What is a transformer's residual stream?

The residual stream is the vector running through the whole transformer, one per text position. No block replaces it: attention and feed-forward read what is in it, compute a correction and add that correction back. Whatever the first layer wrote is still there at the last one, because nothing was ever erased.

It is the concept that makes the rest of the model cohere. The full journey from prompt to answer is in how an LLM works inside; what opens and closes the stream at either end is in embedding and unembedding; and the two components writing into it at every layer have articles of their own, the attention block and the feed-forward network.

The name comes from computer vision, and part of the confusion comes with it. “Residual connection” is the local operation: adding a block’s input to its output. “Residual stream” is the object that shows up once you repeat that operation seventy times and stop looking block by block.

The channel everyone speaks through

The most useful framing of what that means comes from a 2021 interpretability paper at Anthropic: every component of a transformer — the token embedding, the attention heads, the MLP layers and the unembedding — communicates with the others by reading from and writing to different subspaces of the residual stream¹.

The word carrying the weight is “subspace”. The stream is not a list of named fields and it is not a pipeline. It is a fixed-width vector space, and each component sees a slice of it. An attention head projects the vector down, does its work, and projects the result back up: it reads from one subspace and writes into another, and the two are usually different.

From that follows the consequence that changes how you think about the model. A head in layer 3 can write something that only a head in layer 30 will read, and none of the components in between need to take part, or even know a conversation is happening. The stream works less like a pipe and more like a noticeboard where anyone can leave a message for anyone further down. That property is what makes it possible to talk about circuits inside the model, and it is why the concept is the front door to mechanistic interpretability.

The stream also computes nothing. The only operation happening in it is addition. All the processing lives in the branches leaving it and coming back.

One piece is missing for the picture to be right: there is one stream per text position, not one for the sequence. A thousand-token prompt has a thousand vectors running in parallel, each receiving its own additions. Feed-forward works on each one in isolation. Attention is the only component that reads from one stream and writes into another, and it is the sole reason one word ever influences another.

Why addition, and not replacement

The idea dates to 2015 and did not start in language. He and colleagues reformulated the layers of a convolutional network to learn residual functions with reference to the layer inputs, rather than learning the whole transformation, and with that trained networks 152 layers deep — eight times deeper than the standard architecture of the day and still lower in complexity. Their ensemble reached 3.57% error on the ImageNet test set and won ILSVRC 2015².

The arithmetic of why this helps fits in one line. In a stack with no shortcut, the gradient travelling from the output back to layer 1 passes through a product of forty factors. If each factor is 0.9 — an illustrative number, not a measured one — 1.5% of the signal survives. If it is 1.1, the signal explodes. With the shortcut there is a route where that multiplication simply does not happen.

Two later papers gave that intuition precision. He and colleagues returned to the subject in 2016 and showed that with identity mappings on the skip connections and after-addition activation, forward and backward signals propagate directly from any block to any other; they trained a 1,001-layer network to 4.62% error on CIFAR-10³. Veit, Wilber and Belongie decomposed the residual network into paths of varying length and measured that in a 110-layer network most of the gradient comes from paths only 10 to 34 layers deep⁴. Their reading is that a residual network behaves less like a deep stack and more like an ensemble of shallow ones.

In a transformer there is an extra reason, and it is specific to attention. Dong, Cordonnier and Loukas proved that pure attention, stripped of the other components, has a strong bias towards token uniformity: the output converges to a rank-1 matrix doubly exponentially fast with depth. Residual connections and MLPs are exactly what stops the degeneration⁵. Put differently, the residual connection is not an optimisation trick borrowed from computer vision that happened to work here. Without it, a deep transformer collapses by construction.

Worth recording where normalisation fits into this, since it is the other detail deciding whether the stack trains at all. Current models place it inside the residual branch rather than between blocks, which means the identity path crosses the model end to end with no normalisation anywhere along it. Why that arrangement won, and how the variants differ, is in LayerNorm and RMSNorm.

What accumulates, step by step

The vector arriving at the unembedding is literally a sum: the initial embedding plus the contribution of every head and every MLP along the way. That is not a metaphor, it is the definition of the operation, and it has a large practical consequence: you can take one term in isolation and ask what it did.

Geva and colleagues did exactly that with the feed-forward layers. They operate as key-value memories: each key matches a textual pattern, and each value induces a distribution over the output vocabulary. The conclusion that matters here is their closing line — the output of a feed-forward layer is a composition of memories, refined through the residual connections until it becomes the final prediction⁶. The stream is where that composition happens.

There is a special case that usually goes unnoticed and explains a good deal. Since the first term of the sum is the token’s own embedding and nothing removes it, the vector arriving at the end still contains the identity of the input token, mixed with everything added afterwards. There is a direct path from embedding to unembedding that passes through no block at all, and on its own it already produces a bad prediction, though not a random one. Much of what the blocks do is correct that baseline.

Because the unembedding is a product against the output matrix, you can apply that product to the stream at any height and see the prediction that would be made there. The technique became known as the logit lens. It carries a known bias: an intermediate layer does not write in quite the same basis as the last one. Belrose and colleagues measured the drift and proposed training an affine probe per block, which on models up to 20 billion parameters came out more predictive, more reliable and less biased than the raw projection⁷.

Width is a scarce resource

Here is the part that pays off most in practice, and it falls out of a simple count.

In Qwen3-8B the stream holds 4,096 numbers per position. The model has 36 layers, each with 32 attention heads and one MLP. That is 1,152 heads and 36 MLPs, 1,188 components writing into the same 4,096-dimensional vector. Each head works in a subspace of at most 128 dimensions, and the result of all of them has to fit in the same place.

It does not fit, in the literal sense. There are no 1,188 mutually orthogonal 128-dimensional subspaces inside a 4,096-dimensional space. What exists are nearly orthogonal directions, far more numerous than the dimensions, with different components ending up sharing room and interfering a little. Stream width, then, is bandwidth: how much distinct information can travel between layers at once.

That explains why widening is expensive in a way that deepening is not. The stream dimension appears in every matrix in the model. Still in Qwen3-8B: the attention projections come to 41.9 million weights per layer and the MLP to 151 million, which gives 1.51 billion and 5.44 billion across the model — together, the 6.95 billion non-embedding parameters the model card advertises. Doubling the stream width would double both dimensions of most of those matrices, and the cost rises with the square.

The stream itself weighs nothing: 4,096 numbers at 16 bits is 8 KB per position. It is not memory, it is geometry.

Where this fails

Adding does not prevent erasing. The noticeboard image suggests nothing is ever lost, and that is not quite right. Adding the opposite of what is there cancels the information, and a block learns that operation the way it learns any other. “Nothing gets overwritten” describes the arithmetic; it does not describe the effect.

A few dimensions dominate everything. Sun and colleagues found, across several LLMs, a handful of activations with values up to a hundred thousand times larger than their neighbours. They show up in consistent locations, barely change with the input, act in practice as bias terms, and concentrate attention on the corresponding tokens⁸. The picture of a homogeneous space where every dimension counts equally is wrong.

And that breaks quantisation. Same phenomenon seen from the engineering side. Dettmers and colleagues showed that outlier feature dimensions emerge systematically in large transformers and dominate performance; their answer was to isolate those dimensions in a 16-bit multiplication while more than 99.9% of the values run in 8 bits, which let them serve models up to 175 billion parameters with no loss of quality⁹. Quantising the stream uniformly does not work, and this is why.

The basis is not privileged. Reading dimension 1,402 of the stream and hunting for its meaning is almost always wasted effort. What carries information are directions, which rarely line up with the axes. That is why the interpretability methods that work look for directions rather than neurons.

Not every block writes something necessary. If every layer adds a term, you would expect removing one to break the model. Gromov and colleagues tested it and found the opposite: on some open-weight models you can remove up to half of the deeper layers with minimal degradation on question-answering benchmarks, with a light finetune afterwards to recover¹⁰. Their reading is that either pretraining fails to make good use of the deeper layers’ parameters, or the shallow layers hold most of what matters. Neither is comfortable.

One stream cannot see the others. There is one vector per position, and each carries only what was written at that position. The one thing capable of moving information between positions is attention. Treating the stream as though it held the whole sentence leads to wrong conclusions about what the model “knows” at any given point.

What to do with this

1. When instrumenting a model, hook the stream. It is the one place everything passes through. Collecting the output of an MLP or a single head gives you a partial slice of what went into the sum.
2. Intervene by adding a direction, not by editing weights. It is the cheapest operation available in a transformer, because it is exactly what the blocks already do. Arditi and colleagues showed that refusal in 13 open chat models, up to 72 billion parameters, is mediated by a one-dimensional subspace: remove the direction from the stream and refusal stops, add it and the model refuses even harmless requests¹¹.
3. Do not quantise the stream uniformly. Keep the outlier dimensions at higher precision. Any serious quantisation library already does this, but it is worth knowing why before you write your own.
4. Read the model dimension as bandwidth. When comparing two models with similar parameter counts, a wide stream with fewer layers and a narrow stream with more layers are different bets on the same budget.
5. When pruning depth, start from the middle-to-late layers. That is where the evidence for redundancy is strongest, and budget for a short finetune afterwards to close the gap.
6. Calibrate before trusting the logit lens. The raw projection is fine for exploring; for concluding, use a probe trained per layer.

Footnotes

1. Elhage et al. (2021) describe the transformer as a set of components that communicate by reading from and writing to different subspaces of the residual stream, and propose decomposing the stream into those channels rather than analysing the whole vector. ↩

2. He et al. (2015) reformulated layers to learn residual functions with reference to the layer inputs, trained networks 152 layers deep at lower complexity than VGG, and reached 3.57% error on the ImageNet test set, winning ILSVRC 2015. ↩

3. He et al. (2016) showed that with identity mappings on the skip connections and after-addition activation, forward and backward signals propagate directly from any block to any other; their 1,001-layer network reached 4.62% error on CIFAR-10. ↩

4. Veit et al. (2016) decomposed residual networks into collections of paths of varying length and measured that, in a 110-layer network, most of the gradient comes from paths only 10 to 34 layers deep. ↩

5. Dong et al. (2021) proved that pure attention converges to a rank-1 matrix doubly exponentially fast with depth, and that residual connections and MLPs are what stops the degeneration. ↩

6. Geva et al. (2021) showed that feed-forward layers operate as key-value memories, and that the output of each is a composition of memories refined through the residual connections into the final prediction. ↩

7. Belrose et al. (2023) measured the bias of projecting intermediate layers with the output matrix and proposed an affine probe trained per block, more predictive and less biased, on models up to 20 billion parameters. ↩

8. Sun et al. (2024) found, across several LLMs, very few activations with values up to a hundred thousand times larger than the rest, in consistent locations and nearly independent of the input, acting as bias terms and concentrating attention on the corresponding tokens. ↩

9. Dettmers et al. (2022) isolated outlier feature dimensions in a 16-bit multiplication while more than 99.9% of values run in 8 bits, which enabled inference on models up to 175 billion parameters with no degradation. ↩

10. Gromov et al. (2024) removed blocks of layers from open-weight models and found minimal degradation on question answering until roughly half the layers were gone, with a light QLoRA finetune afterwards to close the gap. ↩

11. Arditi et al. (2024) identified, across 13 open chat models up to 72 billion parameters, a one-dimensional subspace mediating refusal: removing it prevents refusal of harmful requests and adding it induces refusal of harmless ones. ↩