1.1 A Model That Predicts Text

Lesson 1 described a neural network as a large set of adjustable numbers, called weights or parameters, that are tuned by gradient descent until the network's outputs match the examples it is trained on. A large language model is a neural network of this kind trained on one deceptively simple task: given a stretch of text, estimate what comes next. The word "large" refers to the size of the network, which in current systems runs to billions of parameters, and to the size of the text collection used to train it. Everything that a general-purpose assistant appears to do, from explaining a statistical concept to drafting an email or writing R code, is produced by repeating this one step many times.

This lesson uses the Cedar Valley population health team as one of its examples. The case is fictional. The Cedar Valley Health Authority is a mostly rural health authority in British Columbia with about 210,000 residents, and its population health team is piloting, for one year, an enterprise AI assistant that the authority procured after a privacy impact assessment. Jordan, a Health Sciences co-op student, has just joined the team for a four-month placement. Before using the assistant for real work, Jordan wants to understand what the tool is doing when it writes, so that they can anticipate where it will need checking.

HSCI 241 Lesson 6 (Section 1) applies this mechanism to evidence retrieval and explains why chatbots fabricate citations. This section gives the fuller general account on which that lesson and the rest of this course build.

Figure 2.1 shows the generation loop through which a language model repeats its one step of next-token prediction, from the text so far to a single chosen token that is appended before the loop starts again.

The subsections that follow take the parts of this loop in order, beginning with the tokens into which a model divides text.

1.2 Tokens

A language model does not read letters or whole words. It reads tokens, which are the units of text in its fixed vocabulary. A token can be a whole common word together with the space before it (" health"), a fragment of a longer word ("iology"), a punctuation mark or a single character. The program that divides text into tokens is called a tokenizer, and each token is stored as an integer that identifies its position in the vocabulary.

Most current tokenizers are built with byte-pair encoding, a method adapted for language processing by Sennrich, Haddow and Birch (2016). The method starts from single characters (or bytes) and repeatedly merges the pair of adjacent units that occurs most often in a large sample of text, adding each merged unit to the vocabulary, until the vocabulary reaches a chosen size. Frequent words therefore become single tokens, and rare words are left as several pieces. GPT-2 small, the model used for the demonstrations in this section, has a vocabulary of 50,257 tokens.

Table 2.1 shows how GPT-2's tokenizer divides three sentences. Common words such as " studies", " health" and " British" are single tokens, while "Epidemiology" becomes three pieces and "Pneumococcal" becomes four. The second sentence is an invented example about the fictional Cedar Valley Connector program, used only to show how its name is split; it reports no real result.

Table 2.1. Tokenization of three sentences by the GPT-2 tokenizer.

The final full stop is a token of its own.

Tokens have practical consequences. Products set their limits and prices in tokens, so technical text uses more of a limit than everyday prose of the same length. A model that sees "P", "neum", "ococ" and "cal" has no direct view of the letters inside each piece, which is one reason language models have stumbled on tasks such as counting the letters in a word. Long numbers are also split into chunks, which contributes to arithmetic errors when no code is used (Section 3). Tokenizers built mainly from English text also divide many other languages into far more tokens for the same content (Petrov and colleagues, 2023), an equity concern that Lesson 10 takes up.

Once text has been divided into tokens, the model replaces each token with a list of numbers. The next subsection describes these lists, called embeddings.

1.3 Embeddings

Inside the network, each token is replaced by an embedding: a list of numbers, learned during training, that represents the token. In GPT-2 small each embedding has 768 numbers. A useful way to picture an embedding is as a set of coordinates on a map with hundreds of dimensions. Training adjusts these coordinates so that tokens used in similar contexts end up close together, because a model that places "influenza" near "flu" and "vaccine" near "immunization" can reuse what it has learned about one word when it meets the other. The idea that word meanings can be captured by vectors learned from their contexts was popularized by the word2vec models of Mikolov and colleagues (2013), and every current language model relies on it.

Figure 2.2 pictures, schematically and in two dimensions, how tokens used in similar contexts receive nearby coordinates.

An embedding at the input describes a token on its own. As the token passes through the model's layers, its list of numbers is repeatedly updated with information from the surrounding text, so that "cold" in "the common cold" and "cold" in "cold weather alerts" end up with different internal representations. These context-dependent representations are what allow the model to resolve ambiguity, follow a pronoun back to its noun and keep track of the topic.

Embeddings are also useful outside text generation. A search system can return the documents whose embeddings lie closest to a question's embedding, which finds passages that use different words for the same idea (Section 3 contrasts this with keyword search). Researchers also use embeddings to group open-ended survey responses by theme, an application that HSCI 841 Lesson 12 develops.

Embeddings give each token its starting representation, and the layers of the model then update it with information from the surrounding text. The next subsection describes the architecture of those layers, the transformer, and its attention step.

