These approaches assume you have access to the trained neural network weights, i.e. that it's a "white box".