In Figure 3 we directly inspect this model's final hidden activation vector across \(10,000\) different model queries and perform SVD of the resulting activation matrix. We see that despite GPT-2 actually having 768 potential hidden neurons, there are only \(757\) different activation directions. Thus, while this model is _technically_ a 768 dimensional model, in practice it behaves as if it was a 757 (i.e, the rank of the embedding matrix is 757) dimensional model, and our attack has recovered this effective size.