1.4 The Transformer and Attention

Almost every current language model uses the transformer architecture introduced by Vaswani and colleagues (2017). A transformer is a stack of identical layers (GPT-2 small has 12). Each layer contains two parts. An attention step lets every position in the text gather information from the other positions, weighting each one by how relevant it is, and a second step processes each position's updated numbers through a small feed-forward network of the kind described in Lesson 1. When a model generates text, attention looks only backward: each position can draw on the tokens before it and never on tokens that have not yet been written.

Attention is easiest to see in an example. To predict what follows "To prevent the spread of influenza, public health officials recommend", the model has to bring forward the fact that the topic is influenza and that the speakers are public health officials. Figure 2.3 shows, schematically, how the final position might weight the earlier tokens. Each layer contains several attention "heads" that learn different weighting patterns, for example one that tracks grammatical structure and another that tracks the topic, and stacking many layers lets the model build up increasingly abstract representations of the text.

The weights and biases in the attention and feed-forward steps are the model's parameters. GPT-2 small, released by OpenAI in 2019 (Radford and colleagues, 2019), has about 124 million of them. The largest GPT-2 model had about 1.5 billion, GPT-3 had 175 billion (Brown and colleagues, 2020), and developers of many current commercial models do not disclose the number. All of them are learned by the procedure described in Lesson 1: the model predicts the next token in training text, its error is measured, and backpropagation adjusts every parameter slightly. Repeated over trillions of tokens, this produces a network that encodes grammar, style, facts and patterns of reasoning as statistical regularities in its weights.

The next subsection follows the output of the final layer, a score for every token in the vocabulary, and explains how one token is chosen from those scores.

1.5 Next-Token Prediction and Temperature

At the end of the last layer, the model produces one score, called a logit, for every token in its vocabulary. A function called softmax converts the scores into probabilities that are all positive and sum to one. The model then has to choose a token. Greedy decoding always takes the most probable token. Sampling draws a token at random in proportion to the probabilities, so that a token with probability 0.30 is chosen about 30 times in 100. Assistants sample, because always taking the most probable token tends to produce flat and repetitive text.

The temperature setting controls how much chance enters the choice. Before the softmax, every logit is divided by the temperature. A temperature below 1 widens the gaps between the scores and concentrates probability on the leading tokens; a temperature above 1 narrows the gaps and spreads probability across many more tokens. Many products also apply a second rule, nucleus or top-p sampling, which samples only from the smallest set of tokens whose probabilities add up to a chosen share such as 0.9 (Holtzman and colleagues, 2020).

Box 2.1 expresses the effect of temperature as a formula and applies it to two of GPT-2's probabilities.

Interactive 2.1 lets you see these effects with real numbers. The probabilities were computed in advance from GPT-2 small and are stored in the page, so no model runs while you use it. GPT-2 has no further training as an assistant (Section 2 explains the difference), which makes it a clear window onto the raw mechanism. Together with the comparison in Section 3, it forms this lesson's worked demonstration.

Several patterns in the explorer deserve attention. For "Washing your hands with soap and", GPT-2 gives " water" a probability of 79.5 percent at temperature 1.0. At temperature 0.5 the same token rises to 99.9 percent, and at 1.5 it falls to 18.7 percent, while the ten tokens displayed together hold only 24.9 percent; the other three-quarters of the probability is spread across tens of thousands of tokens, most of them individually tiny. A high temperature therefore produces more varied text and also more strange text, because it gives every unlikely token a little more room.

For "The most common cause of death in Canada is", the most probable continuation is " heart" (8.2 percent at temperature 1.0), and " cancer" receives 2.25 percent. Statistics Canada reports that cancer is the leading cause of death in Canada, accounting for 26.2 percent of deaths in 2024, with diseases of the heart second at 17.7 percent (Statistics Canada, January 2026). The model's ranking reflects how often phrases appear in its training text, about 8 million web pages collected before 2019, and the model has no means of consulting vital statistics. For "The vaccine was shown to be", " effective" (37.3 percent) and " safe" (37.2 percent) are nearly tied at temperature 1.0, and " ineffective" receives 1.4 percent, so about one sample in seventy would continue with the opposite claim in the same fluent style. A language model produces true and false sentences by exactly the same mechanism, which is the root of the verification habits taught throughout this course.

Box 2.2 asks the reader to apply the same readings to another prompt in Interactive 2.1.

Each chosen token is appended to the text before the loop starts again. The next subsection describes the limit on how much text a model can take into account at once, its context window.

1.6 The Context Window

The context window is the maximum number of tokens a model can take into account at once. It must hold everything the model works from in a conversation: the developer's instructions, the user's messages, any documents or search results that are added, and the model's own replies. GPT-2 had a context window of 1,024 tokens, roughly two pages of text. Windows have grown enormously since then; Google announced a one-million-token window for its Gemini 1.5 Pro model in February 2024, enough for several long reports at once.

Three practical points follow. First, a model has no memory outside its context window. Within a conversation it "remembers" earlier turns only because the product sends them back with every new message, and memory features that carry information between conversations work by inserting saved notes into later contexts. Second, a long context is not used evenly. Liu and colleagues (2024) found that models answered questions more accurately when the relevant information appeared near the beginning or end of a long input than when it sat in the middle. Third, whatever is in the context shapes the output, which is why supplying the right documents and a clear request (the subject of Lesson 3) improves answers so much.

