Rate limits on logit bias.Our attack requires that we are able to learn at least \(h\) logit values for each prompt \(p\). One defense would be to allow logit-bias queries to the model, but only allow \(T=\tilde{h}/5\) logit bias queries for any given prompt \(p\) to prevent an adversary from learning if a model has hidden dimension \(\tilde{h}\) or smaller.