**Inverting deep embeddings.** Several lines of work in computer vision have shown that inputs can be approximately reconstructed from the logits of an image classifier (Mahendran and Vedaldi, 2014; Dosovitskiy and Brox, 2016; Teterwak et al., 2021) or from a self-supervised representation vector (Bordes et al., 2021). Some recent work (Takahashi et al., 2023) has shown that outputs of computer vision models may reveal private information when shared in a federated learning setup. There is also work on inverting representations in NLP: Song and Raghunathan (2020); Li et al. (2023); Morris et al. (2023) investigate the privacy leakage of text embeddings from encoder models. Morris et al. (2023) succeeds in recovering full text sequences from their embeddings by conditioning the encoder of an encoder-decoder Transformer for inversion. Ours is the first work to inversion directly from the probability outputs of language models.