mlsanityData to 14 Oct 2026

Language Models are Injective and Hence Invertible

arXiv 2510.15511 ↗First posted 17 Oct 2025cs.LG cs.AIcited by 35

Not on the map. Why?

Abstract (arXiv)

Transformer components such as non-linear activations and normalization are inherently non-injective, suggesting that different inputs could map to the same output and prevent exact recovery of the input from a model's representations. In this paper, we challenge this view. First, we prove mathematically that transformer language models mapping discrete input sequences to their corresponding sequence of continuous representations are injective and therefore lossless, a property established at initialization and preserved during training. Second, we confirm this result empirically through billions of collision tests on six state-of-the-art language models, and observe no collisions. Third, we operationalize injectivity: we introduce SipIt, the first algorithm that provably and efficiently reconstructs the exact input text from hidden activations, establishing linear-time guarantees and demonstrating exact invertibility in practice. Overall, our work establishes injectivity as a fundamental and exploitable property of language models, with direct implications for transparency, interpretability, and safe deployment.

Key facts. Cited by 35 papers in the map (data through 14 Oct 2026). Builds on 16 of its 32 references that are in the map. First posted on arXiv 17 Oct 2025.

Builds on

16 of 32 references.

References · 16

  1. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  2. 2016Layer Normalizationcited by 5,669
  3. 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,411
  4. 2025Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAscited by 521
  5. 2023TinyStories: How Small Can Language Models Be and Still Speak Coherent English?cited by 449
  6. 2021Attention is Not All You Need: Pure Attention Loses Rank Doubly Exponentially with Depthcited by 419
  7. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 336
  8. 2022Black-Box Tuning for Language-Model-as-a-Servicecited by 256
  9. 2023EvoPrompt: Connecting LLMs with Evolutionary Algorithms Yields Powerful Prompt Optimizerscited by 193
  10. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  11. 2017Breaking the Softmax Bottleneck: A High-Rank RNN Language Modelcited by 152
  12. 2024Extracting Prompts by Inverting LLM Outputscited by 41
4 more
  1. 2025The Non-Linear Representation Dilemma: Is Causal Abstraction Enough for Mechanistic Interpretability?cited by 37
  2. 2020Solving Inverse Problems with Hybrid Deep Image Priors: the challenge of preventing overfittingcited by 18
  3. 2025Better Language Model Inversion by Compactly Representing Next-Token Distributionscited by 9
  4. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 32.

35 papers.

Sort:

By area:

  1. 2026The Latent Space: Foundation, Evolution, Mechanism, Ability, and Outlookcited by 43
  2. 2026FlashMem: Distilling Intrinsic Latent Memory via Computation Reusecited by 8
  3. 2026From Data to Behavior: Predicting Unintended Model Behaviors Before Trainingcited by 8
  4. 2026Steered LLM Activations are Non-Surjectivecited by 8
  5. 2026Expert Selections In MoE Models Reveal (Almost) As Much As Textcited by 6
  6. 2025AdvJudge-Zero: Binary Decision Flips in LLM-as-a-Judge via Adversarial Control Tokenscited by 4
  7. 2026Operationalising the Superficial Alignment Hypothesis via Task Complexitycited by 4
  8. 2026What Does the Server See? Understanding Privacy Leakage from Large Language Models in Split Inferencecited by 4
  9. 2026When Latent Agents Lie: KV-Cache Integrity in Multi-Agent LLM Collaborationcited by 4
  10. 2025TextBO: Bayesian Optimization in Language Space for Eval-Efficient Self-Improving AIcited by 3
  11. 2026Control Reinforcement Learning: Interpretable Token-Level Steering of LLMs via Sparse Autoencoder Featurescited by 2
  12. 2026Zero-Shot Quantization via Weight-Space Arithmeticcited by 2
23 more
  1. 2026QuoVLA: Quotient Space for Vision-Language-Action Modelscited by 2
  2. 2026HijackKV: New Threat in Position-Independent KV Cache Reusecited by 2
  3. 2026VDLM: Variable Diffusion LMs via Robust Latent-to-Text Renderingcited by 1
  4. 2026How Private Are DNA Embeddings? Inverting Foundation Model Representations of Genomic Sequencescited by 1
  5. 2026The Prediction-Measurement Gap: Toward Meaning Representations as Scientific Instrumentscited by 1
  6. 2026Shaping Schema via Language Representation as the Next Frontier for LLM Intelligence Expandingcited by 1
  7. 2026A Geometric View for Understanding Concept Learning and Neuron Interpretation in Sparse Autoencoderscited by 1
  8. 2026Prompting Complexity: Shortest Prompts for Texts and Behaviors in LLMscited by 1
  9. 2025Transformer Injectivity & Geometric Robustness - Analytic Margins and Bi-Lipschitz Uniformity of Sequence-Level Hidden Statescited by 0
  10. 2026Information Theoretic Perspective on Representation Learningcited by 0
  11. 2026Privacy-Aware Split Inference with Speculative Decoding for Large Language Models over Wide-Area Networkscited by 0
  12. 2026PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Promptscited by 0
  13. 2026Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMscited by 0
  14. 2026Recovering Input Text from Hidden States: Study of Gradient-Based Inversion of Decoder-Only Language Modelscited by 0
  15. 2026Reasoning Errors Have a Region and a Direction in the Residual-Stream Trajectory of LLMscited by 0
  16. 2026Federated Prompt Learning: A Unified Framework, Empirical Analysis, and Future Directionscited by 0
  17. 2026A Formal Limitation on Learning Human Language From Textual Corporacited by 0
  18. 2026Does Linguistic Structure Enrichment Enhance Coherence Assessment? Not With Current Architecturescited by 0
  19. 2026ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factorcited by 0
  20. 2026Activation Flow: Manufacturing Activations for Steeringcited by 0
  21. 2026What Gradients Add to Text Leakage in Split Language Models, Counted per Token and per Documentcited by 0
  22. 2026Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PIIcited by 0
  23. 2026Representation-Space MMD for Diffusion Language Modelscited by 0