They can train on the outputs i.e. distillation attacks.