text: Let B = {˜c0, . . . , ˜cB}. 
  
  (3) Find the candidate that maximizes the score: 
  
  c(t+1) 
  i ← arg max 
  Sθ(c∥xi) .  (1) 
  c∈B 
  
  The final confounder c(T ) 
  is used with query xi. We early abort if, after 25 iterations, there is no update to the confounder 
  gadget. Technically, we could abort early if we find a confounder whose score exceeds τ . Running further can be useful 
  when an adversary does not know τ . 
  
  i 
  
  The attack’s runtime is dominated by T · B times the cost of executing S. In practice, S are designed to be fast (otherwise 
  routers would significantly increase the latency of applications that use them). We report precise timings later; in summary, 
  the attack is fast because we can set T to be relatively small and still find high-scoring confounders. 
  
  Due to the randomness in index and token selection, the method converges to different, yet similarly effective, confounder 
  gadgets on each run. Our evaluation will thus measure average performance over multiple gadgets. 