AI, ML & LLM Glossary

Acceptable use

Documented boundaries for permitted users, purposes, data, models, tools, and actions. Acceptable-use rules are not a substitute for technical enforcement.

Governance

Activation

The value produced by a layer or unit for a particular input. Activations are per-inference or per-training-step evidence, not learned parameters.

Neural networks

Activation function

A nonlinear function applied to a neuron's weighted input. It lets a neural network represent relationships more complex than a stack of linear operations.

Neural networks

Adapter

A small set of trainable components added to a mostly frozen model to adapt it without updating every original parameter.

Models

Adaptive attack

A defense-aware evaluation that selects or modifies its attack strategy to test the proposed defense under stated access, perturbation, and query budgets.

AI security

Adversarial example

An input intentionally modified to cause an ML model to make an attacker-chosen or incorrect prediction while often appearing normal to people.

AI security

Agent

A system that uses a model to pursue a goal through a loop that may observe state, plan, select tools, act, evaluate results, and update memory. Autonomy and authority vary.

Agents

Agent loop

The repeated observe–reason or plan–act–observe cycle used by an agent until a stop condition, success, failure, or budget limit is reached.

Agents

AGI

Artificial general intelligence: a contested, nonstandard threshold for broadly capable intelligence. The course does not assume present systems are AGI.

Core AI

AI bill of materials (AIBOM)

An inventory of models, datasets, adapters, prompts, dependencies, runtimes, tools, and provenance associated with an AI system or release.

Governance

AI flight recorder

A protected event record linking identity, tenant, model, prompt, retrieval, tools, policy decisions, memory, egress, and outcomes for detection and reconstruction.

Operations

AI model

A computational model used within an AI system to produce predictions, recommendations, decisions, representations, or generated content.

Core AI

AI system

A socio-technical system containing one or more models plus data, software, infrastructure, identities, people, processes, and downstream actions.

Core AI

Alignment

The effort to make system behavior conform to intended goals, instructions, values, policies, or preferences. Alignment is not equivalent to security.

Trustworthy AI

Annotation

Information added to data, often a label, span, rating, preference, or metadata, for training or evaluation.

Data

Artifact signing

A cryptographic signature over an artifact or metadata that supports integrity and publisher verification. Signing does not prove the artifact is safe.

Governance

Artificial intelligence (AI)

A machine-based capability that produces predictions, recommendations, decisions, or content for human-defined objectives. AI is the broad field; ML is one approach within it.

Core AI

Attack surface

All reachable components, interfaces, identities, data paths, dependencies, and actions an adversary may influence or abuse.

AI security

Attention

A mechanism that computes how strongly each representation should incorporate information from other positions. It produces weighted combinations of value vectors from query–key relevance.

Transformers

Attention head

One parallel instance of attention with its own learned projections. Multi-head attention lets a layer model different relationships simultaneously.

Transformers

Attestation

Evidence, often cryptographically verifiable, about how an artifact or workload was built, measured, configured, or executed.

Governance

Audit trail

A chronological, protected record of identities, events, decisions, changes, and outcomes that supports accountability and investigation.

Governance

Authorization correctness

Whether every retrieval, tool call, and state-changing action is permitted for the initiating identity, tenant, context, and policy.

Evaluation

Autoregressive model

A model that generates a sequence by predicting the next element from preceding elements, then feeding generated elements back into later predictions.

LLMs

Availability

The property that systems and resources remain accessible and usable as required, including compute, model endpoints, retrieval, tools, and budgets.

AI security

Backdoor

Hidden model behavior activated by a trigger and introduced through poisoned data, model modification, or a compromised artifact.

AI security

Backpropagation

The algorithm that propagates loss gradients backward through a differentiable computation graph so an optimizer can update parameters.

Neural networks

Base model

A model before task-specific or instruction-specific adaptation. The phrase is overloaded; always identify its exact checkpoint and training stage.

Models

Batch

A group of examples processed together for one training or inference step. Batch size affects memory, throughput, and optimization behavior.

