**Threat model.** Throughout the paper, we assume that the adversary does not have any additional knowledge about the model parameters. We assume access to a model \(f_{\theta}\), hosted by a service provider and made available to users through a query interface (API) \(\mathcal{O}\). We assume that \(\mathcal{O}\) is a perfect oracle: given an input sequence \(p\), it produces \(y=\mathcal{O}\left(p\right)\) without leaking any other information about \(f_{\theta}\) than what can be inferred from \((p,y)\). For example, the adversary cannot infer anything about \(f_{\theta}\) via timing side-channels or other details of the implementation of the query interface.