How PromptEcho Turns Constraints into Meaning

PromptEcho is the subject of this chapter, and the focus is its central engineering problem: how to turn a sequence of merged lengths—with hidden token boundaries and many possible text explanations—into a coherent semantic hypothesis. The useful judgment is not whether the attack can perform a magical reverse translation from numbers to words. It is why a sequence of weak constraints becomes more informative when PromptEcho segments it, marks its granularity, transfers linguistic priors, and ranks candidates in context. Each step reduces a different kind of ambiguity, while none removes the need for calibration or proves the original response.

First, make the observation manageable

A long merged-length trace is difficult for the same reason that a long sentence with missing spaces is difficult: uncertainty at one position can change the interpretation of everything that follows. If one observed group could contain two tokens, three tokens, or a punctuation-bearing fragment, the number of possible decompositions expands quickly as more groups are added. A reconstruction system that tries to solve the entire response in one unconstrained pass has to carry too many incompatible possibilities at once.

PromptEcho therefore begins by segmenting the observed sequence into shorter, structurally coherent spans. The segmentation is not based on recovered text, because recovered text does not exist yet. It uses the signal itself: abrupt changes in adjacent lengths, punctuation-related patterns that can be learned from service behavior, likely chunk boundaries, and statistical priors about plausible segment sizes. The paper describes an optimization that balances three considerations: whether each proposed span has a plausible total length, whether a boundary coincides with a meaningful local change, and whether the system is creating too many small segments. Candidate boundaries are pruned before dynamic programming selects a useful set.

This step is a control on error propagation. It does not reveal the hidden token boundaries inside each span. It localizes the uncertainty so that an ambiguous early group does not force the model to reinterpret an entire long answer. It also preserves enough local continuity for language patterns to remain useful. A span that is too short may contain almost no context; a span that is too long may contain too many competing decompositions. PromptEcho’s segmentation is therefore a compromise between tractability and meaning.

The authors also use limited heuristics for common response templates, especially near the beginning of an answer. LLMs often open with regular phrases before moving into a list or an explanation. A transition from an introductory sentence to the first enumerated item can create a recognizable change in the length pattern. Such a cue can suggest a boundary even when the actual words are unknown. The important point is not the particular template. It is that predictable application behavior can help locate structure in a stream whose content remains encrypted.

The segmentation objective is best understood as a competition between plausible explanations of the same trace. A candidate span should not be implausibly short or long, a proposed boundary should coincide with a meaningful change in the observed pattern, and the total number of boundaries should remain limited. The system then searches over the surviving boundaries instead of every possible split.