Training

Benchmark

A defined dataset, task, procedure, and metric used to compare systems. Benchmark performance is not automatically real-world or security assurance.

Evaluation

Bias (model parameter)

An additive learned parameter in a model unit. Do not confuse this mathematical meaning with systematic social or statistical bias.

Training

Bias (systematic error)

A recurring skew in data, measurement, model behavior, or outcomes. This is an overloaded term and must be scoped.

Trustworthy AI

Black-box access

Access limited to supplying inputs and observing outputs, without model parameters, gradients, code, or internal state.

AI security

Blast radius

The scope of assets, identities, tenants, data, actions, or compute that can be affected after a component or credential is compromised.

AI security

Byte-pair encoding (BPE)

A subword tokenization family that repeatedly merges frequent symbol pairs to create a vocabulary balancing common words and reusable fragments.

LLMs

Cache isolation

Controls that prevent cached prompts, key-value states, embeddings, results, or responses from crossing users, tenants, models, or authorization contexts.

AI security

Calibration

The degree to which predicted confidence matches observed correctness. A calibrated 0.8 probability should be correct about 80% of comparable cases.

Evaluation

Causal language model

A language model trained to predict tokens using only earlier tokens in the sequence. Most chat LLMs use a decoder-only causal architecture.

LLMs

Causal mask

A constraint that prevents a decoder position from attending to later positions during autoregressive next-token prediction.

Transformers

Chat template

Model-specific serialization that converts structured roles, messages, tool definitions, and special tokens into the exact sequence supplied to a chat model.

LLMs

Checkpoint

A saved state of model parameters and often optimizer or training metadata at a specific training or release point.

Models

Chunk

A unit produced by splitting a source for indexing and retrieval. Chunk boundaries, overlap, metadata, and lineage affect relevance and security.

RAG

Citation precision

The proportion of generated citations that actually support the associated claim.

Evaluation

Citation recall

The proportion of source material relied upon by a response that is represented by citations.

Evaluation

Classification

A task that assigns an input to one or more discrete classes, such as malicious or benign.

Machine learning

Classifier

A model or system that performs classification. An LLM used to label text can act as a classifier but remains nondeterministic unless controlled.

Machine learning

Clustering

An unsupervised task that groups examples by similarity without predefined class labels.

Machine learning

Completion

Generated continuation returned for an input context. Chat APIs typically transform messages into a model-specific completion context.

LLMs

Computer vision (CV)

The field concerned with extracting representations, predictions, or generated content from images and video.

Core AI

Concept drift

A change in the relationship between inputs and the desired target or outcome over time.

Operations

Confidentiality

The property that information is not disclosed to unauthorized entities. In AI systems this includes prompts, data, embeddings, weights, memory, logs, and secrets.

AI security

Context

The tokens and other model inputs available for the current computation. Context can contain instructions, user data, retrieved content, tool definitions, and conversation history.

LLMs

Context engineering

Designing and controlling the complete information supplied to a model—including instructions, retrieval, tools, memory, examples, and state—not merely wording one prompt.

LLMs

Context leakage

Unauthorized disclosure of instructions, retrieved records, conversation state, tool results, cached values, or other protected information present in model context.

AI security

Context window

The maximum model-specific sequence length available for input and often generated output. Effective usable context can be smaller than the advertised limit.

LLMs

Convolutional neural network (CNN)

A neural-network family using learned filters with shared weights, historically dominant in vision and spatial tasks.

Neural networks

Corpus

A collection of text, documents, or other language data used for training, analysis, or retrieval.

Data

Cross-entropy loss

A loss commonly used for classification and next-token prediction that penalizes probability assigned away from the correct target.

Training

Data drift

A change over time in the distribution of production inputs compared with training or earlier operational data.

Operations

Data leakage (ML evaluation)

Information from validation, test, future, or target data improperly influencing training or feature construction, inflating performance estimates.

