--- id: CP-256 slug: how-llms-work-next-token lang: en title: How a large language model works description: An AI assistant such as ChatGPT writes plausible text that nobody has checked. What this changes for your answers, your data and your rules. canonical_url: https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token/ markdown_url: https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "How a large language model works", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token/ (CC BY 4.0) wing: 4 theme: understand_ai reflex: air-037 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token/ fr: https://startbrain.io/cyberpedia/fr/articles/fonctionnement-llm-jeton-suivant/ de: https://startbrain.io/cyberpedia/de/articles/funktionsweise-llm-naechstes-token/ es: https://startbrain.io/cyberpedia/es/articles/funcionamiento-llm-siguiente-token/ sources: - "n": 1 title: Attention Is All You Need publisher: arXiv url: https://arxiv.org/abs/1706.03762 published: "2017-06-12" accessed: "2026-11-03" - "n": 2 title: Language Models are Few-Shot Learners publisher: arXiv url: https://arxiv.org/abs/2005.14165 published: "2020-05-28" accessed: "2026-11-03" - "n": 3 title: Training language models to follow instructions with human feedback publisher: arXiv url: https://arxiv.org/abs/2203.02155 published: "2022-03-04" accessed: "2026-11-03" - "n": 4 title: "BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding" publisher: arXiv url: https://arxiv.org/abs/1810.04805 published: "2018-10-11" accessed: "2026-11-03" - "n": 5 title: Guidelines for secure AI system development publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development published: "2023-11-27" accessed: "2026-11-03" - "n": 6 title: AI Risk Management Framework publisher: NIST url: https://www.nist.gov/itl/ai-risk-management-framework accessed: "2026-11-03" - "n": 7 title: "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations" publisher: NIST url: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2023.pdf published: "2024-01-02" accessed: "2026-11-03" - "n": 8 title: LLMRisks Archive publisher: OWASP url: https://genai.owasp.org/llm-top-10/ accessed: "2026-11-03" - "n": 9 title: OWASP Top 10 for Large Language Model Applications | OWASP Foundation publisher: OWASP url: https://owasp.org/projects/top-10-for-large-language-model-applications accessed: "2026-11-03" --- # How a large language model works A large language model (LLM) is the engine of the AI assistants that draft, summarize or translate text. It does not look facts up in a file. It is trained on a very large body of text, and it writes by continuing what it is given: GPT-3 is described as an autoregressive model [2]. This mechanism explains what employees see every day: fluent answers that are often right and sometimes wrong, in a very confident tone. It also explains why the tool's output must be checked and why sensitive data should not be entrusted to it. ## In 30 seconds - Where it happens: every time a question is put to an AI assistant, in a tool approved by the company or not. - What the model does: it continues a text, like an autoregressive model [2]. - What can go wrong: a false but plausible answer, an entered piece of data that comes out elsewhere, an instruction hidden in a document that hijacks the tool. - The reflex: reread and check any answer that matters, enter no sensitive or personal data in a tool that is not approved, and follow the company's usage rule. - If it is already done: tell the company's security team, without waiting to know whether the data has really leaked. ## Straight answers ### Does an AI assistant understand what it writes? What can be established is a measurable result: a model trained on a large body of text performs translation, question-answering or three-digit arithmetic tasks from simple examples given in the text of the request [2]. It does so without retraining: instructions and examples pass only through the text [2]. ### Why does it sometimes write false things? The InstructGPT authors write that making a model larger does not make it better at following the user's intent, and that large models can produce answers that are "untruthful, toxic, or simply not helpful to the user" [3]. The OWASP project lists misinformation ("Misinformation") among the ten risks in its 2025 list for applications built on an LLM [8]. ### Can the text I enter come out somewhere else? It is a recognized risk. The 2025 OWASP list contains an entry "Sensitive Information Disclosure", the disclosure of sensitive information, which concerns the model as well as the application around it [8]. The NIST report on attacks against machine learning lists privacy breach ("privacy breach"), large language models and chatbots among its keywords [7]. This supports the rule: what is typed into an unapproved tool leaves the perimeter the company controls. ### Can a document or a web page give orders to the tool? This is the risk OWASP puts at the top of its 2025 list, under the name "Prompt Injection", the injection of instructions [8]. The model receives its instructions through text [2]. A neutralized example appears below. ### Who sets the usage rules? The company. The UK NCSC guidelines are addressed to providers of AI systems and note that these systems have new vulnerabilities, to be considered in addition to the usual IT threats [5]. For employees, this translates into the list of approved tools