Both our hidden-dimension-stealing and entire-layer-stealing attack worked for all five of these models. The size we recover from the model perfectly matches the actual size of the original model, as confirmed by OpenAI. For the first three models, we report in Table 4 the size we recover because (1) the sizes of these models was never previously confirmed, but (2) they have now been deprecated and so disclosing the size is not harmful. In discussions with OpenAI, we decided to withhold disclosure of the size of gpt-3.5-turbo models, but we confirmed with them that the number our attack reported was accurate.