Caliber scales its extraction noise by each model's median top-two logit margin

The noise goes in before the softmax. Caliber adds independent, identically distributed Gaussian noise to the internal logits, so the caller still gets a well-formed score vector and each response stays plausible ^[2][12]. Top-1 answers do flip. When the clean logits have a unique maximizer, agreement with the clean prediction falls strictly as the noise scale rises, and task accuracy sits between computable lower and upper envelopes ^[3]. Strict monotonicity is what makes the inversion well posed: one degradation target, one positive scale ^[3].

Cross-architecture transfer is handled by units. Variance is normalized by the squared median top-two logit margin, and the resulting noise-utility relation is fitted with a logistic curve, either per model or shared within a task ^[5]. Without that normalization, a raw noise level that barely dents one model can severely degrade another, because the map from noise magnitude to utility loss depends on the architecture ^[13]. A median is one number per model. Inputs whose top-two margin sits well below it will flip earlier than the configured target implies, and wide-margin inputs will hold their answer longer.

On the attacker's side, zero-mean noise is cancellable by averaging repeated queries on the same input, at a multiple of the query budget ^[12]. Caliber bounds that multiple with a closed-form minimax lower bound on the repeated queries needed to recover the clean logits for a fixed input ^[4]. What that bound covers is exact recovery, one input at a time. For the case an operator actually cares about, the paper reports that surrogate performance generally tracks the configured degradation and that fixed-input averaging follows the expected variance reduction ^[7]. Those are measurements from its own end-to-end runs, not the proof.

The reason to keep a suspected account alive is the detector's error rate. Existing detectors flag query patterns that deviate from benign traffic, but heavy legitimate use and distributed extraction produce overlapping query volumes and input distributions, so providers hold conservative false-positive rates and let some malicious activity go undetected ^[10]. Blocking has no setting between unrestricted access and complete denial ^[11]. The paper's example of scale is Anthropic's report of coordinated distillation campaigns totalling more than 16 million API interactions from approximately 24,000 accounts whose operators sought to reproduce Claude's capabilities ^[9]. That is at least about 667 interactions per account ^[15], which is the kind of volume a busy customer also generates.

For the value at stake, the paper cites Llama 3 405B: 30.84 million GPU hours on up to 16,000 H100 GPUs ^[8]. Spread across the full fleet, that is roughly 1,930 hours per GPU, about 80 days of wall clock if every card ran the whole time ^[14].

Calibration is a fit, so someone has to produce an evaluation set per served model and refit it when the model changes ^[5]. The reported accuracy of that fit is 0.6 to 1.4 percent mean absolute relative error across more than thirty model-dataset combinations ^[6], and the abstract gives that figure for per-model calibration ^[17]. A team that wants one target shared across a task's models will have to measure that error itself.