Stealing

Query access is more than it looks. With enough queries the returned logits constrain the weights that produced them, and parts of a black-box model can be recovered outright.