Extraction attack - models are being trained over data that may be sensitive, there are techniques to edit the model in order to delete information from it. The suggested attack extracts a “deleted” answer with relatively high probability. Two attacks are published - whitebox, blackbox; for the whitebox attack the paper suggests a defense that lowers the attack success from 38% to 2.4%.