Rep2Text Extracts Private Prompts From LLM Vectors

Researchers have introduced Rep2Text, an attack method that reconstructs private text inputs using only a single hidden vector extracted from a target model's final prompt token. The technique maps this isolated activation through a two-layer multilayer perceptron with a gated skip connection, converting it into pseudo-token embeddings. A frozen secondary large language model then reads these embeddings to reconstruct the original input autoregressively, requiring no iterative optimization, partial text hints, or search steps during inference.

In evaluations on held-out 16-token Wikipedia inputs, Rep2Text achieved ROUGE-1 scores from 0.45 to 0.52, recovering roughly half of the input tokens while retaining key entities, topics, and overall sentence structures. The evaluation spanned multiple target models, including Llama-3.1-8B, Llama-3.2-3B, Mistral-7B-v0.1, and Gemma-7B, alongside Llama and Qwen decoders scaling up to 32B parameters. The framework proved capable of cross-model decoding without requiring the attacker to match the target's model family. Additionally, Rep2Text decisively beat the Vec2Text method on out-of-distribution clinical notes, demonstrating a general representation-to-text mapping.

The study highlights that increasing decoder scale yields negligible gains, indicating that recovery limits are determined primarily by the target representation's internal encoding. For AI engineers and security teams, these findings expose significant risks in distributed architectures, split inference systems, and vector databases that cache or transmit intermediate activations. Because a single activation vector can leak core semantic meaning and structure, practitioners can no longer treat intermediate transformer states as secure abstractions.