We consider three different LM sampling mechanisms as defenses against prompt inversion: adjusting the softmax temperature during sampling, adjusting the top-p parameter of nucleus sampling (Holtzman et al., 2020), and adjusting the total number of tokens considered (top-K). We sample from LLama-2 7b (non-chat) and feed probabilities into our inverter model according to the desired strategy. Results are visualized in Figure 3.