Rep2Text: Decoding Full Text from a Single LLM Token Representation

Haiyan Zhao; Zirui He; Yiming Tang; Fan Yang; Ali Payani; Dianbo Liu; Mengnan Du

cs.CLNov 9, 2025

Rep2Text: Decoding Full Text from a Single LLM Token Representation

Authors: Haiyan Zhao, Zirui He, Yiming Tang, Fan Yang, Ali Payani, Dianbo Liu, Mengnan Du

Organizations: New Jersey Institute of Technology · National University of Singapore · Wake Forest University · Cisco Research ·

Abstract

Large language models represent text as hidden numerical patterns, but what information these representations actually contain remains a mystery. Can we recover the original text from just one of them? In this paper, we introduce Rep2Text, a method designed to answer this question by reconstructing text from a single hidden representation. We find that these representations preserve much more information than we might expect. For short texts of about 16 words, Rep2Text can recover roughly half of the original words while preserving their overall meaning. As the text gets longer, recovering the exact wording becomes harder, but the main ideas can still be recovered. These findings offer a new way to understand what language models store internally and highlight potential privacy risks, as hidden representations may reveal parts of the original input.

Figures & tables

Figure 1: Overview of Rep2Text. The last-token representation obtained from the $l$ -th layer of the target model $\mathcal{M}$ is projected into the embedding space of the decoding model $\mathcal{M}^{\prime}$ via the adapter. The projected embeddings, together with those of the system and the user prompts, are then fed into the decoding model to reconstruct the corresponding text sequence.

Figure 2: Examples of structural and entity preservation scores. S and E denote structural and entity similarity, respectively, rated on a 0–5 scale using an LLM-as-a-judge.

Figure 3: Adapter-only tuning versus full fine-tuning. Decoder fine-tuning improves token recovery but yields limited gains on semantic and LLM-judge metrics.

(A) Fixed Llama-3.1-8B decoder, best layer per target: target invertibility
Target Model	Decoding Model	Layer	ROUGE-1	ROUGE-2	ROUGE-L	BERTScore	Structure	Entity	Topic
			(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$
Gemma-7B	Llama-3.1-8B	L26	0.64 (0.24)	0.42 (0.30)	0.61 (0.25)	0.80 (0.14)	0.71 (0.22)	0.64 (0.27)	0.86 (0.22)
Mistral-7B-v0.1	Llama-3.1-8B	L15	0.55 (0.25)	0.35 (0.28)	0.53 (0.25)	0.81 (0.13)	0.70 (0.23)	0.75 (0.25)	0.92 (0.17)
Llama-3.1-8B	Llama-3.1-8B	L10	0.48 (0.23)	0.28 (0.24)	0.47 (0.22)	0.78 (0.11)	0.66 (0.22)	0.74 (0.23)	0.91 (0.14)
Llama-3.2-3B	Llama-3.1-8B	L9	0.46 (0.22)	0.25 (0.22)	0.44 (0.21)	0.76 (0.11)	0.64 (0.22)	0.72 (0.24)	0.89 (0.16)

Table 1: Performance comparison of representation inversion across target and decoding model combinations. Group (A) uses the best layer of each target model, which is the layer with the highest ROUGE-1 in the layer-wise sweep. Groups (B) and (C) fix layer 10, so that all decoders invert the same representations. Bold marks the best score in each column within each group.

Figure 6: Human evaluation sanity check for GPT-4.1-mini semantic scores.

Target model/	Data	Inversion Model	R1	R2	RL	Token F1	BLEU	BS	SS	ES	TS
decoding model			(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$	(0-1) $\uparrow$
Mistral-7B-v0.1/ Qwen-2.5-14B	Wiki	Rep2Text (Ours)	0.41	0.19	0.38	0.42	0.15	0.73	0.57	0.66	0.86
		Vec2Text Base	0.38	0.17	0.35	0.31	0.15	0.71	0.53	0.53	0.80
		* + Corrector (50 Steps)	0.38	0.17	0.35	0.31	0.15	0.71	0.53	0.55	0.79
	Clinical	Rep2Text (Ours)	0.37	0.15	0.34	0.26	0.10	0.74	0.59	0.48	0.64
		Vec2Text Base	0.14	0.02	0.13	0.13	0.04	0.53	0.17	0.16	0.21

Table 2: Inversion comparison between Vec2Text and our method with input sequences of no more than 32 tokens.

