PROVE Training-free prompt recovery using verifiable evidence

The idea

Modern text-to-image models can generate highly realistic images from natural-language prompts, while recent advances in prompt inversion have made it increasingly feasible to recover those prompts from generated outputs, raising new concerns for copyright protection and content ownership. As prompt marketplaces emerge, recovered prompts can enable both the unauthorized reproduction and redistribution of copyrighted creative works, and the exposure of the prompts that encode an artist's creative recipe in AI-generated content. Existing prompt inversion methods rely on gradient-based optimization, autoregressive captioning, or reinforcement learning. However, optimization-based methods often produce unreadable prompts, captioning methods hallucinate unverified details, and RL-based approaches frequently overfit to specific generators while introducing evaluation circularity. We introduce PROVE (Prompt Recovery with Verified Evidence), a training-free, black-box prompt inversion attack that reconstructs prompts by composing verifiable scene descriptions rather than optimizing token sequences, targeting both original copyrighted works and AI-generated content. The resulting prompts are fully auditable, with every recovered claim grounded in explicit image evidence, and are formalized through a precision-constrained recall maximization objective. Across MS-COCO, Flickr30K, and Lexica, using state-of-the-art text-to-image generators, PROVE consistently outperforms optimization, captioning, and RL-based baselines on image similarity (DINO, LPIPS) and text-image alignment (CLIP), without any training, generator access, or fine-tuning, demonstrating a stronger and more practical prompt inversion attack.

Method

Frozen models, no generator in the loop

PROVE assumes black-box access: given only the target image, it recovers the prompt with off-the-shelf components and no gradient optimization. A global caption seeds a query set that acts as the recall ceiling for open-vocabulary detection. Each detected region is described under a slot schema, verified against a label-relative CLIP margin, and, if it survives, serialized into the final prompt. Counts and spatial relations are read straight off the detector boxes, so they bypass the evidence gate entirely.

All components are frozen and off the shelf. PROVE requires no training, no fine-tuning, and no gradient optimization. A repair pass removes dangling fragments and duplicates before the prompt is finalized.

Frozen VLM and detector propose claims; the evidence gate keeps only what the image can verify.

Qualitative

Qualitative comparison

For each source image, the original is shown next to reconstructions from PROVE and the competing methods, across MS-COCO, Flickr30K, and Lexica.

Results

State of the art on image recovery

Across 100 randomly selected images per dataset, two seeds each, and two generators, PROVE gives the strongest overall recovery. It leads every metric on MS-COCO and Flickr30K, and stays competitive on the art-style Lexica set, where captioning and RL baselines are strongest.

Best per column in bold teal. PROVE row highlighted.

Qualitative prompt alignment

We compare PROVE against its three closest baselines, showing both the generated image and the recovered prompt.

Target

Generated	Recovered prompt
	Ours. An open door emits warm light into a dimly lit room with cool blue and orange tones. The walls are plain, and the floor reflects the light, creating a stark contrast between the two halves of the space. Artificial, evening, indoor, eye-level, warm, orange, concrete floor, blurred. It contains three hinges, two walls. Gold handles, open, new, rectangular, smooth. No text, rectangular shape. Hinges. 3D render, minimalist, low-key, muted palette with orange accents, atmospheric, hyperdetailed.
	PromptMiner. an open door room, darker empty room with open doorway leading to glowing lit hallway, warm lighting, orange and blue walls, concrete floor, minimal composition, colorful, minimalist, high-contrast, high resolution.
	VLM-as-expert. A minimalist room with two open doors, one glowing warmly and the other coolly, casting colorful reflections on the concrete floor.
	CLIP-Interrogator. a door in a room with a light coming in, teal orange color palette 8k, pexels, high quality fantasy stock photo, low saturated red and blue light, open door, vanilla-colored lighting, pink and teal and orange.

On these stylized images, PROVE describes the visual style in grounded terms without attributing it to a named artist, unlike the baselines, which recover artist and platform tags.