Context windows have grown enormously since GPT-2, and so has the size of the models. The next subsection explains why developers built ever larger models.

1.7 Scaling: Why Models Grew

Between 2018 and 2024, developers built language models that were larger by several orders of magnitude, and a 2020 study gave them a quantitative reason. Kaplan and colleagues (2020) trained many transformer language models of different sizes and measured their test loss, which is the average error of their next-token predictions on text they had not seen. Loss fell smoothly and predictably, following a power law, as the number of parameters, the amount of training data and the amount of computation increased, with some trends holding across more than seven orders of magnitude. These scaling laws allowed developers to forecast the benefit of a larger training run before paying for it. Hoffmann and colleagues (2022) later refined the result, showing that for a fixed computing budget many large models had been trained on too little data, and that a smaller model trained on more text could match or outperform them. Training sets grew accordingly; Meta reported in April 2024 that its Llama 3 models had been pretrained on more than 15 trillion tokens.

Table 2.2 sets what scaling laws show beside what they do not show.

Table 2.2. What scaling laws show about language models and what they do not show.

Scaling explains why modern assistants know so much more than GPT-2. It also explains why their errors look different. A small model makes obvious mistakes, while a large model makes fewer errors that are much harder to notice, because the false sentence is as fluent, specific and confident as the true one. Lesson 3 describes this uneven capability as a "jagged frontier" and shows how to map it for your own tasks.

With the parts of the mechanism and the reasons for scale in place, the closing subsection of this section sets out what Jordan takes from them.

1.8 What Jordan Takes Forward

After working through the explorer, Jordan notes that the team's assistant reads tokens, represents them as embeddings, uses attention across its context window and writes by choosing one probable token at a time. Its fluency comes from the scale of its training and says nothing about whether a claim is accurate. The team's model is much larger than GPT-2 and has been trained further to behave as an assistant, which Section 2 describes.

The reflection and knowledge check that follow review these parts of the mechanism.

2.1 Three Stages of Training

GPT-2, the model in Section 1's explorer, is a pretrained model, also called a base model. Given "The most common cause of death in Canada is", it continues the sentence in the way web text tends to continue. It does not answer questions, follow instructions or decline requests, because nothing in its training asked it to. The general-purpose assistants that students and public health teams use in 2026 begin as base models of the same kind, much larger, and then pass through further stages of training that change how they behave. Figure 2.4 shows the usual sequence, and the rest of this section explains each stage and what it adds.

The first of these stages, pretraining, is the subject of the next subsection.

2.2 Pretraining

Pretraining is the stage described in Section 1: the model reads a very large collection of text and learns to predict each next token. The collection typically combines public web pages, books, scientific articles, reference works and computer code, filtered to remove duplicates and low-quality material. GPT-2 was trained on about 8 million web pages (Radford and colleagues, 2019); current models are trained on trillions of tokens. Pretraining is called self-supervised because the text supplies its own answers: every next token is a correct label, so no person needs to label anything. It is by far the most expensive stage, and it is where the model acquires almost all of its knowledge of language, facts, styles and code.

It helps to be precise about what the model learns. It does not store the training documents as a library with titles and page numbers. It stores statistical regularities in its weights, so that a frequently repeated fact (that the heart pumps blood, that the World Health Organization is based in Geneva) becomes a highly probable continuation, and a fact that appeared only a few times in training becomes a weaker and less reliable one. The model keeps no record of where a pattern came from, so it cannot reliably say which source taught it a fact. And it learns nothing about events after its training data were collected.

A base model is a powerful text continuer and an awkward assistant. Given a question, it may answer it, or it may continue with more questions, as though it were completing a worksheet or a discussion forum. The tabs below show the difference that the later stages make, using one request.

Pretraining gives the model almost all of its knowledge and leaves it an awkward assistant. The next subsection describes the first of the later stages, instruction tuning.

2.3 Instruction Tuning

Instruction tuning, also called supervised fine-tuning, continues training on a much smaller set of examples, each consisting of a request and a high-quality response written or edited by people. The training method is the same next-token prediction, applied now to conversations, so the model learns that text following a request should be a helpful reply to it. Conversations are marked with special tokens that label who is speaking (the system, the user or the assistant), which is how the model tells instructions from its own previous answers. Instruction tuning teaches format and behaviour; the knowledge the model draws on still comes almost entirely from pretraining.

Instruction tuning relies on responses written or edited by people. The next subsection describes a method built on comparisons between responses, reinforcement learning from human feedback.

2.4 Reinforcement Learning from Human Feedback

Written examples can show a model what a good answer looks like, and they are slow and expensive to produce. People find it much easier to compare two answers than to write one. Reinforcement learning from human feedback (RLHF), developed from earlier work by Christiano and colleagues (2017), uses this fact. Ouyang and colleagues (2022) described the procedure that OpenAI used to produce its InstructGPT models, the direct predecessors of ChatGPT, in three steps.

