---
title: Token-based Model Inversion (TMI)
url: https://www.emergentmind.com/topics/token-based-model-inversion-tmi
type: topic
---

# Token-based Model Inversion (TMI)

Token-based Model Inversion (TMI) designates inversion procedures in which the recovered object, the optimization variable, or the supervisory signal is organized at token granularity rather than treated as a monolithic image or sequence. In recent work, the relevant tokens may be ViT patch tokens and class-token attention, answer tokens in autoregressive vision-language models, discrete text tokens or continuous token embeddings in language models, or newly learned pseudo-tokens in diffusion text encoders. Some papers use the term explicitly, notably in vision-language model inversion, while others describe the same pattern under names such as sparse model inversion, token relabel, selective unlearning, textual inversion, or internal-state inversion [2508.04097][2605.10748][2601.15595][2606.18312][2304.05818][2507.16372].

## 1. Conceptual scope and token granularity

Across the literature, TMI is unified less by a single threat model than by a shared granularity assumption: the decisive inversion operations are token-wise. In ViTs, the token is a patch embedding whose contribution is indexed by class-token attention. In autoregressive VLMs and LLMs, the token is an output or input subword whose probability, hidden state, or gradient footprint can be manipulated or inverted. In diffusion personalization and analogy generation, the token is often a learned pseudo-token or a small set of trainable token embeddings inserted into a frozen text encoder.

| Setting | Token unit | Inversion target |
|---|---|---|
| Vision transformers in one-shot FL | Patch tokens and class-token attention | Synthetic images and token relabeling for global ViT training |
| VLMs | Autoregressive answer tokens | Image latent producing a target textual answer |
| LLMs and transformer leakage | Text tokens, next-token distributions, hidden states, or embeddings | Prompt recovery or token reconstruction |
| Diffusion personalization and analogy | Learned pseudo-tokens or DIFF tokens | Subject, style, or transformation encoded in token embeddings |

This scope includes both adversarial and constructive uses. Adversarial instances reconstruct private training inputs, hidden prompts, client text, or visual examples from logits, hidden states, or gradients. Constructive instances synthesize pseudo-data for one-shot federated learning, remove memorized PII without original training data, or encode a subject, style, or relational edit into reusable text tokens. This suggests that “token-based” in this literature refers less to discreteness than to the level at which inversion decisions are made.

A recurrent contrast is with dense or sequence-level inversion. Dense inversion updates every pixel or patch uniformly; sequence-level inversion aggregates all token losses into one objective. TMI instead privileges localized signals: attention-ranked foreground patches, masked PII spans, per-token autoregressive losses, continuous token embeddings later projected back to the vocabulary, or token-specific subspace constraints.

## 2. Core algorithmic patterns

A first pattern is token-local optimization under a global model. In VLM inversion, token-based MI treats answer generation as a sequence of token predictions and updates the generator latent after every token using
$$
\mathcal{L}=\mathcal{L}_{inv}(M(t,G(w),y_{<i}),y_i),
$$
followed by gradient descent on $w$ [2508.04097]. In hidden-state inversion for decoder-only LMs, a continuous proxy embedding $e_t$ is optimized position-wise so that the predicted hidden state matches the leaked target $h_t$, and only after the inner loop is a discrete token committed by nearest-neighbor verification [2607.00852]. In TIGER, the optimized variable is a continuous token-embedding matrix $\tilde Z^0$, and the loss is the distance of recovered hidden trajectories to gradient-induced embedding subspaces rather than direct full-gradient matching [2606.18312].

A second pattern is token selection by saliency or structure. FedMITR computes class-token attention in a ViT and masks low-attention tokens during inversion, thereby separating semantic foreground from low-information background. The same attention scores are then used for token relabeling: high-information tokens retain the pseudo-label, whereas low-information tokens are relabeled by an ensemble teacher via KL distillation [2605.10748]. DFSU likewise introduces token-level privacy masks over synthetic pseudo-PII; masked tokens receive privacy-maximizing pressure, while unmasked tokens are optimized for utility preservation [2601.15595].

A third pattern is continuous token-space search followed by discrete projection. Gradient-free textual inversion parameterizes a learned token embedding as
$$
e=e_0+W_pQ,
$$
with $Q$ optimized by CMA-ES in a low-dimensional subspace defined by PCA or prior normalization, so only forward passes are required [2304.05818]. TIGER and hidden-state inversion follow the same broad logic: optimize in embedding space, then map back to discrete tokens by cosine similarity or nearest-neighbor testing [2606.18312][2607.00852]. This suggests a common design choice across TMI systems: continuous search is often used to avoid brittle discrete optimization, but the recovered artifact remains token-level at evaluation time.

