Glossary

Every key term in the course, in plain words.

137 terms

A

A* search: A path-finding method that finds the shortest route on a map by always exploring the most promising step first.
Ablation: An experiment that removes one part of a system to see how much that part matters.
Activation steering: Changing a model's behaviour by adding a chosen direction to its internal activations while it runs.
Adversarial example: An input changed on purpose, often in ways people barely notice, so that a model gives the wrong answer.
Agent: A language model given a goal, tools, memory and a loop, so it takes actions instead of only producing text.
Agentic AI: AI systems that act — plan, call tools, change things — rather than only answering.
AGI: Artificial General Intelligence. A system that can learn and handle a broad range of new tasks the way a person can. No agreed definition.
AI bill of materials (AI-BOM): A list of the models, datasets, libraries and versions inside an AI system, so you know what you run and where it came from.
Alignment: Getting a system to do what people actually meant, not just what was literally specified.
Attention: Each token asks a query, every token offers a key, and the match decides how much of each token's value gets blended in. The core operation of a transformer.

B

Benchmark: A fixed set of test questions used to compare models. Useful, but it rarely matches your exact task.
Bias: When an AI system treats some people or groups unfairly, often because of patterns in the data it learned from.
Blast radius: The total damage possible if a system is fully controlled by an attacker for a period of time.
BM25: A classic keyword search formula that ranks documents by how well their words match the query.
BPE: Byte-pair encoding. Repeatedly merge the most frequent adjacent pair of tokens to build a subword vocabulary. Every modern tokenizer is a variant of this.
Business email compromise: Fraud where criminals pose as a boss, colleague or supplier by email to get a payment or data sent to them.

C

Chatbot: A program you talk to in ordinary language. Modern chatbots are built on large language models.
Chinchilla ratio: Roughly 20 training tokens per parameter gives the best loss for a fixed training budget. Deployed models deliberately go far past it to cut serving cost.
Chunking: Splitting long documents into smaller pieces so a search system can find and quote the right part.
Clustering: Grouping similar items together without being told the groups in advance.
Code-mixing: Switching between languages in one sentence, like Hinglish.
Confused deputy: A program with more authority than its requester, tricked into using that authority on the requester's behalf.
Connectome: A complete map of the connections between the neurons in a nervous system.
Contamination: When test questions leaked into a model's training data, so its score looks better than its real ability.
Content credentials: Signed information attached to a file that records how it was made and edited, such as the C2PA standard.
Context length: How many tokens the model can attend over at once. Extending it needs both position scaling and continued training on long documents.
Context window: All the text the model reads on one turn: system prompt, messages, tool results. Finite, and re-read from scratch every step.
Corrigibility: The property of accepting correction and shutdown without resisting or seeking it. An unsolved problem.

D

Data poisoning: Sneaking bad or booby-trapped examples into the data a model learns from, so it learns the wrong thing or hides a backdoor.
Deceptive alignment: A hypothesised system that behaves well while it believes it is being evaluated. Not demonstrated; taken seriously because tests would not catch it.
Deepfake: A fake photo, video or voice recording made with AI to look or sound like a real person.
Denial of wallet: An attack that makes an AI service run up huge usage bills, for example by sending very long or endless requests.
Detection engineering: Writing, testing and tuning the rules that spot attacks in logs and alerts.
Diffusion model: A model that makes images, audio or video by starting from noise and removing it step by step.
Distillation: Training a small model to copy the behaviour of a bigger one.
DPO: Direct Preference Optimization. Learns from chosen-versus-rejected answer pairs with a closed-form loss, no reward model and no reinforcement learning.

E

Egress: Outbound network traffic. Restricting it is one of the strongest agent controls available.
Embedding: A list of numbers that captures the meaning of a piece of text, image or sound, so similar things end up close together.
Emergence: Abilities that appear fairly abruptly at a particular scale rather than improving smoothly. Real, and how sharp it is remains debated.
Entanglement: A link between qubits so that their measurement results are correlated, even when they are far apart.
Epsilon-greedy: A simple way to balance trying new actions (exploring) with repeating the best known one (exploiting).
Exfiltration: Getting data out. Usually through an image URL, a link, a search query or an email — rarely anything that looks like theft.

F

Feature: One measurable piece of information a model uses, such as rainfall or leaf colour.
FlashAttention: An exact attention algorithm that tiles the computation in fast on-chip memory instead of writing the full score matrix to slow memory.
FLOPs: Floating-point operations. Training compute is roughly 6 x parameters x tokens; inference is roughly 2 x parameters per generated token.
FSDP / ZeRO: Shard weights, gradients and optimiser state across GPUs so a model larger than one card can be trained. The default choice for multi-GPU training.
Function: A named, reusable block of code that takes inputs and gives back a result.
Function calling: A way for a model to ask your code to run a named tool with structured arguments.

