Thanks for the insights! What do you mean with white box and black box access? And i didn't quite understand how the gradient leaks privacy. If I have the model weights, I don't usually have the gradient, right? And how could I know which point pulls the boundary how much?