Finally, we demonstrate proof-of-concept security applications: SODA recovers 6 backdoor triggers from a poisoned LLM in under 1000 iterations, and 139 tokens of personally identifiable information from synthetic user-chatbot interactions. Our code is available at https://github.com/AdrSkapars/inversion_optimisation.
Adrians Skapars, Edoardo Manino, Youcheng Sun +1
Department of Computer Science, University of Manchester, Manchester, United Kingdom · Mohamed bin Zayed University of Artificial Intelligence, United Arab Emirates · Federal University of Amazonas, Manaus, Brazil
Unlearning in large language models (LLMs) is typically evaluated at the output level, where a model appears to suppress sensitive or undesirable content. In this work, we show that such evaluations can create an illusion of forgetting: even when output-level leakage is eliminated, sensitive information can remain encoded in the model's hidden representations. We first provide a theoretical analysis establishing a fundamental separation between output suppression and representational erasure. Specifically, we show that the decoder can be made arbitrarily insensitive to sensitive directions, driving output-level leakage to zero, while the hidden representations retain the underlying information. To empirically validate this phenomenon, we train generative probe decoders on hidden states across transformer layers, enabling layer-wise measurement of information leakage. Across three widely used benchmarks, TOFU, MUSE, and WMDP, and state-of-the-art unlearning methods, we find that substantial sensitive information remains recoverable from hidden representations, even when standard output-level metrics indicate successful unlearning. To address this gap, we propose Probe-Adversarial Representation Suppression (PARS), an unlearning objective that adversarially minimizes the extractable information from hidden representations. PARS directly targets representational leakage and provides significantly stronger guarantees of erasure under adversarial probing and relearning attacks, outperforming all evaluated baselines. Our results highlight a fundamental limitation of existing unlearning paradigms and suggest that true forgetting in LLMs requires controlling not only model outputs, but also the information encoded in hidden representations. Codes are available at https://github.com/OptimAI-Lab/HiddenStateUnlearning.
Hadi Reisizadeh, Jiajun Ruan, Sijia Liu +1
University of Minnesota · Michigan State University · IBM Research
This work studies the hidden-state inversion problem: recovering the original input token sequence of a decoder-only language model from its last-layer hidden states. Rather than treating inversion as a one-shot reconstruction, we study it as a continuous embedding-space optimisation in which a soft proxy is driven towards the leaked target without any hard-token projection during the search, and a token is committed only once, at the end of the inner loop. This design choice has two consequences which are the main focus of this paper. First, keeping the optimisation entirely in continuous space exposes a rich set of internal signals: rank trajectories of the ground-truth token, per-position loss curves, and a discrete loss measured at commit time. Second, the discrete loss allows assessing the correctness of recovery via cumulative discrete loss. We further analyse which tokens break the reconstructions and find a sharp categorical asymmetry: space-prefixed, high-frequency function words in dense regions of the embedding matrix dominate the failures, while content-bearing tokens are recovered almost perfectly. On 10-token C4 prompts the exact-match rate rises from 66.9% to 97.5% (mean similarity 0.994) as the candidate window is widened, confirming that most errors are recoverable near-misses rather than genuine ambiguities. A comparison with the released SIPIT reference situates these findings: per-step hard projection is faster, but the continuous formulation is what makes the optimisation observable and its failures detectable. The results show that last-layer hidden states of GPT-2 are as sensitive as the original text.
Mikołaj Słowikowski, Maciej Witold Majewski
AGH University of Krakow, Faculty of Physics and Applied Computer Science, al. Mickiewicza 30, 30-059 Krakow, Poland