and the organization's internal policy. ## How it works The Transformer, presented in June 2017, is a network based solely on attention mechanisms, with no recurrence or convolution [1]. Its authors say it is more parallelizable and requires much less training time [1]. BERT, published in October 2018, is trained on unlabeled text, taking into account the context to the left and right of each word, then adjusted to a specific task [4]. GPT-3, published in May 2020, is an autoregressive model with 175 billion parameters, ten times more than any previous non-sparse model [2]. The InstructGPT authors write that these models are not aligned with their users ("not aligned with their users") [3]. For the model to follow requests, a second stage exists. For InstructGPT, annotators wrote demonstrations of the desired behavior, then ranked model answers, and the model was adjusted by reinforcement learning from this human feedback [3]. Reported result: evaluators prefer the answers of the 1.3-billion-parameter model to those of GPT-3 (175 billion), and truthfulness improves [3]. The authors state that the model "still makes simple mistakes" [3]. ## What you do - Treat every answer as a draft. Check figures, dates, names, references and quotations in a source you know before reusing them in a document, an email or a decision. - Enter no personal data and no confidential document in a tool that is not approved. If the tool is not on the company's list, refrain. - Before pasting into an assistant a text received from outside, ask yourself whether it may contain instructions meant for the machine, and reread the result with that in mind. - Give the tool the minimum access. The OWASP entry "Excessive Agency" targets systems that are granted a degree of initiative [8]. The more access an assistant has to your messages or your files, the greater the reach of its errors. - If in doubt or in case of error, report it to your security team. Illustrative example, neutralized: an instruction hidden in a document to be summarized. ```text [Illustration, fictitious text] Quarterly meeting minutes... [Invisible or small-print passage: paraphrased instruction, asking the assistant to send the content of the conversation to hxxps://example[.]invalid] ``` ## Pitfalls - A fluent text can be false: the quality of the writing says nothing about its accuracy. - A bigger model does not solve everything. The InstructGPT authors write that size does not guarantee that the model follows the user's intent [3]. - The training corpus matters. The GPT-3 authors point out datasets where the model struggles and methodological problems linked to training on large web corpora [2]. - The convenient but unapproved tool. It escapes the rules the company has set for its AI tools, and its users do not know what becomes of the data entered. - The NIST AI Risk Management Framework, published on January 26, 2023, is intended for voluntary use, and the page states that it is under revision [6]. NIST added to it, on July 26, 2024, a profile devoted to generative AI [6]. These are reference points offered to organizations. ## Real cases ### May 2020: news articles that are hard to tell apart In the paper presenting GPT-3, submitted on May 28, 2020, the authors find that the model can produce news articles that human evaluators have difficulty distinguishing from articles written by people [2]. They state that they discuss the consequences of this finding for society [2]. For employees, the look of a text proves neither its author nor its accuracy. ### November 2023: guidelines to secure AI systems On November 27, 2023, the NCSC published its guidelines in version 1.0, divided into four stages: design, development, deployment, operation and maintenance [5]. They aim at systems that work as intended, stay available and do not reveal sensitive data to unauthorized third parties [5]. NIST, for its part, published in January 2024 a taxonomy of attacks against machine learning, with a glossary meant for non-specialist readers [7]. On the OWASP side, the project grew from a small group of security professionals in 2023 to more than 600 expert contributors from more than 18 countries [9]. ## Sources 1. arXiv, "Attention Is All You Need", 12 June 2017. https://arxiv.org/abs/1706.03762 (accessed 3 November 2026) 2. arXiv, "Language Models are Few-Shot Learners", 28 May 2020. https://arxiv.org/abs/2005.14165 (accessed 3 November 2026) 3. arXiv, "Training language models to follow instructions with human feedback", 4 March 2022. https://arxiv.org/abs/2203.02155 (accessed 3 November 2026) 4. arXiv, "BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding", 11 October 2018. https://arxiv.org/abs/1810.04805 (accessed 3 November 2026) 5. NCSC (UK), "Guidelines for secure AI system development", 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026) 6. NIST, "AI Risk Management Framework". https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026) 7. NIST, "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations", 2 January 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2023.pdf (accessed 3 November 2026) 8. OWASP, "LLMRisks Archive". https://genai.owasp.org/llm-top-10/ (accessed 3 November 2026) 9. OWASP, "OWASP Top 10 for Large Language Model Applications | OWASP Foundation". https://owasp.org/projects/top-10-for-large-language-model-applications (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.