Three-Pass Prompting: Protocols & Applications

• Three-Pass Prompting is a multi-stage method that iteratively refines information, enhancing both security in cryptography and reasoning in NLP and multimodal tasks.
• In cryptography, protocols like Shamir’s and Paillier-based schemes use sequential, algebraic transformations to securely exchange messages without pre-shared keys.
• In large language models, the review, rephrase, and resolve stages improve clarity and accuracy, effectively mitigating noise and facilitating complex, hierarchical tasks.

Three-pass prompting is a structured, multi-stage approach employed across cryptographic protocols and machine learning—especially NLP and vision-LLMs—to enhance robustness, disambiguation, and reliability in environments characterized by noise, ambiguity, or adversarial conditions. The term refers either to (a) cryptographic schemes where three sequential message exchanges obviate pre-shared secrets, or (b) a composite prompting architecture in LLM and multimodal systems where output quality is iteratively improved over three distinct, interacting inferential or representational steps.

1. Cryptographic Three-Pass Protocols: Theoretical Foundations and Properties

The original “three-pass protocol” was introduced in the context of cryptography for secure communication without prior key exchange, exemplified by Shamir’s No-Key Protocol and its homomorphic variants. The precise mechanics involve:

• First pass: The sender encrypts the message with a private key transformation and sends the result.
• Second pass: The receiver applies a commutative (or, in homomorphic approaches, compatible) transformation, further encrypting or “blinding” the ciphertext.
• Third pass: The sender removes their transformation, transmitting a ciphertext that the receiver can “unblind” to recover the original message.

In the Paillier-based three-pass scheme, the sender utilizes the homomorphic exponentiation property to enable secure “blinding” and eventual unblinding by the recipient without requiring operation commutativity (Anselme, 2012). This exploits the fact that decryption after repeated exponentiation yields $D((E(m_1))^{m_2}) = m_1 \cdot m_2 \mod n$, enabling message recovery after modular inversion.

Technical comparison:

Variant	Security Basis	Mathematical Property Utilized	Sender Actions	Receiver Actions
Shamir’s Protocol	Commutativity	$E_a(E_b(m)) = E_b(E_a(m))$	Encrypt, Decrypt	Encrypt, Decrypt, Unblind
Paillier-based Protocol	Additive Homomorphism	$D((E(m_1))^{m_2}) = m_1 m_2 \pmod n$	Encrypt, Decrypt	Exponentiate, Invert

This approach enables stateless, confidential transmission. Notably, the entire security guarantees rely on the algebraic properties of the cryptosystem (e.g., Paillier’s composite residuosity), rather than on secret key agreements or key exchanges.

2. Fundamental Limitations and Impossibility Results

A significant line of research interrogates whether three-pass protocols can achieve information-theoretic or post-quantum security when instantiated over public Abelian groups. The principal result demonstrates a critical flaw: in any scheme based on public Abelian group actions, the protocol’s structure enables adversaries observing the message exchanges to reconstruct the secret without computational effort (Onur et al., 2017).

Specifically, for a group action $\circ$ and public Abelian group $G$, any eavesdropper observing $c_1 = k \circ g$, $c_2 = c_1 \circ h$, and $c_3 = c_2 \circ g^{-1}$ can compute $h'$ such that $c_1 \circ h' = c_2$, and subsequently recover $k = c_3 \circ (h')^{-1}$. The uniqueness of the group action’s permutation within a transitive, Abelian structure ensures no ambiguity. This impossibility result excludes the feasibility of unconditional or post-quantum secure three-pass protocols based solely on such groups, redirecting post-quantum protocol design toward hard computational assumptions (lattice, isogeny, etc.) rather than group-theoretic commutativity.

3. Multi-Pass Prompting in LLMs: Principles and Mechanism

In NLP, “three-pass prompting” (termed as R$^3$ prompting) refers to a staged prompt design that segments LLM reasoning under noisy or adversarial conditions into sequentially dependent inferential stages (Tian et al., 2023). The canonical architecture involves:

1. Review pass: Extraction of key sentences or relevant informational fragments from the noisy or distractor-laden input. This denoising step reduces propagation of irrelevant or misleading data.
2. Rephrase pass: Transformation of these fragments into formal, symbolic, or variable-bound representations (e.g., variable declaration, equation formatting). This stage operationalizes the necessary mapping from extracted facts to manipulable state.
3. Resolve pass: Final calculation, synthesis, or answer generation, driven by the previously formalized variables and equations.