Table 2.3 sets out the three steps and what each produces.

Table 2.3. The three steps of reinforcement learning from human feedback described by Ouyang and colleagues (2022), with what each step produces.

The results showed how much this training changes behaviour. In the evaluations reported by Ouyang and colleagues (2022), labellers preferred the outputs of a 1.3-billion-parameter InstructGPT model to those of the 175-billion-parameter GPT-3, a model more than 100 times larger, and the InstructGPT models produced fewer fabricated statements and less toxic text. Later methods reach similar ends by other routes; for example, direct preference optimization trains the model on pairs of preferred and rejected responses without a separate reward model (Rafailov and colleagues, 2023).

Preference training has a side effect that matters for every user. A model trained to produce responses that people rate highly also learns whatever people tend to rate highly, and people tend to rate agreement, praise and confident answers favourably. Sharma and colleagues (2023) found that assistants trained in this way often agree with a user's stated view, change a correct answer when the user pushes back, and give feedback that flatters the user's work. This tendency, called sycophancy, follows directly from the training method. Lesson 3 includes it among the errors to check for, and Lesson 7 teaches countermeasures.

Ratings from people are one source of feedback for preference training. The next subsection describes an approach in which the main human input is a written list of principles.

2.5 Training Against Written Principles

Human ratings have limits of their own. They are costly, raters disagree, and asking people to read large amounts of harmful content in order to rate it is undesirable. Bai and colleagues (2022) at Anthropic described an alternative called constitutional AI, in which the main human input is a written list of principles, the "constitution". Training has two phases. In the first, the model drafts responses to difficult prompts, critiques its own drafts against principles drawn from the list, and revises them, and it is then fine-tuned on the revised responses. In the second, the model compares pairs of responses against the principles to produce preference labels, a preference model is trained on those labels, and reinforcement learning proceeds as in RLHF. Because the feedback comes from a model, this second phase is called reinforcement learning from AI feedback.

The approach has two practical attractions. It reduces the amount of human labelling, and it makes the intended behaviour legible, because anyone can read the principles and compare the model's behaviour with them. Bai and colleagues aimed for an assistant that was harmless without being evasive, one that explains its objection to a harmful request in place of refusing without explanation. In practice, developers combine several methods, including human ratings, written principles and targeted training data, and they publish varying amounts of detail about them.

These methods all act on the model's weights during training. The next subsection turns to the instructions that a product adds at the start of each conversation, the system prompt.

2.6 The System Prompt

Training fixes a model's weights. Every product built on a model then adds instructions at the start of each conversation, before the user types anything. These instructions are the system prompt. A system prompt typically sets the assistant's role, its rules, the tools it may use, the format of its answers and the current date. The model reads the system prompt as text in its context window, in the same way that it reads the user's message, and its training has taught it to give these instructions priority. Box 2.3 is a system prompt for the Cedar Valley team's assistant, written for this lesson.

Three properties of system prompts are worth knowing. A system prompt changes behaviour only for the conversation in which it appears, so it cannot add knowledge that the model lacks, and anything it does not say is left to the model's training. A system prompt is an instruction to a statistical model, so the model usually follows it and occasionally does not. The pilot's privacy rule is therefore enforced by the team's own practice as well as by the prompt. And users can add instructions of their own, through settings such as custom instructions or project instructions, which the product places in the context alongside the developer's. Lesson 3 shows how to use these settings well. Table 2.4 summarizes the layers that shape an assistant's answer.

Table 2.4. Layers that shape an assistant's answer.

Only the first two change the model itself.

Because several of these layers can differ from one conversation to the next, they are one reason that the same prompt can return different answers. The next subsection sets out this and the other reasons.

2.7 Why the Same Prompt Can Return Different Answers

Students who ask an assistant the same question twice are often surprised to receive two different answers. Several mechanisms contribute, and the accordion below sets them out.

Variation has a practical use. If two runs of the same factual question give different answers, the model's probabilities are spread across alternatives and at least one of the answers is likely to be wrong. For tasks that matter, it is worth running the prompt more than once, comparing the results and recording the prompt and the output in an AI use log, a practice that Lesson 3 describes.

Variation between runs is one limit on what a single answer shows. The next subsection describes another, the date at which the text used to train a model ends.

2.8 The Training Cut-Off Date

Every model has a training cut-off, the date after which no text was collected for its pretraining. The model knows nothing about later events unless they are supplied in its context, through web search, uploaded documents or retrieval. Models are usually released some months after their cut-off and then used for a year or more, so the gap between what a model knows and the present grows throughout its working life. Models are also often uncertain about their own cut-off, because the last months before it are thinly represented in the training text.

Public health facts change in exactly the way that exposes this gap. Statistics Canada's release of 2022 mortality data (November 2023) listed COVID-19 as the third leading cause of death in Canada, after cancer and heart disease. Its release of 2024 data (January 2026) reported that COVID-19 had fallen from sixth place in 2023 to ninth in 2024, with accidents in third place. A model whose training text ended before 2026 can state the older ranking fluently and confidently, and it will be wrong about the present. Section 3 uses this example in the lesson's worked demonstration.

