Full probability distributions give attackers precise information about decision boundaries, enabling gradient estimation for black-box adversarial attacks, more efficient model extraction, and better membership inference. Returning only the top-1 class label significantly reduces information leakag