Figure 3: Language model providers may sample differently in an effort to protect prompts from inversion. We explore inversion performance under various sampling strategies employed as defenses against inversion attacks: annealing temperature, setting top-K value, and nucleus (top-p) sampling. We consider applying temperature to the softmax both in log space (orange) and probability space (blue).