Evaluation

Data leakage (security)

Unauthorized disclosure of data. Because the term is overloaded, state whether you mean evaluation contamination or confidentiality loss.

AI security

Data minimization

Collecting, retaining, and exposing only the data necessary for a defined purpose and period.

Privacy

Data poisoning

Intentional manipulation of training, fine-tuning, feedback, or retrieval data to alter model or system behavior.

AI security

Data provenance

Traceable information about a data item's origin, custody, transformations, versions, permissions, and use.

Data

Data split

A partition of examples into training, validation, test, and sometimes calibration sets with leakage controls.

Training

Dataset

A defined collection of examples and associated labels or metadata used for training, adaptation, evaluation, or operation.

Data

Decoder

A Transformer component that generates output representations, typically with causal masking for autoregressive language generation.

Transformers

Decoding

The procedure for selecting output tokens from model logits or probabilities, such as greedy decoding, beam search, temperature sampling, top-k, or top-p.

LLMs

Deep learning

Machine learning based on neural networks with multiple representation-learning layers. Deep learning is a subset of ML.

Core AI

Denial of wallet

Resource or cost abuse that causes unexpected financial consumption through model inference, tokens, tools, storage, or cloud compute.

AI security

Dense retrieval

Retrieval using learned vector embeddings and a similarity measure rather than exact lexical term matching.

RAG

Deterministic

Producing the same output for the same complete input and state. Many LLM APIs are not guaranteed deterministic even with low temperature.

Core AI

Differential privacy (DP)

A formal privacy framework that bounds how much an output distribution can change when one individual's record is added or removed.

Privacy

Diffusion model

A generative model trained to reverse a gradual noising process, widely used for image, audio, and video generation.

Models

Dimensionality

The number of coordinates or features in a representation, such as the length of an embedding vector.

Data

Direct Preference Optimization (DPO)

A preference-training method that directly optimizes a policy from preferred and rejected responses without a separate reinforcement-learning loop.

Training

Direct prompt injection

Adversarial instructions supplied through an application's interactive input channel to influence behavior across a protected boundary.

AI security

Discriminative model

A model that estimates classes, scores, boundaries, or other decisions rather than primarily generating new samples. The term is a family description, not a security property.

Models

Distillation

Training a smaller student model to reproduce selected behavior or distributions of a larger teacher model.

Training

Distribution shift

A mismatch between training and deployment distributions. Data drift, concept drift, and adversarial manipulation can create shift.

Operations

Dropout

A regularization method that randomly disables units during training to reduce dependence on specific pathways.

Training

Early stopping

Stopping training when validation performance ceases improving to reduce overfitting and wasted computation.

Training

Egress

Outbound data movement from a system or component. AI applications require explicit destination, protocol, content, and identity controls.

AI security

Embedding

A learned numeric vector representing an item so relevant relationships can be measured in a vector space. Embeddings can leak or encode sensitive attributes.

Models

Embedding model

A model that converts text, images, or other objects into vectors for retrieval, clustering, similarity, or downstream features.

RAG

Encoder

A Transformer component that builds contextual representations from an input sequence, usually using bidirectional attention.

Transformers

Encoder model

A model or architecture that transforms input into contextual representations, often for classification, retrieval, or embeddings rather than autoregressive generation.

Models

Encoder–decoder model

A Transformer architecture where an encoder represents input and a decoder generates output while attending to encoder states.

Transformers

Epoch

One complete pass through the training dataset, subject to batching and sampling choices.

Training

Evaluation (eval)

A defined process for measuring a model or system against tasks, datasets, criteria, scorers, and acceptance thresholds.

Evaluation

Evasion attack

An inference-time attack that modifies input to cause a target model to misclassify, miss, or produce an attacker-desired output.

AI security

Excessive agency

Risk created when an AI component can perform more actions, with more permissions or autonomy, than required for its task.

AI security

Explainability

Methods or properties that communicate why a system produced an output. Explanations may be approximate and are not automatically faithful.

