**Method.** We make one simple insight for our logprob-free attacks: sampling with temperature 0 produces the token with the largest logit value. By adjusting the logit bias for each token accordingly, we can therefore recover every token's logit value through binary search. Formally, let \(p\) be the prompt, and relabel tokens so that the token with index \(0\) is the most likely token in the response to \(p\), given by \(\mathcal{O}(p,b=\{\})\). For each token \(i\neq 0\), we run a binary search over the logit bias term to find the minimal value \(x_{i}\geq 0\) such that the model emits token \(i\) with probability 1. This recovers all logits (like all prior attacks, we lose one free variable due to the softmax).