Method	Ground-truth Sequence	Inverted Sequence	Token F1	BLEU
In-distribution, Llama-3.1-8B target
Ours	Phil LaMarr Phillip LaMarr (born January 24, 1967) is an American actor, voice actor, comedian and writer.	Phil LaMarr Philip LaMarr (born January 24, 1967) is an American actor, voice actor, comedian and writer.	0.94	0.89
Vec2Text Base		David A. Smith David A. Smith (born December 16, 1964) is an American actor, voice actor, writer, and voice actor.	0.43	0.32
Vec2Text + Corrector (50 Steps)		David A. Smith David A. Smith (born August 24, 1964) is an American actor, voice actor, writer, and voice actor.	0.49	0.33
In-distribution, Mistral-7B-v0.1 target
Ours	List of submissions to the 37th Academy Awards for Best Foreign Language Film The following 18 films, all from different countries, were	List of films submitted to the 80th Academy Awards for Best Foreign Language Film The following 14 films, from 14 different countries,	0.77	0.46

Table 3: Inverted examples of the three methods on the same inputs. Bold marks the best Token F1 in each group.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 9 — Figure D.1: Training dynamics of both Vec2text and our methods.

Panel of Figure 10 — Figure E.1: Performance comparison under different representation–text correspondence settings. The baseline uses correctly paired representations and original input sequences, Reverse uses word-level reversed input sequences as reconstruction targets, and Random randomly pairs representations with unrelated target sequences. The strong degradation under Random indicates that Rep2Text relies on representation-specific information rather than only decoder language priors.

Llama-3.1-8B (32 layers)
Layer	ROUGE-1	ROUGE-2	ROUGE-L	BERTScore	Structure	Entity	Topic
L5	0.46	0.26	0.44	0.76	0.62	0.69	0.88
L10	0.48	0.28	0.47	0.78	0.66	0.74	0.91
L15	0.48	0.28	0.45	0.77	0.62	0.75	0.91
L20	0.44	0.24	0.42	0.74	0.56	0.72	0.91
L25	0.42	0.21	0.39	0.72	0.54	0.71	0.89

Appendix

Table F.1: Layer-wise inversion performance of four target models with Llama-3.1-8B as the decoder. Bold rows mark the layer with the highest ROUGE-1, which Table 1 uses. The L10 rows of Mistral-7B-v0.1, Gemma-7B, and Llama-3.2-3B come from the main runs in Table 1 .

Tokens	Model	ROUGE-1	ROUGE-2	ROUGE-L	BERTScore	Structure	Entity	Topic
8	8B	0.62	0.42	0.59	0.83	0.78	0.77	0.93
16	8B	0.48	0.28	0.47	0.78	0.66	0.74	0.91
32	8B	0.40	0.18	0.36	0.72	0.57	0.68	0.86
64	8B	0.36	0.13	0.28	0.68	0.49	0.60	0.82
16	3B	0.46	0.26	0.45	0.76	0.64	0.69	0.88
128	3B	0.30	0.08	0.22	0.63	0.37	0.41	0.72

Appendix

Table G.1: Inversion performance across input lengths. 8B denotes Llama-3.1-8B and 3B denotes Llama-3.2-3B. Each model serves as both the target and the decoder.

Emb Model	Dec Model	Max Len	$\mathbf{n}_{\textbf{vecs}}$	#GPU	Mini batch	Grad Accum	Eff. Batch	LR	Warmup Ratio
Transfer experiments
Gemma-7B	Llama-3.1-8B	16	16	2	32	16	1024	$1\mathrm{e}{-3}$	0.15
Llama-3.2-3B	Llama-3.1-8B	16	16	2	32	16	1024	$1\mathrm{e}{-3}$	0.15
Mistral-7B	Llama-3.1-8B	16	16	2	32	16	1024	$1\mathrm{e}{-3}$	0.15
Mistral-7B	Llama-3.2-3B	16	16	2	64	8	1024	$1\mathrm{e}{-3}$	0.15
Mistral-7B	Qwen2.5-14B	16	16	2	32	16	1024	$1\mathrm{e}{-3}$	0.30

Appendix

Table I.1: Experiment-specific hyperparameters for transfer, token-length, and layer-sweep experiments. All unspecified settings follow the shared default configuration described in Appendix I . The Qwen2.5-72B run uses a tensor-parallel size of 4, so its 8 GPUs form 2 data-parallel replicas.

Panel of Figure 14 — Figure J.1: Inversion performance on different number of inverted embedding tokens.

Panel of Figure 15 — Figure J.2: Inversion Performance on varying expansion factors.

Panel of Figure 16 — Figure K.1: Dataset size ablation across eight metrics. Increasing the number of training examples consistently improves Rep2Text inversion performance: loss and perplexity decrease, while token-level and semantic reconstruction metrics increase. The gains remain positive from 320K to 640K examples, but become smaller, indicating diminishing returns at larger data scales.

Train Size	Epochs	Per-GPU BS	Grad. Accum.	GPUs	Eff. BS	LR
10K	15	32	2	1	64	$3\times 10^{-4}$
50K	6	32	4	1	128	$4\times 10^{-4}$
100K	5	32	4	2	256	$5\times 10^{-4}$
320K	4	64	4	2	512	$7\times 10^{-4}$
640K	3	64	8	2	1024	$1\times 10^{-3}$

Appendix

Table K.1: Training configurations for the dataset size ablation.

Tokens (#)	Ground-truth Sequence	Inverted Sequence	R1	R2	RL	BS	SS	ES	TS
8	in the Centre-Val de Loire	in the Centre-Val de Loire	1	1	1	1	1	1	1
	is the second era of the Hade	is the third era of the Hade	0.86	0.67	0.86	0.99	1	0.8	1
	who enforce New Zealand’s regulatory building control	the enforcement of New Zealand statutory building control	0.63	0.29	0.63	0.77	0.4	0.6	1
	Tyler, the Creator production discography\n\n	Metro Boomin production discography\n\n	0.44	0.29	0.44	0.77	0.8	1	1
	biologist \n Stanley Fields (actor) (	:\n\n John Allen (actor) (born	0.25	0	0.25	0.78	0.6	0.8	0.8
16	species within the genus Conus, these snails are predatory and venomous.	species within the genus Conus, these snails are predatory and venomous.	1	1	1	1	1	1	1

Appendix

Table 18

64	Rush Hour 2\n\nRush Hour 2 is a 2001 American action comedy film directed by Brett Ratner and written by Jeff Nathanson, based on the characters created by Ross LaManna. A sequel to Rush Hour, it is the second installment in the Rush Hour series and stars Jackie Chan,	Rush Hour 2\n\nRush Hour 2 is a 2001 American buddy cop action comedy film directed by Brett Ratner and written by Jeff Nathanson. It is the sequel to the 1998 film Rush Hour and the second installment in the Rush Hour film series. The film stars Jackie Chan,	0.84	0.67	0.78	0.91	0.8	1	1
	hull length of, a beam of, a height of, and a draught of. The submarine was powered by two Germaniawerft F46 four-stroke, six-cylinder supercharged diesel engines producing a total of for use while surfaced, two AEG GU 460/8\u201327 double-	. The U-boat had a displacement of when at the surface and while submerged. The U-boat had a total length of, a pressure hull length of, a beam of, a height of, and a draught of. The submarine was powered by two Germaniawerft F46 six-	0.61	0.48	0.49	0.8	0.4	1	1
	the same rights of audience as members of the Bar of Northern Ireland.\n\nThe Advocate General was created as a separate office upon the devolution of policing and justice powers to the Northern Ireland Assembly on 12 April 2010.\n\nUnlike the Advocate General for Scotland, the position is not supported by a distinct government department.	the Scottish Parliament. The office was created in 1999, and is the equivalent of the Parliamentary Under-Secretary of State in the United Kingdom Government.\n\nThe office is not a ministerial post, and the holder is not a member of the Scottish Government. Responsibility for the office is held by the Scottish Secretary.	0.41	0.08	0.24	0.66	0.4	0.4	0.8
	producer Thom Wilson and released in 1982 as catalog number VIRUS 10. Singer Jack Grisham credited himself as Jack Ladoga on the sleeve, following a tradition of using a different pseudonym on each release both to confuse audiences and to hide his true identity from the police. Drummer Todd Barnes credited himself	the band’s first album, and the first to feature the band’s new lineup. The band members used pseudonyms on the album, with the exception of guitarist and vocalist John "Baz" Bascaran, who used his real name because he was the only member of the band with a driver’s license. Drum	0.21	0.04	0.15	0.59	0.8	0.6	0.8
	Linux kernel.\n\nXC3018\nIt is a variant that only supports analog reception and DVB-T digital reception.\n\nTechnical specification\nOutline Dimensions: 7 x 7 x 0.85\u00a0mm\nSupply Voltage (DC): 1.8V, 3.3V\nSystem setting time:	2010.\n\nSpecifications\nFrequency: 2.4\u00a0GHz\nData rate: 1, 2, 5.5, 11\u00a0Mbps\nModulation: DSSS\nPower consumption: 0.1\u00a0W\nOperating temperature: 0\u00a0\u00b0C to 70\u00a0\u00b0C\n	0.09	0	0.09	0.62	0	0	0.8

