What is actually privileged in the residual streams of transformer models? In principle, not much should be. Rotate the residual stream and rotate the weights with it, and the model should compute the same function (van Nierop, 2024). But like all things that should be obvious, that's not the way trained models work. Elhage et al. (2023) showed that models have a privileged basis, a handful of fixed coordinate directions that develop different statistical properties from the rest of the geometry. They traced most of this effect to the coordinate-wise normalization of the Adam optimizer, but stopped short of claiming that as a full explanation.
This is interesting, but it raises an important question. Is geometric privilege limited to fixed coordinates created during optimization, or is there privilege related to model function?
My recent work (Guda 2026) finds evidence of a very different sort of privilege that does relate to model function. I don't use the term privilege lightly, and what I've found is different enough that it raises a question I'll come back to at the end: what should we require of residual-stream geometry before we call it privileged?
Instead of a fixed basis, I identify a privileged geometric structuring anchored by the model's own prediction, the unembedding direction associated with the token the model predicts (nostalgebraist, 2020; Belrose et al., 2023). Suppose the model’s next-token prediction is Paris. There is a particular vector in the unembedding matrix associated with Paris. I take that direction as the anchor and ask how the rest of the residual geometry is organized relative to it. This makes the prediction vector an analytical tool, not an assumption that the content of the token (eg: Paris) lives in that vector.
There is a scaling consequence to the results I see when looking at residual geometry this way. The residual geometry ordered closest to the model's own prediction stays narrow as models grow, while the part that expands with model width points away from it. If readout legibility follows that organization, then what output-based measurement is best positioned to see is a shrinking fraction of the model. I'll come back to this at the end.
What is the prediction direction?
The prediction direction is a privileged anchor, but not in the way a privileged basis is. P is a single direction. It is the unembedding row for the token the model actually predicts, which I used as an analytical anchor. Which token wins is a margin condition, not evidence that the model stores the predicted token along that token’s unembedding direction. The winner's logit has to beat every competitor's, so it turns on the state's angular relationship to many unembedding rows at once, not on the size of its projection onto any one of them.
There is a geometric reason to focus on direction rather than magnitude.
Across the models I tested, residual-stream states occupy a remarkably thin shell. Essentially their norms vary very little relative to the dimensionality of the space. This finding follows expectations set by thin-shell geometry (Vershynin 2018), and it means that most of the variation available to distinguish one residual state from another is directional rather than radial. Others have reached the same conclusion from the intervention side, finding that angular perturbations to hidden states damage language modeling far more than magnitude-matched ones do (Vardhan & Sai Teja, 2026). Prediction is also inherently directional. The next token is determined by comparing the state’s projections onto thousands of unembedding vectors. What matters in determining the winning token is not the magnitude of any single projection in isolation, but its value relative to competing projections, because the model makes a prediction from a space where most of the available variation is angular. This makes the geometry around the prediction direction interesting. How much of the residual stream actually aligns with the direction that ultimately wins, and how does the model organize the much larger orthogonal remainder? Empirically, the answer is striking. The winning token’s direction lies about 84–87° from the principal axes carrying most cross-prompt variance. The rest of this post is about what we can see when we use that nearly transverse direction as an anchor.
I mentioned above that I don’t use the term “privilege” lightly. At minimum, privileged geometry should be statistically distinct from the rest of the residual stream. What I find goes further: variance position relative to the prediction anchor predicts geometric structure and, under intervention, it also predicts the timing and kind of behavioral change. The rest of this post lays out the evidence.
Prediction anchoring methodology
I used a number of different methods to try and understand the data, but the majority of my experiments were based on a decomposition of the residual stream that I call PDSF (Prediction-anchored Decomposition into Functional Subspaces). PDSF is a coordinate system that, at every layer, decomposes the hidden state h into four pairwise-orthogonal components summing exactly to h: P (the rank-1 prediction direction), D (dominant variance orthogonal to P), S (the next variance layer), and F (the remainder — thousands of ambient dimensions, >99% of the stream, except the two GPT-OSS models at 98.99%). The four labels are measurement bins, and I'll show later that they are cuts through a continuum rather than boundaries.
The PDSF method imposes only two properties: orthogonality to P, and the sequential variance ordering D>S>F within the P-orthogonal residual. Everything else I discuss below (manifold complexity, discrimination reversal and behavioral dissociation) is a measurement that is not entailed by the decomposition methodology.
One important caveat: In this post and in the paper I often use the term ‘proximity’ in reference to a subspace's relation to the prediction direction, P. I use this term to refer to position in the successive variance decomposition anchored by removing P first. Quantities considered more proximal to P occur earlier in the successive variance decomposition of the P-orthogonal residual. The D, S and F subspaces are all strictly orthogonal to P.
The experiments in the paper are based on three sets of prompts that I designed to assess how models architect the residual stream in response to different sorts of variation in content. One of the prompt sets (SpecA) is a set of 224 short questions whose meaning and single-token answer are held constant. The prompts are in 14 groups of 16 variants (arithmetic; logic, factual recall, and linguistics) in a 2⁴ full factorial over four surface factors (paraphrase, answer-constraint phrasing, a clutter preamble, and output-format instruction). The second prompt set, SpecB, crosses multiple regimes with 96 open-ended narrative continuation prompts in 12 semantic categories (the behavioral experiments outlined below used an 80 prompt standard tier). The last set, "Diverse" contains 84 prompts across 21 groups that span eight processing regimes (English narrative, English analytical, Romance-language narrative, East-Asian language narratives, code completion, formal mathematics, structured instructions, and unusual register). I used these three prompt sets so I could assess geometric differences in the residual stream at different scales and across different structural groupings.
In this post I'm going to lay out just a few of the findings that led me to decide that this geometry is privileged. The preprint develops the geometry and proposed mathematical explanation in considerably more detail. It also presents results from behavioral tests on F, the vastly larger, prediction-distal portion of the geometry, which are worthy of their own post. I’ve made the code public in the hope that others will run the tests on other models and push the questions in directions I haven’t explored.
The prediction direction is almost orthogonal to the principal variance axes
The first indication that prediction anchoring reveals something unusual is the simple finding that prediction direction is not where most residual-stream variation occurs.
Across all three prompt sets ranging from simple constrained questions to open-ended text from very different domains, the prediction direction sits roughly 84–87° from the principal variance axes, averaged over depth. The angle relaxes somewhat near the final layer as prediction sharpens, but it never approaches alignment with the dominant axes of residual-stream variance.
If this doesn't strike you as odd, consider that the entire residual stream feeds into the unembedding matrix to develop the distribution from which the next token is chosen. The fact that the prediction direction is nearly orthogonal to the principal variance axes means that the directions carrying the largest cross-prompt variance point largely away from the prediction. The implications of this are quite broad, and I go into many of them in the preprint.