The training cut-off is one of several reasons why fluent text can be wrong, and the next subsection draws these reasons together.

2.9 Why Fluent, Confident Text Can Still Be Wrong

The training process explains why an assistant's fluency and confidence are poor guides to its accuracy. Pretraining rewards the model for predicting the text that people wrote, and that text contains no labels marking which statements are true. Frequently repeated facts become highly probable and are usually right. Rare facts, such as the sample size of a particular trial, a specific statistic or the exact title of a paper, cannot be reconstructed from general patterns, so the model produces something with the right form and an unreliable content. Kalai and colleagues (2025) argued that later training and the way models are evaluated make the problem worse: when a test scores only correct answers, a model that guesses earns a higher score than one that admits uncertainty, in the same way that a student gains by guessing on a multiple-choice test with no penalty for wrong answers.

The confidence of an answer is a feature of its writing style. Assistants learn a clear and assured tone from their training text and from preference ratings, and they apply it to everything they write. A fabricated reference, an outdated ranking and a correct definition can therefore arrive in identical prose. HSCI 241 Lesson 6 documents how often chatbots fabricated references in studies published in 2023, and Lesson 5 of this course teaches a four-step citation check. The general rule that follows from the mechanism is that the effort spent checking a claim should depend on what kind of claim it is.

Box 2.4 sets out where the mechanism predicts that language models are strongest and weakest, and Box 2.5 applies the mechanisms of this section to three outputs that Jordan sees in one week.

The closing subsection of this section sets out what Jordan takes from these mechanisms.

2.10 What Jordan Takes Forward

Jordan now understands that the team's assistant is a pretrained model taught to follow instructions, shaped by ratings and principles, and configured with a system prompt for the pilot. Its knowledge stops at its cut-off, its answers vary from run to run, and its tone is equally confident whether a claim is right or wrong. Section 3 describes the remedies that developers have built into assistants, including reasoning, retrieval and tools, and uses Lewis, the series tutor, to show how a retrieval system works from the inside.

The reflection and knowledge check that follow review how training shapes an assistant's behaviour and its errors.

3.1 Chain-of-Thought Prompting

This section describes the remedies that developers have built around the core model, starting with one that needs nothing more than the model itself. Wei and colleagues (2022) showed that large language models solved arithmetic word problems and other multi-step reasoning tasks much more accurately when the examples in the prompt included the intermediate steps of the reasoning, which they called a chain of thought. The improvement appeared mainly in the largest models they tested. Kojima and colleagues (2022) then found that simply adding "Let's think step by step" to a question produced a similar, smaller benefit without any examples.

The mechanism from Section 1 explains why this works. The model produces each token with a fixed amount of computation, so a question whose answer requires several dependent steps is hard to answer correctly in a single token. When the model writes the steps out, each intermediate result becomes part of the context, and every later token can draw on it, much as a person uses scratch paper. Worked Example 2.1 uses hypothetical numbers.

Written reasoning has an important limit. Turpin and colleagues (2023) showed that models' step-by-step explanations do not always reflect what actually drove their answers: when the examples in a prompt were biased toward a particular option, models chose that option and then wrote plausible reasoning that never mentioned the bias. A chain of thought is a useful display of steps that a reader can check, and it should not be treated as a faithful record of the model's computation.

Chain-of-thought prompting asks for written steps in the prompt. The next subsection describes models trained to produce such reasoning before they answer.

3.2 Reasoning Models

On 12 September 2024, OpenAI released a preview of o1, a series of models that it described as designed to "spend more time thinking before they respond". These reasoning models are trained with reinforcement learning to produce a long chain of reasoning before they give a final answer, so the step-by-step behaviour that users once requested in the prompt is now built into the model's training. In January 2025, DeepSeek released DeepSeek-R1, a reasoning model whose weights were published openly together with a description of how reinforcement learning was used to train it. Other developers released reasoning models or reasoning modes during 2025, and many assistants in 2026 let the user, or the product itself, choose how much reasoning effort to spend on a request.

Table 2.5 compares a standard reply with a reasoning model or mode on how each answers, the tasks each suits, its cost and the errors it leaves in place.

Table 2.5. A standard reply compared with a reasoning model or mode.

The developers of the first reasoning models reported their largest gains on tasks with checkable answers, such as competition mathematics, programming and science questions. For a public health student, this means that a reasoning mode is worth choosing for a calculation, a study design problem or a piece of code, and that it does not remove the need to verify the facts and sources in its answer.

Reasoning leaves errors in recalled facts in place. The next subsection describes the most direct remedy for unreliable recall, retrieval-augmented generation.

3.3 Retrieval-Augmented Generation

The most direct remedy for unreliable recall is to give the model the relevant text. Retrieval-augmented generation (RAG), described by Lewis and colleagues (2020), combines a language model with a retrieval system that searches a collection of documents. In their version, a retriever found relevant passages in Wikipedia and a generator wrote the answer conditioned on those passages, which improved accuracy on knowledge-intensive questions and allowed the model's knowledge to be updated by changing the documents instead of retraining the model. Almost every assistant that answers from documents, from enterprise search tools to the series tutor, follows the same four steps (Figure 2.5).

