How LLMs Actually Work

What Is an LLM?

LLM stands for Large Language Model. Strip away the marketing and here's what it does:

You give it text. It predicts the next token.

That's the core generation operation. An LLM learns statistical patterns from large mixtures of text and other training data, then applies those patterns one token at a time to generate a response.

When you ask "What's the capital of France?" the model isn't looking up an answer in a database. It's predicting that, given the pattern of your question, the most likely next words are "The capital of France is Paris."

Tokens: How the Model Sees Text

LLMs don't read words the way you do. They break text into tokens - small pieces that might be whole words, parts of words, or even single characters.

Every model has a token limit - the maximum number of tokens it can process at once. This isn't just trivia. It's the fundamental constraint that shapes how LLMs work.

The Context Window

The context window is the model's working memory. It's the total amount of text the model can "see" at any one time - your messages, its responses, and any instructions from the developer.

Think of it like a whiteboard with a fixed size. Everything the model needs to know must be written on this whiteboard. When it fills up, old content gets erased to make room.

Example context window sizes (the exact limit depends on the model and product):

• 4K tokens - about 3,000 words (early models)
• 128K–1M tokens - about 100,000–750,000 words (available in many current long-context models)
• 1M+ tokens - roughly 750,000 words or more (supported by some current models)

Each API Call Receives Its Context

Here's the thing most people don't realize: a base LLM does not retain the previous API call by itself. The application must provide the context needed for every new turn.

In a typical chat, the application stores your conversation and sends the relevant transcript again on each turn. Long conversations may be truncated, summarized, or selectively retrieved instead of replayed word-for-word. Product memory features also live outside the base model and insert saved information into later requests.

Click through each turn to see what actually gets sent. (The "instructions" row is the developer's hidden setup text - you'll learn about that in the next module.)

In this simple example, the context keeps growing. Turn 1 sends 2 messages. Turn 2 sends 4 messages. Turn 3 sends 6. The model is not internally continuing the conversation; the application supplies the transcript again and the model predicts what comes next.

When the context window fills up, the application must drop, summarize, or retrieve older material. Anything it does not include in the next request is unavailable to that model call.

Why This Matters for Security

If, at its core, an LLM is a next-token text predictor with a finite text window and no memory between calls, then:

• It can't be guaranteed to "follow rules" - it generates text that's statistically consistent with its instructions and training, so a cleverly worded input can steer it off them
• It can't reliably "protect secrets" - anything sitting in the context window is just text, and the right prompt can often coax it back out
• It has no hard security boundary inside natural-language context that guarantees untrusted content cannot act like instructions - role hierarchy helps, but it is not deterministic authorization

Every AI security vulnerability you'll learn about traces back to these fundamentals.

Now that you know what an LLM actually is, the next question is: how do developers control its behavior? That's where system prompts come in - and where things start to get fragile.

Sources

• Attention Is All You Need - the Transformer architecture underlying modern LLMs
• Google Gemini API: Long context - current examples and behavior of long context windows