Appendix

Table 19

LLM Interpretability

Large language model (LLM) interpretability studies how internal representations and computations produce outputs, and how they can be explained or controlled.

See all 778 papers

GPT, But Backwards: Exactly Inverting Language Model Outputs
Jul 2, 2025Adrians Skapars, Edoardo Manino, Youcheng Sun +1Privacy Leakage in Language Models LLM Security
Department of Computer Science, University of Manchester, Manchester, United Kingdom · Mohamed bin Zayed University of Artificial Intelligence, United Arab Emirates · Federal University of Amazonas, Manaus, Brazil
Do LLMs Really Forget? Hidden-State Leakage in Model Unlearning and How to Fix it
Sep 29, 2026Hadi Reisizadeh, Jiajun Ruan, Sijia Liu +1Machine Unlearning LLM Unlearning
University of Minnesota · Michigan State University · IBM Research
Recovering Input Text from Hidden States: Study of Gradient-Based Inversion of Decoder-Only Language Models
Jul 1, 2026Mikołaj Słowikowski, Maciej Witold MajewskiDecoder-Only Language Models Privacy Leakage in Language Models
AGH University of Krakow, Faculty of Physics and Applied Computer Science, al. Mickiewicza 30, 30-059 Krakow, Poland

Jul 2, 2025J/K move · Enter open · S save

GPT, But Backwards: Exactly Inverting Language Model Outputs

Adrians Skapars, Edoardo Manino, Youcheng Sun, Lucas C. Cordeiro

Department of Computer Science, University of Manchester, Manchester, United Kingdom · Mohamed bin Zayed University of Artificial Intelligence, United Arab Emirates · Federal University of Amazonas, Manaus, Brazil

Privacy Leakage in Language Models LLM Security

Open paper AskPDF arXiv

Recent work shows that distinct inputs produce distinct hidden representations in LLMs, so the input can in principle be recovered from them. Yet, no existing method can reliably do so from the model's output text or logits alone. We introduce Sparse One-hot Discrete Adam (SODA), a white-box search-based algorithm that reconstructs textual inputs from partial knowledge of the output. Given output logits, SODA recovers natural sequences of up to 17 tokens with zero false positives and achieves a 4x improvement in exact-match reconstruction over the strongest prior method. We further show that input length and vocabulary size matter more for inversion difficulty than parameter count, with SODA inverting models from 33M to 3B parameters. Finally, we demonstrate proof-of-concept security applications: SODA recovers 6 backdoor triggers from a poisoned LLM in under 1000 iterations, and 139 tokens of personally identifiable information from synthetic user-chatbot interactions. Our code is available at https://github.com/AdrSkapars/inversion_optimisation.

Abstract

LLM Interpretability

Explore similar work

GPT, But Backwards: Exactly Inverting Language Model Outputs

Do LLMs Really Forget? Hidden-State Leakage in Model Unlearning and How to Fix it

Recovering Input Text from Hidden States: Study of Gradient-Based Inversion of Decoder-Only Language Models