Laughing in the face of LLMS aka AI......


Artificial Intelligence (AI) and Large Language Models (LLMs) are reshaping the digital world. From automating workflows to powering chatbots, copilots, search engines, and content creation LLMs like ChatGPT, Claude, Gemini, and open-source models are everywhere.
But with great capabilities come serious security concerns.
This blog explores the growing attack surface of AI and LLM systems, real-world vulnerabilities, and how we can secure the future by design not just by defense.
With great intelligence comes great responsibility ~ especially when that intelligence is artificial.
🤖 Let’s start with.…..
What is AI?
Artificial Intelligence (AI) refers to the ability of machines especially computer systems to perform tasks that typically require human intelligence. These tasks include:
Understanding and generating language (like ChatGPT does)
Recognizing images or speech
Making decisions or predictions
Learning from data (machine learning)
Solving problems or automating complex processes
In simple terms, AI is about building machines that can think, learn, and act intelligently either by following rules or by learning patterns from data.
🧠 Types of AI (At a Glance)
Narrow AI
- Specialized in one task (e.g., spam filters, voice assistants).
General AI
- Can perform any intellectual task a human can (still theoretical).
Superintelligent AI
- Beyond human intelligence (a future concept).
🧰 Examples of AI in Daily Life
Chatbots and virtual assistants (e.g., Siri, Alexa, ChatGPT).
Recommendation engines (e.g., Netflix, YouTube).
Autonomous vehicles (self-driving cars).
Fraud detection in banking.
AI-generated images, text, or music.
Okay, So what is LLM now !
Imagine you're in a vast, infinite library. Billions of books—novels, news articles, research papers, code snippets, forum posts are stacked around you. No human could ever read them all, but you’ve got a superpowered intern who can.
This intern is your LLM - Large Language Model.
But this isn’t just any intern. It's one trained by reading the entire internet billions of words, concepts, arguments, codebases, and conversations. And now, when you ask it a question, it doesn’t search for an answer it writes one that statistically fits everything it’s ever read.
⚙️ Under the Hood: How the Magic Works
Let’s break the illusion and look inside this intern’s brain.
🔬 1. The Brain: Transformer Architecture
LLMs are built using the Transformer architecture a neural network that doesn’t read word-by-word like humans. Instead, it looks at all the words at once and figures out which words are talking to each other, using a mechanism called self-attention.
Imagine reading the sentence:
“The trophy doesn’t fit in the suitcase because it is too small.”
A transformer figures out that “it” refers to “suitcase” by weighing every possible meaning and deciding which is most statistically likely, based on everything it’s learned.
This ability to see context globally rather than sequentially is why transformers revolutionized NLP.
🧮 2. The Thinking: Probability, Not Facts
LLMs don’t “know” things they predict.
When you prompt:
“The capital of France is…”
The LLM doesn’t look up a fact. It predicts the next most probable word, given everything it has seen. That word happens to be “Paris” because it appeared that way billions of times in training data.
That’s why it can hallucinate. It’s not retrieving; it’s generating.
🧰 3. The Toolkit: Tokens, Embeddings & Layers
Here’s the journey of your prompt inside the model:
Tokenization – Your text is broken down into small subwords or tokens (e.g., “intelligence” → “intel”, “ligence”).
Embedding – Each token is turned into a vector—a point in a high-dimensional semantic space.
Transformer Layers – Dozens or hundreds of layers refine these vectors using:
Multi-head self-attention
Feed-forward networks
Positional encoding (so it knows order matters!)
Output – It spits out a probability distribution over the next token. Then the next. Then the next...!
🧠 Training the LLM: Becoming a Linguistic Demigod
Training an LLM is like raising a baby genius on a thousand lifetimes of knowledge. Except this baby has:
Billions of parameters (e.g., GPT-3: 175B, GPT-4: undisclosed but bigger)
Terabytes of data (Common Crawl, Wikipedia, GitHub, Reddit, books, etc.)
Thousands of GPUs running in parallel for weeks or months
The goal? Learn to predict the next token, given a previous context. That’s it.
But by doing this at scale, it learns grammar, logic, bias, poetry, sarcasm, and Python.
🧠 After Pretraining: Specialization
Once the model is trained, it can be:
Fine-tuned: Trained further on medical/legal/code-specific data.
Aligned: Using reinforcement learning from human feedback (RLHF), so it behaves ethically.
Tool-enhanced: Connected to search engines, calculators, APIs (a.k.a. Toolformer, function calling, or agent frameworks).
Guardrailed: Using prompt validators, filters, and context boundaries.
🧨 Risks and Weirdness
LLMs are powerful, but not perfect. They can:
Hallucinate: Confidently invent fake facts or citations.
Leak data: If training data included sensitive info, it might be reproducible.
Be manipulated: Via prompt injections or adversarial inputs.
Reinforce bias: Mirroring toxic or biased patterns in training data.
Securing them requires constant testing, red teaming, monitoring, and ethical design.
🔁 Looping Back: So What Is an LLM?
A Large Language Model is a deep neural network, trained on vast text data using transformers, capable of understanding and generating human-like text by predicting the next word in a sequence.
It’s not magic. It’s not conscious. But it’s an astonishing feat of statistical pattern recognition—and a tool we must use wisely and securely.
Cool stuff, right? Now that we’ve decoded the brain of an LLM*, the next step is figuring out how to **command it. See you in Part 2*: *The Power of Prompts!*
Subscribe to my newsletter
Read articles from INDRAYAN SANYAL directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by

INDRAYAN SANYAL
INDRAYAN SANYAL
A cybersecurity consultant with over 4 years of experience, I specialize in assessing web applications, APIs, mobile applications, and more from a black/grey box perspective. My responsibilities include identifying vulnerabilities in source code and providing clients with action plans to protect their organizations against cyber threats.