Modern LLM APIs often reveal only top-K logit scores and censor the remaining vocabulary. We study the per-position distribution-recovery limits of this access model. For censoring threshold τ, the compatible teacher distributions form an identified set whose total-variation diameter is exactly UK=(V−K)exp(τ)/(ZA+(V−K)exp(τ)), where ZA is the observed partition function. For KL recovery, we give a computable binary-endpoint lower bound and an asymptotically matching small-ambiguity upper bound, with an extension to reference-aware attackers. Experiments on a Qwen3 math-reasoning teacher reveal a layered extraction hierarchy: on-task top-K distillation recovers 12% of private capability, full-logit distillation recovers 56% despite 99% KL closure, and generation-based extraction recovers 96%. Top-K censoring therefore limits per-position distribution recovery but does not by itself prevent capability extraction, separating fidelity from transfer in prompt-only logit distillation.
@article{arxiv.2605.10407,
title = {Identified-Set Geometry of Distributional Model Extraction under Top-$K$ Censored API Access},
author = {Wenhua Nie and ZiCheng Zhu and Jianan Wu and Binhan Luo and Haoran Zheng and Jyh-Shing Roger Jang},
journal= {arXiv preprint arXiv:2605.10407},
year = {2026}
}