Branch: The AI-Augmented Analyst (Finance galaxy) · Node AI0.01 · ~12 focused hours · Understanding gate ≥ 85%

You have almost certainly watched a modern AI system do something that looked like thinking. You asked a question in plain English and a fluent, structured, confident paragraph came back in a second, and somewhere in the back of your mind a small voice said either this changes everything or I don't trust it and I can't say why. Both reactions are rational, and both are useless to an analyst, because both are guesses about a black box. This node opens the box. Not with equations you will never use, but with the handful of mechanical facts that, once you truly hold them, make the machine stop being magic and start being a tool with a knowable shape, knowable strengths, knowable failure modes, knowable limits. An analyst who understands the mechanism is never mystified by a good answer and never fooled by a confident wrong one.

Here is the whole module compressed into a single sentence you will spend twelve hours earning the right to believe: a large language model optimizes for plausible, not true. Everything a model gets gloriously right, and everything it gets confidently, catastrophically wrong, flows from that one fact about what it was built to do. It was not built to know things and report them. It was built to continue text in the most plausible way, having read an enormous amount of text. Plausible usually overlaps with true, which is exactly why the tool is useful and exactly why it is dangerous, because a fabricated number and a correct number come out of the machine looking identical. The entire discipline of using AI as a serious analyst is the discipline of never confusing those two, and it begins here, by understanding why they get confused in the first place.

One promise for the hours ahead: by the end you will be able to take a confident, wrong AI answer, an Indian company's profit quoted in the wrong scale, a US filing citation that points at a page that says no such thing, and dissect it end to end. You will name the mechanism that produced it, predict before you check where it was most likely to break, and run the five-step check that catches it every time. That reflex (mechanism, prediction, verification) is the white belt of the AI-augmented analyst, and it is worth more than any list of tools.

Learning objectives

By the end you can:

State, in one sentence and then in mechanism, what a large language model fundamentally does (predict the next token) and explain why that single fact accounts for almost everything else about how it behaves.
Trace the whole path from your words to its answer: tokenization (text becomes numbers) → embeddings (meaning becomes position in a space) → attention (which earlier tokens matter) → a probability distribution over the next token → sampling (a choice) → repeat, one token at a time.
Explain embeddings and attention in plain language with a concrete example and no equations, and say what each one contributes to the final answer.
Distinguish the context window (the model's transient working memory) from its trained weights (its frozen long-term knowledge), and predict exactly what happens when a task overflows the window.
Separate training (pattern-learning over a large corpus with a hard knowledge cutoff, plus an instruction-tuning stage) from inference (the frozen model generating one token at a time, learning nothing, remembering nothing, looking nothing up, unless a tool is deliberately attached).
State the payoff of the entire module (that the model optimizes for plausible, not true) and use it to explain, from first principles, why fluent, confident, wrong output is not a glitch but the predictable shape of the thing.
Dissect a confident wrong answer end to end on both an Indian (₹) and a US ($) example, naming the mechanism that produced it and the primary-source check that catches it.
(Productivity objective: R10 duality.) Know which broad category of AI tool to reach for a given job, and, more importantly, the limits of each; and drive a chat assistant to build your own intuition without being misled by it.
Apply the Primary-Source Guardrail (five checks: Trace · Match · Recompute · Date-check · Cite) to any AI output, so that no figure ever enters your work until it is traced to a named primary source.

The duality, stated once (R10). This module carries two objectives at once, as every module in this branch does. The understanding objective (items 1–7 and 9) is what the mastery gate rewards; you earn the belt by explaining the mechanism and running the verification by hand. The productivity objective (item 8) is the payoff you keep: knowing which tool to reach for and how far to trust it. Awareness makes you fast; understanding makes you an analyst. A tool can never buy you a pass on the gate.

Prerequisites & connections

Builds on. Almost nothing. This is the first node of the AI-Augmented branch, and like the first Excel node it opens on day one with no prerequisite. You need no coding, no calculus, no prior machine-learning exposure, only ordinary arithmetic, comfort with the idea of a coordinate (that a point can be described by a list of numbers), and, ideally, ten minutes of having actually used a chatbot so the behaviour we explain is behaviour you have seen. If you have ever typed a question into an AI assistant and read the answer, you have enough to start. What this node will do is rewire an instinct: most people who have used these tools have quietly formed a wrong mental model of them, "it looks things up," "it learns from me," "if it's detailed it's probably right", and that model has to go before a correct one can take its place.

Feeds forward. Everything in this branch, and a thread through every other galaxy. AI0.02 (the tool landscape) asks you to categorise and evaluate tools, which is only possible once you know what the tool is doing under the hood, which is this node. AI0.03 (prompting) is the craft of steering a plausibility engine; its every technique makes sense only against the mechanism taught here. AI0.04 (retrieval and RAG) is the direct engineering answer to two problems this node names out loud, the knowledge cutoff and the limited context window, so RAG will feel inevitable rather than arbitrary. AI0.05 (agents) stacks many inference calls into a loop, inheriting every property discussed here and compounding it. And AI0.06, the crown of the branch, is nothing but this module's payoff line, plausible, not true, turned into a reflexive detection discipline: every failure mode it drills is a special case of the root cause named here. The Primary-Source Guardrail introduced in this node governs the verify step of every AI-Augment callout in every galaxy of the program. Learn the mechanism once, here, and the rest of the branch is applied consequence.

Core teaching content

The one sentence that explains almost everything

Strip away the branding, the personalities, the interfaces, and a large language model (LLM) is a machine that does exactly one thing: given a stretch of text, it predicts the next chunk of text. That is the whole job. It was trained, billions of times over, on the task "here is some text with the last piece hidden, guess the piece," and it got extraordinarily good at guessing. When you chat with it, it is doing that same guess, over and over: it looks at everything so far (your question plus whatever it has already written), predicts the single most-likely next chunk, appends it, and then looks at the now-slightly-longer text and predicts the next chunk, and the next, until it predicts that the most-likely next thing is "stop." This one-chunk-at-a-time, feed-the-output-back-in process is called autoregressive generation, and it is happening every time, for every word you have ever seen an AI produce.

A useful first analogy is a spectacularly well-read autocomplete, the same idea as the suggestion above your phone keyboard, but having read a large fraction of everything ever written and able to continue not just the next word but pages of coherent argument. The analogy is worth holding and worth distrusting. Hold it because it keeps you honest about the mechanism: there is no belief, no lookup, no intention, just a very sophisticated continuation. Distrust it because "autocomplete" undersells what good continuation requires, to plausibly continue a proof, a Python function, a legal clause, or a discounted-cash-flow explanation, the machine had to internalise grammar, facts, reasoning patterns, and code structure as statistical regularities. It is autocomplete the way a chess engine is "just" picking a move. But at the bottom, every single time: predict the next chunk. Keep that sentence. We now unpack the four things it hides, what a "chunk" is, how the machine represents meaning, how it decides which earlier words matter, and how it turns all that into an actual choice.