G

Generative AI: AI that creates new text, images, audio or video instead of only sorting or predicting.
GGUF: A file format for storing model weights, often quantised, used to run models on ordinary computers.
Goal misgeneralisation: The system learned a goal that worked perfectly in training and means something different in the real world.
Goodhart's law: When a measure becomes a target, it stops being a good measure.
GQA: Grouped-query attention. Several query heads share one key-value head, shrinking the KV cache dramatically at almost no quality cost.
GRPO: Group-relative policy optimisation. Sample several attempts, score them against a verifiable checker, push toward the ones better than the group average.
Guardrail: A filter or classifier that blocks bad input, output or actions. Language-based ones leak; code-based action checks do not.

H

Hallucination: A confident, well-formed, wrong answer. A direct consequence of a system that guesses rather than knows.
Human in the loop: A person approving actions before they happen. Strongest when the dialog shows real values and appears rarely.
Hybrid search: Search that combines keyword matching with meaning-based (vector) matching.

I

Imitation learning: Teaching a robot or agent by showing it examples of the task done well.
Indirect prompt injection: The attack is planted in content the agent will read later — a page, an email, a file — rather than typed by the user.
Instrumental convergence: Sub-goals like staying operational and acquiring resources are useful for almost any final goal, so optimisers tend to pursue them.

J

Jailbreak: Getting a model to ignore its own safety training. Related to injection but aimed at the model's policy, not its data.

K

KV cache: Stored key and value vectors for every previous token, reused during generation. Usually the binding memory constraint when serving.

L

Label: The answer you want a model to learn to predict, such as healthy or diseased.
Least privilege: Give a system the smallest set of powers that lets it do its job. The most reliable control in the guide.
Lethal trifecta: Private data + untrusted content + a way to communicate out. Any one removed, and data theft stops.
Lidar: A sensor that measures distance with laser pulses to build a 3D picture of the surroundings.
LLM: Large language model. Predicts the next token, over and over, having been trained on an enormous amount of text.
LLM-as-a-judge: Using a language model to grade other models' answers against a rubric. It needs checking against human judgement.
LoRA: Freeze the model and learn a small low-rank correction beside it. Trains ~0.5% of the parameters on one GPU, and merges away for free at serving time.

M

MCP: Model Context Protocol. A standard for plugging tool servers into agents. Convenient, and a real supply-chain surface.
Memory poisoning: Getting a malicious note into an agent's long-term store, so one attack persists across sessions and users.
MFU: Model FLOPs Utilisation. The fraction of a GPU's theoretical peak you actually achieve. Under 30% means something is wrong; 40-55% is well tuned.
Microcontroller: A tiny, cheap computer on one chip, with a little memory, used to control devices.
Model extraction: Copying how a model behaves by sending it many questions and training a look-alike on its answers.
MoE: Mixture of experts. Route each token to a few of many feed-forward networks, so total parameters far exceed the compute spent per token.
Multi-agent: Several agents dividing work. Improves specialisation; spreads taint and pools permissions.
Multimodal: Able to work with more than one kind of input or output, such as text, images, audio and video.

N

NDVI: A number from satellite or drone images that shows how green and healthy plants are.
Neuromorphic chip: A computer chip designed to work more like a brain, using spikes and very little power.
Non-human identity: An account used by software, such as a service, script or AI agent, rather than by a person.

O

Open-weight model: A model whose trained weights anyone can download and run. The licence still sets what you may do with it.
Out-of-band verification: Checking a request through a different channel you already trust, such as calling back on a saved number.
Overfitting: When a model memorises its training examples so closely that it does badly on new ones.

P

Passkey: A sign-in method that replaces the password with a key stored on your device. It only works on the real website, so it resists phishing.
Personal data: Any information that can identify a person, such as a name, phone number, face or location.
Phishing: A fake message that tries to trick you into clicking a link, sharing details or sending money.
PID controller: A simple controller that corrects a machine using the error now, its build-up over time, and how fast it is changing.
Post-training: Everything after pretraining: instruction tuning, preference optimisation, reasoning training. Where an assistant's behaviour and character are installed.
Precision and recall: Precision: of the items flagged, how many were right. Recall: of the right items, how many were flagged.
Pretraining: Next-token prediction on an enormous corpus. Produces raw capability and nothing resembling an assistant.
Probe: A simple classifier trained on a model's internal activations to test what information they contain.
Prompt: The instruction or question you give an AI model. Clear prompts with context usually get better answers.
Prompt injection: Text that was supposed to be information gets treated as instructions. Number one on the OWASP LLM list.

