[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-149157-105":59,"doc-detail-149157-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","dory-deliberative-prompt-recovery-for-llm-abstract-and-introduction","DORY - Deliberative Prompt Recovery for LLM - Abstract and Introduction","","Prompt recovery in large language models (LLMs) is essential for understanding model behavior and addressing privacy and copyright concerns. Inference-only APIs restrict access to recovery-relevant information, making existing prompt recovery methods less effective. By extracting prompt-related signals from limited outputs, DORY finds a strong negative relationship between output-probability uncertainty and prompt recovery success. It reconstructs drafts, refines them using uncertainty-guided hints, and filters noise, outperforming baselines by about 10.82% across diverse LLMs and benchmarks.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/dory-deliberative-prompt-recovery-for-llm-abstract-and-introduction/149157/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/dory-deliberative-prompt-recovery-for-llm-abstract-and-introduction/149157.png","ImageObject",300,407,{"name":92,"@type":93},"Connor ","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-28","2026-08-27",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",12,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"Why is prompt recovery difficult for inference-only LLM APIs?","Question",{"text":113,"@type":114},"Inference-only APIs typically provide only output text and associated output probabilities, which severely limits the information available for recovering the original prompt.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"What is the key insight behind DORY?",{"text":118,"@type":114},"DORY leverages uncertainty derived from output probabilities, establishing a strong negative correlation between uncertainty and prompt recovery performance across prompt benchmarks.",{"name":120,"@type":111,"acceptedAnswer":121},"How does DORY recover prompts from limited outputs?",{"text":122,"@type":114},"DORY reconstructs a draft from the output text, refines it using uncertainty-guided hints (shared tokens), and reduces noise by filtering non-shared tokens.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},149157,1787794851,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":56,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":144,"preview_page_count":4},687207022233,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","DORY: Deliberative Prompt Recovery for LLM  \nLirong Gao, Ru Peng, Yiming Zhang, Junbo Zhao*  \nZhejiang University, Zhejiang, China {gaolirong, rupeng, yimingz, [j.zhao}@zju.edu.cn](j.zhao}@zju.edu.cn)  \nAbstract  \nPrompt recovery in large language models (LLMs) is crucial for understanding how LLMs work and addressing concerns regarding privacy, copyright, etc. The trend towards inference-only APIs complicates this task by restricting access to essential outputs for recovery. To tackle this challenge, we extract promptrelated information from limited outputs and identify a strong(negative) correlation between output probability-based uncertainty and the success of prompt recovery. This finding led to the development of Deliberative PrOmpt RecoverY (DORY), our novel approach that leverages uncertainty to recover prompts accurately. DORY involves reconstructing drafts from outputs, refining these with hints, and filtering out noise based on uncertainty. Our evaluation across diverse LLMs and prompt benchmarks shows that DORY outperforms existing baselines, improving performance by approximately 10.82% and establishing a new state-of-the-art record in prompt recovery tasks.  \nSignificantly, DORY operates using a single LLM without any external resources or model, offering a cost-effective, user-friendly prompt recovery solution.  \n1 Introduction  \nLarge language models (LLMs) are widely applied for their groundbreaking performance across various tasks, typically by parsing user-inputted prompts to generate output text. Considering scenarios where the input prompt is agnostic, it is particularly critical to recover the prompt from the output—dubbed as “Prompt Recovery”. Prompt recovery interests researchers for its ability to reveal system prompts of closed-source LLMs (Morris et al., 2023b) and detect security vulnerabilities, such as user’s query theft (Zheng, 2023), highquality prompt leaks (Sha and Zhang, 2024 ; Yang et al., 2024), and defenses bypassing to generate  \n* Corresponding author.  \n\n| Prompt |\n| --- |\n| When did the American Revolution begin? |\n\n\n| Recovered Prompt |\n| --- |\n| When did the American Revolution begin? |\n\nFigure 1: Diagram of the prompt recovery task: recovering the prompt from the LLM’s limited output—output text and output probabilities.  \nillegal outputs (Wei et al., 2023) . Moreover, it can aid experts in pinpointing the origins of LLMgenerated content, thereby clarifying responsibility for harmful (Chao et al., 2023 ; Wu et al., 2023), copyright-disputed (Karamolegkou et al., 2023), or gender-biased (Kotek et al., 2023) content (detailed examples can be found in Appendix A) . Therefore, Prompt Recovery is a vital part of the application and research of LLMs.  \nAlong this line, an exploratory question naturally arises: can we recover the prompts from the LLMs’ outputs? Recent works of LLMs compressing and recovering data on their own demonstrate that LLMs possess the capability to recover inputs (Delétang et al., 2023 ; Wu et al., 2023) . However, as the parameter scale of LLMs grows, there has been a trend towards offering inference-only APIs to users, known as API-based LLMs, such as ChatGPT (John Schulman et al., 2022), GPT- 4 (Achiam et al., 2023), and Gemini (Team et al., 2023) . While this trend does indeed facilitate user access to LLMs, it also renders the models more  \n10614  \nFindings of the Association for Computational Linguistics: ACL 2024 , pages 10614–10632 August 11-16, 2024 ©2024 Association for Computational Linguistics  \nopaque, meaning that the information available for prompt recovery is severely limited. As Figure 1 illustrates, most (if not all) API-based LLMs provide only the output text and associated output probabilities. In such cases with limited outputs, the prevailing approach for prompt recovery involves NLP experts manually crafting jailbreak prompts to induce LLMs to recover inputs based on their output (Wu et al., 2023 ; Chao et al., 2023 ; Denget al., 2023 ; Liu ","cbCailUXkIPynS8y","https://ap.wps.com/l/cbCailUXkIPynS8y","pdf",2105616,"English","# Abstract\n# 1 Introduction","[{\"question\":\"Why is prompt recovery difficult for inference-only LLM APIs?\",\"answer\":\"Inference-only APIs typically provide only output text and associated output probabilities, which severely limits the information available for recovering the original prompt.\"},{\"question\":\"What is the key insight behind DORY?\",\"answer\":\"DORY leverages uncertainty derived from output probabilities, establishing a strong negative correlation between uncertainty and prompt recovery performance across prompt benchmarks.\"},{\"question\":\"How does DORY recover prompts from limited outputs?\",\"answer\":\"DORY reconstructs a draft from the output text, refines it using uncertainty-guided hints (shared tokens), and reduces noise by filtering non-shared tokens.\"}]","DORY - Deliberative Prompt Recovery for LLM - Abstract and Introduction | PDF",48]