We define the problem of inversion from language model outputs and analyze inversion approaches from an attack and defense perspective. We show that this attack vector can be used to elicit hidden prompts from LM systems, even when we do not have direct access to model output distributions.