Model inversion: how your LLM leaks secrets

Model inversion is a new class of attack against large language models. Instead of guessing prompts, attackers feed the model carefully crafted inputs and watch its outputs — then reverse-engineer the data it was trained on. The result: personal information, private documents, even training data from competitors, pulled straight out of the model's weights.

The paper from Greptile walks through three attack vectors: membership inference (did this person exist in the training set?), reconstruction (rebuild the original record), and extraction (pull out specific fields like email or SSN). The attacks work best on smaller models and on data that was heavily featured in training — which is to say, most of the public web scraped into LLMs.

The fix isn't one thing. Red teaming, input filtering, and output sanitization help but don't solve it. The real move is treating any LLM that touches sensitive data as a leaky bucket: assume it will regurgitate what it saw, and design around that. That means not feeding PII in, rotating training data, and — for anything that matters — using on-prem models where you control what gets in and what gets out.

Why this matters for us: If you're running a model on customer data, your competitors and scammers can pull that data back out — so the question is whether your business is storing more secrets than it realizes.