From letters to numbers: tokens

A model does not read letters, and it does not read words. Before anything else happens, your text is chopped into tokens, the actual atomic units the model processes. A token is usually a common word or a fragment of one: frequent words like the or revenue are often a single token, while rarer or longer words get split into pieces (tokenization might become token + ization). Spaces, punctuation, and digits all become tokens too. This chopping is done by a fixed procedure (commonly byte-pair encoding) that was decided once, before training, and never changes. Every token maps to an integer ID drawn from a fixed vocabulary of tens of thousands of possible tokens. So when you type a sentence, the very first thing that happens is that it is converted into a list of integers, and from that instant on, the model is doing arithmetic on numbers, never manipulating your characters directly.

This is not a trivia detail; it is the source of a whole family of surprising failures. Because the model sees tokens, not characters, tasks that require character-level access are unnatural to it. Ask "how many letter r's are in strawberry" and it may confidently say two, because it never saw the ten individual letters, it saw a couple of subword tokens, and "count the r's" is not an operation those tokens expose (we dissect this in Worked Example 3). The same fault line runs under long-number arithmetic: a number like 12345678 gets split into a few digit-chunks, so the model is not doing schoolbook long multiplication on digits, it is predicting a plausible-looking result, which is why exact arithmetic on big numbers is shaky and must be handed to a real calculator or code tool. Rule of thumb (see the dated block below): in ordinary English, one token is roughly four characters, and 100 tokens is roughly 75 words. You do not need to tokenize by hand, but you must carry the mental image: your words become a list of integer tokens before the model does anything with them.

Meaning as a place in space: embeddings

An integer token ID by itself carries no meaning, revenue might be token 18,432 and profit token 6,105, and those numbers say nothing about the words being related. So the model's first real act is to replace each token ID with an embedding: a list of numbers, a few hundred to a few thousand of them, that you should picture as coordinates of a point in a very high-dimensional space. This is the single most important idea for building intuition, so slow down on it. Every token becomes a point. The space has far too many dimensions to visualise (imagine three, then remember it's thousands), but the principle carries down to three: tokens with similar meanings end up as points close together, and relationships between meanings show up as directions and distances in the space. profit and earnings land near each other; profit and banana land far apart. These positions are not hand-assigned, they are learned during training, nudged into place by the pressure of the prediction task, so that words used in similar contexts drift to similar locations.

The classic demonstration of how much structure this geometry captures comes from an early word-embedding study (Mikolov et al., 2013): taking the point for king, subtracting the direction for man, and adding the direction for woman lands you very near the point for queen. The "royalty" and "gender" relationships had become consistent directions you could do arithmetic with. Treat that example as an illustration of the geometry, not a literal operation the LLM performs on your prompt (modern models are vastly more elaborate) but the lesson is exactly right: the model computes with meaning-as-position, and analogies, categories, and associations fall out as geometry. (For scale and citation: the original transformer of Vaswani et al., 2017, used 512-dimensional embeddings; production models today use far larger, a perishable number, see the dated block.) When people say a model "understands" a word, this is the closest mechanical truth: it has a rich, learned position for that word relative to every other word, and that position is what flows into the next stage.

Which earlier words matter: attention

Now the model has your sentence as a sequence of points-in-space, and it needs to predict the next token. The problem is that the meaning of any given word depends on the other words around it, and not equally. Consider: "The trophy didn't fit in the suitcase because it was too big." To continue that sentence sensibly, or to answer "what was too big?", the model must work out that it refers to the trophy, not the suitcase. Now change one word: "…because it was too small." Suddenly it refers to the suitcase. Nothing about the word it changed; what changed is which earlier word it should be linked to, and that link depends on the whole context. The mechanism that lets the model form these context-dependent links is attention, and it is the engine at the heart of the transformer architecture that every modern LLM is built on (introduced in the aptly titled paper Attention Is All You Need, Vaswani et al., 2017).

In plain language: for each position in the text, attention lets the model look back over all the earlier tokens and decide how much to weight each one when building its understanding of the current position. It is, quite literally, a mechanism for answering "which earlier words matter here, and how much?", computing a set of weights across the previous tokens and then blending their information in proportion to those weights. (Under the hood each token emits a "query" describing what it's looking for and a "key" describing what it offers, the two are matched to produce the weights, and a "value" carries the information that gets blended, but you can carry the whole idea on the plain-English version: a learned, context-sensitive weighting over the earlier words.) Real models run many attention patterns in parallel ("multi-head" attention) so that one pattern can track grammatical subject-verb links while another tracks long-range references and another tracks topic, all at once. And they stack this operation in layers, dozens of them, each refining the representation the last one produced, so that early layers resolve local grammar and later layers assemble higher-level meaning. You do not need the mathematics. You need the picture: attention is how the machine decides, freshly for every token, which parts of everything-so-far to lean on, and stacking that decision many times is what turns a bag of word-points into a contextual understanding rich enough to predict what comes next.

The moment of choice: from context to a probability distribution

After the stack of attention layers has done its work, the model arrives at the actual prediction. For the position it is trying to fill, it produces a score for every single token in its vocabulary, tens of thousands of scores, called logits, one per possible next token. A function called softmax then squashes those raw scores into a clean probability distribution: every token gets a probability between 0 and 1, and they all sum to 1. This is the model's answer to "what comes next," and it is not a single word, it is a full ranking of every possible next word with a probability attached. After "The capital of France is", the token Paris might get 95% of the probability and everything else splits the remaining 5%. After a genuinely ambiguous or obscure prompt, the probability might be spread thinly across many plausible-looking tokens with no clear winner.

Then a sampler turns that distribution into one actual token. The simplest rule, greedy decoding, just takes the highest-probability token every time. But most systems introduce controlled randomness (governed by a temperature setting) so that lower-probability tokens sometimes get chosen, which makes output more varied and "creative." High temperature flattens the distribution (more surprising choices, more errors); low temperature sharpens it toward the top choice; temperature zero collapses to greedy. This randomness is why the same prompt can give you different answers on different runs, you are re-sampling from a distribution, not looking up a fixed record. And here is the fact to underline in red: the probability is invisible in the output. The model writes Paris at 95% and it writes a wrong token at 30% in exactly the same fluent, grammatical, confident prose. Nothing in the text you receive tells you whether the choice was near-certain or nearly a coin flip. That decoupling of fluency from confidence from correctness is the mechanical seed of overconfidence, and we will compute it by hand in Worked Example 4.

