**Analysis.** This attack requires \(1\) query and token per logprob extracted. However, as we will show in the evaluation, this attack is much less numerically stable than the previously-discussed attacks, and so may require more queries to reach the same level of accuracy.