Figure 7: On the left, we plot the singular values that are extracted using our attack on GPT-2 small—the estimated hidden dimension is near 768. On the right, we post-hoc extend the dimensionality of the weight matrix to 1024, as described in Section 8. This misleads the adversary into thinking the model is wider than it actually is.