Cyberpediaby Brain
ENDEFR

How a large language model works

An AI assistant such as ChatGPT writes plausible text that nobody has checked. What this changes for your answers, your data and your rules.

In 30 seconds

Where it happens
Every time a question is put to an AI assistant, in a tool approved by the company or not.
What the model does
It continues a text, like an autoregressive model2.
What can go wrong
A false but plausible answer, an entered piece of data that comes out elsewhere, an instruction hidden in a document that hijacks the tool.
The reflex
Reread and check any answer that matters, enter no sensitive or personal data in a tool that is not approved, and follow the company's usage rule.
If it is already done
Tell the company's security team, without waiting to know whether the data has really leaked.

What it is

A large language model (LLM) is the engine of the AI assistants that draft, summarize or translate text. It does not look facts up in a file. It is trained on a very large body of text, and it writes by continuing what it is given: GPT-3 is described as an autoregressive model2.

This mechanism explains what employees see every day: fluent answers that are often right and sometimes wrong, in a very confident tone. It also explains why the tool's output must be checked and why sensitive data should not be entrusted to it.

Straight answers

Does an AI assistant understand what it writes?

What can be established is a measurable result: a model trained on a large body of text performs translation, question-answering or three-digit arithmetic tasks from simple examples given in the text of the request2. It does so without retraining: instructions and examples pass only through the text2.

Why does it sometimes write false things?

The InstructGPT authors write that making a model larger does not make it better at following the user's intent, and that large models can produce answers that are "untruthful, toxic, or simply not helpful to the user"3. The OWASP project lists misinformation ("Misinformation") among the ten risks in its 2025 list for applications built on an LLM8.

Can the text I enter come out somewhere else?

It is a recognized risk. The 2025 OWASP list contains an entry "Sensitive Information Disclosure", the disclosure of sensitive information, which concerns the model as well as the application around it8. The NIST report on attacks against machine learning lists privacy breach ("privacy breach"), large language models and chatbots among its keywords7. This supports the rule: what is typed into an unapproved tool leaves the perimeter the company controls.

Can a document or a web page give orders to the tool?

This is the risk OWASP puts at the top of its 2025 list, under the name "Prompt Injection", the injection of instructions8. The model receives its instructions through text2. A neutralized example appears below.

Who sets the usage rules?

The company. The UK NCSC guidelines are addressed to providers of AI systems and note that these systems have new vulnerabilities, to be considered in addition to the usual IT threats5. For employees, this translates into the list of approved tools and the organization's internal policy.

1How it works1 min

The Transformer, presented in June 2017, is a network based solely on attention mechanisms, with no recurrence or convolution1. Its authors say it is more parallelizable and requires much less training time1.

BERT, published in October 2018, is trained on unlabeled text, taking into account the context to the left and right of each word, then adjusted to a specific task4. GPT-3, published in May 2020, is an autoregressive model with 175 billion parameters, ten times more than any previous non-sparse model2.

The InstructGPT authors write that these models are not aligned with their users ("not aligned with their users")3. For the model to follow requests, a second stage exists. For InstructGPT, annotators wrote demonstrations of the desired behavior, then ranked model answers, and the model was adjusted by reinforcement learning from this human feedback3. Reported result: evaluators prefer the answers of the 1.3-billion-parameter model to those of GPT-3 (175 billion), and truthfulness improves3. The authors state that the model "still makes simple mistakes"3.

2What you do1 min
  • Treat every answer as a draft. Check figures, dates, names, references and quotations in a source you know before reusing them in a document, an email or a decision.
  • Enter no personal data and no confidential document in a tool that is not approved. If the tool is not on the company's list, refrain.
  • Before pasting into an assistant a text received from outside, ask yourself whether it may contain instructions meant for the machine, and reread the result with that in mind.
  • Give the tool the minimum access. The OWASP entry "Excessive Agency" targets systems that are granted a degree of initiative8. The more access an assistant has to your messages or your files, the greater the reach of its errors.
  • If in doubt or in case of error, report it to your security team.

Illustrative example, neutralized: an instruction hidden in a document to be summarized.

Excerpt
[Illustration, fictitious text] Quarterly meeting minutes...
[Invisible or small-print passage: paraphrased instruction,
asking the assistant to send the content of the conversation
to hxxps://example[.]invalid]
3Pitfalls1 min
  • A fluent text can be false: the quality of the writing says nothing about its accuracy.
  • A bigger model does not solve everything. The InstructGPT authors write that size does not guarantee that the model follows the user's intent3.
  • The training corpus matters. The GPT-3 authors point out datasets where the model struggles and methodological problems linked to training on large web corpora2.
  • The convenient but unapproved tool. It escapes the rules the company has set for its AI tools, and its users do not know what becomes of the data entered.
  • The NIST AI Risk Management Framework, published on January 26, 2023, is intended for voluntary use, and the page states that it is under revision6. NIST added to it, on July 26, 2024, a profile devoted to generative AI6. These are reference points offered to organizations.
4Real cases1 min

May 2020: news articles that are hard to tell apart

In the paper presenting GPT-3, submitted on May 28, 2020, the authors find that the model can produce news articles that human evaluators have difficulty distinguishing from articles written by people2. They state that they discuss the consequences of this finding for society2. For employees, the look of a text proves neither its author nor its accuracy.

November 2023: guidelines to secure AI systems

On November 27, 2023, the NCSC published its guidelines in version 1.0, divided into four stages: design, development, deployment, operation and maintenance5. They aim at systems that work as intended, stay available and do not reveal sensitive data to unauthorized third parties5. NIST, for its part, published in January 2024 a taxonomy of attacks against machine learning, with a glossary meant for non-specialist readers7. On the OWASP side, the project grew from a small group of security professionals in 2023 to more than 600 expert contributors from more than 18 countries9.

Fact sheet

Identifier
CP-256
Wing
4. Artificial intelligence
Brain skill
Understanding AI & LLMs (understand_ai)
Brain reflex
air-037
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
9 sources checked on 3 November 2026
Sources9 sources
  1. arXiv, “Attention Is All You Need”, 12 June 2017. https://arxiv.org/abs/1706.03762 (accessed 3 November 2026)
  2. arXiv, “Language Models are Few-Shot Learners”, 28 May 2020. https://arxiv.org/abs/2005.14165 (accessed 3 November 2026)
  3. arXiv, “Training language models to follow instructions with human feedback”, 4 March 2022. https://arxiv.org/abs/2203.02155 (accessed 3 November 2026)
  4. arXiv, “BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding”, 11 October 2018. https://arxiv.org/abs/1810.04805 (accessed 3 November 2026)
  5. NCSC (UK), “Guidelines for secure AI system development”, 27 November 2023. https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development (accessed 3 November 2026)
  6. NIST, “AI Risk Management Framework”. https://www.nist.gov/itl/ai-risk-management-framework (accessed 3 November 2026)
  7. NIST, “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations”, 2 January 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2023.pdf (accessed 3 November 2026)
  8. OWASP, “LLMRisks Archive”. https://genai.owasp.org/llm-top-10/ (accessed 3 November 2026)
  9. OWASP, “OWASP Top 10 for Large Language Model Applications | OWASP Foundation”. https://owasp.org/projects/top-10-for-large-language-model-applications (accessed 3 November 2026)

Cite this article

Brain, “How a large language model works”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token/

BibTeX 
@misc{brain_cp256_en_2026,
  author = {Brain},
  title = {How a large language model works},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/how-llms-work-next-token/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence