What is an LLM and how does it actually work: an in-depth explanation

What an LLM actually is

A large language model (LLM) is a mathematical function with billions to trillions of adjustable parameters that has learned to do exactly one thing extraordinarily well: predict the most likely next word (more precisely, token) in a piece of text. That sounds surprisingly simple for something capable of writing code, explaining physics, or holding a conversation — and it's precisely in this gap between the simplicity of the principle and the richness of the resulting behavior that most misunderstandings about what LLMs are (and aren't) come from.

An LLM isn't a database of facts, and it isn't a search engine. It's a statistical language model trained on an enormous amount of text, which built up internal representations of grammar, facts, style, and (to some extent) logical reasoning during training — not because that was ever its explicit goal, but because accurately predicting the next word requires it.

Step 1: Tokenization — turning text into numbers

Neural networks don't understand letters or words — they work exclusively with numbers. The first step is therefore tokenization: splitting text into smaller units called tokens, each of which gets a numerical ID from a vocabulary that typically contains tens to hundreds of thousands of possible tokens.

A token isn't the same thing as a word. Most modern LLMs use an algorithm similar to Byte-Pair Encoding (BPE), which first learns which sequences of characters occur most frequently in the language, and merges those into a single token. Common short words (e.g. "a", "the") often end up as a single token each, while longer or rarer words get broken down into several sub-word pieces.

Step 2: Embeddings — words as coordinates in a space of meaning

A token's numerical ID carries no meaning by itself — "42" isn't "closer" to "43" in any linguistically meaningful sense. That's why every token is first turned into an embedding: a vector of hundreds to thousands of decimal numbers that represents its meaning as a coordinate in a high-dimensional space.

During training, this space gets organized so that tokens with similar meaning or usage end up geometrically close to each other. A famous (simplified) example: the vector for "king" minus the vector for "man" plus the vector for "woman" ends up close to the vector for "queen" in the trained space — the model captures relationships between concepts as directions in space, not as explicit rules anyone programmed in.

Step 3: The Transformer — the architecture that drives it all

Every large language model today — GPT, Claude, Gemini, Llama — is built on the Transformer architecture, introduced in 2017 in the paper "Attention Is All You Need." Its key contribution is a mechanism called self-attention.

Self-attention: the model "notices" the relevant words

Picture the sentence: "The cat sat on the chair because it was tired." For the model to correctly figure out what "it" refers to — the cat, or the chair — it has to be able to connect that word to the right earlier word in the context of the whole sentence, not just the nearest neighbor. That's exactly what self-attention does: for every token, it computes how much it should "pay attention" to every other token in the sentence when interpreting it.

Mechanically, this happens using three derived vectors for every token — a Query (what I'm looking for), a Key (what I offer), and a Value (what content I carry). The relevance between two tokens is computed as the product of their Query and Key vectors; the resulting weights are used to build a weighted average of the Value vectors — producing a new representation of the token, enriched with context from the whole sentence.

Attention(Q, K, V) = softmax( Q · K^T / sqrt(d_k) ) · V

This formula, abstract as it looks at first glance, is the mathematical core of essentially all modern language-based AI. The model doesn't run this operation just once, but simultaneously across multiple attention "heads" (multi-head attention) — each head can learn to track a different type of relationship (e.g. one for grammatical agreement, another for references to people, another for logical continuity).

Positional encoding and layering

Since self-attention on its own has no sense of word order (it processes tokens in parallel, not sequentially like older recurrent networks), positional encoding is added — information about which position in the sentence a token occupies. The self-attention layer is then followed by a simple feed-forward network (an independent transformation of each token), and this entire block — attention plus feed-forward, both wrapped in a residual connection and normalization — repeats many times in sequence within the model, typically across dozens to hundreds of layers. Each subsequent layer builds on the representations of the one before it and captures increasingly abstract relationships — from grammar in the lower layers to semantics and style in the higher ones.

Step 4: Training — where the model's "knowledge" comes from

The architecture alone is just an empty structure. The actual "knowledge" lives in the parameters (weights) — numbers that determine exactly how the model transforms input into output at every layer. These are set during training (pre-training).

The principle is conceptually simple: the model is shown an enormous amount of text (web pages, books, code, scientific papers — on the order of trillions of tokens), part of which is hidden, and the model's job is to predict what comes next. At first it guesses randomly. Every prediction is compared against the actual next word, an error is computed (called the loss), and the backpropagation algorithm nudges millions to billions of parameters a tiny bit in the direction that reduces the error. This cycle repeats trillions of times, across thousands of specialized GPU/TPU chips running simultaneously for weeks to months.

This massive scaling isn't an end in itself: research has repeatedly shown that as the number of parameters, amount of data, and compute increase, model quality improves predictably — and more interestingly, at certain scales emergent capabilities show up that smaller models simply didn't have at all (e.g. multi-step logical reasoning), without ever being explicitly trained for them.

Step 5: Fine-tuning and alignment

A model trained purely to predict the next word from internet text is extraordinarily capable, but not necessarily a useful or safe assistant — it will just as readily finish a dangerous set of instructions as a weather report, because both appear on the internet. Several additional phases follow:

• Supervised fine-tuning (SFT) — the model is further trained on carefully selected examples of high-quality questions and answers that demonstrate the desired assistant conversational style.
• RLHF (Reinforcement Learning from Human Feedback) — human raters compare multiple model responses to the same question and mark which one is better. These preferences are used to train a separate "reward model," which then provides feedback for fine-tuning the main model using reinforcement learning techniques.
• Additional alignment methods — various labs supplement this process with their own techniques (e.g. training the model to evaluate its own responses against a set of principles), so the resulting system is not only capable, but predictably safe and helpful too.

