Reconstruct the record before interpreting the answer
Prompt reconstruction begins with acquired text and source relationships. It does not begin by asking a model to guess the prompt that would produce an observed answer. Many different inputs and configurations can lead to similar outputs, so a plausible reverse-engineered prompt is not recovered evidence.
Define the object you are reconstructing: the user-visible message, the conversation state, or the effective inputs supplied during a particular run. Those objects may overlap, but an export of one does not necessarily contain the others.
Keep the input layers separate
| Evidence or distinction | What it supports | Limit or next question |
|---|---|---|
| Visible message | Text directly recovered from an interface, export, or stored record. | Identify the source and any revision. |
| Contextual material | Attachments, retrieved text, tool output, or earlier messages. | Record whether inclusion in the run is supported. |
| Summary or transformation | A condensed or normalized representation of earlier material. | Keep it distinct from the underlying original. |
| Unavailable runtime input | A system instruction or other input outside the acquisition scope. | Name the gap without inventing its contents. |
Why identifiers matter more than a tidy transcript
Retain message identifiers, parent references, roles, and known revisions. A time-sorted list can place a regenerated response next to the wrong version of a prompt. Build supported relationships first, then provide a readable view of the recovered sequence.
W3C PROV offers a general way to express derivation and activity relationships. Using that vocabulary does not validate an application-specific parent field. Explain how each consequential relationship was interpreted and which source supports it. PROV-DM: The PROV Data Model.
An answer refers to an attachment you do not have
Hypothetical example: a recovered answer says “in the attached table,” but the export contains no attachment payload. The statement establishes that the answer contains that wording. A recorded attachment identifier may support that a reference existed. Neither observation recovers the table’s cells.
Search the authorized acquired sources for the referenced object and document the search scope. If it remains unavailable, show the missing object in the reconstruction. Do not create a replacement table from the answer and label it as the original input.
Practical checks that expose unsupported reconstruction
For each quoted input, ask whether its bytes or text were acquired directly. For each connection, ask whether the source recorded it or the analyst inferred it. For each omitted context item, ask whether absence means unavailable, unexamined, filtered, or confirmed missing in a defined source.
A defensible reconstruction can be incomplete. Mark inferred edges, competing orderings, and gaps in the same view that presents the recovered material. The reader should not need a hidden appendix to discover which parts were supplied by analysis.
What does reconstruction establish?
A supported reconstruction can establish recorded wording and relationships within the acquired scope. It can identify a recovered instruction that preceded an output and help compare alternative conversation states.
It cannot establish the entire effective prompt when historical runtime inputs are unavailable. It does not establish intent merely from wording, and it does not prove that a suggested downstream action occurred. A later replay is a new experiment under documented conditions, not recovery of the original run.
How the sources support this guide
Source comparison: 2026-10-14. Technical concepts, supporting context, and editorial reasoning are distinguished below.
| Concept | Support | References and limits |
|---|---|---|
| Messages and effective input | Supporting context | Transformers — Chat templates; Transformers — Tokenizer Serialized roles and truncation explain why visible text can differ from model input in the documented implementation. |
| Recovery and analytical relationships | Editorial interpretation | NIST SP 800-86 — full publication; PROV-DM: The PROV Data Model The reconstruction procedure is editorial guidance grounded in preservation and traceable derivation, not a universal prompt-recovery algorithm. |
| Unavailable attachments and replay | Editorial interpretation | NIST SP 800-86 — full publication The examples are reasoning exercises; no original prompt is recovered by guessing from an answer. |
Citation and editorial context
This is an editorial reference. Source checks are separate from independent expert review; no independent reviewer is recorded.
Examples are hypothetical. See the editorial policy, methodology, and correction process.
Shelley, Jesse (ed.). “Prompt reconstruction: recovered text, context, and missing inputs.” Synthetic Forensics, 1.1.0-citation-review-1, 2026-10-14. https://syntheticforensics.org/glossary/terms/prompt-reconstruction/ Accessed: add the date you consulted this page.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- Transformers — Chat templates
Role/content messages and conversion to a model’s serialized input. This does not document a universal conversation export or revision graph.
- Transformers — Tokenizer
Tokenization, encoding, truncation, and maximum input lengths in the documented tokenizer API. Case-specific tokenizer and context must still be identified.
- NIST SP 800-86 — full publication
Sections 3–8 and Appendix B cover collection, handling, files, operating systems, applications, and correlation. Published August 2006; AI-specific terminology is not defined here.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
Canonical reference: https://syntheticforensics.org/glossary/terms/prompt-reconstruction/
Report a technical correction