National Cyber Warfare Foundation (NCWF)

Welcome back, my aspiring cyberwarriors! We are living on the cusp of one of the most exciting eras in the history of technology! Artificial Intelligence (AI) is about to change everything we do and change the way the world operates. This change will likely be more dramatic and consequential than the invention of printing press […]

The post How Artificial Intelligence (AI) Large Language Models (LLMs) Work, Part 1 first appeared on Hackers Arise.

Welcome back, my aspiring cyberwarriors!

We are living on the cusp of one of the most exciting eras in the history of technology!

Artificial Intelligence (AI) is about to change everything we do and change the way the world operates. This change will likely be more dramatic and consequential than the invention of printing press or the development of the internet. For this reason, it is incumbent upon you to try to understand what is taking place and how. Only in this way, can you stay ahead of this tsunami and ride this wave to better job and a higher income. Those who ignore this wave will likely be washed away into the dustbin of history.

With that goal in mind, I have started this series on how large language models (LLM) work in AI.

Under the Hood

At the core of every LLM lies the transformer architecture—a neural network designed to handle sequences (like sentences or code). Unlike older models that processed words one-by-one, transformers analyze entire sequences in parallel using self-attention. This mechanism lets the model weigh the importance of every word in a sentence relative to others. For example:

“The hacker breached the router”
Here, “breached” links strongly to “hacker” and “router,” ignoring irrelevant words. This contextual understanding is what makes LLMs so powerful

Training: Gorging on Data

LLMs train on massive text corpora—think Wikipedia, books, code repositories, and web pages (GPT-3 devoured 45TB of text!). During training:

Tokenization: Text is split into chunks (tokens), which can be words, subwords, or symbols.

Embedding: Tokens convert into numerical vectors (e.g., “router” → [0.24, -1.7, ...]), capturing semantic relationships. Similar words cluster in vector space

Next-Word Prediction: The model learns by guessing the next token in sequences. Correct guesses reinforce connections; errors adjust the model’s 175 billion+ parameters (weights/biases)

This unsupervised pre-training teaches grammar, facts, and reasoning—no human labels needed.

Text Generation: The Inference Loop

When you prompt an LLM, here’s what happens under the hood:

Tokenize Input: Your prompt (“Explain VPNs to a hacker”) splits into tokens.

Process Through Layers:
- Embedding layer converts tokens to vectors.
- Transformer layers apply self-attention and feed-forward networks to build context.
- Output layer generates a probability distribution for the next token

Sample and Repeat: The model picks the next token (e.g., “VPNs” → “create”), appends it, and repeats until done.

Note: Control output randomness with:

temperature (higher = more creative)

top-p (limits sampling to high-probability tokens)

Why Hackers Should Care

LLMs are force multipliers:

Social Engineering: Generate convincing phishing emails or fake personas.

Code Automation: Write scripts for scanning, exploits, or tooling (e.g., “Write a Python port scanner”).

Recon: Summarize leaked docs or technical manuals in seconds.

Obfuscation: Use LLMs to craft polymorphic malware or evade detection.

Gotcha: LLMs hallucinate. Always verify outputs—especially for critical ops

Build Your Own LLM: Minimalist Demo

Would you like to train a nano-LLM? Here’s the basic skeleton in Python to get started.

This uses GPT-2 to complete the phrase. You swap gpt2 for larger models (e.g., gpt-j-6B) and complex results.

The Future: LLMs in Offensive Security

Imagine:

AI Red Teamers: LLMs that autonomously probe networks for weaknesses.

Adaptive Malware: Code that rewrites itself using LLM feedback loops.

Counter-LLM Warfare: Detecting AI-generated disinformation in ops.

Rule #1: Never trust an LLM blindly. Treat it like a rookie hacker—verify its work

Conclusion

LLMs are neural networks on steroids: trained on internet-scale data, masters of context, and invaluable for hacking. Understand their architecture, leverage their generative power, and stay sharp—because in the AI arms race, the best hackers adapt fastest.

Stay curious. Stay dangerous.