Trustworthy AI

Exposure bias

The train–generation mismatch created when a sequence model trains on true previous tokens but generates from its own earlier outputs.

LLMs

F1 score

The harmonic mean of precision and recall. It hides class-specific and threshold details unless those are reported.

Evaluation

False negative (FN)

A positive case incorrectly predicted as negative, such as malicious activity missed by a detector.

Evaluation

False positive (FP)

A negative case incorrectly predicted as positive, such as benign activity incorrectly alerted.

Evaluation

Feature

An input variable or derived representation supplied to a model.

Machine learning

Feature engineering

Selecting, transforming, or constructing input variables to improve learning, performance, or interpretability.

Machine learning

Few-shot prompting

Providing a small number of input–output examples in context to demonstrate the desired task or format without updating model weights.

LLMs

Fine-tuning

Continuing training from a pretrained checkpoint on a smaller task, domain, instruction, or preference dataset.

Training

Forward pass

Computing model outputs from inputs through the model's current parameters without updating those parameters.

Neural networks

Foundation model

A broadly capable model trained on large and diverse data that can be adapted to many downstream tasks.

Models

Function calling

A model/API pattern that produces a structured request to invoke a named function. The application must validate and authorize the call outside the model.

Agents

Generalization

The ability to perform on relevant unseen examples or conditions rather than only memorizing training data.

Evaluation

Generative AI

AI models and systems that generate new content such as text, code, images, audio, video, or structured data.

Core AI

Generative model

A model that learns a distribution or generation process for producing new samples, sequences, or content. Generative does not mean safe or broadly reusable.

Models

Gradient

The vector of partial derivatives of an objective with respect to parameters, indicating the local direction and magnitude of change.

Training

Gradient descent

An optimization family that updates parameters in a direction intended to reduce loss, commonly through stochastic variants.

Training

Grammar-constrained generation

Generation restricted by a formal grammar or schema. It can enforce structure but does not establish semantic safety, correctness, or authorization.

LLMs

Greedy decoding

Selecting the highest-scoring available token at each generation step. This does not guarantee service-level determinism.

LLMs

Groundedness

The degree to which generated claims are supported by the supplied evidence or authoritative context. Groundedness is not the same as truth or authorization.

Evaluation

Grounding

Constraining or informing generation with specified external evidence, data, tools, or state. Grounding reduces some errors but does not guarantee truth.

RAG

Guardrail

An overloaded marketing term for a preventive or detective constraint around model input, output, actions, or use. Always name the actual mechanism and boundary.

AI security

Hallucination

Generated content that is unsupported, incorrect, or fabricated but presented as if valid. The term describes an output failure, not a diagnosis of model intent.

LLMs

Hidden layer

A neural-network layer between input and output whose learned representations are not directly observed as task outputs.

Neural networks

Human-in-the-loop (HITL)

A workflow requiring meaningful human input or approval at specified points. A generic confirmation dialog is not necessarily an effective control.

Agents

Hyperparameter

A configuration chosen outside ordinary parameter learning, such as learning rate, batch size, architecture depth, or regularization strength.

Training

Incident response

The process of preparing for, detecting, containing, investigating, eradicating, recovering from, and learning from a security incident affecting an AI system.

AI security

Indirect prompt injection

Instructions embedded in external content that enter model context through retrieval, browsing, messages, tool results, or other data paths.

AI security

Inference

Using trained parameters to compute predictions, representations, recommendations, or generated outputs from new input.

Models

Inference API

A network or local programming interface that accepts model inputs and returns inference outputs, often with routing, quotas, logging, and policy.

Operations

Instruction tuning

Fine-tuning on instruction–response examples to improve following natural-language tasks and formats.

Training

Integrity

The property that data, models, configuration, outputs, decisions, and actions are accurate and protected from unauthorized alteration.

AI security

Interpretability

The degree to which people can understand model mechanisms or input–output relationships. It overlaps with but is not identical to explainability.

