How an LLM Actually Works: A First-Principles Reconstruction

One line: An LLM is a function that predicts the next token — everything it appears to "know" or "do" is a downstream consequence of that one objective.

Why this post exists: Most explanations start from what LLMs are used for ("they answer questions") and reason backwards, which quietly smuggles in assumptions that turn out to be false — that the model stores text, that parameters hold "meanings," that confidence tracks truth. This post rebuilds the understanding from the bottom, as a chain of questions, stopping only at facts that rest on a definition, a logical necessity, or evidence you can check yourself.

What is an LLM actually trained to do?

Predict the next token. Not "answer correctly" — predict what comes next in a sequence of text. "Answering questions" is an emergent use of a model whose only job was statistical continuation. This distinction is the root of everything below; if you get this wrong, every later intuition inherits the error.

What single number does training minimize?

The loss — specifically the cross-entropy between the model's predicted distribution and the actual next token. For each position, the penalty is −log(probability the model assigned to the true next token). Averaged over billions of positions, that's the entire objective.

logits = model(tokens[:-1])              # a distribution over the vocab, per position
loss   = cross_entropy(logits, tokens[1:])  # how surprised was it by the real next token?
loss.backward()                          # nudge weights to be less surprised next time

Notice what's absent: nothing in this loss knows about truth. It rewards plausibility. Keep that in mind for two questions from now.

The model can't read letters. What happens to text first?

Before any neural network touches it, text is tokenized — chopped into subword pieces and mapped to integer IDs from a fixed vocabulary. The model never sees "hello"; it sees an integer.

"unhappiness"
  → ["un", "happiness"]   # tokenizer splits into known pieces
  → [557, 23961]          # each piece → an integer ID

So the unit the model operates on is not the word and not the character — it's the token, a chunk somewhere in between.

Integers aren't math you can learn on. How do they become vectors?

Each integer ID indexes into a lookup table — the embedding matrix — returning a vector of floats. That vector is the first thing the network actually computes on.

[557, 23961]
  → [[0.21, -0.40, ...],   # row 557 of the embedding table
     [0.08,  0.90, ...]]   # row 23961
  # THIS is the network's real input

The bridge from text to math is two steps, both mechanical: tokenize, then look up.

People quote "7B parameters." What is one parameter?

A single floating-point number. Print one and you get something like 0.0134. A 7B model is seven billion such numbers — the entries of the weight matrices that multiply against those embedding vectors.

>>> model.layers[0].attn.q_proj.weight[0][0]
tensor(0.0134)   # that's one parameter. just a number.

A parameter is not a word and not a meaning. Meaning isn't stored in any single number — it only appears when many of them act on an input together.

So where is the "knowledge"? Is the training text stored inside?

No. Here's the proof, and it's just arithmetic: a 7B model in 16-bit precision is about 14 GB. Its training data was terabytes. You cannot fit terabytes inside 14 GB losslessly. Therefore the model cannot be storing the text — it's a lossy compression of statistical structure, not a database of sentences.

training data:  ~ terabytes
model weights:  ~ 14 GB
14 GB  <<  terabytes   ⇒  the text is not in there

The model didn't memorize the library. It absorbed the patterns and threw the books away.

Then at generation time — is it looking things up, or computing?

Computing, every time. There's no table to look in. Each step it runs the current context through the frozen weights, gets a fresh distribution over the next token, samples one, appends it, and repeats.

while not done:
    logits   = model(context)       # recomputed from scratch every step
    next_tok = sample(logits[-1])   # draw from the distribution
    context.append(next_tok)        # feed it back in, loop

"Retrieval vs. computation" was a false choice. It's computation. The only thing that ever gets reused is the frozen weights.

Why this architecture? What did we use before, and what couldn't it do?

Before Transformers, sequence models were RNNs/LSTMs — they read tokens one at a time, squeezing all prior context through a single evolving hidden state. Two fatal limits: they couldn't be parallelized (strictly sequential), and information from early tokens decayed before reaching distant ones. Attention fixed both: every token can look directly at every other token in one parallel operation, regardless of distance.

# BEFORE — RNN: sequential, one bottleneck vector
h = zeros()
for tok in sequence:          # must process in order
    h = update(h, tok)        # token 1's signal fades by token 500

# AFTER — attention: all pairs at once, no distance penalty
scores = Q @ K.T              # every token ↔ every token, one matmul
out    = softmax(scores) @ V  # parallel, direct long-range access

It was never about "efficient recalling." It was about direct, distance-independent, parallelizable access to context — which is also what made training at massive scale practical.

If it's only trained to predict tokens, why can it translate, summarize, and code?

Because all of those are next-token prediction in disguise. To predict the next token well across the entire internet, the cheapest strategy the optimizer can find is to internalize the regularities behind the text — grammar, translation correspondences, code syntax, reasoning patterns. Generality isn't bolted on; it's the most efficient way to minimize that one loss at scale.

Does it know when it's making things up?

No — and this falls straight out of the objective. The model has internal confidence (a sharp vs. flat probability distribution), but that confidence measures how well a token fits the pattern, not whether it's true. A fluent fabrication is often the statistically smoothest continuation, so the model can be supremely confident and completely wrong.

p = softmax(logits)[next_tok]   # high p = "this fits the learned pattern"
                                # high p ≠ "this is factually correct"

Since the loss only ever rewarded plausibility, nothing in training forces confidence to track truth. Hallucination isn't a bug layered on top — it's the objective behaving exactly as defined.

Where does capability actually come from — the architecture or the data?

Data and scale dominate; architecture enables. This isn't a hunch — it's the result of the experiment of training identical architectures on increasing data and compute. Scaling laws show capability rising smoothly and predictably with parameters, data, and compute together. The Transformer's role is to be a substrate that scales efficiently; once it's good enough, the capability comes from the data poured through it.

capability  ≈  f(parameters, data, compute)   # smooth, predictable
architecture: the thing that lets f scale at all, not where the ability "lives"

So "architecture + data, combined" was the right instinct stated too vaguely. The sharp version: architecture is necessary but saturating; data × scale is the engine.

The first principles it rests on

Verify these on revisit — everything above is built from them:

The training objective is next-token prediction, scored by cross-entropy loss. (Definition.)
The output is a probability distribution over a fixed token vocabulary. (Definition.)
A parameter is a single floating-point number; meaning is distributed across many, never stored in one. (Definition.)
Input is tokenized to integer IDs, then embedded to vectors before any computation. (Definition.)
Model size ≪ training data size, so the model compresses statistical structure rather than storing text. (Information theory — checkable arithmetic.)
Generation is fresh computation through frozen weights, not retrieval. (Follows from 3 and 5.)
Attention gives parallel, distance-independent access to context, which RNNs could not. (Architectural fact, Vaswani et al. 2017.)
Confidence reflects plausibility, not truth, because the objective only ever rewarded plausibility. (Logical consequence of 1.)
Capability scales with data, parameters, and compute; architecture enables scaling rather than supplying the ability. (Empirical — scaling laws.)

Acronyms

LLM — Large Language Model
RNN — Recurrent Neural Network
LSTM — Long Short-Term Memory
Q / K / V — Query / Key / Value (the three projections used in attention)
ID — Identifier (as in token ID)
GB — Gigabyte
B (as in 7B) — Billion (parameter count)