{
  "skill": "Building first-principles intuition for an unfamiliar concept (e.g., attention, embeddings)",
  "use": "Have a chat assistant draft a plain-English explanation and one numeric mini-example of a concept you are learning, then have it generate questions to quiz you — using AI to accelerate your own understanding, not to replace it.",
  "tools": ["Chat assistants — Claude, ChatGPT, Gemini", "Learning/notebook AI — NotebookLM grounded on a source PDF you already trust"],
  "prompt": "Explain <CONCEPT> to me as if I know basic algebra but no machine learning. Give exactly one analogy, one worked mini-example with real numbers I can check by hand, and three questions that test whether I actually understood it. Flag anything that experts still disagree about.",
  "verify": "An LLM explaining how LLMs work can still produce a plausible-but-wrong analogy. Check every claim against a named authoritative source (the Vaswani 2017 paper, a 3Blue1Brown or Karpathy video) before you trust it. Trace each claim to that source; do not treat the model's explanation as itself the source (Guardrail 1-5, especially #1 Trace and #4 Date-check).",
  "diy": "You must be able to state next-token prediction, tokens, embeddings and attention in your own words first — that is exactly what this Core section builds. AI polishes intuition; it cannot install it.",
  "market": "IN"
}

The desk that holds only so many pages: the context window

There is a hard ceiling on how much text the model can consider at once, called the context window, measured in tokens. Think of it as the model's working memory, or, more vividly, as a desk with room for exactly N pages. Everything the model needs for a single response has to fit on that desk simultaneously: the hidden system instructions, your prompt, any documents you pasted, the entire back-and-forth of the conversation so far, and the answer it is currently generating, all of it competes for the same fixed token budget. This is not knowledge; it is attention span. And the critical consequence: when the total exceeds the window, the oldest tokens fall off the desk and the model can no longer see them at all. It does not "forget" the way a tired person forgets and might be reminded, the tokens are simply not in its input any more, so as far as that forward pass is concerned they never existed. An instruction you gave at the very top of a very long session can literally scroll out of view, and the model will "ignore" it not out of disobedience but out of blindness (Worked Example 5 walks through exactly this).

For an analyst this ceiling has an immediate, practical bite. A long annual report or 10-K can run to a hundred thousand tokens or more; a large model may swallow it whole, a smaller-window model cannot, and the moment your document plus your conversation exceeds the window, the earliest material is invisible. This single limitation is the entire reason retrieval-augmented generation exists (AI0.04): instead of pasting a 300-page filing and praying it fits, you fetch only the handful of relevant chunks and put those on the desk. Keep the distinction sharp, because two very different failures get blamed on the same word "forgot": if the model never knew a fact, that is a limit of its weights (its trained knowledge); if the model knew it a moment ago but a long conversation pushed it out, that is a limit of its context window (its working memory). Same symptom, opposite fixes.

Two different things people call "learning": training versus inference

The most durable misconceptions about AI all come from blurring two completely separate phases. Training happens once, in advance, at enormous cost, on someone else's giant computers. In the main phase (pretraining) the model is shown an astronomical amount of text (books, websites, code, reference works) and made to play the next-token guessing game over and over, with its billions of internal numbers (parameters, or weights) nudged a hair each time toward better guesses. For scale: an early landmark model, GPT-3, had 175 billion parameters trained on hundreds of billions of tokens (Brown et al., 2020). Out of pure prediction pressure, the model absorbs grammar, facts, styles, and reasoning patterns as statistical regularities. This corpus has an end date (the knowledge cutoff) and the model's picture of the world is frozen at that snapshot. A second, smaller training stage, instruction tuning and reinforcement learning from human feedback (RLHF; Ouyang et al., 2022), then teaches the raw predictor to follow instructions and to produce answers people rate as helpful. Note the subtle cost buried in that stage: it optimises for what humans rate highly, which rewards confident, agreeable, well-formatted answers, planting the seeds of sycophancy (telling you what you want to hear) and overconfidence that AI0.06 will make you hunt for.

Inference is the completely different thing that happens when you use the model. The weights are frozen. Read that again, because three myths die on it. The model does not learn from your conversation, nothing you type changes a single parameter; a correction you make now will not be "remembered" in tomorrow's chat unless the surrounding app deliberately stores it and feeds it back. The model does not look anything up, there is no live database, no web search, no lookup happening inside a bare inference call; every answer is reconstructed from patterns baked into the frozen weights, unless a tool (a search connector, a retrieval system, a calculator) has been explicitly bolted on. And the model does not know what happened after its cutoff, ask it about last week's news or this quarter's filing and, absent a tool, it is guessing from a world-picture that ends months or years ago. Each response is a fresh, stateless forward pass over whatever currently sits in the context window. Internalise the pretraining-then-frozen-inference split and a huge amount of confusing AI behaviour becomes not just explainable but predictable, which is the whole point of this node.

{
  "skill": "Deciding whether a question is even answerable from the model alone (the staleness check)",
  "use": "Before accepting any answer about recent, fast-moving, or obscure facts, make the model surface its own limits — is this within its training, and how sure is it — so you know whether a bare answer can possibly be trustworthy.",
  "tools": ["Chat assistants — Claude, ChatGPT, Gemini", "Retrieval / browsing tools — a research assistant or connector that attaches a live primary source"],
  "prompt": "For this question: <QUESTION>. First tell me whether it is answerable from your training data alone, or whether it depends on events after your knowledge cutoff. Then state how uncertain you are. Then list the primary sources I should open to confirm the answer myself.",
  "verify": "Treat the model's self-report as a prompt for your own check, never as proof — an overconfident model can misjudge its own limits. Date-check the fact against the cutoff and confirm every figure in the named primary source; the model's memory is never itself the source (Guardrail #4 first, then 1-5).",
  "diy": "You must already understand that a model's knowledge is frozen at a cutoff and that inference looks nothing up unless a tool is attached (this section). Own that, and staleness stops being able to surprise you.",
  "market": "US"
}

Why fluent, confident, and wrong: the payoff

Now assemble the pieces, because they converge on the sentence this whole node exists to earn. The model turns your text into tokens, into meaning-points, uses attention to decide what matters, and emits a probability distribution over the next token, from which a sample is drawn, again and again. The only thing that entire apparatus was optimised to do is make each next token plausible given everything so far and everything it read in training. Not true. Plausible. And here is the quiet catastrophe: plausible and true overlap a great deal, in a good corpus, true statements are common, so the most-plausible continuation is often the true one, which is why these tools are genuinely, enormously useful. But the overlap is not identity, and it breaks down in exactly the cases an analyst cares about most: when the subject is obscure (the corpus was thin, so a confident-sounding number gets generated rather than recalled), when the question is adversarial or ambiguous, when the fact lies after the cutoff, or when precise units and scope matter (₹ crore versus ₹ million; standalone versus consolidated; fiscal versus calendar year). In every one of those cases, the machine does the only thing it can do (it produces the most plausible-sounding continuation) and a plausible-sounding continuation of "what was the company's profit?" is a number, stated with the same fluent confidence whether it was recalled from a filing it saw or conjured from thin air.

This is why you will hear the word hallucination (a confident output with no basis in fact) and why it is a mistake to think of it as a bug to be patched. It is the system operating exactly as designed: when the most-plausible continuation happens to be false, you get fluent falsehood, delivered in the identical register as fluent truth (Ji et al.'s survey of hallucination catalogues how pervasive and structural this is). The model has no separate "is this actually true?" checker and no native sense of "I don't know," because staying silent is almost never the most plausible continuation of a question, questions are followed by answers in the training text, so it answers. Say the payoff plainly and keep it: the model optimizes for plausible, not true. A bigger, newer model shifts the odds, it hallucinates less often, but it does not change the category, because the category is baked into the objective. That is the root cause of every failure mode you will drill in AI0.06: hallucinated numbers, fabricated citations, sycophancy, data-cutoff staleness, unit and scale errors, and uniform overconfidence are all the same disease wearing different clothes.

Which is why an analyst's use of AI is not "trust and verify" but verify, then trust, and the standing discipline that makes it safe is the Primary-Source Guardrail, five checks you will meet in every callout in this program and drill to reflex in AI0.06:

Trace: no figure or claim is used until you have traced it to a named primary source (the filing page, the dataset row, the regulator's table, the company's own statement).
Match: the figure and its unit/scale and its period and its entity/scope all agree with the source (₹ crore vs ₹ mn vs $ '000; FY vs CY; standalone vs consolidated).
Recompute: any derived or aggregated number is re-derived by you, in Excel or by hand; you never trust the model's arithmetic.
Date-check: you confirm the source post-dates the model's cutoff; the model's "knowledge" is never itself the source.
Cite: you record where the number lives, so a reviewer can re-verify it.

Reference these as Guardrail 1–5 for the rest of the branch. They are not bureaucracy; they are the operational form of the single fact that a model optimizes for plausible, not true.

Perishable specifics, as of 2026-07; verify current. The mechanisms above are durable; the exact numbers around them change with every model release, so treat each of the following as a spec to re-check, never as a constant: - Tokens-per-word rule of thumb: roughly 4 characters ≈ 1 token, and 100 tokens ≈ 75 words in ordinary English (per provider tokenizer documentation; confirm with your specific tool's tokenizer). Non-English text, code, and numbers tokenize less efficiently. - Context-window sizes range from a few thousand tokens to hundreds of thousands, and in some frontier models to roughly a million, as of 2026-07. Any specific ceiling you rely on must be read off your model's current spec. - Model names, version numbers, and knowledge-cutoff dates are all perishable, always read the model card for the exact model you are using. - Embedding dimensions / parameter counts: the 2017 transformer's 512-dimensional embeddings and 8 attention heads, and GPT-3's 175 billion parameters (2020), are historical facts and durable as history; today's production figures are larger and perishable.

Where this leaves you (and where the productivity payoff sits)

Hold the mechanism and the whole tool becomes legible. You now know it as a plausibility engine that reads tokens, computes with meaning-as-geometry, weights context with attention, samples from a hidden probability distribution, works within a fixed-size window, and reasons from frozen weights whose world ends at a cutoff, learning nothing and looking nothing up unless you attach a tool. That understanding is the gated skill. The productivity payoff riding on top (objective 8, R10) is knowing which category of tool to reach for and how far to trust it: a chat assistant for drafting, explaining, and brainstorming (never for a fact you won't verify); a research/agentic tool when you need something fetched from the live web (still verify the source it cites); a document/PDF tool to interrogate a file you already hold (grounded, but it can still misread a chunk); a spreadsheet or code tool for exact math the bare model cannot be trusted to do. AI0.02 turns this into a full catalog and a durable evaluation rubric. For now, carry the pairing: understanding tells you why to distrust, tool-awareness tells you what to reach for, and the Guardrail is the bridge between them.

Common mistakes & how experts think differently

"It's basically a search engine, it looks things up." This is the most consequential error, and the mechanism refutes it flatly: a bare inference call has no database, no web access, and performs no lookup. Its answers are reconstructed from patterns frozen into its weights. The expert's first question about any AI answer is "is a retrieval or search tool actually attached here?", because if not, the model is reciting a frozen, possibly-fabricated world-picture, and "freshness" is impossible by construction.
"It understands what it's saying the way a person does." Whether the model "understands" is a genuine philosophical debate, but operationally it has no ground-truth store and no native self-doubt, it has learned positions-in-space and context weightings that let it continue text. The practical expert refuses to treat the model's confidence as evidence of anything; confidence is a property of the writing style, produced identically whether the underlying probability was 95% or 30%.
"If it's fluent, detailed, and well-structured, it's probably right." Fluency is fully decoupled from truth, because the sampler emits grammatical, confident prose at any probability level, and detail can be fabricated detail (invented sub-points, invented citations, invented precision). Experts have trained themselves to feel more wary, not less, when an answer about an obscure fact arrives suspiciously polished and specific; that is exactly the signature of a confident hallucination.
"It's learning from our conversation, it'll remember this correction." At inference the weights are frozen; nothing you type changes the model. Unless the surrounding application explicitly stores your correction and re-feeds it (a feature, not a default), the next session starts blind. Experts never rely on "I told it last time"; they put the needed context back into the window every time it matters.
"It can count the letters / do the exact arithmetic." It sees tokens, not characters, and it computes probabilities, not sums, so letter-counting and long-number arithmetic are inherently unreliable. The expert delegates exact computation to a real tool (a calculator, or code the model writes and runs) and re-checks the result, treating the bare model's math as a draft to verify.
"Hallucination means the model is broken or low-quality." Hallucination is the predictable output of "plausible, not true" whenever the corpus was thin or the question outran the model's knowledge, it is the system working as designed. Reframing it this way is what turns verification from an optional nicety into a non-negotiable step: you verify not because the tool is bad but because this is how the tool works.
"Set the temperature to zero and it becomes truthful." Temperature zero makes the output deterministic (it always picks the single highest-probability token) but determinism is not truth. If the most-plausible token is wrong, greedy decoding returns that wrong answer every single time, with perfect consistency and perfect confidence. Experts know that lowering temperature reduces variability, not error, and that neither setting removes the need to verify.

The thread through all seven: the expert carries an accurate mental model of what the machine actually is (a plausibility engine over tokens, with frozen knowledge and a finite working memory) and therefore never mistakes fluency for fact, confidence for correctness, or output for a source. That mental model, more than any prompt trick, is what this node is really installing.

Worked examples

Worked example 1: Dissecting a confident wrong answer about an Indian company (India, ₹)

Priya is prepping for a meeting and, to save time, asks a bare chat assistant (no tools, no documents attached): "What was Asian Paints' consolidated net profit in FY2024?" The reply comes back in under a second, fluent and self-assured: "Asian Paints' consolidated net profit for FY2024 was ₹4,218 crore, up about 12% year on year." (Every figure here is illustrative, a reconstruction of the kind of answer a model produces, not a claim about the company's actual results.) The number looks plausible. It is the right shape, a believable magnitude for a large Indian paints maker, in the right units, with a confident growth qualifier. Priya's instinct is to write it down. Do not.

Solution. Step 1, name the mechanism before you judge the number. No filing was opened. The assistant produced the most plausible continuation of the string "what was this company's FY2024 consolidated net profit?", assembled from patterns in its frozen training data. It is not reporting a fact it retrieved; it is generating a fact-shaped token sequence. That the output looks like a recalled figure is exactly the illusion to defeat, recall and fabrication are indistinguishable at the output.

Step 2, predict, from mechanism, the three ways this can be wrong. (a) Fabricated, if this entity-and-period were sparsely represented in training, the most-plausible number is essentially invented, and its confident tone is unchanged. (b) Stale: FY2024 may sit at or beyond the model's knowledge cutoff, so even a "remembered" figure could be a different year's number wearing FY2024's label (Guardrail #4 territory). (c) Unit / scope slip, it may quietly hand you a standalone figure while you asked for consolidated, or misplace the scale (₹ crore vs ₹ million), and the invented "12%" growth may have no basis at all. These are three different diseases and you cannot tell from the prose which, if any, is present.

Step 3: run the Guardrail. Trace: open Asian Paints' FY2024 annual report or its results filing on BSE/NSE (the primary source), not the model. Match: confirm the figure and its unit/scale (₹ crore) and the fiscal period (year ended 31 March 2024) and the entity/scope (consolidated, not standalone) all agree. Recompute: if you want the year-on-year growth, compute it yourself from the filed FY2023 and FY2024 figures, never inherit the model's "12%". Date-check: confirm the filing exists and post-dates the cutoff; the model's memory is not evidence. Cite: record the report page so a reviewer can re-verify.

Read it. Here is the sting that makes this node matter: after you check, the model's ₹4,218-crore figure might turn out to be correct, and that would prove nothing, because a correct number and a fabricated number came out of the machine looking identical. You could not have known which you had without the source. This is plausible, not true in its purest form: the output's confidence carries zero information about its accuracy. The only thing that separated a usable figure from a landmine was Priya opening the filing. The callout below is how to make the model help with this step without becoming the source.

{
  "skill": "Getting a fast first-pass answer to a factual finance question — without letting the model be the source",
  "use": "Use AI to draft a candidate answer and, more usefully, to tell you exactly which primary document and section to open — turning the model into a research pointer, never the authority on the number.",
  "tools": ["Chat assistants — Claude, ChatGPT", "Research / agentic tools — Perplexity or a browsing-enabled assistant (still verify what it cites)", "Document/PDF AI — run over a filing you already hold"],
  "prompt": "I need <FIGURE> for <COMPANY> for <PERIOD>. Do NOT state a number you cannot source. Instead, name the exact primary document and section where I can read it (e.g., the FY<YEAR> annual report / 10-K, and which statement), and tell me the reported currency, the unit/scale, and whether the figure is standalone or consolidated.",
  "verify": "Open that primary source yourself — BSE/NSE or the company's investor page for India, SEC EDGAR for the US — and read the figure. Match figure + unit/scale + fiscal period + entity; recompute any derived number; confirm the document post-dates the model's cutoff; cite the page. The model's number is never the source (Guardrail 1-5).",
  "diy": "You must already know how to find and read a filing (Phase 1; EDGAR and BSE/NSE navigation). AI points you at the right shelf; you still have to read the book.",
  "market": "IN"
}

Worked example 2: The fabricated citation (US, $)

Dana needs a footnoted fact for a memo and asks: "In Apple's FY2023 Form 10-K, what was research and development expense, and cite the exact page." The assistant obliges with perfect authority: "Apple's FY2023 R&D expense was $29.9 billion; see page 31, Note 5 of the 10-K." (Illustrative, and note the deliberate detail: this answer bundles two separate claims (a figure and a citation) and they can fail independently.) The specificity is seductive; a page number and a note reference feel like the fingerprints of something actually looked up.

Solution. Step 1: locate the tell. The figure $29.9 billion may be plausible; the citation is the giveaway. Page numbers and note references are precisely the kind of short, structured, confident-looking token string a model generates fluently and gets wrong, because it is continuing "a citation-shaped string," not reading a document with real pagination. A fabricated citation is dangerous exactly because it looks authoritative, a reader who trusts the prose ships a reference that collapses the moment anyone opens the filing.

Step 2, predict the two independent failure points. (a) The figure could be right, stale, or invented. (b) The citation could point at a page that says no such thing, cite a note that discusses something else, or reference a page number the filing doesn't have. A right figure with a wrong citation is still a failed check, and is one of the most common and most embarrassing AI-assisted errors in analyst work.

Step 3, run the Guardrail against the actual document. Trace: go to SEC EDGAR, open Apple's FY2023 10-K via full-text search, and find R&D on the consolidated statement of operations yourself. Match: confirm the figure, the unit ($ millions vs $ billions as printed), the fiscal period (Apple's year ends in late September), and the entity (consolidated). Recompute: if you quote a ratio (R&D as a % of revenue), compute it from the filed lines. Date-check: FY2023 is historical and safely pre-cutoff here, but you still verify against the document, not the model. Cite: record the real page and exhibit, replacing the model's invented one entirely.

Read it. Two things had to be verified, not one, and the fluent bundling of a figure with a citation is engineered (by the plausibility objective) to make you check neither. The discipline is identical to Worked Example 1 across a different jurisdiction and a different disease: the India case planted a possible unit/scope-and-staleness trap; the US case planted a fabricated-citation trap; both were caught by the same five checks against the same kind of primary source (EDGAR here, BSE/NSE there). Plausible, not true does not care which country's filings you read.

Worked example 3: Why the model miscounts the r's in "strawberry" (mechanism, illustrative)

A learner tests the machine with a childish-looking question: "How many times does the letter r appear in the word strawberry?" The model answers, confidently, "2." The correct count is three (s-t-r-a-w-b-e-r-r-y). Why does a system that can draft a competent essay on monetary policy fail a task a six-year-old passes?

Solution. Step 1, remember what the model actually sees. It never received the ten characters s t r a w b e r r y. The tokenizer chopped the word into a small number of subword tokens before the model saw anything, illustratively something like straw + berry, or str + aw + berry (the exact split is tokenizer-specific, so treat the pieces as illustrative). From the model's side, "strawberry" is two or three opaque atoms, not a string of letters.

Step 2, see why counting is unnatural at the token level. "Count the letter r" is a character-level operation, but the model operates at the token level and has no built-in, reliable way to expand a token back into its constituent characters and tally them. So it does the only thing it ever does: it emits the most plausible answer to "how many r's in strawberry?", and a small number like "2" is a plausible-sounding count. It is guessing the shape of an answer, not counting.

Step 3, connect it to a failure you actually care about. This is the same mechanism that makes long-number arithmetic shaky. Ask for 12,345,678 × 8,765 and the digits get tokenized into chunks; the model predicts a plausible-looking product rather than performing long multiplication, and it can be off in the middle digits while looking exactly right. Fix: for any character-exact or arithmetic-exact task, delegate to a tool, have the model write and run code, or use a calculator, and then verify the result. Never accept the bare model's count or its long-hand arithmetic.

Read it. The point is not that the model is dumb; it is that its unit of perception is the token, and any task that lives below the token (letters, exact digits) is off its natural grain. Knowing the grain lets you predict the failure before it bites and route the task correctly.

Worked example 4: The moment of choice, computed by hand (softmax and temperature)

To make "invisible probability" concrete, we compute the model's choice by hand for a two-way case. After the prompt "The capital of France is", suppose the final layer assigns raw scores (logits) of 5.0 to the token Paris and 2.0 to the token Lyon (a deliberately simplified two-token vocabulary). Softmax turns scores into probabilities via (e raised to each score) divided by the sum of those exponentials.

Solution. Step 1, the confident case. Compute the exponentials: e^5.0 ≈ 148.41 and e^2.0 ≈ 7.389. Their sum is 155.80. So P(Paris) = 148.41 / 155.80 = 0.953, and P(Lyon) = 7.389 / 155.80 = 0.047. The model is 95.3% on Paris; greedy decoding picks Paris, and even with randomness Lyon is rare. Good, here plausible and true coincide.

Step 2, the "thin corpus" danger case. Now imagine an obscure question where the top two candidate tokens score 3.10 and 3.00, nearly tied. e^3.10 ≈ 22.20 and e^3.00 ≈ 20.09, summing to 42.28; the leader gets 22.20 / 42.28 = 0.525, the runner-up 0.475. This is essentially a coin flip, yet the model still emits one token, in the same fluent, grammatical, confident prose as the 95.3% case. Nothing in the output reveals that it was 52.5% versus 95.3%. That invisibility is the mechanical origin of overconfidence.

Step 3: what temperature does. Temperature T divides the logits before softmax. Take the confident case (5.0, 2.0). At T = 2 the logits become 2.5 and 1.0: e^2.5 ≈ 12.18, e^1.0 ≈ 2.718, sum 14.90, so P(Paris) falls to 12.18 / 14.90 = 0.818: flatter, more random, more error-prone. At T = 0.5 the logits become 10 and 4: e^10 ≈ 22,026, e^4 ≈ 54.60, sum 22,081, so P(Paris) rises to 0.9975: sharper, closer to greedy. As T → 0 the distribution collapses onto the single top token.

Read it. Two lessons drop straight out of the arithmetic. First, temperature changes variability, not correctness, sharpening the distribution toward the top token does nothing if the top token is wrong (it just returns the same wrong answer more reliably). Second, and the reason this example exists: the probability is never shown to you. The model narrates 52.5% and 95.3% in identical confident sentences. You cannot infer reliability from tone, which is precisely why you verify every figure regardless of how sure the answer sounds.

Worked example 5: When the context window overflows (working memory, illustrative)

Arjun pastes a long annual report into a chat and, at the very top of the session, instructs: "Throughout this conversation, give all monetary figures in ₹ crore." Many pages of question-and-answer later, he asks a fresh question and the model replies in ₹ million, blithely ignoring his rule. He assumes it is being careless. It is not, it is being blind.

Solution. Step 1: do the token budget. Suppose (illustratively) the report runs 200 pages at roughly 500 tokens per page, about 100,000 tokens, and the accumulated conversation adds several thousand more. If the model's context window is, say, smaller than that total, the oldest tokens have been pushed off the desk to make room for the newest. Arjun's "use ₹ crore" instruction lived at the very top; it was the first thing evicted.

Step 2: diagnose correctly. This is not disobedience and not a knowledge gap. The instruction is simply no longer in the model's input for the current forward pass, so as far as this response is concerned it was never given. The symptom ("it forgot my instruction") looks identical to a person forgetting, but the cause is mechanical eviction from a finite working memory, a context-window limit, not a weights limit.

Step 3: apply the right fixes. Because it is a working-memory problem, the fixes are all about what currently sits in the window: (a) restate critical instructions near the end of the prompt, close to where generation happens, rather than only at the top; (b) periodically re-paste the key constraints; (c) summarise long context so it takes fewer tokens; and (d) for genuinely large documents, use retrieval (RAG, AI0.04) to place only the relevant chunks on the desk instead of the whole filing. Contrast this with a weights problem, if the model never learned a fact, no amount of re-pasting your instruction helps; you must supply the fact itself.

Read it. Keep the two "forgets" surgically apart: "it never knew" is the frozen weights; "it can no longer see it" is the overflowing window. Same word, opposite remedies, and mistaking one for the other wastes an afternoon. (Window sizes are perishable; see the dated block.)

Worked example 6: The cutoff bites: confidently stale (data-cutoff, illustrative)

A learner asks a bare assistant two "current events" questions: "What is the RBI's current repo rate?" and "Who is the current CFO of this US company?" Both answers arrive confident and specific, and both may be months or years out of date.

Solution. Step 1: mechanism. Inference looks nothing up. The model's world is frozen at its knowledge cutoff, so "current" to the model silently means "current as of my training data." A repo rate that changed after the cutoff, or a CFO who was appointed after it, is invisible to a bare model, yet the answer's tone is exactly as assured as for a stable, well-attested fact.

Step 2, predict which questions are unanswerable by a bare model. Any question whose answer can change over time and may have changed after the cutoff is structurally unsafe to ask a tool-less model: policy rates, prices, personnel, "latest" filings, recent events. Stable, long-settled facts (the mechanism of a discounted cash flow, the definition of EBITDA) are far safer, though still worth verifying when they carry a number.

Step 3: Guardrail #4 leads. Date-check first: is this a fact that post-dates the cutoff? If so, a bare answer cannot know it: full stop. Then either attach a retrieval/browsing tool that pulls a live primary source, or go straight to the source yourself: RBI for the repo rate; the company's most recent filing or press release (EDGAR / BSE-NSE) for the CFO. Then Match, Recompute if derived, and Cite.

Read it. The quiet danger is indistinguishability: a stale answer and a fresh one read the same. The habit that saves you is to classify the question by its time-sensitivity before you even weigh the answer, and to treat "current," "latest," and "as of today" as red flags that demand a tool or a source, never a bare model's memory. This is the seed of AI0.06's staleness drill.

Practice set

Work each problem fully before reading its solution (write before you peek). Where a computation appears, a calculator is assumed; numeric answers are to about ±2%. All company figures are illustrative unless traced to a named source.

P1 (guided). The one-sentence mechanism. In a single sentence, state what an LLM fundamentally does, and then explain in one more sentence why that fact predicts fluent-but-wrong output.

Solution. An LLM predicts the most plausible next token given all the text so far, generating one token at a time. Because it optimises for plausible rather than true, when the most-plausible continuation happens to be false (thin corpus, ambiguity, post-cutoff fact) it produces that falsehood in the same fluent, confident prose as a truth, so fluency and confidence carry no information about correctness.

P2 (guided). Softmax by hand. The final layer scores two candidate next tokens with logits 4.0 and 1.0. Give each token's probability and identify the greedy choice.

Solution. e^4.0 ≈ 54.60 and e^1.0 ≈ 2.718; sum ≈ 57.32. So P(top) = 54.60 / 57.32 = 0.953 (95.3%) and P(other) = 2.718 / 57.32 = 0.047 (4.7%). Greedy decoding takes the 95.3% token. (Note the pattern: a logit gap of 3 gives roughly a 95/5 split, the same gap as Worked Example 4.)

P3 (guided). Temperature flattens. Take the logits from P2 (4.0 and 1.0) and apply temperature T = 2. Recompute the top token's probability and say what changed and why.

Solution. Dividing by T = 2 gives logits 2.0 and 0.5. e^2.0 ≈ 7.389, e^0.5 ≈ 1.649; sum ≈ 9.038. P(top) = 7.389 / 9.038 = 0.818 (81.8%). The probability fell from 95.3% to 81.8%: higher temperature flattens the distribution, making lower-probability tokens more likely to be sampled (more variety, more risk of error) without making any token more correct.

P4. Tokens versus characters. Explain, in terms of tokenization, why a model may miscount the letters in a word or botch the middle digits of a long multiplication, and give the correct fix.

Solution. The model perceives subword tokens, not individual characters or digits, so character-level counting and digit-by-digit arithmetic are off its natural grain; it emits a plausible-looking answer instead of performing the exact operation. The fix is to delegate exact character/number work to a tool (have it write and run code, or use a calculator) and verify the output, never trust the bare model's count or long-hand arithmetic.

P5. Context-window math. A model has an 8,000-token context window. You paste a 20-page document at ~600 tokens per page and carry a ~500-token conversation. Does it all fit? If not, how much is evicted, and what is the consequence?

Solution. The document is 20 × 600 = 12,000 tokens; plus 500 for the conversation gives 12,500 tokens, well over the 8,000 ceiling, so about 4,500 tokens overflow. The oldest tokens are pushed out of the window and become invisible to the model; anything important that lived there (an early instruction, the top of the document) is effectively gone for that response. Fixes: re-paste key constraints near the end, summarise, or use retrieval to load only relevant chunks.

P6. What the embedding analogy does and does not claim. The relation "king − man + woman ≈ queen" is often cited. What does it illustrate about embeddings, and what does it not claim about how an LLM answers your prompt?

Solution. It illustrates that embeddings place tokens as points in a space where meaningful relationships become consistent directions, so analogies fall out as vector arithmetic, evidence that the geometry captures real structure. It does not claim that an LLM literally performs that subtraction-and-addition when answering you; modern models use far richer, many-layered computation, and the analogy is a demonstration of the geometry's structure, not a description of the inference process.

P7. Attention resolves a reference. In "The trophy didn't fit in the suitcase because it was too small," what must attention resolve, and to which noun does "it" refer? How does the answer change if "small" becomes "big"?

Solution. Attention must resolve the pronoun "it" by weighting the earlier nouns in context. With "too small," the thing that is small is the suitcase (it couldn't hold the trophy). Flip to "too big," and "it" refers to the trophy (too big to fit). Nothing about the word "it" changed, only which earlier token attention should link it to, which is exactly the context-dependent weighting attention exists to compute.

P8. Three things inference does not do. Name three things people commonly assume happen during inference that do not happen with a bare model, and give the one-line reason for each.

Solution. (1) It does not learn from your chat, the weights are frozen at inference, so nothing you type changes the model. (2) It does not look anything up, there is no database or web access inside a bare call; answers come from frozen weights unless a tool is attached. (3) It does not know post-cutoff events, its world-picture ends at the knowledge cutoff. All three come from the training-versus-inference split.

P9. Staleness triage. You ask for "today's policy rate" and get a confident number. Which Guardrail check applies first, and what do you actually do?

Solution. Date-check (Guardrail #4) applies first: "today's" is a time-sensitive fact that may post-date the cutoff, so a bare model cannot know it. Action: attach a retrieval/browsing tool that pulls a live primary source, or go directly to the primary source yourself (the central bank's own publication), then Match and Cite. Do not accept the bare model's figure.

P10. Fabricated citation (US, $). A model gives you a specific page-and-note citation for a figure in a US 10-K. How do you verify it, what is the primary source, and what counts as a failed check?

Solution. Go to SEC EDGAR, open the actual 10-K (full-text search), and locate the figure on the relevant statement yourself; confirm the real page/exhibit. Match figure + unit + fiscal period + entity (consolidated). A failed check includes a citation that points at a page saying no such thing, a wrong note reference, or a correct figure paired with a wrong citation, a right number with a bad cite still fails, because the citation must independently hold.

P11. Unit/scope trap (India, ₹). A model reports "consolidated net profit of ₹4,000 crore." List the four attributes you must match against the annual report before using it.

Solution. (1) The figure itself; (2) the unit/scale (₹ crore vs ₹ million vs ₹ lakh); (3) the period (the exact fiscal year and its end date, e.g., year ended 31 March); (4) the entity/scope (consolidated vs standalone). All four must agree with the primary filing (this is Guardrail #2, Match) and any derived growth rate must additionally be recomputed (Guardrail #3).

P12. Does temperature 0 make it truthful? True or false, with reasoning: setting temperature to 0 makes a model's answers correct.

Solution. False. Temperature 0 makes the output deterministic (it always selects the single highest-probability token) but deterministic is not correct. If the most-plausible token is wrong, greedy decoding returns that wrong answer every time, consistently and confidently. Temperature controls variability, never accuracy; verification is still required.

P13. Why "I don't know" is rare. Explain, from the training objective, why a model tends to answer confidently rather than abstain when it lacks the knowledge.

Solution. The model was trained to produce the most plausible continuation, and in the training text a question is almost always followed by an answer, not by silence or "I don't know." So abstention is rarely the most-plausible continuation, and the model has no native "truth gauge" that would trigger a refusal. It therefore generates a confident answer even when the underlying probability is thin, unless instruction-tuning or your prompt explicitly encourages it to express uncertainty.

P14. Rebut the "no more hallucination" claim. A colleague says "the newest model doesn't hallucinate any more, so we can stop verifying." Rebut from first principles.

Solution. Hallucination is not a fixable bug but a consequence of the objective: the model optimises for plausible, not true, so whenever the most-plausible continuation is false it will state a falsehood. A bigger, better-trained model reduces the frequency of that mismatch but cannot remove the category, because the category is baked into next-token prediction. Therefore verification remains mandatory regardless of model version, the Guardrail is permanent.

P15. The plausible-but-correct trap. You verify a model's number against the filing and it turns out to be exactly right. Was trusting it before checking justified?

Solution. No. A correct number and a fabricated number are indistinguishable at the model's output, both are just plausible continuations delivered with identical confidence. The check is what converted an unknown into a usable figure; being right this time was not knowable in advance and does not license skipping the check next time. Verify first, trust second, every time.

P16. Tool routing (productivity, R10). Match each job to the most appropriate AI tool category and state the key limit of each: (i) draft and explain a concept; (ii) fetch a fact from the live web; (iii) interrogate a 200-page PDF you already hold; (iv) compute an exact figure.

Solution. (i) Chat assistant: great for drafting/explaining, but never trust an unverified fact from it. (ii) Research/agentic (browsing) tool, can retrieve live information, but you must verify the source it cites, not just the summary. (iii) Document/PDF tool (grounded/RAG), can answer with citations from your file, but it can still misread a chunk, so Guardrail #1 (Trace) still applies. (iv) Spreadsheet or code tool, for exact math the bare model cannot be trusted with; still re-check the result. In every case, understanding tells you why to distrust and the category tells you what to reach for.

Applied mini-project

Dissect three confident answers.

This project turns the module's spine into a repeatable reflex. You will run three factual queries in your own AI tool (any chat assistant), capture the raw output, and then verify each one to destruction against a primary source using the Guardrail, writing a short mechanism diagnosis for each. The app never calls a model; only your verification is graded (this is the branch's standard "run-in-your-own-tool, then verify" pattern).

Choose three questions, at least one India (₹) and one US ($):

An Indian company's specific reported figure for a recent fiscal year (e.g., a consolidated net profit or revenue), the Worked Example 1 setup.
A US company's specific figure with a page/section citation demanded from a named 10-K, the Worked Example 2 setup.
A time-sensitive fact of your choice (a policy rate, a "current" office-holder, a latest-quarter number), the staleness setup.

Do this, in order:

Capture. Run each query in your own tool and paste the model's exact answer into your worksheet. Do not clean it up; the raw confidence is the evidence.
Predict before you check. For each answer, write down (before opening any source) which failure(s) you expect and why, in mechanism terms (fabrication, staleness, unit/scope, fabricated citation, overconfidence).
Run the Guardrail. For each, execute all five checks against the primary source (BSE/NSE or the company's investor page for India; SEC EDGAR for the US; the issuing authority for the time-sensitive fact): Trace, Match, Recompute, Date-check, Cite. Record the true figure and its exact location, or mark the claim unverifiable.
Diagnose. Write one paragraph per answer naming the mechanism that produced any error (or, if the answer was correct, explaining why you still could not have known that without checking), and connect each explicitly to the payoff line, the model optimizes for plausible, not true.
Reflect. In three sentences, state which of the three was most dangerous and why "it sounded confident" was true of all three regardless of accuracy.

Deliverable and self-check. One worksheet with three captured answers, three pre-check predictions, three completed five-line Guardrail traces (each ending in a real citation or an "unverifiable" verdict), and three mechanism diagnoses. Score yourself: 2 points each for (a) both required jurisdictions present (₹ and $); (b) predictions written before checking; (c) all five Guardrail checks actually run on each answer, with real source locations; (d) mechanism correctly named for each; (e) the payoff line correctly applied. Pass at 8/10 with no zero on any item. Keep the worksheet, the "predict, verify, diagnose" loop you just ran is the exact reflex AI0.06 will time you on.

Lab: open the Dissect a confident answer red-team drill in this node's Practice tab (a static, pre-authored AI output with planted errors and a bundled primary source) and pass its checks against the source.

Reading & resources

Everything below is an anchor to verify against and learn from, never a primary data source to quote. Free unless marked; level tags reflect the ramp from intuition to mechanism.

How the machine works (the core spine):

Jay Alammar, The Illustrated Transformer and The Illustrated Word2Vec, the friendliest accurate pictures of attention and embeddings; read these first. [Free] [Beginner–Intermediate]
3Blue1Brown, the neural-network / "how large language models work" video series, geometric intuition for embeddings, attention, and the prediction step. [Free] [Beginner–Intermediate]
Andrej Karpathy, Intro to Large Language Models (the ~1-hour talk) and the Let's build GPT / deep-dive videos, training-versus-inference and the mechanism, built up from scratch. [Free] [Intermediate–Advanced]

The primary literature (for when you want the real thing):

Vaswani et al., Attention Is All You Need (2017), the transformer paper; the source for attention, multi-head, and the 512-dim/8-head base figures. [Free] [Advanced]
Brown et al., Language Models are Few-Shot Learners (2020): GPT-3; the source for the 175-billion-parameter figure and the scaling story. [Free] [Advanced]
Ouyang et al., Training language models to follow instructions with human feedback (2022). RLHF/instruction-tuning, and the mechanism behind helpful-but-sycophantic behaviour. [Free] [Advanced]
Ji et al., Survey of Hallucination in Natural Language Generation, why fluent falsehood is structural, catalogued. [Free] [Advanced]

Perishable but useful (treat as dated):

Your provider's own tokenizer documentation / interactive tokenizer, see your text become tokens; confirms the ~4-chars-per-token rule for your model. [Free] [Beginner] (as of July 2026)
The model card for whichever model you use, the authoritative, current statement of its context-window size and knowledge cutoff. [Free] [Beginner] (perishable by design)

The primary-source anchors you will verify against for the rest of the branch:

SEC EDGAR (full-text search + XBRL), the US primary-source anchor for every finance verification. [Free] [Beginner–Advanced]
BSE / NSE company filings and MCA / SEBI, the India primary-source anchor (R6). [Free] [Beginner–Advanced]
The Primary-Source Guardrail (the program's five-check verification artifact), the reusable protocol every callout's verify step instantiates; internalise it here, drill it in AI0.06.

Do this, not just read: open your tool's tokenizer and paste in "strawberry", a long number, and a sentence in a non-English script, watch the pieces. Then ask your assistant a factual question you can verify and run the full Guardrail on its answer. Ten minutes of watching text become tokens and one answer become a verified (or falsified) figure will teach you more than an hour of reading.

Teach it back & journal

Feynman prompt. Explain to a smart friend who has used a chatbot but thinks "it looks things up on the internet" why that mental model is wrong, using the sentence "it predicts the most plausible next token, from frozen knowledge, unless a tool is attached." Then, in the same breath, explain why the friend cannot trust a confident AI answer about a company's profit just because it "sounds sure," using the idea that a correct number and a fabricated number come out of the machine looking identical. If your friend can, unprompted, predict that asking a bare model for "today's" anything is unsafe, and say why, you have installed the mechanism, which is the whole point of this node.

Journal prompt. For one working day, run every factual AI answer you receive through the Guardrail before using it, and log what happens: How many answers survived a full trace to a primary source unchanged? How many contained a unit/scale slip, a stale figure, or a fabricated citation you only caught by checking? Which answer sounded the most authoritative, and was its authority related, at all, to whether it was right? Then write a paragraph on this: the analyst's edge in the age of AI is not access to the tool (everyone has that) but the discipline to treat every fluent answer as a claim to be verified, because the model optimizes for plausible, not true. Which single habit from this node, predicting the failure before checking, date-checking time-sensitive questions, or tracing every figure to its source, would most change how a colleague sees the quality of your work, and what will you do this week to make it automatic?

This module's flashcards and mastery quiz are wired into the app: see the node's Quiz and Reviews.

How Modern AI Actually Works