{"type":"post","id":"rep2text-reconstructs-text-from-a-single-last-token-a808b9","slug":"rep2text-reconstructs-text-from-a-single-last-token-a808b9","title":"Rep2Text reconstructs text from a single last-token LLM representation using a trainable adapter plus a decoder LLM.","description":"Rep2Text is a research probe into how much source text remains recoverable from a model’s internal representation.","retrieval_nugget":"Rep2Text is a research probe into how much source text remains recoverable from a model’s internal representation.","published_at":"2026-10-21","updated_at":"2026-10-21","record_date":"2026-10-21","date_kind":"published_at","topics":["models","ai-security"],"source_urls":["https://arxiv.org/abs/2511.06571"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:rep2text-reconstructs-text-from-a-single-last-token-a808b9","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:991d3d78936e1faf84738fa913c9a802b8e2626295cb66e74337e15f017c9c94","reviewed_at":"2026-10-21T02:02:14.625Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"A model’s hidden representation may retain enough information to reconstruct parts of its input, making representation access relevant to privacy risk.","observed_facts":[{"text":"Rep2Text reconstructs text from a single hidden representation at the last token using a trainable adapter and a decoder LLM.","source_urls":["https://arxiv.org/abs/2511.06571"]},{"text":"For short texts of about 16 words, the paper reports recovering roughly half the original words while preserving overall meaning.","source_urls":["https://arxiv.org/abs/2511.06571"]},{"text":"The paper says exact wording is harder to recover for longer text, while main ideas can still be recovered.","source_urls":["https://arxiv.org/abs/2511.06571"]}],"mechanism":"Rep2Text trains an adapter to map a single hidden representation into a form that a decoder language model can use to generate reconstructed text.","why_now":"The paper gives a concrete reconstruction result, rather than treating hidden states only as opaque internal data.","implications":["Teams should not assume that a non-text representation is inherently safe to expose or retain; its sensitivity depends on access controls and the specific model and decoding conditions."],"evidence_boundary":"The supplied arXiv abstract reports the method and summarized findings, but does not specify an operational attack, deployment prevalence, or the risk across all models and data types.","watch_conditions":["Further evaluations should test reconstruction across model families, input lengths, and realistic access constraints before translating this result into a quantified product risk."],"related_records":[],"new_branch_reason":"No prior New Runtime record is supplied for this paper; this starts a distinct record on reconstruction from hidden representations."},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/rep2text-reconstructs-text-from-a-single-last-token-a808b9/","markdown":"https://newruntime.com/posts/rep2text-reconstructs-text-from-a-single-last-token-a808b9.md","json":"https://newruntime.com/posts/rep2text-reconstructs-text-from-a-single-last-token-a808b9.json"},"next_reads":[{"type":"topic","path":"/topics/models/","url":"https://newruntime.com/topics/models/","title":"Models","reason":"Explore the models topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/models.md","json_url":"https://newruntime.com/topics/models.json"},{"type":"topic","path":"/topics/ai-security/","url":"https://newruntime.com/topics/ai-security/","title":"Ai Security","reason":"Explore the ai-security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/ai-security.md","json_url":"https://newruntime.com/topics/ai-security.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}