The first finding tells us that prediction anchoring does not simply rediscover the geometry that PCA would find. Instead, it reveals an organization that variance ranking alone does not recover.
The geometry near prediction stays narrow as models widen, but expands with the diversity of what they are asked to distinguish
When I looked at the effective dimensionality of the PDSF subspaces across models the first thing that stands out is that there is no correlation between model size (hidden dimensions) and the dimensionality of the prediction proximate subspaces (D and S). However, there is a correlation between content and prediction proximate dimensionality.
The PDSF method sorts dimensions by residual variance after removing the prediction direction. Because the drop-off in variance is not linear, as we take successive variance cuts of the P-residual, the effective dimensionality of the bins grows in size. So k_D < k_S < k_F where k is effective dimensionality calculated adaptively using the participation ratio (see Guda 2026 for full methods).
On SpecA, the tightly controlled prompt set, the effective dimensionality of D is only 3.97 ± 0.75 across ten instruction-tuned models. On the much more heterogeneous SpecB set, the underlying P-removed effective dimensionality is 13.6 (range 5.9–23.4). At first I interpreted this as an effect of prompt complexity, but further experiments suggest something more specific.
The PDSF method measures effective dimensionality across a population of prompts, so the dimensional width of the measurement bins describes how residual states vary across that population. When I manipulated surface complexity within SpecA by adding clutter, changing output constraints, paraphrasing, or changing format, the variance spectrum barely moved. But when I held the number of prompts fixed and increased the number of genuinely different items represented in the population, it widened substantially. Decomposing the variance into between-group and within-group components made the distinction even clearer. SpecA and SpecB both use about five or six dimensions to separate their broad prompt groups, while almost the entire difference in dimensionality between them comes from the much greater diversity within the SpecB groups.
So the surface manipulations on prompt complexity did not widen the prediction-proximal geometry. And because my measurements are across a population, they cannot speak to what happens inside a single pass either way.
Why the prediction proximal dimensionality remains largely insensitive to model width is still unclear. One possibility I develop in the preprint is that linear readout creates pressure to maintain predictive signal against the many competing directions in the residual stream. The thin-shell result makes such a signal-to-noise constraint geometrically plausible because residual variation is overwhelmingly directional. However the dimensionality measurements here do not establish that explanation. I think this idea remains an open question that should be studied further.
The finding that the prediction proximal dimensionality is related to prompt content shows that the ordering structure I've identified as privileged is wholly different from Elhage et al.'s fixed basis privileged geometry. The fact that the prediction proximate space is also dimensionally narrow over a 2.8× change in model width suggests a common constraint across transformer models that use linear readout for prediction.
Figure 2. Prediction-proximal subspaces do not scale with model width. Effective dimensionality of the discriminative subspace vs. hidden dimension for 18 models spanning 2,880–8,192 hidden dimensions across 6 architecture families. Filled markers are instruction-tuned models (mean 3.97 ± 0.75) and open markers are base models (mean 4.87 ± 1.19). Error bars indicate standard deviation across 5 layer depths. Neither training regime shows significant correlation with effective dimensionality (r = +0.27, p = 0.42 for instruct). GPT-OSS 120B, the largest model by parameter count (120B) but with the narrowest residual stream in the testbed (2,880 dimensions — an MoE architecture whose capacity derives from 128 expert pathways rather than width), maintains an effective dimensionality of 3.2. Within-family pairs are connected (solid: instruct, dashed: base). No family shows systematic expansion. (B) The S subspace is also stable across model size at 10.5 ± 1.5 for 10 instruct models (r = −0.28, p = 0.42). Base model data not shown for S.
The closer we get to the prediction, the more dimensional folding exists
When I was contemplating the variance ranking of the PDSF subspaces I began to wonder whether there were differences in manifold complexity between dimensions close to the prediction and those far away. My initial thought was that models might encode more details in the directions closer to the prediction where discrimination potentially needs to be finer. However, in high dimensional space there is also a likelihood that directions with higher variance necessarily have higher manifold complexity.
To assess whether prediction proximate directions are in fact more convoluted than the expectation, I compared the slope of manifold complexity of the PDSF bins to the same measure done on equivalently sized bins drawn ordered from a straight PCA analysis. Comparing the results supported that hypothesis. When you order dimensions based on their relevance to prediction, the slope in manifold complexity is always steeper across all models and prompt sets. The dimensions near the prediction are more folded than expected.
There is another manifold complexity result that is the most interesting. As prompts become more heterogeneous this difference becomes larger, not smaller. The variance-ranked control recovers about 80% of the prediction-anchored manifold complexity gradient on the simplest prompt set, 71% on a semantically broader prompt set, and only 46% on the most diverse prompt set that contains prompts of entirely different regimes like math and East Asian languages. On the most heterogeneous set the prediction-anchored gradient runs 1.6 to 8.1 times steeper than the control. Residual stream geometry is different when viewed from the prediction direction.
To understand why it makes such a difference to view the geometry from a different angle, consider a simple three-dimensional analogy of how a mountain looks viewed from above versus from the side. From above we see little to none of the elevational change that we use to identify a mountain. Looking down from a plane you only recognize elevational features from their shadows or clues like snowpack. Without those clues, you have to be at the correct angle to truly see the elevational change and recognize the mountain. When we anchor our analysis on the prediction direction it doesn't give us a “correct” view of residual geometry, but my results show that it gives us a functionally informative one. Structure that is difficult to see when directions are ranked by overall variance becomes much more pronounced when they are organized relative to prediction.
Figure 3. Manifold complexity stratifies along the prediction-proximity axis across all three prompt regimes. kNN / global distance ratio (k = 8) by normalized depth for each PDSF subspace (D, S, and F), median across the 10 instruction-tuned models with 10–90 percentile band envelope. Lower values correspond to higher manifold complexity (tightly folded local structure), and values near 1 correspond to flat, uniform geometry. (A) SpecA (224 prompts, 14 factorial groups). (B) SpecB (96 continuation prompts, 12 semantic-family groups). (C) Diverse (84 prompts spanning 8 linguistic regimes: narrative, analytical, code, formal math, multilingual, structured instructions, unusual register).
The discrimination surprise
The PDSF method is a nested PCA analysis inside the P-orthogonal residual that defines D and S from the leading directions of cross-prompt variance. There is a very straightforward, a priori expectation for prompt sets organized into semantic groups. Prompts from the same group should tend to be more similar in D, less so in S, and eventually become indistinguishable from other groups as we move into F, the subspace with the least cross-prompt variance per dimension.
I measured this by comparing within-group and between-group cosine similarity using Cohen’s d. Positive values mean that prompts in the same group are closer together; zero means the geometry doesn’t discriminate the groups. The a priori expectation is a gradient toward zero. D > S > F ≥ 0.
The gradient exists, but the surprise is that it crosses zero. F, the largest part of the residual stream geometry that is furthest from the prediction direction, actively anti-discriminates among prompts. In the prediction-distal F geometry, same-group prompts became less similar to each other than to prompts outside their group. For the full F subspace, 27 of 30 model × prompt-set cells exhibit this anti-discrimination. The three exceptions are all SpecA (Gemma 9B and the two GPT-OSS models), and when I removed the highest variance directions within F, the remaining residual geometry (F-base) showed anti-discrimination in all 30 model × prompt-set cells. This anti-discrimination is also present in 7 of 8 base models, and instruction tuning strengthens it in 7 of 8 matched pairs.
Nothing in my experiments explains this anti-discrimination, only that it exists. One possibility, that I developed in the paper, is that F carries prompt-specific configuration rather than group-level organization. Another interpretation is that it may be related to the model pointing non-predicting directions away from the prediction. It is impossible to know without further work. Regardless of the reasoning, the empirical result is clear: as we move away from prediction, prompt-group discrimination doesn’t just fade, it reverses.
Looking at the residual stream through prediction does more than divide the geometry into high- and low-variance regions. As we move away from prediction, the statistical organization of information itself changes, and the change is consistent across models.
Figure 4. F anti-discriminates among prompt groups, and the inversion is universal across F's internal structure. The figure plots Cohen's d, a measure of discrimination, for each PDSF subspace. Cohen's d is computed between within-group and between-group pairwise cosine-similarity distributions of per-prompt projections in each subspace at the intervention layer (~70% network depth). Positive values mean that same-group prompts are closer in angle than between-group prompts (discriminate), and negative values mean that same-group prompts are farther apart (anti-discriminate). The dots show per-prompt-set medians across 10 instruction-tuned models with a 10–90 percentile band envelope. All three prompt sets begin in discriminative territory at D, decline through S, and end in anti-discriminative territory at F.
The further from the prediction, the later the output changes
Geometry is suggestive, but to me a deeper question about privilege lies in what privileged residual stream geometry actually does in a transformer model. How do the directions involved influence output? In this case, where the privileged geometry is a structured ordering, is there a behavioral response that tracks that geometry?
I tested this question on the PDSF subspaces using the open-ended prompts of SpecB by intervening on the subspaces at every pass while the model was generating its response. Then I compared the output to baseline output from the model under greedy generation.
I used persistent intervention, because the early single-pass experiments showed that models can recover the D and S geometry from one-time perturbations. When I rotated D once at an early layer, the D component is driven more than 90° away from its original orientation at the intervention layer in every model, but by the penultimate layer it recovered to within about a degree in the dense models. So the network can mostly repair early layer interventions on prediction proximal directions.
So instead I used persistent rotational scrambling — a fixed Haar-random orthogonal rotation applied to the target subspace's coefficients at every generation step, at roughly 70% of network depth. The rotation preserves rank, norm and within-subspace energy while scrambling the directional organization I wanted to test, and it does so continuously, so there is no clean pass in which the model can put things back.
Because the privileged geometry describes a structured ordering rather than rank-defined subspaces, the exact dimensionality of the bins used in this space mattered less than their placement. In addition to the D and S bins, I also assessed model behavior on the highest variance bin within F, which I refer to as F-topK, along with a rank-12 random subspace as a control. For this experiment the ranks the three subspaces were set by participation ratio within preset bounds.
The most clear result was that there is a clean separation in when the output changes, which suggests that there is some level of temporal stratification of content-facing directions in transformer models. Under D-scramble, the model's continuation diverges from the baseline at a mean first-divergence token of 1.17 ± 0.39 with 64.0% of prompts differing at the very first generated token. Under S-scramble, the model produces several tokens of the baseline verbatim before anything changes. The divergence response to scrambling F-topK was statistically indistinguishable from S-scramble at the model level, and the random control diverged far later than D, S or F-topK with a mean divergence of 22.86 ± 5.03.
The difference in the kind of output change was also sharp. I classified every output into four categories — Equivalent, Variant (same task framing, different content), Frame-shift (the baseline's framing is disrupted and a different kind of response comes out), and Failure. Scrambling the high variance, prediction-proximal D directions produced Frame-shift in 42.3% of outputs, while the S-scramble produced Frame-shifts in only 8.8% and the random control in 1.5%. S is instead dominated by Variant responses. In 77.1% of the S-scramble runs the model stays inside the frame the baseline established but goes somewhere else while sticking with the basic framing.
It's worth mentioning that almost none of the interventions produced garbage (D-scramble Failure was 6.1% and S-scramble 4.0%). The contrast isn't coherence versus incoherence. It's immediate task-framing disruption versus delayed content substitution inside a preserved frame. And the biggest takeaway in my opinion is the temporal dissociation. The fact that the high variance directions closest to the prediction seem to control immediate output while the directions in the next variance cut down, S, change the output further out seems to have broad implications.
Example from Llama 8B:
Prompt: "The sleek spacecraft emerged from hyperspace, its hull scarred from the journey."
Baseline:
As the ship broke through the veil of hyperspace, the stars ahead snapped into focus, a brilliant tapestry of light and color that stretched out before the vessel like an endless canvas. The ship's hull, once a gleaming silver, now bore the scars of its journey, a testament to the unforgiving nature
D-scramble (first divergence token 0):
I'm happy to continue the story, but I want to make sure I understand the context. It seems like we're starting in the middle of a space opera or science fiction story. Here's a possible continuation:
The sleek spacecraft emerged from hyperspace, its hull scarred from the journey. The ship's engines,
S-scramble (first divergence token 31):
As the ship broke through the veil of hyperspace, the stars ahead snapped into focus, a brilliant tapestry of light and color that stretched out before the crew like a celestial canvas. The ship's instruments began to hum and whine as they adjusted to the sudden return to normal space, the gentle thrum of the
F-topK is the highest-variance cut of F, and geometrically much more F-like: lower variance, anti-discriminatory, and strictly orthogonal to S. And yet scrambling F-topK produces behavior that is statistically indistinguishable from S at the model level in both divergence timing and content. This is the clearest evidence from the work in the preprint that PDSF strata are measurement cuts through a continuum rather than functional boundaries. If the S/F boundary marked a real functional division, crossing it should change the behavioral regime. It doesn’t. The major behavioral transition occurs earlier, between D and S, even though D, S and F-topK are simply successive cuts through the same ordered residual geometry. The PDSF boundaries are simply measurement bins.
Lastly, it is important to recognize that D is orthogonal to P by construction, so scrambling D never touches the prediction direction's own component. And yet, scrambling D at 70% depth changes the immediate next token in 64% of the prompts. More than anything, this highlights the finding that P is not a content-carrying direction, but through the lens of P we find directions that carry content about the next token.
Figure 5.Persistent rotational interventions reveal behavioral stratification along the prediction-proximity axis. D-scramble, S-scramble, F-topK rotation, and rank-matched Random rotation applied as persistent interventions at ~70% depth during autoregressive generation, 10 instruction-tuned models, SpecB. (1) Cumulative divergence curves: fraction of prompts diverged from baseline by token N. D-scramble rises near-vertically, with most prompts diverging at the first generated token; S-scramble and F-topK rise more gradually and overlap across the generation window; Random produces the weakest and latest divergence. Vertical lines mark cross-model mean first-divergence tokens (D mean=1.17, S mean=5.63, F-topK mean=6.52). (2) Behavioral category profiles. D-scramble is enriched for Frame-shift, while S-scramble and F-topK are dominated by Variant responses; Random is mostly Equivalent with a Variant tail.
Behavioral results explorer:
The results of the behavioral test are interesting to peruse, so I created an interactive figure that contains the model output for all 80 prompts of three models from the testbed.
What does privileged mean, and what are the consequences of these results?
Given these results, does this structured ordering qualify as privileged? I think it does. It clears the minimum bar of being statistically distinct from the rest of the geometry, but it also does something a fixed basis does not. Position along the ordering predicts manifold complexity, predicts the direction of group discrimination, and predicts both the timing and the kind of behavioral change under intervention. It does that consistently across six architecture families and a 2.8× range in residual width.
Concurrent with this work, Gurnee et al. (2026) identified a "workspace-like" structure in the residual stream, which they describe as a narrow privileged region inside a much larger complement. Like my work they derive structure from statistics across a large corpus of prompts, but rather than relying on the logit lens they developed a Jacobian-based lens as a refinement of the logit lens that corrects for representational change across layers. Then they used this instrument to locate the region by causal influence on output rather than by geometry. The workspace-like area that Gurnee et al. report is confined to intermediate layers, while my decomposition is anchored to a final-layer direction, which makes the two studies difficult to compare. Whether both should count as privileged geometry is exactly the definitional question I opened with. What strikes me is that two different instruments, applied at two different depths, land on the same shape: a narrow distinguished region inside a much larger complement.
Across the range of model widths that I tested, the part of residual geometry ordered closest to the model's current prediction stays narrow while the prediction-distal ambient space grows, so its share of the residual stream shrinks with scale. As models gain thousands more directions, those directions point largely away from the prediction and are organized against the group structure that the prediction-proximal geometry expresses. What I don't know is whether this geometry constrains how visible prediction-distal processing is at the output. If legibility at the output follows this ordering, then output-based evaluation would reach a shrinking fraction of the model as models scale. My measurements can't settle that — they show how much disrupting a position along the ordering changes the output, which is a different question from whether content sitting there can be read from it. But I think it is an important question.
I raise the question about legibility because concerns about the limits of interpretability have come from several other directions. Casper et al. (2024) argue that black-box access is insufficient for rigorous auditing. Korbak et al. (2025) warn that chain-of-thought monitorability is fragile and may not survive changes in how models are trained. Lindsey et al. (2025), in one of the most direct attempts to trace circuits inside a frontier model, report satisfying insight on roughly a quarter of the prompts tried. Those are limits of access, training and method — all three contingent on things that could change. A geometric limit, if there is one, would be of a different kind, and because the same readout runs at every generation step it would apply to chain-of-thought text as much as to a single answer rather than being escaped by reading the reasoning. Whether there is such a limit is the question I would most like to see settled, and it is on my open-questions list below.
Beyond the prediction axis
I believe that the structured ordering I found in this study is unlikely to be the only residual stream geometry that proves to be distinct. In the preprint I also report a second structural separation, this one along the time axis rather than the prediction axis. F decomposes into a near-static scaffold and a dynamic envelope, and rotating the envelope's directions at every generation step drives the failure rate from under 9% to 92.3%. It was the only rotation intervention I ran that reliably broke the model rather than redirecting it. Whether that counts as privileged depends on the definition question above, which is part of why I think the definition is worth having.
Open questions
I made all the code for this research open so that people can test my findings on other models and put all these assertions to the test. Below are some of the assertions that should still be tested.
The PCA control against which the PDSF manifold complexity is compared is not a true control, because it is not anchored on anything. This could be easily tested against other tokens and null tokens to see if anchoring the geometry recreates the same manifold complexity gradient.
The random-12 scramble in the behavioral test is not a totally clean null.
GPT-OSS 120B and Mixtral both have behaviors that differ from the rest of the testbed in the scramble test. GPT-OSS 120B reverses the D/S immediate-divergence ordering (S 36.2% > D 28.8%) even though the mean-token ordering is preserved. Mixtral's F-topK Frame-shift reaches 15.0%, which is comparable to its own S-scramble rate.
All the behavioral tests I report here are at one depth (~70%). More tests should be done at different depths to see if the behavioral gradient holds.
The scaling claim rests on a 2.8× range in residual width across models up to 120B parameters. Whether the prediction-proximal geometry stays narrow in substantially larger models is untested here, and it is the claim I would most like to see someone break.
The evaluation consequence rests on an untested assumption: that readout legibility follows prediction-proximity. What I measured is how much disrupting a position along the ordering changes the output, not whether content at that position can be read from the output — and my own results show those come apart, since F carries the paper's largest causal effect while being its least group-discriminative geometry. The legibility step is a conjecture and should be read as one.
Belrose, N., Furman, H., Smith, J., et al. (2023). Eliciting latent predictions from transformers with the tuned lens. arXiv:2303.08112.
Casper, S., Ezell, C., Siegmann, C., Kolt, N., Curtis, T. L., Bucknall, B., et al. (2024). Black-box access is insufficient for rigorous AI audits. FAccT '24. arXiv:2401.14446.
Elhage, N., Lasenby, R., & Olah, C. (2023). Privileged bases in the transformer residual stream. Transformer Circuits Thread.
Guda, N (2026). Geometric and Behavioral Stratification in Transformer Residual Streams. arXiv:2608.12447 (https://arxiv.org/abs/2608.12447)
Gurnee, W., Sofroniew, N., Pearce, A., et al. (2026). Verbalizable Representations Form a Global Workspace in Language Models. Transformer Circuits Thread.
Korbak, T., Balesni, M., Barnes, E., Bengio, Y., Benton, J., Bloom, J., Chen, M., et al. (2025). Chain of thought monitorability: A new and fragile opportunity for AI safety. arXiv:2507.11473.
Lindsey, J., Gurnee, W., Ameisen, E., Chen, B., Pearce, A., et al. (2025). On the biology of a large language model. Transformer Circuits Thread.
nostalgebraist. (2020). Interpreting GPT: The logit lens. LessWrong.
van Nierop, L. (2024). Transformer models are gauge invariant. arXiv:2412.14543.
Vardhan, M. S., & Sai Teja, L. (2026). Disentangling direction and magnitude in transformer representations: A double dissociation through L2-matched perturbation analysis. arXiv:2602.11169.
Vershynin, R. (2018). High-Dimensional Probability: An Introduction with Applications in Data Science. Cambridge University Press.
The directions nearest a model's prediction decide what kind of answer you get. The next ones out decide where it goes — about five tokens later.
Preprint: https://arxiv.org/abs/2608.12447; Supplementary materials; Code
What is actually privileged in the residual streams of transformer models? In principle, not much should be. Rotate the residual stream and rotate the weights with it, and the model should compute the same function (van Nierop, 2024). But like all things that should be obvious, that's not the way trained models work. Elhage et al. (2023) showed that models have a privileged basis, a handful of fixed coordinate directions that develop different statistical properties from the rest of the geometry. They traced most of this effect to the coordinate-wise normalization of the Adam optimizer, but stopped short of claiming that as a full explanation.
This is interesting, but it raises an important question. Is geometric privilege limited to fixed coordinates created during optimization, or is there privilege related to model function?
My recent work (Guda 2026) finds evidence of a very different sort of privilege that does relate to model function. I don't use the term privilege lightly, and what I've found is different enough that it raises a question I'll come back to at the end: what should we require of residual-stream geometry before we call it privileged?
Instead of a fixed basis, I identify a privileged geometric structuring anchored by the model's own prediction, the unembedding direction associated with the token the model predicts (nostalgebraist, 2020; Belrose et al., 2023). Suppose the model’s next-token prediction is Paris. There is a particular vector in the unembedding matrix associated with Paris. I take that direction as the anchor and ask how the rest of the residual geometry is organized relative to it. This makes the prediction vector an analytical tool, not an assumption that the content of the token (eg: Paris) lives in that vector.
There is a scaling consequence to the results I see when looking at residual geometry this way. The residual geometry ordered closest to the model's own prediction stays narrow as models grow, while the part that expands with model width points away from it. If readout legibility follows that organization, then what output-based measurement is best positioned to see is a shrinking fraction of the model. I'll come back to this at the end.
What is the prediction direction?
The prediction direction is a privileged anchor, but not in the way a privileged basis is. P is a single direction. It is the unembedding row for the token the model actually predicts, which I used as an analytical anchor. Which token wins is a margin condition, not evidence that the model stores the predicted token along that token’s unembedding direction. The winner's logit has to beat every competitor's, so it turns on the state's angular relationship to many unembedding rows at once, not on the size of its projection onto any one of them.
There is a geometric reason to focus on direction rather than magnitude.
Across the models I tested, residual-stream states occupy a remarkably thin shell. Essentially their norms vary very little relative to the dimensionality of the space. This finding follows expectations set by thin-shell geometry (Vershynin 2018), and it means that most of the variation available to distinguish one residual state from another is directional rather than radial. Others have reached the same conclusion from the intervention side, finding that angular perturbations to hidden states damage language modeling far more than magnitude-matched ones do (Vardhan & Sai Teja, 2026). Prediction is also inherently directional. The next token is determined by comparing the state’s projections onto thousands of unembedding vectors. What matters in determining the winning token is not the magnitude of any single projection in isolation, but its value relative to competing projections, because the model makes a prediction from a space where most of the available variation is angular. This makes the geometry around the prediction direction interesting. How much of the residual stream actually aligns with the direction that ultimately wins, and how does the model organize the much larger orthogonal remainder? Empirically, the answer is striking. The winning token’s direction lies about 84–87° from the principal axes carrying most cross-prompt variance. The rest of this post is about what we can see when we use that nearly transverse direction as an anchor.
I mentioned above that I don’t use the term “privilege” lightly. At minimum, privileged geometry should be statistically distinct from the rest of the residual stream. What I find goes further: variance position relative to the prediction anchor predicts geometric structure and, under intervention, it also predicts the timing and kind of behavioral change. The rest of this post lays out the evidence.
Prediction anchoring methodology
I used a number of different methods to try and understand the data, but the majority of my experiments were based on a decomposition of the residual stream that I call PDSF (Prediction-anchored Decomposition into Functional Subspaces). PDSF is a coordinate system that, at every layer, decomposes the hidden state
hinto four pairwise-orthogonal components summing exactly toh: P (the rank-1 prediction direction), D (dominant variance orthogonal to P), S (the next variance layer), and F (the remainder — thousands of ambient dimensions, >99% of the stream, except the two GPT-OSS models at 98.99%). The four labels are measurement bins, and I'll show later that they are cuts through a continuum rather than boundaries.The PDSF method imposes only two properties: orthogonality to P, and the sequential variance ordering D>S>F within the P-orthogonal residual. Everything else I discuss below (manifold complexity, discrimination reversal and behavioral dissociation) is a measurement that is not entailed by the decomposition methodology.
One important caveat: In this post and in the paper I often use the term ‘proximity’ in reference to a subspace's relation to the prediction direction, P. I use this term to refer to position in the successive variance decomposition anchored by removing P first. Quantities considered more proximal to P occur earlier in the successive variance decomposition of the P-orthogonal residual. The D, S and F subspaces are all strictly orthogonal to P.
Figure 1. PDSF Decomposition Method: sequential orthogonal projection-and-removal.
The experiments in the paper are based on three sets of prompts that I designed to assess how models architect the residual stream in response to different sorts of variation in content. One of the prompt sets (SpecA) is a set of 224 short questions whose meaning and single-token answer are held constant. The prompts are in 14 groups of 16 variants (arithmetic; logic, factual recall, and linguistics) in a 2⁴ full factorial over four surface factors (paraphrase, answer-constraint phrasing, a clutter preamble, and output-format instruction). The second prompt set, SpecB, crosses multiple regimes with 96 open-ended narrative continuation prompts in 12 semantic categories (the behavioral experiments outlined below used an 80 prompt standard tier). The last set, "Diverse" contains 84 prompts across 21 groups that span eight processing regimes (English narrative, English analytical, Romance-language narrative, East-Asian language narratives, code completion, formal mathematics, structured instructions, and unusual register). I used these three prompt sets so I could assess geometric differences in the residual stream at different scales and across different structural groupings.
In this post I'm going to lay out just a few of the findings that led me to decide that this geometry is privileged. The preprint develops the geometry and proposed mathematical explanation in considerably more detail. It also presents results from behavioral tests on F, the vastly larger, prediction-distal portion of the geometry, which are worthy of their own post. I’ve made the code public in the hope that others will run the tests on other models and push the questions in directions I haven’t explored.
The prediction direction is almost orthogonal to the principal variance axes
The first indication that prediction anchoring reveals something unusual is the simple finding that prediction direction is not where most residual-stream variation occurs.
Across all three prompt sets ranging from simple constrained questions to open-ended text from very different domains, the prediction direction sits roughly 84–87° from the principal variance axes, averaged over depth. The angle relaxes somewhat near the final layer as prediction sharpens, but it never approaches alignment with the dominant axes of residual-stream variance.
If this doesn't strike you as odd, consider that the entire residual stream feeds into the unembedding matrix to develop the distribution from which the next token is chosen. The fact that the prediction direction is nearly orthogonal to the principal variance axes means that the directions carrying the largest cross-prompt variance point largely away from the prediction. The implications of this are quite broad, and I go into many of them in the preprint.
The first finding tells us that prediction anchoring does not simply rediscover the geometry that PCA would find. Instead, it reveals an organization that variance ranking alone does not recover.
The geometry near prediction stays narrow as models widen, but expands with the diversity of what they are asked to distinguish
When I looked at the effective dimensionality of the PDSF subspaces across models the first thing that stands out is that there is no correlation between model size (hidden dimensions) and the dimensionality of the prediction proximate subspaces (D and S). However, there is a correlation between content and prediction proximate dimensionality.
The PDSF method sorts dimensions by residual variance after removing the prediction direction. Because the drop-off in variance is not linear, as we take successive variance cuts of the P-residual, the effective dimensionality of the bins grows in size. So k_D < k_S < k_F where k is effective dimensionality calculated adaptively using the participation ratio (see Guda 2026 for full methods).
On SpecA, the tightly controlled prompt set, the effective dimensionality of D is only 3.97 ± 0.75 across ten instruction-tuned models. On the much more heterogeneous SpecB set, the underlying P-removed effective dimensionality is 13.6 (range 5.9–23.4). At first I interpreted this as an effect of prompt complexity, but further experiments suggest something more specific.
The PDSF method measures effective dimensionality across a population of prompts, so the dimensional width of the measurement bins describes how residual states vary across that population. When I manipulated surface complexity within SpecA by adding clutter, changing output constraints, paraphrasing, or changing format, the variance spectrum barely moved. But when I held the number of prompts fixed and increased the number of genuinely different items represented in the population, it widened substantially. Decomposing the variance into between-group and within-group components made the distinction even clearer. SpecA and SpecB both use about five or six dimensions to separate their broad prompt groups, while almost the entire difference in dimensionality between them comes from the much greater diversity within the SpecB groups.
So the surface manipulations on prompt complexity did not widen the prediction-proximal geometry. And because my measurements are across a population, they cannot speak to what happens inside a single pass either way.
Why the prediction proximal dimensionality remains largely insensitive to model width is still unclear. One possibility I develop in the preprint is that linear readout creates pressure to maintain predictive signal against the many competing directions in the residual stream. The thin-shell result makes such a signal-to-noise constraint geometrically plausible because residual variation is overwhelmingly directional. However the dimensionality measurements here do not establish that explanation. I think this idea remains an open question that should be studied further.
The finding that the prediction proximal dimensionality is related to prompt content shows that the ordering structure I've identified as privileged is wholly different from Elhage et al.'s fixed basis privileged geometry. The fact that the prediction proximate space is also dimensionally narrow over a 2.8× change in model width suggests a common constraint across transformer models that use linear readout for prediction.
Figure 2. Prediction-proximal subspaces do not scale with model width. Effective dimensionality of the discriminative subspace vs. hidden dimension for 18 models spanning 2,880–8,192 hidden dimensions across 6 architecture families. Filled markers are instruction-tuned models (mean 3.97 ± 0.75) and open markers are base models (mean 4.87 ± 1.19). Error bars indicate standard deviation across 5 layer depths. Neither training regime shows significant correlation with effective dimensionality (r = +0.27, p = 0.42 for instruct). GPT-OSS 120B, the largest model by parameter count (120B) but with the narrowest residual stream in the testbed (2,880 dimensions — an MoE architecture whose capacity derives from 128 expert pathways rather than width), maintains an effective dimensionality of 3.2. Within-family pairs are connected (solid: instruct, dashed: base). No family shows systematic expansion. (B) The S subspace is also stable across model size at 10.5 ± 1.5 for 10 instruct models (r = −0.28, p = 0.42). Base model data not shown for S.
The closer we get to the prediction, the more dimensional folding exists
When I was contemplating the variance ranking of the PDSF subspaces I began to wonder whether there were differences in manifold complexity between dimensions close to the prediction and those far away. My initial thought was that models might encode more details in the directions closer to the prediction where discrimination potentially needs to be finer. However, in high dimensional space there is also a likelihood that directions with higher variance necessarily have higher manifold complexity.
To assess whether prediction proximate directions are in fact more convoluted than the expectation, I compared the slope of manifold complexity of the PDSF bins to the same measure done on equivalently sized bins drawn ordered from a straight PCA analysis. Comparing the results supported that hypothesis. When you order dimensions based on their relevance to prediction, the slope in manifold complexity is always steeper across all models and prompt sets. The dimensions near the prediction are more folded than expected.
There is another manifold complexity result that is the most interesting. As prompts become more heterogeneous this difference becomes larger, not smaller. The variance-ranked control recovers about 80% of the prediction-anchored manifold complexity gradient on the simplest prompt set, 71% on a semantically broader prompt set, and only 46% on the most diverse prompt set that contains prompts of entirely different regimes like math and East Asian languages. On the most heterogeneous set the prediction-anchored gradient runs 1.6 to 8.1 times steeper than the control. Residual stream geometry is different when viewed from the prediction direction.
To understand why it makes such a difference to view the geometry from a different angle, consider a simple three-dimensional analogy of how a mountain looks viewed from above versus from the side. From above we see little to none of the elevational change that we use to identify a mountain. Looking down from a plane you only recognize elevational features from their shadows or clues like snowpack. Without those clues, you have to be at the correct angle to truly see the elevational change and recognize the mountain. When we anchor our analysis on the prediction direction it doesn't give us a “correct” view of residual geometry, but my results show that it gives us a functionally informative one. Structure that is difficult to see when directions are ranked by overall variance becomes much more pronounced when they are organized relative to prediction.