Retrieval comes in two main forms. Keyword retrieval scores passages by the words they share with the question; the standard method, BM25 (Robertson and Zaragoza, 2009), gives more weight to words that are rare across the collection, gives diminishing credit for repeated words and adjusts for passage length. Embedding retrieval, also called dense retrieval, converts the question and every passage into embeddings (Section 1) and returns the passages whose embeddings are closest, which finds passages that express the same idea in different words. Many systems combine the two.

RAG changes three things. Answers can draw on current, specific or local documents that the model never saw in training, each claim can be linked to a passage that a reader can open, and fabrication falls because the model is copying and summarizing more than recalling. RAG also leaves three problems in place. Retrieval can miss the passage that holds the answer, or return a passage that matches the words of the question without answering it. The model can misstate a passage, merge two passages into a claim that neither makes, or add material from its own training. And the answer can be no better than the documents searched. HSCI 241 Lesson 6 works through what these problems mean for evidence reviews.

The next subsection works through these steps in a retrieval-augmented system available on every lesson page of this series, Lewis.

3.4 Worked Example: How Lewis Works

Every lesson page in this series has a "Get Help" button in the bottom-right corner that opens Lewis, the series' virtual research assistant. Lewis is a retrieval-augmented system, and its design shows each step of Figure 2.5 in a tool you can use while you read.

Figure 2.6 shows how Lewis answers a question, and the paragraphs that follow describe its index, retrieval, generation, scope guardrails and fallback in turn.

The index. Before Lewis can answer, the text of every lesson in the series is divided into passages. The reading text of each section is split at its main headings into passages of roughly 120 to 300 words, and the index also holds the flip cards, the slide narration, the glossary, the lesson objectives, the key takeaways and the podcast transcripts. The options, answer keys and explanations of the knowledge checks and the model answers to reflections are left out, so that Lewis can recognize a pasted question and offer a hint without being able to give the answer.

Retrieval. When a student asks a question, Lewis ranks the passages of every lesson with BM25 keyword scoring, light stemming (so that "vaccinate" and "vaccination" can match) and matching that tolerates one typing error. Passages from the lesson the student is reading receive a boost, and passages from the section being read receive a larger one. Passages from the lesson that best matches the question overall, and passages that contain pairs of words from the question in the same order, are also boosted. If even the best match is weak, Lewis gives a fixed reply saying that the course materials do not cover the question, and no answer is generated.

Generation. The best passages, up to four and about 1,700 tokens in total, are placed in the prompt for a small open-weight model from the Qwen3.5 family, which runs inside the student's browser through the WebLLM library and the browser's WebGPU interface to the graphics processor. An open-weight model is one whose trained weights are published, so that anyone can download and run it. Students can choose a Light (0.8 billion parameters), Standard (2 billion) or Stronger (4 billion) version, each stored with 4-bit numbers to shrink the download. Lewis's system prompt instructs the model to answer only from the passages, to cite them as [1] and [2], and to give hints in place of answers to knowledge-check questions. Each citation becomes a button that opens the cited section and highlights the passage, and a passage from another lesson opens that lesson in a new tab.

Scope guardrails. Several layers keep Lewis on the course material. Each message is first checked against written patterns, and messages in defined categories receive fixed replies that the model never sees: messages that suggest a crisis receive the 9-8-8 and 9-1-1 numbers and SFU's support contacts; personal matters, attempts to change Lewis's role or reveal its instructions, unrelated requests (poems or jokes, for example) and questions about course arrangements each receive their own fixed reply. Next comes the weak-match rule described above. Before each answer, the model is asked a short yes or no question about whether the message concerns the course material, and a "no" produces the fixed out-of-scope reply. Guarded messages are left out of the conversation history that the model sees later.

Fallback. Browsers without WebGPU, and devices on which the model fails to load, receive a search-only mode that lists the matching passages with links. Because no server is involved, the questions and answers stay in the student's browser; the only network traffic for the model is a one-time download of the library and the model weights.

Table 2.6 sets each step of retrieval-augmented generation beside how Lewis carries it out, what can go wrong and the check that applies.

Table 2.6. The steps of retrieval-augmented generation as Lewis carries them out, with what can go wrong at each step and the check that applies.

Lewis's design trades size for privacy and cost. A 2-billion-parameter model running on a laptop is far less capable than the models behind commercial assistants, so retrieval and citations do much of the work, and the series' documentation states that small models can still misstate or over-combine a passage. The citation buttons let a student check every answer against the lesson text in one click. Lesson 4 returns to Lewis as a study tool.

Box 2.6 asks the reader to predict which part of Lewis's design determines its response to three messages.

Lewis retrieves passages from one collection of lesson text. The next subsection turns to the wider set of tools that general-purpose assistants can call.

