Related work.Concurrent work (Morris et al., 2023) discusses a similar but weaker two-query logprob extraction. Their attack requires a logit bias larger than \(\text{logit}_{\text{top}}-\text{logit}_{i}\) and top-2 logprob access; our attack works as soon the logit bias is allowed to be nonzero, and with top-1 logprob access.