Explain the technology
Distinguish AI, ML, deep learning, generative AI, foundation models, LLMs, RAG, and agents without using them as synonyms.
The technical foundation and canonical vocabulary for the entire course. Understand what models actually learn, how LLM applications move data and authority, and where security-relevant boundaries appear.
Distinguish AI, ML, deep learning, generative AI, foundation models, LLMs, RAG, and agents without using them as synonyms.
Follow data from raw input through preprocessing, tokenization, model inference, retrieval, tools, memory, output, and telemetry.
Read training, evaluation, and performance claims with the right metrics, datasets, baselines, thresholds, and limitations.
Identify assets, identities, trust boundaries, state changes, and control points before studying individual attacks.
The course glossary defines how terminology is used in learner work. When a source uses an overloaded term differently, quote or restate that source’s meaning. A model is never shorthand for the complete AI system.
| Block | Activity |
|---|---|
| 1 | AI, ML, deep learning, and problem types |
| 2 | Data, learning paradigms, training, and evaluation |
| 3 | Neural networks and optimization |
| 4 | Transformers, tokens, embeddings, and generation |
| 5 | Pre-training, post-training, adaptation, and serving |
| 6 | RAG architecture and retrieval evaluation |
| 7 | Agents, tools, memory, and MCP |
| 8 | Deployment, MLOps, performance, and observability |
| 9 | Architecture trace and terminology clinic |
| 10 | Knowledge check and review |
Block 1
Artificial Intelligence
├── rule-based, search, planning, knowledge, optimization, robotics …
└── Machine Learning
├── classical statistical and algorithmic ML
└── Deep Learning
├── discriminative models
└── generative models
├── diffusion and other families
└── foundation models
└── large language models
These are overlapping levels, not interchangeable labels. AI describes the broad capability and field. ML learns behavior from data or experience. Deep learning is ML using multilayer neural networks. Generative AI produces new content. A foundation model is broadly reusable. An LLM is a large language model, usually Transformer-based.
| Task | Typical output | Example security use |
|---|---|---|
| Classification | Discrete class or probability | Malicious / benign file prediction |
| Regression | Continuous value | Expected incident cost or anomaly score |
| Clustering | Groups without fixed labels | Infrastructure or behavior grouping |
| Ranking / retrieval | Ordered candidates | Relevant threat-report passages |
| Generation | New sequence or media | Report draft, code, query, image, or audio |
| Policy / control | Action selection | Agent chooses a tool or next investigative step |
Classify five systems you use by task and technique. For each, name the complete system, the model component, the output, and whether the model can change real-world state.
Block 2
Learns from input–target pairs. Typical tasks are classification and regression.
Finds structure without explicit labels, such as clustering or dimensionality reduction.
Derives learning targets from the data itself, such as masked-token or next-token prediction.
Combines a smaller labeled set with a larger unlabeled set.
Learns action policy through state, action, reward, and return.
Reuses representations or parameters learned on one setting for another task or domain.
Collect and document data → clean, transform, label, and split → select architecture and objective → initialize parameters → train on batches → validate and tune hyperparameters → evaluate once on held-out test conditions → release a specific artifact → monitor inputs, behavior, outcomes, cost, and drift → retrain, roll back, replace, or retire
Parameters are learned values such as weights. Hyperparameters are selected configuration such as learning rate, batch size, regularization, architecture depth, and decoding settings. The distinction matters for provenance and incident reconstruction.
Training loss measures the optimization objective on training examples. Validation supports development choices. A test set estimates behavior on held-out data only if it has not become part of iterative tuning. Strong benchmark performance can coexist with poor deployment performance, privacy leakage, or adversarial fragility.
Given a phishing classifier, define its features, labels, train/validation/test split, false-positive cost, false-negative cost, drift signal, and one way test leakage could inflate the result.
Block 3
input tensor → weighted transformation → activation function → hidden representations through multiple layers → output logits or values → loss against target → backpropagation computes gradients → optimizer updates parameters
A neuron or unit combines numeric inputs with learned weights and usually a bias, then applies an activation. Layers compose these transformations. A forward pass computes output. A loss function quantifies training error. Backpropagation applies the chain rule through the computation graph. An optimizer such as Adam uses gradients to update weights.
The model does not learn enough structure; both training and validation performance remain inadequate.
The model fits training-specific patterns and fails to generalize. It can also increase privacy risk.
Constraints such as weight decay, dropout, augmentation, or early stopping intended to improve generalization.
Deployment inputs, targets, or environment differ from development conditions—naturally or adversarially.
White-box attackers may use gradients to craft adversarial inputs. Poisoning changes what the model learns. Model extraction approximates behavior. Membership inference and inversion target information encoded by learning.
Block 4
A tokenizer converts raw text into token IDs using a versioned vocabulary and algorithm. Tokens may be words, fragments, bytes, punctuation, or special control markers. Tokenization changes length, cost, truncation, multilingual behavior, and attack representation.
Token IDs are mapped to embeddings. Positional information represents order. Transformer layers combine self-attention, feed-forward transformations, residual connections, and normalization to build contextual representations.
messages and application context
→ model-specific chat template
→ tokenizer → token IDs
→ token and position representations
→ repeated Transformer layers
self-attention: query–key relevance weights value information
feed-forward network: transforms each position
→ logits for possible next tokens
→ decoding policy selects one token
→ append token and repeat until stop condition
For one attention head, the common conceptual form is Attention(Q,K,V) = softmax(QKᵀ / √d) V. Learners do not need to derive it, but must understand that attention is learned weighted information flow—not a factuality or authorization mechanism.
| Decoding control | Meaning | Important limitation |
|---|---|---|
| Temperature | Rescales logits before sampling | Low temperature does not guarantee service-level determinism |
| Top-k | Restricts sampling to k highest-probability tokens | Can remove low-ranked but correct alternatives |
| Top-p | Uses the smallest set reaching cumulative probability p | The candidate set changes at every step |
| Maximum tokens | Bounds generated length | Does not bound tool loops or total workflow cost |
| Stop sequence | Stops on configured token patterns | Tokenization and encoding can affect matching |
A language model does not inherently provide current knowledge, tenant authorization, secret handling, factual verification, stable identity, policy enforcement, transactional integrity, or safe action execution. The application must provide those controls.