Trustworthy AI

Jailbreak

An input strategy intended to bypass model behavior restrictions or safety policies. A jailbreak is not necessarily a security exploit unless connected to assets or authority.

AI security

Judge model / LLM-as-a-judge

A model used to score other model outputs. It can introduce bias, inconsistency, prompt sensitivity, leakage, and correlated failure.

Evaluation

Key-value cache (KV cache)

Cached attention keys and values reused across autoregressive generation. Cache ownership, lifecycle, isolation, and eviction can affect confidentiality and availability.

Operations

Knowledge base

A managed collection of information used for search, retrieval, reasoning, or generation. It may contain documents, records, graphs, or structured data.

RAG

Label

A target value or annotation associated with an example for supervised learning or evaluation.

Data

Language model

A model that estimates probabilities over tokens or token sequences. Not every NLP model is a language model.

LLMs

Large language model (LLM)

A high-parameter language model, usually Transformer-based and pretrained on large corpora, that can perform or support many language tasks.

LLMs

Latent space

A learned representation space in which inputs or generated states are encoded as vectors. The term is overloaded across model families.

Models

Layer

A stage of learned or fixed computation that transforms one representation into another.

Neural networks

Learning rate

A hyperparameter controlling the size of optimizer updates. Too high may destabilize training; too low may slow or stall learning.

Training

Least privilege

Giving an identity, tool, process, model, or workload only the authority required for its defined task and no broader access.

AI security

Logit

A model's raw, unnormalized score for a possible output class or token before softmax or another normalization.

LLMs

LoRA

Low-Rank Adaptation: a parameter-efficient fine-tuning method that learns low-rank update matrices while the base weights remain mostly frozen.

Training

Loss function

A differentiable objective that quantifies training error or preference and guides parameter updates.

Training

Machine learning (ML)

A set of methods that learn model behavior or parameters from data or experience instead of expressing all behavior as explicit rules.

Core AI

Mean reciprocal rank (MRR)

A retrieval metric that averages the reciprocal rank of the first relevant result. It does not measure authorization correctness or complete recall.

Evaluation

Membership inference

Inferring whether a particular record was included in a model's training data.

AI security

Memory (agent)

State retained or retrieved across agent steps or sessions. It may be short-term context, persisted records, summaries, or vector-retrieved history.

Agents

Metric

A defined quantitative measure. A metric is meaningful only with its dataset, threshold, aggregation, and operational context.

Evaluation

MLOps

Practices and systems for developing, testing, versioning, deploying, monitoring, and governing ML models and data in production.

Operations

Modality

A type of information such as text, image, audio, video, sensor data, or structured records.

Models

Model

A parameterized computational representation that maps input to output. In casual speech, 'model' is often incorrectly used for the entire AI system.

Models

Model cache

Stored model weights, compiled artifacts, or runtime data reused to reduce loading cost. Cache integrity, provenance, and tenant isolation must be controlled.

Operations

Model card

Documentation describing a model's intended uses, training or evaluation information, limitations, risks, and other release-relevant facts.

Governance

Model Context Protocol (MCP)

A client-server protocol for connecting AI applications to tools, resources, prompts, and related capabilities using a defined data and transport architecture.

Agents

Model drift

A change in production model performance or behavior over time due to data, environment, dependencies, or system changes.

Operations

Model extraction

Reconstructing or approximating a target model's parameters, decision behavior, or functionality through queries, artifacts, or internal access.

AI security

Model inversion

Inferring representative or sensitive properties of training data from model access and outputs.

AI security

Model registry

A controlled catalog of model artifacts, versions, metadata, approvals, stages, and deployment status.

Operations

Model serving

Infrastructure and software that load models and expose inference while managing scaling, batching, routing, hardware, policy, and telemetry.

Operations

Multimodal model

A model that accepts or produces more than one modality, such as text and images.

Models

Natural language processing (NLP)

The field concerned with computational representation, understanding, transformation, and generation of human language.

Core AI

Neural network

A parameterized model composed of connected layers that transform inputs through learned weights, biases, and nonlinear functions.

