How the thing actually works

Seventy-five minutes, five sections. The order matters: you cannot understand hallucination until you understand prediction, and you cannot understand the context window until you understand tokens. Each section ends with four discussion questions; use them or skip them depending on the room.

Here is the whole mechanism, and it fits on one line: given the text so far, produce a score for every possible next chunk, pick one, add it to the text, and go again. That is what a large language model does, and it is all it does. The “model” is a very large file of numbers together with a fixed recipe for combining them with the text. When you type a question, your question, any documents you attached, and the conversation so far are turned into chunks called tokens and pushed through that recipe. Out comes a probability for every token in the vocabulary. One is chosen, usually with a little deliberate randomness, and appended. Then the whole thing runs again on the slightly longer text. A long answer is that loop run thousands of times. Two things follow immediately. First, the model does not retrieve anything; it has no index, no table, no file of facts it consults. It produces a plausible continuation. Second, it re-reads everything so far on every step, which is why length costs money and why the context window (section three) matters so much. The figure in the takeaway uses OpenAI’s rule of thumb that 100 tokens is about 75 words, so 2,000 words is roughly 2,700 tokens, and therefore roughly 2,700 passes through the loop.

The model never sees letters or words. Before anything happens, text is cut into tokens: chunks chosen by a fixed, mechanical procedure so that common words become a single chunk and rare words become several. The sentence on the slide is real: pasted into OpenAI’s public tokeniser in October 2026 it came back as 53 characters and 12 tokens. Common words such as “invoice” and “reconsider” are one token each, with the leading space attached. Numbers are cut away from the space in front of them, which is why “ 14” costs two tokens. OpenAI’s rule of thumb is about four characters per token for ordinary English, or roughly three-quarters of a word; a 1,000-word document is about 1,300 tokens. Other languages tokenise less efficiently: their own example, “Cómo estás”, is ten characters and five tokens. This matters for two reasons. You are billed per token, both for what you send and for what comes back, so verbosity has a price. And the model has no direct view of the letters inside a chunk. The famous 2024 failure, where GPT-4o and Claude both said “strawberry” has two r’s, is a tokenisation failure: the model is asked a question about letters it cannot see. Newer models are often trained around that specific question; the underlying limitation remains, and shows up in spelling, letter counts, and anything character-level.

Part I called the weights “the knobs”, and that is still the best word. Inside the function are billions of numbers. Training turns the knobs; using the model does not. When a vendor says “7B” or “405B”, they are counting knobs. Meta’s Llama 3.1 release in July 2024 gives the honest scale of this: three sizes, 8, 70 and 405 billion parameters, the largest trained on more than 15 trillion tokens of text using over 16,000 H100 GPUs. The weights are literally a file. Part I and Part II covered what it means to own that file. The subtle point for a non-expert is that nothing in the file is a fact. There is no knob labelled “capital of France”. What the training process produces is a set of numbers that, taken together, make “Paris” the most likely continuation of “The capital of France is”. Knowledge is a tendency, not a record. A tendency can be strong, weak, or confidently wrong, and the model has no way to tell the difference from the inside. The one lever you have as a user is the text you put in front of the frozen function: instructions, documents, examples. Everything in the rest of this series (prompts, retrieval, harnesses, agents) is a way of pulling that one lever well. Part II’s memory rule of thumb, parameters × bits ÷ 8, is worked through in the appendix.

The cheapest dismissal of these systems is “it’s just autocomplete”, and the cheapest hype is “it understands”. Both are half right. It is true that next-token prediction is the entire objective. There is no second goal inside called “be accurate” or “be honest”. The model continues text, and if the text so far is a confident claim, it continues confidently, because that is how confident text continues. Everything in section three follows from this: hallucination, sensitivity to phrasing, the reluctance to say “I don’t know”. But “just” is doing dishonest work in that sentence. Predicting the next token of a tax opinion well requires representing a great deal about tax, opinions, and English. The pressure to predict forces internal structure. Anthropic’s March 2025 paper, “Tracing the thoughts of a large language model”, found concrete examples: when writing a rhyming couplet, Claude selected the rhyme word before composing the line; when adding 36 and 59, it used parallel internal paths, one estimating the rough total and one fixing the last digit, and then, when asked how it did it, described the school carrying method instead. The internal process and the stated explanation differed. So: an autocomplete that was forced to build a rough, uneven model of the world in order to autocomplete well. Hold both halves. The deck comes back to what we actually know about the inside in section five.

