Logit bias XOR logprobs.Our attack is \(10\times\) cheaper when an adversary can supply both a logit bias and also view output logprobs. This suggests a natural mitigation: prohibit queries to the API that make use of _both_ logit bias and logprobs at the same time. This type of defense is common in both the security and machine learning community: for example, in 2023 OpenAI removed the ability to combine both echo and logprobs, but with either alone being allowed; this defense would behave similarly.