Neural networks

Next-token prediction

The training or inference task of predicting a probability distribution over the next token given preceding context.

LLMs

Node / neuron / unit

A computational element that combines inputs and parameters and usually applies an activation function. Terminology varies by architecture.

Neural networks

Nondeterminism

Variation in outputs or artifacts caused by randomness, concurrency, numeric kernels, hardware, data order, or hidden implementation choices even when the nominal program and data appear unchanged.

Operations

Objective function

The quantity an optimization process seeks to minimize or maximize. It may combine primary loss, regularization, reward, or constraints.

Training

One-shot prompting

Providing one example in context before requesting a new response.

LLMs

Optimizer

An algorithm such as SGD or Adam that uses gradients and internal state to update parameters.

Training

Output encoding

Converting output into a safe representation for its destination, such as HTML, SQL, shell, or a URL context. Encoding is destination-specific and not a substitute for authorization.

AI security

Output sanitization

Removing, escaping, validating, or rejecting unsafe content before it reaches a parser, renderer, interpreter, tool, or downstream system. Sanitization must match the destination.

AI security

Overfitting

Learning training-specific patterns that do not generalize to relevant unseen data.

Evaluation

Parameter

A numeric value learned during training, such as a weight or bias. Parameter count is an incomplete proxy for capability.

Models

Parameter-efficient fine-tuning (PEFT)

Adaptation methods that train a small subset or additional parameters rather than all base-model weights.

Training

Perplexity

An exponentiated average language-model loss reflecting how surprised the model is by a token sequence. Lower is better only for comparable data and tokenization.

Evaluation

Personally identifiable information (PII)

Information that identifies or can reasonably be linked to an individual. AI prompts, training data, retrieval content, and logs may contain PII.

Privacy

Perturbation budget

The maximum permitted change to an adversarial input, expressed by a mathematical norm or a real-world constraint such as preserving a valid and functional file.

AI security

Positional information

A mechanism that represents token order, including learned positions, fixed encodings, or rotary position embeddings such as RoPE.

Transformers

Pre-training

Initial large-scale training that learns broad representations or next-token behavior before narrower adaptation.

Training

Precision

Among predicted positives, the fraction that are actually positive: TP/(TP+FP). Also an overloaded term for numeric data type, such as FP16.

Evaluation

Prompt

Input supplied to a model for a generation or prediction. It may contain instructions, data, examples, tool definitions, retrieved content, and state.

LLMs

Prompt cache

A cache of reusable prompt prefixes or prompt-derived computation. Cache keys and authorization context must prevent cross-tenant disclosure.

Operations

Prompt engineering

Designing prompts to elicit useful behavior. It improves interaction quality but is not an authorization or security boundary.

LLMs

Prompt injection

An attempt to make model-controlled behavior follow attacker-supplied instructions that conflict with the application's intended instruction hierarchy or policy.

AI security

Prompt leakage

Disclosure of hidden or application-supplied prompt content. Prompts must not be treated as secret storage.

AI security

Prompt template

A versioned structure that combines fixed instructions and variable data into model input.

LLMs

Provenance

Traceable information about origin, ownership, transformations, versions, custody, and approvals for data, models, prompts, content, or actions.

Governance

Quantization

Representing model weights or activations with lower numeric precision to reduce memory, cost, or latency, sometimes with quality trade-offs.

Operations

Query

A representation of an information need sent to a search or retrieval system. It may be the user text, a rewrite, decomposition, or embedding.

RAG

Query budget

The maximum number or rate of probes available to an attacker or evaluator through an inference interface under a stated identity and output policy.

AI security

Rate limiting

Restricting request, token, tool, data, or cost volume over an identity, tenant, resource, or period to reduce abuse and availability impact.

AI security

Re-identification

Linking de-identified, pseudonymized, or aggregated information with other data to infer an individual's identity.

Privacy

Recall

Among actual positives, the fraction correctly predicted: TP/(TP+FN). In retrieval, the fraction of relevant items retrieved.