This phase is exactly why a raw, pre-trained-only model (a base model) behaves very differently from the product you normally interact with through a chat interface.

How an LLM actually generates text (inference)

When an LLM "answers," it doesn't do so all at once — it generates text autoregressively, one token at a time. At every step, the model computes a probability distribution over its entire vocabulary (what's the chance the next token is "the," what's the chance it's "however," what's the chance it's "42"...) and picks one token to append to the text so far — then the whole process repeats for the next token, now with the previous choice included as part of the input.

How a token gets picked from that probability distribution is configurable:

• Greedy decoding — always pick the most probable token. Deterministic, but often leads to dull, repetitive text.
• Temperature — a parameter that "smooths" or "sharpens" the probability distribution. Low temperature makes output more predictable and conservative; high temperature increases randomness and creativity (and the risk of nonsense).
• Top-k and top-p (nucleus) sampling — instead of choosing among absolutely every token in the vocabulary, the choice is restricted to the most probable subset (e.g. the top-k best candidates, or the smallest group whose combined probability exceeds a threshold p), which eliminates extremely unlikely, nonsensical continuations.

This probabilistic nature of generation is exactly why the same model can answer the same question slightly differently each time you ask it — that's not a bug, it's a property of the very principle it's built on.

The context window: the model's working memory

An LLM has no persistent memory between conversations — every new conversation starts "from zero." What a model "remembers" during a single conversation is limited to its context window — the maximum number of tokens (your input, the conversation history, and the generated output combined) it can process at once. Modern models have context windows ranging from tens of thousands to hundreds of thousands of tokens, but anything beyond that limit simply falls out of the model's "working memory."

Why LLMs hallucinate

A hallucination — a confidently stated, but incorrect or made-up claim — isn't a random software bug that can simply be "fixed." It's a direct consequence of what an LLM fundamentally is: a statistical generator of the most likely continuation of text, not a system that checks every claim against some database of truth.

When a model doesn't know an answer with certainty, its training has nonetheless taught it that a fluent, confident-sounding sentence is a statistically more likely "good" continuation of the text than admitting uncertainty — because the human-written text it was trained on contains relatively few examples of an honest "I don't know" in contexts where the author was expected to give an answer. Newer reasoning models and better alignment reduce this risk, but the underlying principle — the model generates what's statistically likely, not necessarily what's true — remains a fundamental property of the architecture, not a bug in any particular implementation.

Reasoning models: "thinking" before answering

A newer generation of models adds an extra step — before generating a final answer, the model internally produces a longer chain of intermediate steps (so-called chain-of-thought), in which it breaks the problem down into parts, tries multiple approaches, or checks its own work. This approach, known as increasing test-time compute (compute spent at answer time, not just during training), significantly improves performance on tasks requiring multi-step logic, math, or programming — essentially by letting the model "think longer" about harder problems, much like a person reaches for pen and paper on a difficult task instead of answering instantly from memory.

Beyond text: multimodality and tools

The same principle — tokenization, embedding, self-attention — can be extended beyond text. An image can be split into small patches that get tokenized similarly to words; audio can be converted into a sequence of discrete units. The resulting multimodal models process text, images, audio, and video within the same architecture.

Another extension is the ability to perform tool use / function calling — the model learns to recognize when it can't answer from its own parameters alone, and instead of guessing, generates a structured request to an external tool (a web search, running code, calling an API), waits for the result, and works it into its answer. This exact capability is what powers today's agentic AI systems, which can carry out multi-step tasks on their own.

Security risks specific to LLMs

The architecture described above also introduces a class of security risks that practically didn't exist before LLMs:

• Prompt injection — since an LLM doesn't fundamentally distinguish between "instructions from the developer" and "text it's currently processing," an attacker can hide text phrased as a command inside a web page, document, or email that the model reads. If the model interprets that embedded text as an instruction, it can act against the user's original intent — this connects directly to the topic of our article on the most common cyberattacks.
• Jailbreaking — carefully crafted inputs that try to bypass the safety guardrails set during the alignment phase, for example by framing a dangerous request as a fictional scenario or role-play.
• Training data leakage — under certain types of input, models can sometimes reproduce fragments of text they saw during training, which poses a privacy leak risk when sensitive or personal data was present in the training set.
• Data poisoning — since a model learns from a huge corpus of web text, an attacker with sufficient resources could theoretically insert misleading or malicious content onto publicly accessible websites to influence future training of models that draw on those sources.
• Non-determinism as a testing challenge — since an LLM's output isn't always identical for the same input, and "correctness" of an answer isn't binary the way it is in classic software, traditional approaches to security testing and QA need to be substantially adapted.

Summary

At its core, an LLM is an elegant, if extraordinarily compute-hungry, application of a single idea: learn to predict the next token accurately enough on a huge amount of text, and let complex behavior — grammar, facts, style, and to some degree logic — emerge as a byproduct of that task. Text gets broken into tokens, tokens turn into vectors of meaning, the self-attention mechanism in the Transformer architecture connects every word to relevant context across the whole sentence and document, training on trillions of examples sets billions of parameters, and an alignment phase (RLHF and similar techniques) turns the raw model into a usable assistant. The result is a system that's extraordinarily useful, yet fundamentally different from classic deterministic software — which brings both new opportunities and new security risks that the cybersecurity field is only just learning to deal with.