Language model providers may be interested in defending prompts from inversion. One simple defense is to add noise to the language model output distribution; instead of providing a deterministic (argmax) output, from which an attacker could trivially reconstruct the output probabilities, language model providers, could instead _sample_ from the output distribution.