A model has three lives. In pretraining, the lab shows it an enormous pile of text and plays one game trillions of times: hide the next token, make the model guess it, nudge every knob slightly towards the right answer. Months later you have a “base model” that will continue any text you give it, in any register, with no particular interest in being helpful. In post-training, the lab shapes that raw predictor into an assistant: it is taught to follow instructions, to answer in a sensible format, to decline some requests, and to prefer the kinds of answers that human raters score highly. This is a small fraction of the cost of pretraining, and it is where almost all of what you experience as “personality” is made. Then there is inference, which is the only stage a customer ever touches: the weights are frozen, your tokens go in, its tokens come out, and you are billed for both directions on every call. Two consequences are worth saying plainly. Nothing is learned during inference. When a chatbot seems to “remember” you, that is the harness putting earlier text back into the window (Part II), not the model changing. And the price you pay has nothing to do with the cost of training; it is a price per token for running a fixed function.

The numbers on this slide are here to make one point: pretraining is an industrial process that a handful of organisations can afford, and you are not one of them. Meta reports that Llama 3.1 405B was pretrained on more than 15 trillion tokens using over 16,000 H100 GPUs. DeepSeek’s V3 technical report gives 14.8 trillion tokens and about 2.79 million H800 GPU-hours for the full run, which the authors price at roughly $5.6 million at a $2 per GPU-hour rental rate (and which excludes research, staff, and failed runs). Epoch AI, the most careful public tracker of these trends, found training compute for frontier models growing four to five times per year between 2010 and May 2024, and the amortised hardware-and-energy cost of the largest runs growing about 2.4 times per year since 2016; on that trend, they projected billion-dollar runs by 2027. All of these are dated figures and the trend lines are extrapolations; treat them as scale, not precision. The business consequence is simple. Nobody in this room will pretrain a frontier model. You will rent one through an API, or download open weights that someone else paid to train (Parts I and II). What you can afford is everything downstream: choosing a model, feeding it the right context, and wrapping it in tools and guardrails.

The phrase “trained to be helpful, harmless and honest” hides a mechanism that is worth seeing once. OpenAI’s 2022 InstructGPT paper describes it. Start with a base model that merely continues text. First, people write demonstrations of good answers and the model is fine-tuned to imitate them; this is instruction tuning. Second, people are shown several answers to the same prompt and rank them. Third, a separate “reward model” is trained to predict those rankings, so it can score answers at scale without a human in the loop. Fourth, the assistant is adjusted, by reinforcement learning, to produce answers the reward model scores highly. That is RLHF: reinforcement learning from human feedback. Anthropic’s Constitutional AI paper, also 2022, replaced much of the human ranking with a model ranking answers against written principles, which is RLAIF: feedback from AI. The InstructGPT result worth remembering is that raters preferred a 1.3-billion-parameter model trained this way over the 175-billion-parameter GPT-3 it came from. Manners beat size. The consequence to carry into section three: the model is optimised to produce what raters reward. If raters reward confident, complete answers more than honest “I don’t know”s, you get a confident guesser. OpenAI’s own 2025 analysis of hallucination says exactly that about the evaluations the industry uses.

This table is the economics in one place. Pretraining and post-training are paid for by the lab, once; their cost is recovered in the per-token price of the API or, for open weights, not recovered from you at all. Inference is the only line a customer sees: a price per million input tokens and a usually higher price per million output tokens. On the October 2026 price lists, output costs about five times input across the major vendors (OpenAI’s GPT-6 Astra at $10 in and $50 out per million; Anthropic’s Sonnet 5.5 at $2 and $10). Those exact prices belong on the “current board” slide in section four and will be stale by the time you quote them; the ratio has been stable for years and is the thing to remember. What you control at each stage is the interesting column. In training: nothing, except which model you choose. Fine-tuning, which adjusts the weights with your own examples, is real but is a project with its own costs and risks, not a setting. At inference you control everything that goes into the window, and that turns out to be most of what matters in practice. The ranges in the cost row are deliberately wide: Epoch AI’s cost estimates are for frontier runs, and open-weight training runs such as DeepSeek-V3 have been reported at single-digit millions for the final run alone.