Figure 3. Manifold complexity stratifies along the prediction-proximity axis across all three prompt regimes. kNN / global distance ratio (k = 8) by normalized depth for each PDSF subspace (D, S, and F), median across the 10 instruction-tuned models with 10–90 percentile band envelope. Lower values correspond to higher manifold complexity (tightly folded local structure), and values near 1 correspond to flat, uniform geometry. (A) SpecA (224 prompts, 14 factorial groups). (B) SpecB (96 continuation prompts, 12 semantic-family groups). (C) Diverse (84 prompts spanning 8 linguistic regimes: narrative, analytical, code, formal math, multilingual, structured instructions, unusual register).
The discrimination surprise
The PDSF method is a nested PCA analysis inside the P-orthogonal residual that defines D and S from the leading directions of cross-prompt variance. There is a very straightforward, a priori expectation for prompt sets organized into semantic groups. Prompts from the same group should tend to be more similar in D, less so in S, and eventually become indistinguishable from other groups as we move into F, the subspace with the least cross-prompt variance per dimension.
I measured this by comparing within-group and between-group cosine similarity using Cohen’s d. Positive values mean that prompts in the same group are closer together; zero means the geometry doesn’t discriminate the groups. The a priori expectation is a gradient toward zero. D > S > F ≥ 0.
The gradient exists, but the surprise is that it crosses zero. F, the largest part of the residual stream geometry that is furthest from the prediction direction, actively anti-discriminates among prompts. In the prediction-distal F geometry, same-group prompts became less similar to each other than to prompts outside their group. For the full F subspace, 27 of 30 model × prompt-set cells exhibit this anti-discrimination. The three exceptions are all SpecA (Gemma 9B and the two GPT-OSS models), and when I removed the highest variance directions within F, the remaining residual geometry (F-base) showed anti-discrimination in all 30 model × prompt-set cells. This anti-discrimination is also present in 7 of 8 base models, and instruction tuning strengthens it in 7 of 8 matched pairs.
Nothing in my experiments explains this anti-discrimination, only that it exists. One possibility, that I developed in the paper, is that F carries prompt-specific configuration rather than group-level organization. Another interpretation is that it may be related to the model pointing non-predicting directions away from the prediction. It is impossible to know without further work. Regardless of the reasoning, the empirical result is clear: as we move away from prediction, prompt-group discrimination doesn’t just fade, it reverses.
Looking at the residual stream through prediction does more than divide the geometry into high- and low-variance regions. As we move away from prediction, the statistical organization of information itself changes, and the change is consistent across models.
Figure 4. F anti-discriminates among prompt groups, and the inversion is universal across F's internal structure. The figure plots Cohen's d, a measure of discrimination, for each PDSF subspace. Cohen's d is computed between within-group and between-group pairwise cosine-similarity distributions of per-prompt projections in each subspace at the intervention layer (~70% network depth). Positive values mean that same-group prompts are closer in angle than between-group prompts (discriminate), and negative values mean that same-group prompts are farther apart (anti-discriminate). The dots show per-prompt-set medians across 10 instruction-tuned models with a 10–90 percentile band envelope. All three prompt sets begin in discriminative territory at D, decline through S, and end in anti-discriminative territory at F.
The further from the prediction, the later the output changes
Geometry is suggestive, but to me a deeper question about privilege lies in what privileged residual stream geometry actually does in a transformer model. How do the directions involved influence output? In this case, where the privileged geometry is a structured ordering, is there a behavioral response that tracks that geometry?
I tested this question on the PDSF subspaces using the open-ended prompts of SpecB by intervening on the subspaces at every pass while the model was generating its response. Then I compared the output to baseline output from the model under greedy generation.
I used persistent intervention, because the early single-pass experiments showed that models can recover the D and S geometry from one-time perturbations. When I rotated D once at an early layer, the D component is driven more than 90° away from its original orientation at the intervention layer in every model, but by the penultimate layer it recovered to within about a degree in the dense models. So the network can mostly repair early layer interventions on prediction proximal directions.
So instead I used persistent rotational scrambling — a fixed Haar-random orthogonal rotation applied to the target subspace's coefficients at every generation step, at roughly 70% of network depth. The rotation preserves rank, norm and within-subspace energy while scrambling the directional organization I wanted to test, and it does so continuously, so there is no clean pass in which the model can put things back.
Because the privileged geometry describes a structured ordering rather than rank-defined subspaces, the exact dimensionality of the bins used in this space mattered less than their placement. In addition to the D and S bins, I also assessed model behavior on the highest variance bin within F, which I refer to as F-topK, along with a rank-12 random subspace as a control. For this experiment the ranks the three subspaces were set by participation ratio within preset bounds.
The most clear result was that there is a clean separation in when the output changes, which suggests that there is some level of temporal stratification of content-facing directions in transformer models. Under D-scramble, the model's continuation diverges from the baseline at a mean first-divergence token of 1.17 ± 0.39 with 64.0% of prompts differing at the very first generated token. Under S-scramble, the model produces several tokens of the baseline verbatim before anything changes. The divergence response to scrambling F-topK was statistically indistinguishable from S-scramble at the model level, and the random control diverged far later than D, S or F-topK with a mean divergence of 22.86 ± 5.03.
The difference in the kind of output change was also sharp. I classified every output into four categories — Equivalent, Variant (same task framing, different content), Frame-shift (the baseline's framing is disrupted and a different kind of response comes out), and Failure. Scrambling the high variance, prediction-proximal D directions produced Frame-shift in 42.3% of outputs, while the S-scramble produced Frame-shifts in only 8.8% and the random control in 1.5%. S is instead dominated by Variant responses. In 77.1% of the S-scramble runs the model stays inside the frame the baseline established but goes somewhere else while sticking with the basic framing.
It's worth mentioning that almost none of the interventions produced garbage (D-scramble Failure was 6.1% and S-scramble 4.0%). The contrast isn't coherence versus incoherence. It's immediate task-framing disruption versus delayed content substitution inside a preserved frame. And the biggest takeaway in my opinion is the temporal dissociation. The fact that the high variance directions closest to the prediction seem to control immediate output while the directions in the next variance cut down, S, change the output further out seems to have broad implications.
Example from Llama 8B:
Prompt: "The sleek spacecraft emerged from hyperspace, its hull scarred from the journey."
Baseline:
D-scramble (first divergence token 0):
S-scramble (first divergence token 31):
F-topK is the highest-variance cut of F, and geometrically much more F-like: lower variance, anti-discriminatory, and strictly orthogonal to S. And yet scrambling F-topK produces behavior that is statistically indistinguishable from S at the model level in both divergence timing and content. This is the clearest evidence from the work in the preprint that PDSF strata are measurement cuts through a continuum rather than functional boundaries. If the S/F boundary marked a real functional division, crossing it should change the behavioral regime. It doesn’t. The major behavioral transition occurs earlier, between D and S, even though D, S and F-topK are simply successive cuts through the same ordered residual geometry. The PDSF boundaries are simply measurement bins.
