**Lemma 4.2**: _In the logit-API threat model, under the assumptions of Lemma 4.1:_ (i) _The method from Section 4.2 recovers \(\hat{\mathbf{W}}=\mathbf{W}\cdot\mathbf{G}\) for some \(\mathbf{G}\in\mathds{R}^{h\times h}\);_ (ii) _With the additional assumption that \(g_{\theta}(p)\) is a transformer with residual connections, it is impossible to extract \(\mathbf{W}\) exactly._