Evaluation

Red teaming

Authorized adversarial testing designed to discover and validate security, safety, privacy, abuse, or resilience weaknesses under defined rules of engagement.

AI security

Regression

A task that predicts a continuous numeric value.

Machine learning

Regularization

Methods that constrain learning to improve generalization, such as weight decay, dropout, or data augmentation.

Training

Reinforcement learning (RL)

Learning a policy through interaction using states, actions, rewards, and returns rather than fixed labels alone.

Machine learning

Repetition penalty

A decoding adjustment applied to scores for previously generated tokens. It can reduce repetition but may suppress necessary repeated content.

LLMs

Representation

A numeric encoding of an input, intermediate state, or concept used by a model.

Models

Reranker

A model or rule that reorders retrieved candidates using a more precise relevance estimate after initial retrieval.

RAG

Retention

The policy and technical behavior governing how long data, prompts, outputs, logs, embeddings, memory, and artifacts are kept and when they are deleted.

Governance

Retrieval-augmented generation (RAG)

A system pattern that retrieves external information and supplies it to a generative model so output can use non-parametric knowledge.

RAG

Reward model

A model trained to estimate preference or quality and provide a reward signal for policy optimization or ranking.

Training

Risk register

A maintained record of identified risks, causes, assets, owners, likelihood or confidence, impact, controls, treatment, and residual risk.

Governance

RLHF

Reinforcement Learning from Human Feedback: training a policy using preferences or feedback, typically involving a reward model and RL optimization.

Training

Robustness

The ability to maintain acceptable behavior under expected variation, errors, stress, or attack. Robustness must be scoped and measured.

Trustworthy AI

Safety

Freedom from unacceptable harm. Safety overlaps with security but includes harms not caused by an adversary.

Trustworthy AI

Safety regression

A measurable degradation in previously accepted safety behavior after a model, adapter, prompt, data, tool, policy, or runtime change.

Evaluation

Sampling

Selecting outputs from a probability distribution. In MCP, sampling is also a protocol feature by which servers request model completions from a client; state the meaning.

LLMs

Sandboxing

Isolating code, models, tools, or artifacts with restricted identities, filesystem, network, compute, and data access to limit compromise impact.

AI security

Scoped credentials

Credentials limited by identity, tenant, resource, action, audience, purpose, or expiry rather than broad reusable authority.

Identity

Self-attention

Attention where queries, keys, and values are derived from positions in the same sequence.

Transformers

Self-supervised learning

Learning targets from the structure of unlabeled data itself, such as predicting masked or next tokens.

Machine learning

Semantic cache

A cache that reuses results for semantically similar requests. Similarity keys must include authorization and data-sensitivity context where required.

Operations

Semantic search

Retrieval based on meaning-oriented representations, usually embeddings, rather than exact keyword matching alone.

RAG

Semi-supervised learning

Training that combines a smaller labeled dataset with a larger unlabeled dataset.

Machine learning

Sequence

An ordered collection of tokens or other elements processed as a unit.

LLMs

Server-side request forgery (SSRF)

A vulnerability in which an application is induced to make network requests chosen by an attacker, potentially reaching internal services or metadata endpoints.

AI security

Softmax

A function that converts a vector of logits into normalized positive values summing to one, often interpreted as a categorical distribution.

Neural networks

Sparse retrieval

Retrieval using sparse lexical representations, such as term-frequency methods, where most vector dimensions are zero.

RAG

Special token

A reserved vocabulary item representing protocol structure such as sequence, role, padding, tool, generation, or document boundaries.

LLMs

Stop sequence

A configured token pattern that ends generation when matched. Tokenization, encoding, and streaming behavior affect how it is recognized.

LLMs

Supervised fine-tuning (SFT)

Fine-tuning on curated input–desired-output examples, often used to make pretrained LLMs follow instructions.

Training

Supervised learning

Learning a mapping from inputs to known target labels or values.

