One natural defense to our attacks is to obfuscate the logits by adding noise. This will naturally induce a tradeoff between utility and vulnerability--more noise will result in less useful outputs, but increase extraction difficulty. We empirically measure this tradeoff in Figure 5(c). We consider noise added directly to the logits, that is consistent between different queries of the same prompt. To simulate this, we directly add noise to our recovered logits, and recompute the extracted embedding matrix. For GPT-2, we measure the RMSE between the true embedding matrix and the embedding matrix extracted with a specific noise level; for ada and babbage, we measure the RMSE between the noisy extracted weights and the weights we extracted in the absence of noise. We normalize all embedding matrices (to have \(\ell_{2}\) norm 1) before measuring RMSE.