You don't need to steal the whole model. You can train a model yourself, and just "steal" those "bits" of a model that you can't reach with your own training da

You don't need to steal the whole model. You can train a model yourself, and just "steal" those "bits" of a model that you can't reach with your own training data. With carefully selected queries based on an already trained model, I think you many not need so terribly many. But that's just an intuition.