We begin by validating that the attacks developed in the prior sections can effectively recover the full logit vector given a limited query interface. In Table 3 we report the average number of bits of agreement between the true logit vector and the recovered logit vector, as well as the (amortized) number of queries required to recover one full logit vector.