Machine learning

System prompt

Application-supplied instructions intended to guide model behavior. It is part of model context, not a secret store or deterministic policy boundary.

LLMs

Telemetry

Recorded signals describing system state and behavior, including inputs, versions, retrieval, policy decisions, tools, identities, egress, performance, and outcomes.

Operations

Temperature

A decoding parameter that rescales logits before sampling. Higher values generally flatten the distribution; zero does not guarantee platform-level determinism.

LLMs

Tenant isolation

Controls that prevent one customer, organization, or security domain from accessing or influencing another tenant's data, memory, tools, identity, or compute.

AI security

Tensor

A multidimensional array used to represent data, parameters, activations, and gradients.

Neural networks

Test set

A held-out dataset used for final evaluation after model and hyperparameter choices. Repeated tuning on it contaminates the estimate.

Evaluation

Threat model

A structured representation of assets, actors, goals, trust boundaries, assumptions, attack paths, controls, and residual risks for a defined system.

AI security

Token

A vocabulary unit processed by a language model. A token may be a word, subword, byte, punctuation mark, or special control symbol.

LLMs

Token embedding

A learned vector mapped from a token ID before contextual processing.

Transformers

Token scoping

Restricting a token’s permissions, audience, resources, operations, and lifetime to the smallest required authority.

Identity

Tokenizer

The versioned algorithm and vocabulary that convert raw input to token IDs and token IDs back to text or other units.

LLMs

Tool

A function or capability exposed to an AI application to retrieve information or change state. Tool execution must be authorized outside the model.

Agents

Tool calling

The process of selecting a tool and producing structured arguments for execution. The model proposes; application controls must validate and authorize.

Agents

Top-k sampling

Sampling restricted to the k tokens with highest current probability.

LLMs

Top-p / nucleus sampling

Sampling from the smallest set of tokens whose cumulative probability reaches a threshold p.

LLMs

Training

The process of adjusting model parameters to optimize an objective using data, feedback, or interaction.

Training

Training data

Data used to learn model parameters. It is distinct from validation, test, retrieval, and production input data.

Data

Transformer

A neural-network architecture built primarily from attention and feed-forward layers that processes token representations in parallel during training.

Transformers

Trigger

The input pattern, token, feature, context, or artifact condition that activates hidden backdoor behavior.

AI security

Triggered prompt injection

A planted instruction that activates only when a specified phrase, context, identity, time, user action, or system event is present.

AI security

True negative (TN)

A negative case correctly predicted as negative.

Evaluation

True positive (TP)

A positive case correctly predicted as positive.

Evaluation

Truncation policy

A deterministic rule for rejecting, removing, summarizing, or selecting content when a request exceeds its context budget.

LLMs

Trust boundary

A point where data, identity, authority, ownership, or assurance level changes and controls must validate the transition.

AI security

Underfitting

Failure to learn enough structure to perform adequately even on the training objective or relevant validation data.

Evaluation

Unsupervised learning

Learning patterns or structure from data without explicit target labels, such as clustering or dimensionality reduction.

Machine learning

Validation set

Data used during development for model selection, thresholding, early stopping, or hyperparameter tuning.

Evaluation

Vector database

A database product designed to store, index, filter, and search vectors with associated metadata. The term is often used loosely.

RAG

Vector store

A component that stores vectors and supports similarity retrieval, often with metadata filtering. It may be a feature of a general database.

RAG

Vocabulary

The finite mapping between tokenizer representations and token identifiers used by a particular tokenizer version.

LLMs

Weight

A learned parameter multiplying or transforming model activations. Model weights are security-sensitive intellectual property and executable inputs to a runtime.

Models

White-box access

Access to model internals such as parameters, architecture, gradients, code, or training details.

AI security

Workload identity

An identity assigned to a running service, job, container, model runner, or agent workload so its actions can be authorized and attributed separately from a human user.

Identity

Zero-shot prompting

Requesting a task without providing task-specific examples in the current prompt.

LLMs