Platforms like PromptBase, PromptHero, and CivitAI let creators buy, sell, and share text prompts for AI image generation.
Sellers assert intellectual property rights over their prompts, claiming them as proprietary creative assets. Platforms keep the actual prompt hidden until purchase.
Every marketplace listing shows sample images. Can someone reverse-engineer the secret prompt just by looking at those images?
Prompts have a subject (what it depicts: cat, robot, astronaut…) and one or more modifiers (style, lighting, mood, color palette, medium…)
Even small modifier changes radically alter the image — capturing stylistic intent from visuals alone is deeply ambiguous.
100 real-world prompts sampled from PromptHero. Wide stylistic variety. Participants wrote free-form prompts describing five AI-generated images they were shown. Open-ended inference task.
100 prompts built from scraped Lexica data. Fixed subjects (man, woman, astronaut, cat, robot) + 121 stylistic modifiers from Midjourney's keyword list. Ground truth known; enables direct comparison.
CFG Scale: 5 · Sampling Steps: 40 · Euler sampler
MidJourney used default model settings (parameters not user-controllable)
Responses filtered: excluded entries missing subject or modifier, containing random/blank text, or non-English
We measure inference quality by generating images from inferred prompts and comparing them to original-prompt images using three metrics:
Perceptual hash via Hamming distance. Score 0–64 (lower = more similar). Captures shallow visual cues.
Learned Perceptual Image Patch Similarity in deep feature space. Score 0–1 (lower = more similar). Reflects structure, texture, color composition.
Cosine similarity of CLIP (ViT-L/14, ViT-B/32) embeddings. Score 0–1 (higher = more aligned). Measures semantic text–image alignment.
txt2img models are stochastic — the same prompt produces different images each run. A single lucky match doesn't prove prompt equivalence.
For each prompt, generate 200 reference images (original prompt) and 50 inferred images (participant prompt). Treat each as a sample from a probability distribution.
Two-sample KS test checks whether the two similarity-score distributions are statistically indistinguishable (p > 0.05 = a "hit").
Fig. 6 — Same prompt (a,b) → overlapping distributions (f); different prompt (d) → diverging distribution (h). A hit = distributions are statistically indistinguishable (p > 0.05).
LLM merging was chosen over simple concatenation to preserve linguistic coherence, balance human and AI contributions, and avoid keyword repetition that could bias image generation.
| Metric | Controlled Hit Rate | Uncontrolled Hit Rate |
|---|---|---|
| ImageHash | 53.29% | 53.72% |
| LPIPS | 22.89% | 9.77% |
| CLIP B32 | 7.28% | 7.56% |
| CLIP L14 | 7.05% | 7.21% |
LPIPS gap between controlled (22.89%) and uncontrolled (9.77%) confirms that open-ended prompts from the wild are far harder to reverse-engineer than structured laboratory prompts.
DreamShaper XL — strongest positive relation with success (controlled r= +0.15).
Realistic Vision v5 — higher variability (controlled r= +0.14 for LPIPS variance), weaker inference success.
SDXL — largely neutral. Trends consistent across controlled and uncontrolled sets.
| Metric | Human Only | Human–AI Combined | Change |
|---|---|---|---|
| ImageHash | 53.29% | 60.62% | ↑ +7.3pp |
| LPIPS | 22.89% | 18.59% | ↓ −4.3pp |
| CLIP B32 | 7.28% | 5.89% | ↓ −1.4pp |
| CLIP L14 | 7.05% | 5.77% | ↓ −1.3pp |
ImageHash improvement (+7pp) reflects better pixel-level surface similarity, not meaningful perceptual alignment. This is a false positive — and further confirms why we exclude ImageHash from core analysis.
Broad subject matter is recoverable from images. Participants reliably identify the main theme, object, or scene — especially in controlled settings with common subjects.
Precise stylistic modifiers — lighting, texture, color palette, artistic medium, mood — are extremely difficult to reconstruct. CLIP hit rates of ~7% confirm this ceiling.
ImageHash inflates success by capturing only shallow pixel patterns. LPIPS and CLIP are more honest evaluators and reveal genuinely low inference success for unconstrained prompts.
Results suggest that prompts are relatively resilient to reverse engineering under current human + AI inference techniques.
Effective human-AI co-creation for prompt inference remains unsolved. Future methods should optimize for LPIPS/CLIP alignment, not shallow surface similarity.
AI familiarity and arts background had limited impact on success rates — task and system-level constraints dominate over user expertise.