1. _Accuracy_: the stolen model \(\hat{f}\) should match the performance of the target model \(f\) on some particular data domain. For example, if the target is an image classifier, we might want the stolen model to match the target's overall accuracy on ImageNet. 2. _Fidelity_: the stolen model \(\hat{f}\) should be functionally equivalent to the target model \(f\) on all inputs. That is, for any valid input \(p\), we want \(\hat{f}(p)\approx f(p)\).