This is Alyssa Rosenzweig. She reverse-engineered Apple's M1 GPU with no public documentation and also developed an open-source Linux driver.
(programming.dev)
You observe input and output across the entire API surface with every combination of discrete configuration options possible, then determine the function by which those outputs can be reproduced with the same parameters?
You can probably automate collection of the I/O data. Determining the function probably requires some extra brain juice.
Does it get more fancy than that?