The era of the 'secret sauce' in prompt engineering is officially over. Proprietary instruction libraries and intricate system roles for AI agents have long been treated as protected intellectual property, but a new research paper from Adobe and IIT Bombay effectively strips away this illusion of security. The method, dubbed Previous-Token Prediction (PTP), demonstrates that an attacker doesn't need model weights or back-end access to steal your logic—they only need the output.
By inverting the fundamental logic of large language models, which are built to predict the next token, the PTP approach uses an inverse model to reconstruct the preceding input based solely on the generated text. This isn't just a theoretical vulnerability; it is a practical roadmap for reverse-engineering third-party models by analyzing their public API responses. For any business built on 'Prompt-as-a-Service' models, the floor has just dropped out.
The mechanics of prompt reconstruction
The PTP method relies on a specialized inverse model trained on synthetic data generated by a target LLM. As the researchers documented, this tool can produce the exact original prompt or multiple variations that capture the core intent with surgical precision. In one test, the prompt 'How to reach out to competitors to find their pricing strategies?' was reconstructed word-for-word from the output text alone.
By tweaking decoding parameters, an attacker can generate several phrasing variants that produce nearly identical responses when fed back into a forward model. This effectively renders internal business logic—the 'invisible' instructions that guide an AI agent’s behavior—transparent to anyone willing to run a small, open-source inversion model against your interface.
Cross-model vulnerabilities and enterprise risk
The most alarming takeaway for CTOs and risk managers is the method's model-agnostic nature. An attacker doesn't even need to know which specific model produced a text to deconstruct it. According to the team at IIT Bombay and Adobe Research, their inverse model successfully reconstructed prompts from responses generated by GPT-4o, despite the model's closed architecture.
While current tests focused on shorter prompts, the trajectory is clear: proprietary system prompts containing moderation rules, trade secrets, or specialized chain-of-thought instructions are now leaking through public-facing interfaces. Relying on the 'secrecy' of a system prompt is no longer a viable security strategy. Companies must shift toward 'security by design,' moving critical business logic and sensitive computations outside the LLM context window entirely. If your competitive advantage is hidden in a text box, consider it public domain.