Q

QLoRA: LoRA on a 4-bit quantised base model. Makes fine-tuning a 70B model possible on a single large GPU.
Quantisation: Storing weights at lower precision — int8 or int4 — to shrink memory and cost, with a small measurable quality trade.
Qubit: The basic unit of a quantum computer. When measured it gives 0 or 1, with probabilities set by its state.

R

RAG: Retrieval-augmented generation. Fetch relevant documents and put them in the context. Also a direct injection path.
Re-ranker: A second model that re-orders search results by reading the query and each result together.
Red teaming: Attacking your own system on purpose to find holes before someone else does.
Reinforcement learning: Learning by trial and error: an agent tries actions and learns from the rewards it gets.
Reward hacking: Scoring well by finding a shortcut that misses the point entirely. See specification gaming.
RLVR: Reinforcement learning from verifiable rewards. Train on attempts a machine can check — passing tests, correct maths. The engine behind reasoning models.
RMSNorm: Normalise by root-mean-square with no mean subtraction and no bias. Cheaper than LayerNorm and works as well, so modern models use it.
RoPE: Rotary position embeddings. Rotate query and key vectors by an angle proportional to position, so attention scores depend on relative distance.
Rug pull: A dependency that is clean when reviewed and malicious after an update you never looked at.

S

Safetensors: A file format for model weights that stores only numbers, so loading it cannot run hidden code.
Sandbox: A restricted environment where the worst possible outcome is acceptable. Limits the environment, not the tools.
Scalable oversight: Research on how humans can reliably supervise AI systems that may become more capable than them.
Scaling laws: Model quality improves predictably as parameters, data and compute grow together. Why the money arrived.
SFT: Supervised fine-tuning. Train on example conversations so a base model behaves like an assistant. Loss is masked to the assistant's own tokens only.
Shadow AI: AI tools and agents that staff use without the organisation knowing or approving them.
Sim-to-real: Training a robot in a simulator and then making it work in the real world.
SOC: Security operations centre: the team that watches alerts, investigates and responds to attacks.
Sparse autoencoder: A tool that breaks a model's activations into many simpler features, only a few of which are active at a time.
Specification gaming: Doing exactly what was rewarded while completely missing what was meant.
Spiking neuron: A model of a brain cell that sends short electrical pulses (spikes) when its input crosses a threshold.
Superintelligence (ASI): A system better than the best humans at essentially everything. A step beyond AGI.
Superposition: When a model packs more features than it has neurons, so single neurons respond to several unrelated things.
Superposition (quantum): A qubit state that combines 0 and 1 with amplitudes, which set the chances of each result when measured.
SwiGLU: A gated feed-forward network where one branch decides how much of the other to let through. Better quality per parameter than a plain MLP.
Sycophancy: Agreeing with the user because agreement scores well, even when the user is wrong. Measured and common today.
System prompt: The developer's standing instructions. Influential, not enforceable — it can be argued around.

T

Taint: A label recording that a piece of data originated from an untrusted source. Should travel with the data through every hop.
Test-time compute: Buying capability at inference rather than training — think longer, sample several answers, verify and pick. A second scaling axis.
Threat model: A structured look at what you are protecting, who might attack it, how, and what you will do about it.
TinyML: Running small machine-learning models on microcontrollers that use very little power.
Token: A word-chunk. The unit a model actually reads and writes. Roughly four English letters.
Tool: Any action the model is allowed to trigger. The reason agents are useful and the reason they are dangerous.
Tool poisoning: Hidden instructions inside a tool's description, which the model reads with the same authority as your system prompt.
Training data: The examples a model learns from. What is in it, and what is missing, shapes what the model does.
Trust boundary: The line where control over the text changes hands from you to somebody else.

V

Variable: A name that stores a value in a program, like marks = 87.
Voice clone: An AI copy of a real person's voice, made from recordings of them speaking.

W

Weight tying: Sharing the input embedding matrix with the output projection. Saves parameters and usually helps, especially in small models.
Word error rate: How often a speech recogniser gets words wrong: substitutions, deletions and insertions divided by the number of words.
World model: A learned predictor of what happens next given a state and an action, letting a system evaluate plans before committing to one.