[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-gpt-2-hidden-states-can-leak-your-input-text":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},3274,"gpt-2-hidden-states-can-leak-your-input-text","GPT-2 Hidden States Can Leak Your Input Text","A new study shows gradient-based attacks can recover input text from a model's hidden states with up to 97.5% accuracy on short prompts.","Researchers have found that the last-layer hidden states of GPT-2 are about as sensitive as the original input text — meaning anyone with access to those states can reconstruct what you typed.\n\nThe study treats text recovery not as a single guess but as a continuous optimization problem. Instead of projecting back to hard tokens at each step, the method keeps the search in \"embedding space\" — the model's internal numerical representation — and only commits to actual words at the very end. On 10-token prompts from the C4 dataset, exact-match recovery rates climbed from 66.9% to 97.5% as the search window widened, with a mean similarity score of 0.994. The remaining failures weren't random noise: they clustered around common function words like \"the\" and \"a\", which sit in dense, hard-to-distinguish regions of the embedding matrix. Content words — the ones that actually carry meaning — were recovered almost perfectly.\n\nThis matters because hidden states are treated as an internal implementation detail, not user data. If a model's intermediate representations can reliably reconstruct inputs, then any system that exposes, logs, or leaks those states — think API telemetry, caching layers, or multi-tenant inference infrastructure — becomes a potential privacy liability. The attack doesn't require model weights, just the hidden states themselves.\n\nThe paper benchmarks against SIPIT, an existing reference method that projects to hard tokens at each step and runs faster. The trade-off is observability: the continuous approach exposes internal signals that let researchers detect and diagnose failures, which is precisely what makes it a sharper research tool — and a sharper threat model.","[\"ai\",\"security\",\"privacy\",\"language-models\"]","2026-07-02T04:00:00.000Z","2026-07-02T06:24:56.171Z","2026-07-02T06:24:59.080Z","published",null,[],"security",[26,24,27,28],"ai","privacy","language-models",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2607.00852",0,{"sections":35},[36,40,44,49,54,59,64,69,74,79,84,88,93,98],{"name":37,"slug":26,"count":38,"latest_published_at":39},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":41,"slug":24,"count":42,"latest_published_at":43},"Security",294,"2026-07-15T19:59:48.000Z",{"name":45,"slug":46,"count":47,"latest_published_at":48},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Dev Tools","dev-tools",59,"2026-07-07T04:00:00.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":85,"slug":86,"count":82,"latest_published_at":87},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]