Block 5
data collection and filtering → tokenizer and architecture selection → large-scale pre-training → base checkpoint → supervised / instruction fine-tuning → preference alignment: RLHF, DPO, or related methods → safety, capability, and task evaluation → optional domain adaptation: full fine-tune, LoRA/PEFT, adapters → quantization or distillation → registry and release approval → serving, routing, monitoring, updates, and retirement
| Technique | Changes weights? | Primary use |
|---|---|---|
| Prompting / few-shot examples | No | Change current-context behavior |
| RAG | Normally no | Add external knowledge at inference time |
| Fine-tuning / SFT | Yes | Adapt task, domain, style, or instruction behavior |
| LoRA / PEFT | Adds or updates a smaller parameter set | Cheaper adaptation |
| RLHF / DPO | Yes | Optimize preferences or desired behavior |
| Quantization | Changes numeric representation | Reduce memory, latency, or cost |
| Distillation | Trains a new student | Transfer selected teacher behavior to a smaller model |
For one LLM release, list the base checkpoint, tokenizer, configuration, adapter, prompt template, evaluation set, decoding configuration, quantization, runtime, registry entry, and serving route. Which change could explain an unexpected behavior change?
Block 6
RAG combines a generative model’s parametric knowledge with retrieved external information. Ordinary RAG does not retrain the LLM. It changes inference context.
OFFLINE / INGESTION
source → parse → normalize → split into chunks → preserve metadata and ACL
→ embedding model → vector / lexical index
ONLINE / QUERY
user and tenant identity → query → optional rewrite/decomposition
→ dense, sparse, or hybrid retrieval with authorization filters
→ optional reranking → selected chunks with provenance
→ prompt augmentation → LLM generation
→ citation and support validation → response
| Measure | Question answered |
|---|---|
| Recall@k | Did the top k retrieved items include the relevant evidence? |
| Precision@k | How much of the top k was relevant? |
| Mean reciprocal rank | How early did the first relevant item appear? |
| Groundedness / faithfulness | Are generated claims supported by supplied evidence? |
| Citation precision / recall | Are citations supportive, and are relied-upon sources cited? |
| Authorization correctness | Was every retrieved item permitted for the initiating identity and tenant? |
Chunks and embeddings inherit data sensitivity and access requirements. Retrieval can create cross-tenant exposure, poisoning, stale-data use, indirect prompt injection, and provenance loss. Authorization must occur before sensitive content enters model context.
Block 7
An agent is a system pattern, not a special magical model. It connects model output to state, tools, and repeated execution.
goal and initiating identity → observe context and state → plan or choose next step → propose tool and structured arguments → application validates policy and authorization → optional human approval bound to exact action → execute with scoped workload identity → observe result and write controlled memory → repeat within time, cost, step, and authority limits
An MCP host is the AI application. It creates one or more clients, each connected to a server. MCP separates a JSON-RPC data layer from transport. Servers can expose three core primitives:
Executable functions the AI application may invoke to retrieve information or change state.
Data or content managed by the application and supplied as context.
Reusable interaction templates or workflows selected for model conversations.
Clients may also support sampling and other capabilities. “Model-controlled” does not mean “model-authorized.” Applications must authenticate endpoints, validate schemas, enforce user and tenant authorization, constrain tools, display material actions, bind approvals, log definitions and calls, and control egress.
| Memory | Example | Security concern |
|---|---|---|
| Working / context | Current conversation and scratch state | Sensitive context, injection, truncation |
| Episodic | Past actions or sessions | Cross-session or cross-user leakage |
| Semantic | Facts, summaries, vector-retrieved knowledge | Poisoning, staleness, provenance |
| Procedural | Reusable workflows or policies | Unauthorized modification or shadowing |
Block 8
| Dimension | Examples |
|---|---|
| Task quality | Accuracy, precision, recall, F1, success rate, human rubric |
| Generation | Task success, groundedness, citation support, format validity |
| Retrieval | Recall@k, precision@k, ranking, authorization correctness |
| Security | Attack success rate, control-bypass rate, unauthorized action rate, data exposure |
| Reliability | Variance, retry behavior, availability, drift, graceful failure |
| Operations | Latency, time to first token, tokens/second, throughput, cost, GPU/CPU/memory |
client → authentication and quota → model gateway / router → prompt and policy processing → selected model runtime → accelerator and cache → streamed or complete output → validation / tool orchestration → telemetry and billing
MLOps adds versioning and governance for data, models, code, configuration, evaluation, registry stages, deployment, monitoring, rollback, and retirement. An incident record must identify the exact model, tokenizer, adapter, prompt template, retrieval index, tool definitions, policy, runtime, and route—not only a vendor model name.
Helpful is not necessarily factual. Safe is not necessarily secure. High benchmark performance is not necessarily robust production behavior.
Block 9
Trace the same user question through three progressively capable systems:
Correct this statement using the glossary:
“The AI learned our PDF during inference, stored it in its neural-network database, reasoned deterministically, and securely called the MCP API. The 95% accuracy score proves the agent is safe.”