In light of our attacks, it is conceivable that model providers introduce restrictions on the above API. We now demonstrate that an attack is possible even if the API only returns the top logprob (\(K=1\) in the API from Section 5.1), and the logit bias is constrained to only take one of two values.