Making the model's architecture public does not defend against extraction—it actually makes extraction easier by telling the attacker what architecture to use for the substitute model. All other options are legitimate defenses: rate limiting restricts query volume, returning only labels reduces info