---
type: "post"
id: "rep2text-reconstructs-text-from-a-single-last-token-a808b9"
slug: "rep2text-reconstructs-text-from-a-single-last-token-a808b9"
title: "Rep2Text reconstructs text from a single last-token LLM representation using a trainable adapter plus a decoder LLM."
description: "Rep2Text is a research probe into how much source text remains recoverable from a model’s internal representation."
retrieval_nugget: "Rep2Text is a research probe into how much source text remains recoverable from a model’s internal representation."
published_at: "2026-10-21"
updated_at: "2026-10-21"
record_date: "2026-10-21"
date_kind: "published_at"
topics: ["models","ai-security"]
source_urls: ["https://arxiv.org/abs/2511.06571"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:rep2text-reconstructs-text-from-a-single-last-token-a808b9"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:991d3d78936e1faf84738fa913c9a802b8e2626295cb66e74337e15f017c9c94","reviewed_at":"2026-10-21T02:02:14.625Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"A model’s hidden representation may retain enough information to reconstruct parts of its input, making representation access relevant to privacy risk.","observed_facts":[{"text":"Rep2Text reconstructs text from a single hidden representation at the last token using a trainable adapter and a decoder LLM.","source_urls":["https://arxiv.org/abs/2511.06571"]},{"text":"For short texts of about 16 words, the paper reports recovering roughly half the original words while preserving overall meaning.","source_urls":["https://arxiv.org/abs/2511.06571"]},{"text":"The paper says exact wording is harder to recover for longer text, while main ideas can still be recovered.","source_urls":["https://arxiv.org/abs/2511.06571"]}],"mechanism":"Rep2Text trains an adapter to map a single hidden representation into a form that a decoder language model can use to generate reconstructed text.","why_now":"The paper gives a concrete reconstruction result, rather than treating hidden states only as opaque internal data.","implications":["Teams should not assume that a non-text representation is inherently safe to expose or retain; its sensitivity depends on access controls and the specific model and decoding conditions."],"evidence_boundary":"The supplied arXiv abstract reports the method and summarized findings, but does not specify an operational attack, deployment prevalence, or the risk across all models and data types.","watch_conditions":["Further evaluations should test reconstruction across model families, input lengths, and realistic access constraints before translating this result into a quantified product risk."],"related_records":[],"new_branch_reason":"No prior New Runtime record is supplied for this paper; this starts a distinct record on reconstruction from hidden representations."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/rep2text-reconstructs-text-from-a-single-last-token-a808b9/","markdown":"https://newruntime.com/posts/rep2text-reconstructs-text-from-a-single-last-token-a808b9.md","json":"https://newruntime.com/posts/rep2text-reconstructs-text-from-a-single-last-token-a808b9.json"}
---

# Rep2Text reconstructs text from a single last-token LLM representation using a trainable adapter plus a decoder LLM.

## Retrieval answer

Rep2Text is a research probe into how much source text remains recoverable from a model’s internal representation.

Rep2Text is a research probe into how much source text remains recoverable from a model’s internal representation. The paper describes a method that reconstructs text from a single hidden representation at the last token, using a trainable adapter and a decoder LLM. For short texts of about 16 words, the authors report recovering roughly half the original words while preserving overall meaning. These results are the observed basis for the analysis, not a claim about every model or representation.

Thesis: A model’s hidden representation may retain enough information to reconstruct parts of its input, making representation access relevant to privacy risk. Mechanism: Rep2Text trains an adapter to map a single hidden representation into a form that a decoder language model can use to generate reconstructed text. Why now: The paper gives a concrete reconstruction result, rather than treating hidden states only as opaque internal data. The authors say exact wording becomes harder to recover as texts grow longer, while main ideas can still be recovered. This is a demonstration of a method in research settings, not evidence of a successful attack on a deployed system.

Evidence boundary: The supplied arXiv abstract reports the method and summarized findings, but does not specify an operational attack, deployment prevalence, or the risk across all models and data types. Implication: Teams should not assume that a non-text representation is inherently safe to expose or retain; its sensitivity depends on access controls and the specific model and decoding conditions. Watch condition: Further evaluations should test reconstruction across model families, input lengths, and realistic access constraints before translating this result into a quantified product risk.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Models](https://newruntime.com/topics/models.md): Explore the models topic hub.
- topic hub: [Ai Security](https://newruntime.com/topics/ai-security.md): Explore the ai-security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)