Because the weights are set during training and frozen after, every model has a knowledge cutoff: a date after which it read nothing. Vendors publish it. Anthropic distinguishes a “training data cutoff” from a “reliable knowledge cutoff”, the latter being earlier, because the last few months before the cutoff are thinly represented; the internet had not yet finished writing about them. Then come weeks or months of post-training and testing, then release, then however long you use it. A model you talk to today may not have read anything for over a year. What does it do when asked about something after the cutoff? It continues the text with the patterns it has. A well post-trained model will often say it cannot know. A less careful one produces a plausible answer from old patterns. In July 2024 Meta AI told users the assassination attempt on Donald Trump was a “fictional event”; Meta’s explanation, in a blog post by its policy chief, was that the model’s training data predated the event and that it had hallucinated. The fix is not to wait for a newer model, which will simply have a later cutoff. The fix is to put the current facts into the window: a web search tool, your own documents, today’s date. That is what the “search” toggle in a chat product does, and what retrieval does (Part II). The model is then reading, not remembering, and reading is something it is good at.

Everything the model knows about you, your company, and this conversation is in the context window at the moment it answers. Nothing else. The window is the set of tokens passed into the function on one call: the system prompt (standing instructions from the vendor and from you, hidden in consumer chat products), any documents or search results or tool outputs, every earlier turn of the conversation, and the answer it is writing. All of it is re-sent on every message; a chat product hides this, but the bill does not. Windows have grown quickly: 128,000 tokens was the frontier in 2024 and the major vendors now offer around a million (Anthropic made 1M generally available for Opus and Sonnet 4.6 in March 2026; OpenAI’s GPT-5.5 lists 1,050,000). A million tokens is roughly 750,000 words, using OpenAI’s ¾-word rule. Two things that are not the window. First, the weights: what the model learned in training is not “in” the window and cannot be edited there. Second, memory: there is none. When the window fills, the application drops or summarises the oldest text. When the chat ends, it is gone. A product’s “memory” feature is the harness (Part II) keeping notes and pasting them back in at the start of the next chat, which is useful, and is not the model remembering. This is the single most important mental model in the deck: if a fact is not in the window, the model is guessing at it.

Anyone who has used a chatbot for an hour knows the feeling: it gets vaguer, repeats itself, resurrects an idea you rejected twenty messages ago. The model is not tired. The window has filled with noise and it reads all of it, every time, with no sense of which parts are stale. Two pieces of research make this concrete. “Lost in the Middle” (Liu and colleagues, 2023, Stanford and others) tested models on retrieving a relevant passage from a long input: accuracy was highest when the passage was at the beginning or end and fell sharply when it was in the middle, even for models designed for long inputs. Chroma’s “Context Rot” report (July 2025) tested eighteen models from Anthropic, OpenAI, Google and Alibaba and found reliability falling as input length grew, even on trivial tasks: one distracting passage reduced accuracy, four reduced it further, and the same question answered from a focused 300-token prompt scored far higher than when buried in 113,000 tokens. Both are dated snapshots of specific models and newer ones do better; the shape of the result has held. The habits follow. Start a new chat for a new task. Put the instruction that matters in a system prompt or repeat it. When you paste a long document, say which part matters and put it near the start or the end. And when a draft is wrong, do not argue with it for ten turns; take the good parts into a fresh window and leave the rest behind.

A hallucination is a fluent, confident, false statement: an invented case citation, a date, a price, a policy, a person. It is the behaviour people find most alarming and it follows directly from section one. OpenAI’s September 2025 paper, “Why language models hallucinate”, gives the cleanest account. Pretraining shows the model only fluent text with no labels for true or false. Patterns that are consistent, such as spelling, grammar and format, are learned well and improve with scale. Arbitrary facts with no pattern behind them, the paper’s example is a pet’s birthday, cannot be inferred; the model produces something plausible. Then the evaluations make it worse: almost all benchmarks score accuracy only, so a blank answer scores zero and a guess might score, and post-training learns to guess the way a student learns to never leave a multiple-choice question empty. The paper’s illustration, drawn from the GPT-5 system card on the SimpleQA test, is on the slide: the older o4-mini abstained 1% of the time, was right 24% and wrong 75%; gpt-5-thinking-mini abstained 52%, was right 22% and wrong 26%. Slightly less “accurate”, a third as often wrong. The deepest point is the last row: there is no internal flag for “I made this up”. The same mechanism produces the right date and the wrong one. Any check has to come from outside the model: a source in the window, a tool, or you.

People are unsettled that the same question gets different answers, and read it as the model being unreliable. It is, but not for the reason they think. The model never outputs a word. It outputs a score for every token in its vocabulary. Software then picks one, at random, weighted by those scores; this is called sampling. On the slide, with invented numbers, “overdue” wins about a third of the time and “due” about a quarter, so two runs of the same prompt will often diverge at the fourth word and keep diverging. This is a deliberate choice. Always picking the top token produces flat, repetitive text; a little randomness produces text people prefer. Temperature is the dial. OpenAI’s API exposes it as a number from 0 to 2; low values make the top token win almost always, high values spread the picks across more options. Chat products set a middle value you never see. A related dial, top-p, is in the appendix. The point for a business reader is the third card. Turning the temperature to zero makes the output more repeatable; it does not make it more correct. If the highest-scoring continuation is wrong, you now get the wrong answer every time, with the same confidence. Consistency is not accuracy. The cheap practical test is on the takeaway line: ask three times. Agreement is weak evidence. Disagreement is strong evidence that the model was guessing.

Three stories, three mechanisms from this section. Mata v. Avianca (Southern District of New York, 2023) is the canonical hallucination case. Lawyers for a passenger suing an airline filed a brief citing decisions that did not exist; ChatGPT had produced the cases, the quotations and the citations, and when a lawyer asked it whether the cases were real it said they were and could be found in legal databases. Judge Castel fined the lawyers $5,000 and found subjective bad faith; the underlying case was dismissed. Meta AI in July 2024 is the knowledge-cutoff story. Asked about the assassination attempt on Donald Trump, the assistant called it fictional; Meta’s policy chief explained that the model’s training data predated the event and that it had then hallucinated rather than saying it did not know. Deloitte Australia in October 2025 is the one closest to most readers’ work. A AU$440,000 review for the Department of Employment and Workplace Relations contained references to papers that did not exist and a fabricated quotation attributed to a federal judge; a Sydney University researcher found the errors after publication, the revised version disclosed that Azure OpenAI had been used, and Deloitte agreed to refund the final instalment, reported at about AU$98,000. Deloitte did not say whether the AI caused the errors; the department’s statement and the disclosure make the inference hard to avoid. Nobody in these stories was stupid. They trusted fluency.

In September 2024 OpenAI released o1, and the industry acquired a new species. A reasoning model is trained, by reinforcement learning, to produce a long passage of working before its answer: trying an approach, checking, backtracking, trying another. OpenAI reported that performance improved both with more training and with more time spent reasoning at inference, which the industry now calls test-time compute. The headline numbers were on competition maths: on the AIME exam, GPT-4o solved around 12% and o1 74%. DeepSeek-R1, released with open weights in January 2025 and later published in Nature, showed that pure reinforcement learning with no hand-written reasoning examples produced the same self-reflection and verification behaviour. Anthropic’s Claude gained extended thinking in 2025. The thing to hold onto is that the “thinking” is text, produced by the same next-token loop, aimed at the model itself instead of at you. You can read it (sometimes summarised). You pay for it: Anthropic’s documentation is explicit that thinking tokens are billed as output tokens and exposes a budget, with a minimum of 1,024 tokens. When does it help? When the problem has a right answer the model can check its working against: maths, code, logic, planning. For drafting and summarising it is slower and dearer for no gain. And it is not a cure for hallucination; OpenAI’s own system card in April 2025 reported o3 hallucinating on a people-facts test at 33% against o1’s 16%, with the note that it makes more claims overall.

“Multimodal” means the model takes or produces more than one kind of data: text, images, audio, video. It sounds like a different technology and is not. An image is cut into small patches; each patch is converted into the same kind of numerical token the model uses for words, and the patches are placed in the context window next to your text. From there it is next-token prediction as before, which is why a model can describe a chart, read a screenshot, or assess a photograph of a damaged parcel, the support example from Part III. Audio is the clearest illustration of why native multimodality matters. OpenAI’s GPT-4o announcement in May 2024 describes the earlier Voice Mode as a chain of three separate models, speech-to-text, a text model, text-to-speech, and notes that the middle model could not observe tone, multiple speakers or background noise because all of that was lost in transcription. GPT-4o was instead “a single new model end-to-end across text, vision, and audio”, so sound goes in and sound comes out of one network. Video is sampled frames as image patches plus audio, in the same window; a long video is an enormous token count and a real bill. Generating images is the idea reversed: predict the next chunk of an image. The practical rule is unchanged: everything goes into the same window, is billed in the same tokens, and is subject to the same forgetting and guessing.

Models come in sizes, and the size is the parameter count from slide six. The ladder is a teaching device, not an industry standard, and the boundaries are fuzzy. At the bottom, models of one to four billion parameters run on a phone or an ordinary laptop: fast, cheap, forgetful, and perfectly good for classifying, extracting and simple drafting when the facts are supplied in the window. Seven to fourteen billion is the Part II workhorse: a good laptop or a single GPU. Around seventy billion is where “dense” models, in which every parameter participates in every token, start needing a serious server; by Part II’s rule of thumb a 70B model at 16-bit precision needs roughly 140 GB of memory for the weights alone. Mixture-of-experts models break the link between size and running cost: many parameters exist but only a subset is used for each token. DeepSeek-V3 is the public example, with 671 billion total parameters and 37 billion active per token; cheap per token to run, enormous to store, because all the experts have to live somewhere. The closed frontier models, GPT, Claude, Gemini, do not disclose their sizes; the common assumption that they are large MoE models is an assumption. You never see the file. You rent it. Two “bigger is not always better” facts from earlier: InstructGPT’s 1.3B model beat the 175B base model on human preference, and for a classification job with the facts in the window, a small model is often indistinguishable from a frontier one at a hundredth of the price.

This is the one slide in the deck with product names, prices and benchmark figures, and it carries its check date for a reason: every number here was read off a vendor page in October 2026 and several will be wrong by the time you read this. Prices are per million tokens as published on the OpenAI and Anthropic model pages. GPT-6 Astra, the current flagship, lists $10 in and $50 out, a context window of 1,050,000 tokens and a knowledge cutoff of 30 April 2026, with a surcharge above 272K input tokens; GPT-6 Luna, which OpenAI describes as its most efficient model for high-volume tasks, shows what the small end costs at $0.10 and $0.50 with the same window. The previous generation’s pages (GPT-5.5 at $5 and $30) are still up; they are not the current board. Anthropic’s Opus, Sonnet and Haiku 5.5 list $4/$20, $2/$10 and from $0.10/$0.50, all with a 1M window and a published “reliable knowledge cutoff” of June 2026. DeepSeek-V3 is open weights: the price depends on who hosts it, or on your own hardware (Part II). The hallucination line uses Vectara’s public leaderboard, which measures something specific: how often a model’s summary of a supplied document contradicts that document, as judged by Vectara’s own detector. As of May 2026 the best models were under 2% and the worst over 20%. It is not a measure of how often a model is wrong about the world; no such single number exists. The message is the price range: a hundredfold spread for the same API shape. The right model is the cheapest one that passes your own test set (Part III), and that is rarely the most famous one.

Most misuse comes from treating the model as one of four things it resembles. It is not a database. A database stores a fact once and returns it exactly; the model stores tendencies in its weights and returns the likeliest continuation. If you need a record, query the system of record and put the answer in the window. It is not a search engine. A search engine finds pages that exist; a model with no search tool produces the page that would plausibly exist, complete with plausible URL. Given a search tool it reads real results, which is fine, and still worth checking. It is not a calculator. It predicts digits the way it predicts words; short common sums are usually right because they appear in text, long ones are guesses, and this is why Part III insisted that code does the arithmetic and why modern tools hand the model a calculator. And it is not a person. It has no memory between conversations, no goals, no stake in being right, and no sense that it is wrong. When it writes “I’m confident”, that is a register learned in post-training, not a report on an inner state. Which brings us to the adjectives. Claims that a model “understands”, “knows” or “reasons” are claims about its outputs; they say nothing checkable about what is inside. Judge the output against your test set. The next slide is what we honestly do know about the inside.

It is fair to ask whether anyone knows what is going on inside these systems. The honest answer in 2026 is: a little, and the people who know most are the most careful about saying so. The best public account is Anthropic’s March 2025 research, “Tracing the thoughts of a large language model”, which built what the authors call an AI microscope: a way of tracing which internal features fire, step by step, as a short prompt becomes an answer, on Claude 3.5 Haiku. Several findings undercut the “just autocomplete” story. Asked to write a rhyming couplet, the model picked its rhyme word before writing the line, and could be made to choose a different one by suppressing that feature. Asked to add 36 and 59, it used parallel paths, one estimating the rough total and one fixing the last digit; asked afterwards how it did it, it described the school carrying method. The stated explanation was not the process. The same conceptual features activated across English, French and Chinese. And a “decline to answer” circuit was on by default, switched off by a “known entity” feature; when that feature fired for a name the model knew little about, the result was a confident fabrication, which is a mechanical picture of hallucination. The caveats are the authors’ own. The method captures only a fraction of the computation even on short prompts; a prompt of tens of words took hours of human effort; some of what the tools show may be artefacts of the tools. Nobody can yet look inside and certify an answer. Everything else is testing from the outside, which is what Part III’s test set is for.

Five habits, each a direct consequence of a slide earlier in the deck. Put the facts in the window, because the window is the only thing the model can see and anything not in it is a guess; say which part matters and put it near the start or end, because of “lost in the middle”. Ask for sources and open them, because a citation is a prediction of what a citation looks like and both Mata and Deloitte were caught by not opening one; the checking time is the job, not an overhead on it. Do not ask it to count or calculate, because it sees chunks rather than letters and predicts digits the way it predicts words; give it a tool, or give it the answer and ask for the explanation. Start a new chat for a new task, because long windows fill with stale text that the model reads with equal weight; carry only the good draft forward and put standing instructions where they are re-sent automatically. And pick the species for the job: a reasoning model when there is a checkable right answer, a fast cheap one for drafting and sorting, and in every case the cheapest that passes your own test set. None of this needs new software. It needs an accurate picture of what the software is.

For the curious: the architecture behind every model in this deck is the Transformer, introduced in “Attention Is All You Need” by Vaswani and colleagues at Google in June 2017. Each token is first converted into a vector, a list of a few thousand numbers, with a position signal added so that word order survives. Then comes the step that gives the paper its name. For each token, the model scores how relevant every other token in the window is to it and blends their vectors in according to those scores; this is attention, and it is how “it” in a sentence comes to carry the meaning of “the invoice” three clauses earlier. A feed-forward layer then processes each token’s blended vector on its own; much of what we loosely call the model’s knowledge is thought to live in these layers. Attention and feed-forward alternate for dozens of layers, each refining every token’s representation using every other token. Finally the last token’s vector is turned into one score per vocabulary entry, and sampling (slide 20) picks the next token. The paper’s contribution was to drop the earlier recurrent designs entirely, so all tokens could be processed in parallel; that is what made training at the scale of section two practical. The cost is that every token attends to every other, so attention work grows roughly with the square of the window length. Vendors mitigate this with caching and sparse variants, but a long window is never free, which is why long prompts cost real money and real seconds.

Three details the main deck deliberately skipped. Temperature scales the next-token scores before sampling; OpenAI’s API accepts values from 0 to 2. Near zero, the top token almost always wins and output becomes repeatable and a little flat; above one, low-scoring tokens are chosen more often, which reads as creative for a while and then as nonsense. Top-p, or nucleus sampling, takes a different approach: it keeps only the most probable tokens whose scores sum to p and samples among those, so 0.9 means “ignore the least likely ten percent”. OpenAI’s documentation presents it as an alternative to temperature, and adjusting both at once makes results hard to reason about. Neither dial makes an answer more correct; they decide how the dice are thrown over the scores the model already produced. The memory rule of thumb is Part II’s: parameters times bits divided by eight gives the bytes needed for the weights alone. A 70-billion-parameter model at 16-bit precision needs about 140 GB; quantised to 4-bit, about 35 GB, with some quality cost that depends on the method. DeepSeek-V3 illustrates the MoE trap: 671 billion parameters at 8-bit is about 671 GB to store, even though only 37 billion are used for each token. And that is only the first term. The KV cache, the stored attention state for every token in the window, grows with context length and at a million tokens can exceed the weights. Part II covers the rest of the arithmetic.