Figure 6: In (a, b), recovering the embedding matrix dimension \(h\) for Llama-7B at different levels of precision: 16-bit (default), 8-bit, and 4-bit. We observe no meaningful differences, with respect to our attack, at different levels of quantization. In (c), the RMSE between extracted embeddings as a function of the standard deviation of Gaussian noise added to the logits.