3.5 Tools: Search, Code, Documents, Images and Audio

Retrieval is one example of a broader design called tool use. The model is told in its system prompt which tools are available, and when it needs one it writes a structured request in place of ordinary text; the product runs the tool and places the result in the context window, and the model continues writing. Most general-purpose assistants available in 2026, such as ChatGPT, Claude, Gemini and Microsoft Copilot, can search the web and read uploaded files, and several can run code.

The four cards that follow describe these tools in turn: web search, code execution, documents, and images and audio.

Each tool replaces a weak point of next-token prediction with a better-suited process: search replaces recall of recent facts, code replaces mental arithmetic, and documents replace memory of a specific text. Each also adds a new place where errors can enter, so the check shifts to whether the tool found the right source and whether the model reported it correctly.

The next subsection shows one of these tools, web search, at work on a single factual question.

3.6 Worked Demonstration: Search Off and Search On

This subsection brings the mechanisms of Sections 1 and 2 and the remedies of this section together in one worked demonstration. Box 2.7 presents a question about the leading causes of death in Canada, asked with web search turned off and then on, together with the two outputs and Jordan's commentary.

Table 2.7 traces each claim in the two outputs to what the source shows.

Table 2.7. Claims in Output A (search off) and Output B (search on) checked against the source.

Each claim in the two outputs traced to Statistics Canada's release "Deaths, 2024" (13 January 2026) and, for the 2022 ranking, to its release of 27 November 2023.

The demonstration shows the general pattern of this section. Web search fixed the problems that come from the training cut-off and from recall without a source, and it replaced them with the characteristic error of retrieval, a real source reported inaccurately. The check was the same in both cases: open the source and find each claim in it. Section 4 extends these ideas to systems that do more than answer, planning and carrying out whole tasks with the tools described here.

The reflection and knowledge check that follow review the remedies described in this section.

4.1 From Answering to Acting

The assistants in Section 3 call a tool when a question needs one and then answer. An AI agent goes further. In an agent, a language model is given a goal, plans how to reach it, calls tools, observes what the tools return and decides on the next step, repeating this cycle until it judges that the task is complete or a limit is reached. The model is the same kind of next-token predictor described in Section 1; what makes the system an agent is the loop around it and the tools it is allowed to use.

The pattern was described by Yao and colleagues (2023) under the name ReAct, short for reasoning and acting. They prompted language models to alternate between a written thought, an action (such as a search of Wikipedia) and the observation that the action returned. On question-answering and fact-checking tasks, grounding each step in retrieved results reduced fabrication compared with reasoning alone, and on interactive tasks, including a text-based game and a simulated online shopping site, the approach outperformed the comparison methods. Current agents use the same cycle with more capable models and many more tools.

Figure 2.7 shows this cycle as a loop, with a checkpoint that stops it for human approval before any action that would be hard to undo.

A short trace makes the loop concrete. Suppose Jordan, the co-op student on the fictional Cedar Valley population health team, gives an agent with web search the goal "Find Statistics Canada's most recent release on deaths and report the three leading causes with their shares." The trace in Table 2.8 is illustrative and written for this lesson; real traces are usually longer.

Table 2.8. An illustrative agent trace for finding the leading causes of death in Statistics Canada's most recent release on deaths.

Each observation enters the context window and shapes the next thought, which is both the strength of the design and its weakness. The agent can correct its course when a search returns nothing useful, and it can also be led astray by whatever text a tool returns, a problem that Subsection 4.4 takes up.

The next subsection asks when a task needs the freedom of this loop, by contrasting fixed workflows with agents.

4.2 Workflows and Agents

Not every system that chains a model to tools needs the freedom of an agent. In guidance published in December 2024, Anthropic distinguished workflows, in which models and tools follow paths fixed in advance by the developer, from agents, in which the model itself directs the process and chooses which tools to use, and it recommended starting with the simplest design that does the job. The difference matters for anyone deciding how to use AI in a team, because the two designs fail in different ways.

Two examples from the Cedar Valley team show the contrast. A weekly media scan could run as a workflow: every Monday the system searches the news for five fixed terms related to the Connector program, summarizes each article with the same prompt, and places the summaries in a draft digest that the team's epidemiologist reviews. A request such as "Find out what other Canadian health authorities have published about social prescribing for older adults and summarize their approaches" suits an agent, because nobody can specify in advance which searches to run, which documents to read or when enough has been found.

Table 2.9 compares the two designs on who decides the steps, the tasks each suits, predictability and testing, cost and time, and typical failure.

Table 2.9. Fixed workflows and open-ended agents compared.

The next subsection describes the forms of agent that moved from research demonstrations into widely available products between late 2024 and 2026.

4.3 Forms of Agent in Use in 2026

Agents moved from research demonstrations into widely available products between late 2024 and 2026. The tabs below describe four forms that a public health student is likely to meet, with examples available in 2026. Product names and features change quickly, so the categories matter more than the names.

The four forms share the loop of Figure 2.7 and differ in their tools. That shared structure gives a short set of questions to ask of any agent: what tools and data it can reach, which of its actions can be undone, where a person reviews its work, and what record it keeps of what it did.