## 3. Vision, diffusion, and multimodal generation

In generative imaging, TMI first appeared in forms that optimize text-conditioning tokens rather than pixels. “Gradient-Free Textual Inversion” formulates the task as learning an embedding $e^\*$ for a pseudo-token $x^\*$ so that prompts containing $x^\*$ reconstruct and generalize a subject or style from a few images. The contribution is a gradient-free framework based on CMA-ES, CLIP-based initialization, and low-dimensional subspace optimization; the resulting performance is reported as comparable to gradient-based textual inversion while retaining forward-only deployment advantages [2304.05818].

BRAT extends this line by introducing bonus tokens and enforcing orthogonality, thereby increasing the token-space capacity available to represent a concept. The method is architecture agnostic in the narrow sense used by the paper: it does not rely on UNet-specific layers and is demonstrated with both a UNet backbone and a diffusion transformer. Its reported finding is that the bonus token improves adherence to the source images and the vision transformer improves adherence to the prompt [2408.04785].

Difference Inversion reorients token-space inversion from subject identity to relational editing. The transformation $A \to A'$ is encoded as learnable DIFF tokens $\tilde D=\{D_1,\dots,D_n\}$, guided by an interpolated CLIP delta and trained with a Token Consistency Loss that enforces reversibility between $\{prompt_A,\tilde D\}$ and $\{prompt_{A'},-\tilde D\}$. Zero initialization of token embeddings is central: the DIFF tokens begin as a no-op and are forced to encode only the difference rather than residual content from $A'$ [2506.07750].

In VLMs, TMI is explicit rather than implicit. “Model Inversion Attacks on Vision-Language Models” defines TMI as stepping through answer tokens $y_1,\dots,y_m$ and updating the image latent after every token. The paper also introduces TMI-C, which fully converges each token before advancing, and compares both to sequence-based methods SMI and SMI-AW. The empirical result is not that token-wise inversion is universally superior: TMI works, but TMI-C performs worse than TMI, and both are outperformed by sequence-based methods, especially SMI-AW with logit-maximization [2508.04097]. This corrects a possible misconception: token granularity offers a strong local signal, but it does not automatically dominate sequence-level optimization.

## 4. Language models, hidden states, and prompt recovery

In language modeling, TMI often targets hidden prompts rather than training data. “Language Model Inversion” studies the problem of recovering a prompt $x_{1:T}$ from the next-token probability vector
$$
\mathbf{v}=p(x_{T+1}\mid x_1,\dots,x_T;\theta),
$$
using a T5-based inverter that unrolls the full probability vector into a sequence of pseudo-tokens for the encoder. On Llama-2 7B, the reported results are BLEU $59$, token-level F1 $78$, and exact recovery of $27\%$ of prompts, showing that next-token distributions contain substantial information about preceding text [2311.13647].

PILS sharpens this result by using sequences of next-token logprob vectors rather than a single step. Its key theoretical claim is that, after additive log-ratio transformation, next-token distributions lie in a $D$-dimensional subspace determined by the hidden size, which enables lossless compression of the full distribution sequence into a lower-dimensional representation for inversion. Empirically, PILS yields $2$–$3.5$ times higher exact recovery than prior methods; one highlighted case increases exact recovery from $17\%$ to $60\%$, and the method generalizes upward in test-time generation length, with an inverter trained on $16$ steps improving when evaluated on $32$ steps [2506.17090].

A separate branch targets leaked internal states rather than logits. “Recovering Input Text from Hidden States” studies inversion from last-layer hidden states of GPT-2 using continuous embedding-space optimization and delayed token commitment. On $10$-token C4 prompts, exact match rises from $66.9\%$ to $97.5\%$ and mean similarity from $0.918$ to $0.994$ as the candidate window is widened, indicating that many failures are near-miss neighborhood errors rather than deep ambiguities. The paper also identifies a categorical asymmetry: space-prefixed, high-frequency function words dominate the failures, while content-bearing tokens are recovered almost perfectly [2607.00852].

“Depth Gives a False Sense of Privacy” extends hidden-state inversion to deep layers and long prompts in LLMs up to $70$B parameters. It introduces two white-box optimization attacks, a transfer-based black-box attack, and a generation-based attack that treats inversion as translation from internal states to text. The headline result is that a $4{,}112$-token medical consulting prompt can be nearly perfectly inverted with $86.88$ F1 token matching from the middle layer of a Llama-3 model, directly challenging the assumption that deeper states are too abstract to invert [2507.16372].

## 5. Federated learning, privacy, and security

TMI also appears as a mechanism for data-free learning. FedMITR addresses one-shot federated learning with ViTs by synthesizing data from uploaded client models and then training a server model using sparse model inversion and token relabel. Sparse inversion masks low-attention tokens so that only semantic foreground patches continue to change, while token relabel uses pseudo-labels for high-information tokens and ensemble soft labels for low-information tokens. The paper gives an algorithmic-stability analysis showing that sparse inversion eliminates gradient instability from background noise and token relabel reduces gradient variance, yielding a tighter generalization bound than dense inversion [2605.10748].

