CLLMSP · Domain 1
LLM Foundations & Transformer Internals
About 12% of the exam
From text to tokens
- Token
- the unit the model actually reads
- Tokenizer
- splits text into subword pieces
- Embedding
- dense vector carrying semantic meaning
- Context window
- tokens the model can attend to
- Self-attention
- every token scores every other
- Quadratic cost
- attention grows with squared length
- Decoder model
- generates the next token repeatedly
- Encoder model
- fixed representation built for comparison
- Rendering mismatch
- what a reviewer sees differs
A bigger context window is a bigger attack surface, because every extra token of untrusted content is another place to hide an instruction
The prompt stack and instruction hierarchy
- System prompt carries the operating rules
- Developer instructions sit below the system
- The user turn ranks below both
- Tool results are data, never instructions
- Retrieved documents rank lowest for trust
- Never place untrusted content in system role
- Truncation can silently drop the system prompt
- Prefill lets a caller start the answer
- Hierarchy is a convention, not a boundary
Decoding controls
- Temperature
- flattens or sharpens the distribution
- Top-p
- smallest set reaching cumulative probability
- Top-k
- sample from k likeliest tokens
- Stop sequence
- string that ends the response
- Max tokens
- hard ceiling on output length
- Seed
- reduces but rarely removes variance
- High temperature
- can push past trained safe behavior
Adaptation choices
- Prompting
- cheapest, no weights change
- Retrieval
- external facts, deletable at source
- Fine-tuning
- bakes behavior and data into weights
- Adapters
- small trainable layers, swappable
- Distillation
- student learns from teacher outputs
- Continued pretraining
- expensive, broad capability change
- Alignment tuning
- shapes refusal and tone
Foundation-level weaknesses
- Pickle checkpoints execute code on load
- Unicode tricks hide text from reviewers
- Homoglyphs survive naive input filters
- Long inputs dilute the system rules
- Prefill bypasses the refusal opening
- Extreme sampling settings destabilize safety
- Shared caches leak across tenants
Guardrail components
- Moderation classifier
- scores prompts and responses
- Refusal policy
- what the model must decline
- Output schema
- narrow shape the app accepts
- Grounding
- answers tied to retrieved evidence
- Eval suite
- repeatable scored behavior tests
- Watermark
- statistical signal of machine origin
- Canary
- planted string proves memorization
Serving, cost and multi-tenancy
- Batching and caching share state across requests
- Isolate caches, batches, adapters and logs
- Prompt cache hits can leak another tenant
- Streaming defeats a whole-response safety scan
- Buffer incrementally and hold the tail
- Support mid-stream termination with a replacement
- Token cost is an availability control
- Rate limit per principal, not per address
Throughput optimizations are the quiet source of cross-tenant leakage, so treat every shared cache and batch as a trust boundary
Model lifecycle and version control
- Select
- Evaluate
- Pin version
- Canary
- Roll out
- Monitor
- Migrate
- Pin an explicit model version
- A deprecation notice starts the migration clock
- Run private capability and safety suites
- Remediate or formally accept regressions
- Keep rollback available through the change
- Routing changes alter the risk profile
- Record model and settings on every call
Evaluation and logging
Evaluation
- Golden set plus adversarial regression cases
- Score safety and capability separately
- Held-out attacks test generalization
- Over-refusal measured alongside refusal
- Re-run evals on every prompt change
Logging
- Log the full request payload
- Record model, version and decoding settings
- Reference the retrieved sources used
- Keep the verbatim response
- Regeneration is not evidence
- Redact secrets before the log store
Memorization and extraction
- Duplicated data raises memorization risk
- Plant canaries and measure extraction rates
- De-duplicate before any fine-tuning run
- Systematic querying distills your model
- Watermarks help prove machine origin
- Curation is a security control
Glossary
- Prefill
- caller supplies the assistant opening
- Grounding
- claims checkable against sources
- Hallucination
- confident output with no basis
- Call hallucination
- invented tool name or argument
- KV cache
- stored attention state for speed
- Adapter
- small module layered on weights
- Eval
- repeatable scored test suite
- Distillation
- copying capability through outputs
Reference strip: tokens, prompt, sampling, serving, evidence
Tokens
- The model reads tokens, not characters
- Attention cost grows quadratically
- Embeddings carry recoverable meaning
- What renders is not what parses
Prompt
- System, developer, user, tool, retrieved
- Trust falls as you go down
- Long content dilutes short rules
- Truncation can drop the rules entirely
Sampling
- Temperature and top-p create variance
- Extreme settings are a safety issue
- Stop sequences bound the output
- Seeds do not guarantee reproduction
Serving
- Shared caches are a trust boundary
- Streaming needs incremental scanning
- Tokens are the cost control
- Pin the model version explicitly
Evidence
- Log request, settings, sources, response
- Regeneration proves nothing later
- Canaries measure memorization directly
- Evals gate every prompt change
Quick exam traps
- Trap: Setting a seed makes the same prompt reproduce the same answer
- Trap: The system prompt is a security boundary the model cannot cross
- Trap: Loading a checkpoint is safe as long as the file scans clean
- Trap: A larger context window only affects cost and latency
- Trap: Retrieval and fine-tuning carry the same deletion obligations
- Trap: A safety classifier on the finished response protects a streaming feature
cybercertprep.com · original revision sheet written from the public body of knowledge