The next subsection describes a risk that grows with the tools and data an agent can reach, prompt injection.

4.4 Prompt Injection

Section 2 explained that a language model reads its system prompt, the user's message and any retrieved text as one sequence of tokens. The model has no reliable way to tell an instruction from its user apart from an instruction that happens to appear inside a web page, an email or a document it has been asked to read. Prompt injection exploits this. In direct prompt injection, a user types instructions designed to override the system prompt. In indirect prompt injection, an attacker places instructions in content that an AI system will later read, and the system follows them on behalf of someone who never saw them. Greshake and colleagues (2023) demonstrated indirect prompt injection against applications built on language models, including Microsoft's Bing Chat, showing that instructions planted in web pages could make an assistant mislead its user or try to extract information from them.

The risk grows with an agent's reach. A chatbot that can only write text can be tricked into writing misleading text; an agent that can read private files and send email can be tricked into sending those files elsewhere. The danger is greatest when one agent combines access to private or confidential data, exposure to content from untrusted sources and the ability to send information out. The OWASP Top 10 for Large Language Model Applications (2025), a widely used security reference, lists prompt injection as its first risk. OpenAI's announcement of ChatGPT agent described the same threat, warning that hidden instructions on a web page could lead an agent to share data from connected apps, and stated that its training, monitoring and confirmation steps reduce the risk without removing it.

Box 2.8 applies these points to an agent design that the Cedar Valley team considers.

Researchers and developers continue to work on defences, including training models to treat retrieved text as data, separating the model that reads untrusted content from the model that can take actions, monitoring for suspicious behaviour and requiring confirmation before sensitive actions. None of these defences is complete in 2026, so the practical protections are design choices: give an agent only the access its task needs, keep confidential data out of its reach, and put a person between the agent and any consequential action.

The next subsection describes where that person's review belongs, at checkpoints defined in advance.

4.5 Human Review at Defined Checkpoints

An agent can take dozens of steps without pausing, and its errors compound: a wrong turn early in a task shapes every later step. Reviewing only the final result misses the actions an agent took along the way, some of which cannot be reversed. Effective oversight therefore places human review at defined checkpoints, chosen in advance, with the amount of review scaled to the consequences of an error. Anthropic's 2024 guidance describes agents that pause for human feedback at checkpoints, and ChatGPT agent asks for permission before consequential actions. Table 2.10 sets out a general scheme.

Table 2.10. Checkpoints for human review of an agent's work.

The examples are fictional.

The three items that follow set out questions to ask before letting an agent act, explain why the person who sets a task stays accountable, and show how oversight is matched to the stakes.

The final subsection of this section draws the four sections of the lesson together.

4.6 From Mechanism to Practice

The four sections of this lesson form one account. A language model represents text as tokens and embeddings and writes by choosing one probable token at a time (Section 1). Training turns that predictor into an assistant with a helpful manner and a cut-off date, and fluency and confidence are part of the manner (Section 2). Reasoning, retrieval and tools add steps that supply what next-token prediction lacks, and each adds its own characteristic error (Section 3). Agents wrap all of this in a loop that can act in the world, which makes checkpoints and limited access essential (this section).

This account predicts where the tools will help and where they need checking, and it will stay useful as products change, because new products are built from the same parts. A good way to keep learning is to watch the parts at work. Open the explorer in Section 1 again and try each prompt at each temperature. Ask your own assistant a factual question with search off and then on, and trace each claim as Jordan did. When you next use Lewis, click every citation. Lesson 3 builds on this foundation with the craft of prompting, supplying context and verifying output.

Box 2.9 gathers this account by task, and Table 2.11 within it sets out how AI performs on each kind of task and the check that applies.

The reflection and knowledge check that follow review the ideas of this section.

Bringing It All Together

This lesson explained, from the mechanism up, how the AI tools that students and public health teams use every day produce their output. A large language model divides text into tokens, represents each token as an embedding, uses attention across its context window and writes by estimating a probability for every possible next token and choosing one. Real probabilities from GPT-2 small showed that this process produces fluent text in the same way whether a claim is true or false, and that temperature controls how much chance enters each choice.

Training turns a pretrained model into an assistant: instruction tuning teaches it to answer requests, and preference training with human ratings or written principles shapes its manner, including an assured tone and a tendency toward agreement. A system prompt configures each product, and the training cut-off limits what any model knows. Reasoning models, retrieval-augmented generation and tools such as web search and code execution supply what next-token prediction lacks, and each brings a characteristic error of its own. Lewis, the series tutor, showed these parts working together in a tool you can open on every page, and the search off and search on comparison showed how to trace each claim to its source.

Agents place the model in a loop that plans, acts and observes, which makes them capable of whole tasks and exposes them to prompt injection. Fixed workflows, limited access and human review at defined checkpoints make their use dependable. The same account will explain new products as they appear, because they are built from these parts.

The final reflection asks you to apply the lesson's account of how these tools work to a task of your own choosing.

Final Knowledge Assessment

Definitions of the terms, methods and people introduced in this lesson on how large language models and AI agents work.