Other work uses TMI defensively against memorization. DFSU synthesizes pseudo-PII by language model inversion, annotates token-level privacy masks, and applies Privacy-Selective Contrastive Unlearning in a LoRA subspace. Its loss separates privacy and utility streams:
$$
\mathcal{J}(\phi)=\alpha \mathcal{L}_{gen}-\beta \mathcal{L}_{priv},
$$
so minimizing $\mathcal{J}$ preserves performance on non-PII tokens while maximizing loss on masked PII tokens. On AI4Privacy-based experiments with Pythia-410M, DFSU reduces E-Hit from $28.78\%$ to $0.13\%$ on WikiText+PII with PPL changing from $8.39$ to $8.83$, and reduces E-Hit from $34.73\%$ to $0.38\%$ on MNLI+PII with accuracy changing from $70.44\%$ to $68.45\%$ [2601.15595].

In federated attack settings, TIGER shows that token-level leakage persists even under perturbations often assumed to be protective. It optimizes continuous token embeddings to minimize their distance to gradient-induced subspaces, then projects the recovered embeddings back to vocabulary tokens. On decoder models, TIGER remains effective under BF16 gradients and under DP-style Gaussian noise; for example, when DAGER’s ROUGE-1 drops to $0$ at $\sigma=10^{-5}$, TIGER remains high and still reports non-zero reconstruction at $\sigma=10^{-3}$ [2606.18312]. A similar conclusion appears in internal-state inversion: quantization, dropout, noisy input embeddings, and Laplace-style DP noise degrade utility before they prevent inversion, so simple perturbative defenses do not produce a satisfactory privacy-utility tradeoff [2507.16372].

These results support a broader interpretation of TMI as dual-use. The same token-level machinery can improve data-free learning or selective unlearning, yet it can also reconstruct prompts, hidden states, and client data with high fidelity when exposed signals remain sufficiently informative.

## 6. Evaluation, comparative findings, and open problems

TMI is evaluated with markedly different metrics across domains. Language-model prompt recovery uses BLEU, ROUGE, exact match, token-level F1, and embedding cosine similarity [2311.13647][2506.17090][2607.00852]. Privacy-preserving unlearning uses Exact Reconstruction Rate, Fractional Reconstruction Similarity, Sample-Level Exposure Rate, and Entity-Level Hit Rate [2601.15595]. VLM inversion combines conventional DNN-based attack accuracy, MLLM-based attack accuracy, human evaluation, and feature distances, with human evaluation reaching an attack accuracy of $75.31\%$ on reconstructed images [2508.04097]. Diffusion analogy generation uses CLIP and DINO-v2 directional scores, human preference, and VLM judgments; Difference Inversion reports a DINO-v2 directional score of $0.5732$ and a $72\%$ human preference rate over baselines [2506.07750]. One-shot FL reports downstream classification accuracy, where FedMITR improves Mini-ImageNet Dir$(0.1)$ from DeepInversion’s $60.28\%$ to $68.21\%$ and OfficeHome Dir$(0.1)$ from $23.89\%$ to $32.81\%$ [2605.10748].

Several comparative findings recur. First, richer output traces usually help: PILS benefits from multiple generation steps rather than a single logprob vector, and hidden-state inversion benefits from larger candidate windows [2506.17090][2607.00852]. Second, token-level treatment is not inherently best at the task level: in VLM inversion, TMI and especially TMI-C are weaker than sequence-based SMI and SMI-AW, indicating that local token supervision can be noisier than sequence-level aggregation [2508.04097]. Third, access assumptions remain decisive. White-box gradient or hidden-state access generally yields stronger token recovery than black-box transfer, and black-box generative inversion depends more on the match between attacker data and victim inputs [2507.16372].

The limitations reported across papers are also structurally aligned. Many methods require white-box logits, hidden states, gradients, or equal-weight client ensembles; others rely on a public generator, a public corpus, or a distributionally similar attacker dataset. Several are architecture-specific in practice even when conceptually broader: FedMITR is tailored to ViTs, DFSU assumes white-box logit access, and gradient-free textual inversion benefits from CLIP/text-encoder alignment in Stable Diffusion [2605.10748][2601.15595][2304.05818]. Future directions named in the papers include better token importance metrics beyond attention, more robust PII annotators, extensions to CNN-transformer hybrids and multimodal foundation models, stronger formal privacy guarantees, and defenses that do more than add light noise or quantization [2605.10748][2601.15595][2507.16372].

Taken together, the recent literature establishes TMI as a general inversion paradigm rather than a single algorithm. Its defining move is to recast inversion around token-local structure—patches, subwords, pseudo-tokens, masked spans, or continuous token embeddings—and then to exploit that structure for reconstruction, editing, distillation, or forgetting. The resulting systems differ sharply in objective, threat model, and modality, but they converge on a shared conclusion: token-level signals in modern architectures are often sufficiently informative to support both high-utility constructive procedures and high-fidelity privacy attacks.

Source: https://www.emergentmind.com/topics/token-based-model-inversion-tmi