Stateful Detection of Model Extraction Attacks