PROVE: Training-Free Prompt Recovery using Verifiable Evidence

2026-08-13

AI Summary

This study addresses the challenges of unreadability, hallucination, and overfitting in existing prompt inversion methods, which hinder reliable content attribution. We propose PROVE, a training-free black-box attack that introduces a novel reconstruction mechanism based on verifiable scene description combinations. Unlike traditional optimization approaches, PROVE maximizes recall under precision constraints to ensure all recovered claims are grounded in visual evidence, enabling fully auditable and accurate inversion. Experiments on MS-COCO and other benchmarks demonstrate that PROVE outperforms current baselines in both image similarity and image-text alignment metrics. Notably, it achieves superior practical utility for inversion attacks without requiring model access or any training, establishing a new standard for interpretable and evidence-based prompt recovery in generative models.

Abstract

Modern text-to-image models can generate highly realistic images from natural-language prompts, while recent advances in prompt inversion have made it increasingly feasible to recover those prompts from generated outputs, raising new concerns for copyright protection and content ownership. As prompt marketplaces emerge, recovered prompts can enable both the unauthorized reproduction and redistribution of copyrighted creative works, and the exposure of the prompts that encode an artist's creative recipe in AI-generated content. Existing prompt inversion methods rely on gradient-based optimization, autoregressive captioning, or reinforcement learning. However, optimization-based methods often produce unreadable prompts, captioning methods hallucinate unverified details, and RL-based approaches frequently overfit to specific generators while introducing evaluation circularity. We introduce PROVE (Prompt Recovery with Verified Evidence), a training-free, black-box prompt inversion attack that reconstructs prompts by composing verifiable scene descriptions rather than optimizing token sequences, targeting both original copyrighted works and AI-generated content. The resulting prompts are fully auditable, with every recovered claim grounded in explicit image evidence, and are formalized through a precision-constrained recall maximization objective. Across MS-COCO, Flickr30K, and Lexica, using state-of-the-art text-to-image generators, PROVE consistently outperforms optimization, captioning, and RL-based baselines on image similarity (DINO, LPIPS) and text-image alignment (CLIP), without any training, generator access, or fine-tuning, demonstrating a stronger and more practical prompt inversion attack.

Problem

• Prompt Inversion
• Text-to-Image Models
• Copyright Protection
• Hallucination
• Content Ownership

Innovation

• Training-Free Prompt Recovery
• Verifiable Evidence
• Black-Box Inversion
• Auditable Reconstruction
• Precision-Constrained Recall Maximization