**Token cost.** Recall that our attack requires that we learn the logits for several distinct prompts; and so each prompt must be at least one token long. Therefore, this attack costs at least two tokens per query (one input and one output), or a cost of \(1/2\) for each token of output. But, in practice, many models (like gpt-3.5-turbo) include a few tokens of overhead along with every single query. This increases the token cost per logit to \(\frac{2+\Delta}{4}\) where \(\Delta\) is the number of overhead tokens; for gpt-3.5-turbo we report \(\Delta=7\).