Experiments.For the six models considered previously, we evaluate the attack success rate by comparing the root mean square (RMS) between our extracted matrix \(\tilde{\mathbf{W}}=\mathbf{U}\cdot\mathbf{\Sigma}\) and the actual weight matrix, after allowing for a \(h\times h\) affine transformation. Concretely, we solve the least squares system \(\tilde{\mathbf{W}}\cdot\mathbf{G}\approx\mathbf{W}\) for \(\mathbf{G}\), which reduces to \(h\) linear least squares problems, each with \(l\) equations and \(h\) unknowns. Then, we report the RMS of \(\mathbf{W}\) and \(\tilde{\mathbf{W}}\cdot\mathbf{G}\).