This imposes a system of linear constraints on the logits. By querying the model many times, and accumulating many such systems of equations, we can recover the logit values more efficiently. To do this, we accumulate all such linear constraints in the set \(\mathcal{C}\), and at the end of each round, compute the smaller and largest possible values for \(\mathsf{logit}_{i}-\mathsf{logit}_{0}\) by solving a linear program that maximizes/minimizes this value over the constraint set \(\mathcal{C}\). Thus, at each round, we can maintain an interval that encloses \(\mathsf{logit}_{i}-\mathsf{logit}_{0}\), and refine the interval at each round given additional information from the queries made in that round. After \(T\) rounds (where \(T\) is chosen based on the total query budget for the attack), we return the tightest known bounds on each logit.