Technically, these stages leverage structured prompt formats—indexed listing for review, explicit variable bindings for rephrase, and equation-based resolution for computation. Empirical results on arithmetic reasoning benchmarks with injected noise demonstrate that R$^3$ prompting with GPT-3.5-turbo yields a 3.7 percentage point average accuracy boost over prior Chain-of-Thought approaches, with robustness maintained as noise increases.

4. Three-Pass Strategies in Prompt Consolidation and User Interaction

A related instantiation is the consolidation of user prompts in interactive LLM applications, such as iterative problem resolution in ChatGPT (Mondal et al., 7 Feb 2024). Prompts typically undergo a three-phase workflow:

1. Initial submission, often incomplete or context-poor.
2. Iterative revision to add missing specifications, clarify context, or request alternate solutions.
3. Final consolidation yielding a single, comprehensive prompt containing all necessary details.

This three-pass refinement can be modeled algorithmically (with prompt merging functions or gap-filling routines) and is shown to significantly reduce required interactions, leading to time savings, cost reduction, and increased user satisfaction. Notably, some gaps (e.g., missing specifications or context) are fully consolidatable, while errors or multi-use prompts may resist full integration.

5. Multistage Prompting in Multimodal and Hierarchical Tasks

In the context of multimodal vision-LLMs, “three-pass” or progressive prompt tuning entails iterative cross-conditioning between modalities to overcome misaligned feature distributions and enhance generalization (Qiu et al., 18 Apr 2024). The ProMPT framework executes:

• Initialization: Independent extraction and filtering of representations from each modality (e.g., image via CLIP, text via prompt templates).
• Iterative evolution: Alternating application of class-conditional vision prompting and instance-conditional text prompting, interleaved with feature filtering based on current embedding similarity.
• Convergence: Multiple passes progressively align modality-specific features, enabling robust prediction even for novel classes or distribution shifts.

Similarly, in hierarchical LLM-based classification tasks (such as multilingual narrative identification), three-step prompting decomposes reasoning into sequential macrocategory, main narrative, and fine-grained sub-narrative assignments, with each pass strictly constrained by the outputs of the preceding stage (Singh et al., 28 May 2025). This cascaded approach is critical for controlling error propagation and optimizing final classification accuracy, as demonstrated by top performance metrics in competitive evaluation.

6. Advances in Automated Prompt Optimization via Three-Pass Strategies

Automated prompt optimization frameworks extend three-pass prompting to the meta-level of prompt design itself, as in the P3 framework (Zhang et al., 21 Jul 2025). Here,

• First pass: Offline co-optimization of system and user (complementary) prompts, focusing on their mutual affinity.
• Second pass: Iterative candidate generation and LLM-based evaluation of complementary instructions for query categories, yielding a curated dataset for dynamic use.
• Third pass: Query-dependent online adaptation—either by fine-tuning a smaller model or retrieval-driven selection—applies optimized complements to new queries for boosted LLM performance.

This pipeline outperforms unidirectional optimization methods and achieves improvements up to 18–25% on smaller LLMs in general and reasoning tasks.

7. Broader Implications and Applications across Domains

Three-pass prompting, as a generalized methodology, offers several domain-independent advantages:

• Error correction and noise resilience: Each pass systematically isolates, clarifies, and resolves uncertainty, reducing error propagation and building robust reasoning chains.
• Structured information extraction and manipulation: Hierarchical decomposition of tasks into modular, tightly supervised steps (extraction, formalization, synthesis) enhances interpretability and debuggability.
• Facilitation of complex, high-dimensional operations: In both factor modeling for high-dimensional forecasting (Jat et al., 12 May 2024) and prompt-based classification, three-pass filtering allows the isolation of signal from noise via iterative, supervised selection and refinement.

In conclusion, three-pass prompting encompasses a suite of protocol and design patterns unified by their reliance on multi-stage, interdependent transformations. Whether in cryptography, LLMs, or vision-language alignment, the methodology has demonstrated empirically verified gains in reliability, interpretability, and robustness in the presence of noise or system uncertainty. Its future relevance will be shaped by advances in interactive reasoning, hierarchical task decomposition, and secure communication protocol design.