PROVE: Training-Free Prompt Recovery using Verifiable Evidence

Rupayan Mallick; Mahsa Khoshnoodi; Sarah Adel Bargal

cs.CVAug 13, 2026

PROVE: Training-Free Prompt Recovery using Verifiable Evidence

Authors: Rupayan Mallick, Mahsa Khoshnoodi, Sarah Adel Bargal

Organizations: Department of Computer Science, Georgetown University

Abstract

Modern text-to-image models can generate highly realistic images from natural-language prompts, while recent advances in prompt inversion have made it increasingly feasible to recover those prompts from generated outputs, raising new concerns for copyright protection and content ownership. As prompt marketplaces emerge, recovered prompts can enable both the unauthorized reproduction and redistribution of copyrighted creative works, and the exposure of the prompts that encode an artist's creative recipe in AI-generated content. Existing prompt inversion methods rely on gradient-based optimization, autoregressive captioning, or reinforcement learning. However, optimization-based methods often produce unreadable prompts, captioning methods hallucinate unverified details, and RL-based approaches frequently overfit to specific generators while introducing evaluation circularity. We introduce PROVE (Prompt Recovery with Verified Evidence), a training-free, black-box prompt inversion attack that reconstructs prompts by composing verifiable scene descriptions rather than optimizing token sequences, targeting both original copyrighted works and AI-generated content. The resulting prompts are fully auditable, with every recovered claim grounded in explicit image evidence, and are formalized through a precision-constrained recall maximization objective. Across MS-COCO, Flickr30K, and Lexica, using state-of-the-art text-to-image generators, PROVE consistently outperforms optimization, captioning, and RL-based baselines on image similarity (DINO, LPIPS) and text-image alignment (CLIP), without any training, generator access, or fine-tuning, demonstrating a stronger and more practical prompt inversion attack.

Figures & tables

Panel of Figure 1 — Figure 1: PROVE regenerations of a real MS-COCO image and an AI-generated image from a Lexica prompt.

Figure 2: Overview of the proposed framework. Given an image $I_{0}$ , a frozen VLM $g_{\phi}$ and a text-based object detector localize regions $I_{1},\dots,I_{n}$ . Per-region claims from the VLM are filtered by an evidence-gated Verifier , while counts and spatial relations are derived deterministically in the geometric extraction block (gray). The Composer serializes the surviving claims into the final prompt $P(I)$ , which the generator renders as $G(P(I))$ .

Panel of Figure 3 — Figure 3: Qualitative comparison across MS-COCO, Flickr30K, and Lexica. For each example the original image is shown alongside reconstructions from PROVE (ours) and the competing methods.

		FLUX.1 dev			Stable Diffusion 3.5 Large
Dataset	Method	DINO $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$	DINO $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$
MS COCO	BLIP	0.426	0.686	0.703	0.480	0.692	0.727
	CLIP-IG	0.520	0.679	0.716	0.505	0.710	0.727
	VLM-as-expert	0.578	0.660	0.754	0.597	0.679	0.763
	PH2P	0.033	0.744	0.410	0.024	0.761	0.427
	STEPS	0.359	0.691	0.677	0.419	0.706	0.736

Table 1: Image similarity across datasets, averaged over two seeds. Higher is better for DINO (

\uparrow

) and CLIP (

\uparrow

); lower is better for LPIPS (

\downarrow

). Bold marks the best result per column within each dataset. Our row is highlighted.

Dataset	Method	DINO $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$
MS COCO	Clean	0.660	0.647	0.790
	Noise	0.632	0.658	0.779
	Puzzle	0.635	0.656	0.783
	Watermark	0.566	0.666	0.750
	Adv. CLIP	0.654	0.655	0.787
Flickr30K	Clean	0.610	0.635	0.763

Table 2: Image similarity across datasets for FLUX.1 dev , averaged over two seeds. Results are reported against each defense to show the robustness of the attack. Higher is better for DINO (

\uparrow

), CLIP (

\uparrow

), and SBERT (

\uparrow

); lower is better for LPIPS (

\downarrow

Dataset	Method	DINO $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$
MS COCO	Clean	0.615	0.664	0.775
	Noise	0.603	0.664	0.765
	Puzzle	0.610	0.667	0.771
	Watermark	0.540	0.680	0.740
	Adv. CLIP	0.613	0.672	0.771
Flickr30K	Clean	0.593	0.664	0.765

Table 3: Image similarity across datasets for SD 3.5 Large , averaged over two seeds. Results are reported against each defense to show the robustness of the attack. Higher is better for DINO (

\uparrow

), CLIP (

\uparrow

), and SBERT (

\uparrow

); lower is better for LPIPS (

\downarrow

	FLUX.1 dev	SD 3.5 Large
Method	SBERT $\uparrow$	SBERT $\uparrow$
BLIP	0.288	0.306
CLIP-IG	0.328	0.351
VLM-as-expert	0.466	0.474
PH2P	0.154	0.154
STEPS	0.372	0.392

Table 4: Textual alignment (SBERT

\uparrow

) on the Lexica dataset, averaged over two seeds. Bold marks the best result per column.

	FLUX.1 dev	SD 3.5 Large
Method	SBERT $\uparrow$	SBERT $\uparrow$
Clean	0.470	0.493
Noise	0.447	0.457
Puzzle	0.453	0.482
Watermark	0.446	0.462
Adv. CLIP	0.454	0.480

Table 5: Textual alignment (SBERT

\uparrow

) on the Lexica dataset, averaged over two seeds. This is computed against the various defense mechanisms used to test the robustness of the attack.

