Unit 1: How LLMs work, for defenders · Lesson 1 of 5 · 18 min
Text becomes tokens
Cut text into tokens the way a model does and measure what a prompt costs.
mission
- You are
- You are the new AI security engineer at Fernway Travel.
- Situation
- Fernway runs Fernbot, a support assistant built on a language model. Your first job is to understand what the model actually receives.
- Goal
- Measure the app's prompts in tokens, the unit every limit, bill and attack is counted in.
- Hand in
- The token size of the system prompt and of each help article.
The tokenizer as a type cutting mill
About ttok
You will count tokens with ttok, a small open source command by Simon Willison. It uses tiktoken, the tokenizer library OpenAI publishes for its models. ttok is already installed in this lab. On your own machine, install it with pip install ttok. By default ttok counts for the gpt-5 model, which uses the o200k_base encoding.
Tokenize a customer question
Models read tokens, not words. ttok --tokens prints each piece instead of a count. Short common words are one token; rare words and long numbers are cut into pieces.
ttok --tokens "Where is my booking FW-20417?"
[b'Where', b' is', b' my', b' booking', b' FW', b'-', b'204', b'17', b'?']
you should see Nine pieces. The booking reference splits into FW, -, 204 and 17. Four tokens for one ID.
defender tip b'...' means raw bytes. A space at the start of a piece belongs to that token.
ttok- Counts or shows the tokens a piece of text becomes for OpenAI models, using the tiktoken tokenizer. Install with pip install ttok.
Tokenize rare words
Names and rare words split into pieces. A filter that matches whole words sees text; the model sees tokens.
ttok --tokens "Fernbot handles bereavement fares"
[b'Fern', b'bot', b' handles', b' bere', b'av', b'ement', b' fares']
you should see Fernbot becomes Fern and bot, and bereavement becomes three pieces. Seven tokens for four words.
Measure the system prompt
The system prompt is sent with every request, so its size is paid on every single call. Without --tokens, ttok prints the count. -i reads the text from a file.
ttok -i app/system_prompt.txt
60
you should see 60 tokens.
Count for another model
-m picks the model. gpt-4 uses the older cl100k_base encoding, so the same file has a different size.
ttok -m gpt-4 -i app/system_prompt.txt
61
you should see 61 tokens instead of 60.
defender tip Real tokenizers differ by model. Use the one for your model when you budget prompts.
Measure the knowledge base
Every retrieved article spends tokens from the same budget as the instructions. The loop prints each file name, then its count.
for f in app/docs/*.md; do printf '%-28s' "$f"; ttok -i "$f"; done
app/docs/baggage.md 81
app/docs/changes.md 49
app/docs/documents.md 47
app/docs/loyalty.md 43
app/docs/partner-offers.md 36
app/docs/refunds.md 58
app/docs/supplier-faq.md 71
you should see baggage.md is the largest, with the partner FAQ next.
defender tip When a document is unusually large or unusually placed, read it. Size is a cheap first signal.
printf- Prints formatted text. Built into Linux and macOS.
Compare word forms
The same word can cost a different number of tokens and look different to the model. That is also why exact word filters miss variants.
ttok --tokens "refund Refund REFUND"
[b'refund', b' Refund', b' REF', b'UND']
you should see refund and Refund are one token each. REFUND is cut into REF and UND.
What a defender takes away
- 1Everything a model reads, writes, costs and forgets is measured in tokens.
- 2The system prompt is resent on every call, so keep it short and free of secrets.
- 3Filters that match words do not see what the model sees.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.