Lastly, it is important to recognize that D is orthogonal to P by construction, so scrambling D never touches the prediction direction's own component. And yet, scrambling D at 70% depth changes the immediate next token in 64% of the prompts. More than anything, this highlights the finding that P is not a content-carrying direction, but through the lens of P we find directions that carry content about the next token.
Figure 5. Persistent rotational interventions reveal behavioral stratification along the prediction-proximity axis. D-scramble, S-scramble, F-topK rotation, and rank-matched Random rotation applied as persistent interventions at ~70% depth during autoregressive generation, 10 instruction-tuned models, SpecB. (1) Cumulative divergence curves: fraction of prompts diverged from baseline by token N. D-scramble rises near-vertically, with most prompts diverging at the first generated token; S-scramble and F-topK rise more gradually and overlap across the generation window; Random produces the weakest and latest divergence. Vertical lines mark cross-model mean first-divergence tokens (D mean=1.17, S mean=5.63, F-topK mean=6.52). (2) Behavioral category profiles. D-scramble is enriched for Frame-shift, while S-scramble and F-topK are dominated by Variant responses; Random is mostly Equivalent with a Variant tail.
Behavioral results explorer:
The results of the behavioral test are interesting to peruse, so I created an interactive figure that contains the model output for all 80 prompts of three models from the testbed.
What does privileged mean, and what are the consequences of these results?
Given these results, does this structured ordering qualify as privileged? I think it does. It clears the minimum bar of being statistically distinct from the rest of the geometry, but it also does something a fixed basis does not. Position along the ordering predicts manifold complexity, predicts the direction of group discrimination, and predicts both the timing and the kind of behavioral change under intervention. It does that consistently across six architecture families and a 2.8× range in residual width.
Concurrent with this work, Gurnee et al. (2026) identified a "workspace-like" structure in the residual stream, which they describe as a narrow privileged region inside a much larger complement. Like my work they derive structure from statistics across a large corpus of prompts, but rather than relying on the logit lens they developed a Jacobian-based lens as a refinement of the logit lens that corrects for representational change across layers. Then they used this instrument to locate the region by causal influence on output rather than by geometry. The workspace-like area that Gurnee et al. report is confined to intermediate layers, while my decomposition is anchored to a final-layer direction, which makes the two studies difficult to compare. Whether both should count as privileged geometry is exactly the definitional question I opened with. What strikes me is that two different instruments, applied at two different depths, land on the same shape: a narrow distinguished region inside a much larger complement.
Across the range of model widths that I tested, the part of residual geometry ordered closest to the model's current prediction stays narrow while the prediction-distal ambient space grows, so its share of the residual stream shrinks with scale. As models gain thousands more directions, those directions point largely away from the prediction and are organized against the group structure that the prediction-proximal geometry expresses. What I don't know is whether this geometry constrains how visible prediction-distal processing is at the output. If legibility at the output follows this ordering, then output-based evaluation would reach a shrinking fraction of the model as models scale. My measurements can't settle that — they show how much disrupting a position along the ordering changes the output, which is a different question from whether content sitting there can be read from it. But I think it is an important question.
I raise the question about legibility because concerns about the limits of interpretability have come from several other directions. Casper et al. (2024) argue that black-box access is insufficient for rigorous auditing. Korbak et al. (2025) warn that chain-of-thought monitorability is fragile and may not survive changes in how models are trained. Lindsey et al. (2025), in one of the most direct attempts to trace circuits inside a frontier model, report satisfying insight on roughly a quarter of the prompts tried. Those are limits of access, training and method — all three contingent on things that could change. A geometric limit, if there is one, would be of a different kind, and because the same readout runs at every generation step it would apply to chain-of-thought text as much as to a single answer rather than being escaped by reading the reasoning. Whether there is such a limit is the question I would most like to see settled, and it is on my open-questions list below.
Beyond the prediction axis
I believe that the structured ordering I found in this study is unlikely to be the only residual stream geometry that proves to be distinct. In the preprint I also report a second structural separation, this one along the time axis rather than the prediction axis. F decomposes into a near-static scaffold and a dynamic envelope, and rotating the envelope's directions at every generation step drives the failure rate from under 9% to 92.3%. It was the only rotation intervention I ran that reliably broke the model rather than redirecting it. Whether that counts as privileged depends on the definition question above, which is part of why I think the definition is worth having.
Open questions
I made all the code for this research open so that people can test my findings on other models and put all these assertions to the test. Below are some of the assertions that should still be tested.
The Preprint and Data:
https://github.com/nelsonguda/pdsf-residual-geometry/blob/main/supplement/Paper_1_supplementary_materials.pdfhttps://github.com/nelsonguda/pdsf-residual-geometryReferences
Belrose, N., Furman, H., Smith, J., et al. (2023). Eliciting latent predictions from transformers with the tuned lens. arXiv:2303.08112.
Casper, S., Ezell, C., Siegmann, C., Kolt, N., Curtis, T. L., Bucknall, B., et al. (2024). Black-box access is insufficient for rigorous AI audits. FAccT '24. arXiv:2401.14446.
Elhage, N., Lasenby, R., & Olah, C. (2023). Privileged bases in the transformer residual stream. Transformer Circuits Thread.
Guda, N (2026). Geometric and Behavioral Stratification in Transformer Residual Streams. arXiv:2608.12447 (https://arxiv.org/abs/2608.12447)
Gurnee, W., Sofroniew, N., Pearce, A., et al. (2026). Verbalizable Representations Form a Global Workspace in Language Models. Transformer Circuits Thread.
Korbak, T., Balesni, M., Barnes, E., Bengio, Y., Benton, J., Bloom, J., Chen, M., et al. (2025). Chain of thought monitorability: A new and fragile opportunity for AI safety. arXiv:2507.11473.
Lindsey, J., Gurnee, W., Ameisen, E., Chen, B., Pearce, A., et al. (2025). On the biology of a large language model. Transformer Circuits Thread.
nostalgebraist. (2020). Interpreting GPT: The logit lens. LessWrong.
van Nierop, L. (2024). Transformer models are gauge invariant. arXiv:2412.14543.
Vardhan, M. S., & Sai Teja, L. (2026). Disentangling direction and magnitude in transformer representations: A double dissociation through L2-matched perturbation analysis. arXiv:2602.11169.
Vershynin, R. (2018). High-Dimensional Probability: An Introduction with Applications in Data Science. Cambridge University Press.