		FLUX.1 dev			Stable Diffusion 3.5 Large
Dataset	Method	DINO $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$	DINO $\uparrow$	LPIPS $\downarrow$	CLIP $\uparrow$
Lexica	PromptMiner	0.593	0.610	0.850	0.615	0.618	0.817
Lexica	PROVE	0.645	0.590	0.839	0.641	0.604	0.827

Table 6: Image-similarity metrics across datasets, averaged over two seeds. Higher is better for DINO (

\uparrow

) and CLIP (

\uparrow

); lower is better for LPIPS (

\downarrow

). Bold marks the best result per column within each dataset. In this cross-test, the target image and the image re-rendered from the recovered prompt are produced by different generators.

Panel of Figure 4 — Figure 4: Additional qualitative comparisons on MS-COCO, Flickr30K, and Lexica.

Panel of Figure 5 — Figure 5: Qualitative comparison on Flickr30K. We compare PROVE against its three closest baselines, showing both the generated image and the recovered prompt. On these natural, caption-style scenes, PROVE recovers finer-grained detailed prompts than the baselines, yielding reconstructions closer to the target.

Panel of Figure 6 — Figure 6: Qualitative comparison on MS-COCO. We compare PROVE against its three closest baselines, showing both the generated image and the recovered prompt. PROVE recovers finer-grained, detailed prompts, which in turn yield reconstructions closer to the target.

Panel of Figure 7 — Figure 7: Qualitative comparison on Lexica. We compare PROVE against its three closest baselines, showing both the generated image and the recovered prompt. On these stylized images, PROVE describes the visual style in grounded terms without attributing it to a named artist, unlike the baselines, which recover artist and platform tags.

Apr 3, 2026

PromptEvolver: Prompt Inversion through Evolutionary Optimization in Natural-Language Space

Text-to-image generation has progressed rapidly, but faithfully generating complex scenes requires extensive trial-and-error to find the exact prompt. In the prompt inversion task, the goal is to recover a textual prompt that can faithfully reconstruct a given target image. Currently, existing methods frequently yield suboptimal reconstructions and produce unnatural, hard-to-interpret prompts that hinder transparency and controllability. In this work, we present PromptEvolver, a prompt inversion approach that generates natural-language prompts while achieving high-fidelity reconstructions of the target image. Our method uses a genetic algorithm to optimize the prompt, leveraging a strong vision-language model to guide the evolution process. Importantly, it works on black-box generation models by requiring only image outputs. Finally, we evaluate PromptEvolver across multiple prompt inversion benchmarks and show that it consistently outperforms competing methods.

Asaf Buchnick, Aviv Shamsian, Aviv Navon +1

Bar-Ilan University, Ramat Gan, Israel

Prompt Optimization for T2I Generation

Ask PDF

Jul 29, 2026

Dual Inversion for Text-to-Image Diffusion Models: From Both Prompt and Noise Perspectives

Prompt inversion, as a typical reverse engineering technique, enables text-to-image (T2I) diffusion models to generate the desired target images without extensive prompt engineering. However, existing prompt inversion methods suffer from significant limitations: (1) gradient-based methods are unstable and uninterpretable, often resulting in generated images with severe artifacts; (2) gradient-free methods yield human-readable prompts but still fail to preserve visual fidelity due to the lack of fine-grained detail alignment. We contend that the limitations stem from treating prompt inversion as a sufficient condition for reverse engineering, ignoring the critical role of the latent noise that encodes structural information. Consequently, we propose Dualin (Dual inversion), a two-stage method that jointly recovers both the semantic prompt and latent noise of the target image. In the first stage, we integrate vision-language model, CLIP and large language model to invert a faithful, human-interpretable hard prompt. In the second stage, unconditional DDIM inversion reconstructs the exact latent noise of the target image, guaranteeing the consistency at the structural information level. Theoretically, we prove that the inverted noise enables flexible image editing without re-optimization. Extensive experiments on diverse datasets demonstrate that Dualin simultaneously generates high-quality inverted prompts and achieves state-of-the-art image fidelity. Additionally, Dualin can establish a robust foundation for the precise and controllable image editing.

Xiaolong Liu, Junjian Li, Yuan Xiao +4

Geely Hangzhou, China · City University of Macau Macau, China

Diffusion Model Inversion Diffusion-Based Inverse Problems Diffusion-Based Image Editing Controllable Image Generation T2I Diffusion Models

Ask PDF

Jul 1, 2026

Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation

Recent advances in Image-to-Video generation allow a single image to be animated into a convincing video under text guidance, raising serious copyright and privacy risks. We propose Anti-Prompt, an image protection approach that injects imperceptible perturbations into an image, inducing visible inconsistencies and structural failures in text-guided I2V generation. Our method is motivated by a simple empirical observation. When text guidance is removed from modern I2V models, generation quality degrades markedly, not only in motion realism but also in subject preservation, structural coherence, and temporal consistency. Building on this insight, Anti-Prompt exploits the model reliance on textual guidance by attenuating text-conditioned interactions during denoising while strengthening visual-only pathways. To further systematically evaluate protection effectiveness, we introduce a Video-LLM-assisted evaluation protocol that provides interpretable, frame-grounded analyses of generation artifacts and inconsistencies. Experiments on two representative I2V architectures demonstrate that our method achieves strong protection performance while improving efficiency and cross-model transferability.

Yeonghwan Song, Chanhui Lee, Jinsoo Park +1

GIST · POSTECH

Image-to-Video Generation Adversarial Examples

Ask PDF

Abstract

Explore similar work

PromptEvolver: Prompt Inversion through Evolutionary Optimization in Natural-Language Space

Dual Inversion for Text-to-Image Diffusion Models: From Both Prompt and Noise Perspectives

Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation