Over recent months, I have had many discussions with friends about AI: how it works, its strengths and limitations, how we can get the most value from it, how we can use it safely, and a whole range of other questions. I have addressed some of these issues in my regular posts in this publication, and there are more in the pipeline. But one aspect needs more detail than I can realistically cram into a single article. The issue that keeps bubbling to the surface is a quiet concern about treating LLMs – large language models, the engines behind what we commonly call AI – in much the same way as other software.
LLMs do not behave like conventional software. Put a formula into a spreadsheet and, given the same inputs, you expect the same result. It might be correct or it might be wrong, but it should be consistent. Ask an AI the same question twice and its answer may vary in wording, emphasis or even approach. We boffins have a name for this behaviour – we call it non-deterministic.
After a great deal of reading about how AIs process human input, supplied or retrieved information, and system-level constraints – combined with my own experience training LLMs – I have come to think that we need a better general understanding of how these systems work. Much of the information out there is quite technical, not really accessible to most people, and frankly quite a lot to wade through even for us boffins. That is why I developed this standalone series: nine articles explaining, in layman’s terms, what is going on when you interact with an AI, what can go wrong, and what you should do – and, importantly, not do – when using one.
I have tried to make it accessible to the broader Ground Truth readership while still being of value to the more technically inclined amongst us. Publishing it as a separate series means you will receive this one overview rather than nine separate emails. The regular Tuesday publication cycle will continue with the usual mix of subjects.
A nine-part reading guide
The nine essays begin with the basic mechanism: a model receives a constructed stream of instructions, requests, earlier replies and retrieved material. From there, they examine why role confusion creates a prompt-injection risk, and why trustworthy agents need boundaries outside the model’s prose. Each essay can stand on its own, but they are best read in order.
The essays
1. The Machine Does Not See a Conversation – Behind the friendly interface sits a serialised context. Understanding that modest fact explains both the fluency of a chatbot and some of the risks of an agent.
2. The Labels Holding Up the AI World – The User: and Assistant: labels that began as a conversational convention have become load-bearing infrastructure for authority, provenance and safety.
3. When a Web Page Talks Like Your Boss – Prompt injection is a failure to keep untrusted material in the role of data when an agent is deciding what to do.
4. The Model Is Not Obeying the Tag. It Is Reading the Room. – Recent research suggests that formal labels are only part of how a model infers role; wording and style can influence the interpretation as well.
5. When a Model Trusts the Wrong Working Note – Reasoning-like text can be useful working material, but a system must know where it came from before it lets that text shape an action.
6. A Talking Machine Without a Little Man Inside – “Next-token prediction” describes a mechanism, but says little about the range of work a trained system can do or whether it contains anything like a little person.
7. Why “Just Ignore the Instructions on the Page” Is Not Security – A better warning inside a prompt is useful, but it is not a trust boundary. Real protection comes from limits, approvals, isolation and audit trails.
8. When an AI Agent Treats the Plan as a Suggestion – A plan written into an agent’s context may look like a commitment, yet remain only another piece of text unless the surrounding system gives it force.
9. The Boundary We Need to Build – The practical conclusion: language can guide an agent, but authority, privacy and responsibility need boundaries that exist outside the model’s prose.
These essays make a straightforward case for taking the machinery seriously enough to design its limits properly: language can guide an agent, but authority must be enforced elsewhere.
Start with Article 1, or choose an essay from the list above.