Another AI Research Paper Just Changed How We Should Think About Prompts
What if the words you type into an AI model leave a mathematical fingerprint from which the original words can be reconstructed?
That is the provocative implication of research presented at ICLR 2026 entitled Language Models are Injective and Hence Invertible.
And it gives us another reason to think carefully about what we put into AI systems.
In Plain English: What Did They Discover?
When you type a prompt into a language model, the computer does not simply hold onto your sentence as ordinary words.
As your prompt travels through the transformer, it is converted into numerical representations known as hidden states or activations.
You might imagine that transformation scrambles the original information beyond recognition.
The researchers found something much more interesting.
They show that the mapping from discrete input sequences to these continuous representations is injective.
In plain English:
different prompts produce distinct internal representations.
The researchers then tested billions of potential collisions across six language models and reported none.
But they went one step further.
Meet SIPIT
The researchers developed an algorithm called SIPIT — Sequential Inverse Prompt via ITerative updates.
Given the relevant hidden activations, SIPIT can work backwards through the representation and reconstruct the input tokens.
In their experiments, the researchers demonstrated exact reconstruction.
That changes an important assumption we might make about AI.
Transforming text into an internal numerical representation does not necessarily mean the information contained in that text has disappeared.
The representation can still preserve the information required to recover the original input.
Put Your Cybersecurity Hat On
This is where the research becomes particularly interesting.
Imagine an organisation using language models to process:
→ Confidential business strategies
→ Proprietary source code
→ Unpublished research
→ Legal documents
→ Sensitive customer information
→ Product designs and intellectual property
The immediate lesson is not that hackers can suddenly open ChatGPT and retrieve everyone’s prompts.
They cannot.
Reconstruction requires access to the relevant internal model representations and technical conditions that ordinary users of hosted AI services do not have.
But from a cybersecurity perspective, the research raises an important question:
What happens if those internal representations themselves become exposed?
A compromised AI system, poorly secured model deployment or leaked activation data could potentially create a different class of information-security risk.
Data that looks like an obscure collection of numbers may not necessarily be meaningless.
It could contain enough information to reconstruct what went into the model.
The New Golden Rule?
The early internet gave us a simple lesson:
“Don’t put anything online you wouldn’t want the world to see.”
Generative AI requires a more sophisticated version.
We should not assume every prompt is public.
But neither should organisations assume that transforming sensitive information inside an AI model automatically makes that information unrecoverable.
That distinction matters.
The question businesses increasingly need to ask is not simply:
“Does the AI remember my prompt?”
It is:
“Where does my information travel, what representations of it are created, who can access them, how long do they exist and what happens if those systems are compromised?”
The Bigger Picture
AI cybersecurity cannot stop at protecting usernames, passwords and databases.
As AI becomes embedded inside organisations, security teams may increasingly need to think about prompts, embeddings, activations, model states and other intermediate representations as potentially sensitive information too.
The mathematics is complicated.
The lesson for the rest of us is surprisingly simple:
Just because you can no longer read the data does not mean the information has disappeared.
And in the AI age, that may become one of the most important cybersecurity lessons of all.