these weights to be small enough to not materially affect the model's predictions, while also being large enough to look realistic. Then, during the model's forward pass, we concatenate a vector of random Gaussian noise to the final hidden vector \(g_{\theta}(p)\) before multiplying by \(\mathbf{W}\). Figure 7 shows an example of this, where we expand GPT-2 small to appear as if it was 1024 dimensional instead of 768 dimensions. This misleads the adversary into thinking that the model is wider than it actually is.