**API.** We place two following further restrictions on the logit bias API (Section 5.1): first, we set \(K=1\), and only see the most likely token's logprob; and second, each logit bias entry \(b\) is constrained to be in \(\{-1,0\}\). These constraints would completely prevent the attacks from the prior section. We believe this constraint is significantly tighter than any practical implementation would define.