LLMs in depth: transformers, training, inference and agents explained

A large language model (LLM) is a neural network, almost always a transformer, trained on huge amounts of text to predict the next token in a sequence. Everything an LLM does, from answering a question to writing code or calling a tool, comes from repeating that one prediction step, shaped by post-training that teaches it to follow instructions.

This post is the in-depth technical guide and the hub of a four-part series: how LLMs are built and run end to end, which families exist as of 2 November 2026, and how to secure them. For the short version, read our primer on what a large language model is and where it fails.

Key takeaways

• An LLM predicts one token at a time. Tokens are subword pieces, and the same sentence costs a different number of tokens in different languages and tokenizers.
• Every modern LLM is built on self-attention from the 2017 transformer. Decoder-only models stack dozens of identical attention and feed-forward blocks.
• Context length is paid for in memory: the KV cache grows with every token, and you can estimate it from five numbers in the model config.
• Pretraining teaches language and knowledge; post-training (SFT, RLHF, RLAIF, DPO) teaches instruction following. Reasoning models spend extra tokens thinking first.
• Agents are LLMs in a loop with tools. Function calling and MCP standardize that loop and turn prompt injection into a real security problem.
• Treat model files as code. Pickle checkpoints can run code when loaded; prefer safetensors or GGUF, pin revisions, keep an AI-BOM and read the licence.

This series

1. LLMs explained (this post): how large language models work, and how the other three families relate to them.
2. Small language models explained: distillation, quantization, on-device AI and security (publishes Thursday 5 November).
3. Vision language models explained: image encoders, document AI, GUI agents and security (publishes Friday 6 November).
4. Audio language models explained: speech encoders, audio tokens, voice agents and security (publishes Saturday 7 November).

What an LLM is, and how SLMs, VLMs and ALMs relate

A language model assigns a probability to every possible next token. Pick one, append it and ask again; repeat and you have a paragraph. "Large" means billions of parameters trained on trillions of tokens, the scale at which one model handles translation, extraction and code, because each is "continue this text" once the task is in the prompt.

The catch is that instructions, user data, documents and tool results all enter the model the same way, as tokens. That is the root of most LLM security problems.

The lines blur. Anthropic's and OpenAI's model pages state that their current models take text and image input, and Google's Gemma 4 page describes a 12B model that projects vision and audio inputs directly instead of using separate encoders. In 2026, "LLM" means a transformer whose main interface is text, not a text-only model.

Tokenization: how text becomes numbers

A tokenizer splits text into pieces from a fixed vocabulary and maps each to an integer ID.

• Byte pair encoding (BPE). Sennrich and colleagues (2015) handled rare words by "encoding rare and unknown words as sequences of subword units". Training starts from characters or bytes and repeatedly merges the most frequent adjacent pair until the vocabulary reaches its target size. Common words become one token; rare words split.
• SentencePiece. Kudo and Richardson (2018) built a "language independent subword tokenizer" that trains directly on raw sentences, treating whitespace as an ordinary symbol, which suits languages that do not separate words with spaces.

Meta's llama-models repository lists SentencePiece for Llama 2 and a "TikToken-based" tokenizer for Llama 3 and Llama 4, so even one family changes tokenizers between generations.

Why token counts differ. The vocabulary is learned from a training mix. Text that resembles the mix compresses well; text that does not splits into many tokens. Languages underrepresented in that mix cost more tokens per word, code depends on how whitespace and symbols are handled, and numbers often split into several pieces. A "1M token" window on one model is not the same amount of text on another. Count with the model's own tokenizer or token-counting endpoint, never with word counts. Billing is covered in what a token is and why LLM bills count them.

Security note. The tokenizer files and chat template ship with the model. A modified chat template changes how system, user and tool messages are wrapped, and so how the model separates instructions from data. Verify them as part of the model artifact.

Embeddings and positional information

Each token ID selects a row of a learned embedding matrix, a vector of a few thousand numbers. Attention has no built-in sense of order, so position must be added. Most current open-weight LLMs use rotary position embedding (RoPE) from the 2021 RoFormer paper, which "encodes the absolute position with a rotation matrix" while making attention depend on the relative distance between tokens. A stated context window is a ceiling, not a guarantee that the model uses information deep inside it. Our post on the human brain vs LLM context window goes further.

Self-attention and multi-head attention

Attention lets each token weigh every earlier token. Each token produces a query (what it looks for), a key (what it contains) and a value (what it passes on).

Attention(Q, K, V) = softmax( Q · Kᵀ / sqrt(d_k) ) · V
d_k: key dimension; in a decoder, scores for future positions are masked out

Vaswani and colleagues introduced the transformer in 2017 as a model "based solely on attention mechanisms, dispensing with recurrence and convolutions entirely", which made training far more parallel. Multi-head attention runs several attention operations with different learned projections and concatenates them, so heads can specialize.

Two refinements matter for cost. Grouped-query attention (GQA) shares key and value heads across groups of query heads; Ainslie and colleagues (2023) report quality close to full multi-head attention with speed comparable to multi-query attention, which uses "a single key-value head". Fewer KV heads means a smaller KV cache. FlashAttention (Dao and colleagues, 2022) computes exact attention in tiles so it reads and writes GPU high bandwidth memory less often; it changes speed and memory, not the result.

The decoder-only transformer block

Generative LLMs keep only the decoder side of the original transformer. One block normalizes its input, applies causal self-attention (each token sees only itself and earlier tokens), adds the result back through a residual connection, normalizes again, applies a feed-forward network to each token, and adds that back too. Stack dozens of blocks, add an embedding layer below and a projection to vocabulary size above, and the final layer produces one score (logit) per vocabulary entry. In a dense model, most parameters sit in the feed-forward layers. Microsoft's phi-4 card is a concrete reference: "14B parameters, dense decoder-only Transformer model", 16K token context, 9.8T training tokens.

Context windows and the KV cache

During generation the model caches each token's keys and values so it never recomputes them. That KV cache is why long contexts are expensive, and you can estimate it from the model config:

KV bytes per token    = 2 (K and V) × layers × kv_heads × head_dim × bytes_per_value
KV bytes per sequence = KV bytes per token × tokens in the window
KV bytes for serving  = KV bytes per sequence × concurrent sequences

Worked example (illustrative config). 32 layers, 8 KV heads, head dimension 128, cache in BF16 (2 bytes):

• Per token: 2 × 32 × 8 × 128 × 2 = 131,072 bytes, or 128 KiB.
• One 32,768 token conversation: 4 GiB.
• Sixteen such conversations at once: 64 GiB, on top of the weights.
• With full multi-head attention (32 KV heads), four times as much: 512 KiB per token.

Weights are the other half: parameters times bytes per parameter. The phi-4 repository on Hugging Face lists 14,659,507,200 BF16 parameters and 29,319,063,356 bytes of files, exactly 2 bytes per parameter. At 4 bits the same weights take roughly a quarter of that, plus overhead for scales.

For frontier-scale numbers, see how many GPUs a 1 trillion parameter model needs.

Mixture of experts

A mixture of experts (MoE) model replaces some feed-forward layers with many experts and a router that sends each token to a few of them. Shazeer and colleagues (2017) reported "greater than 1000x improvements in model capacity with only minor losses in computational efficiency"; the Switch Transformer (2021) simplified routing to one expert per token and tackled the "complexity, communication costs and training instability" that had held MoE back.

Model cards now give total and active parameters. DeepSeek-V3 has "671B total parameters with 37B activated for each token". OpenAI's gpt-oss-120b lists "117B parameters with 5.1B active parameters". Qwen3 names models 30B-A3B and 235B-A22B, and Meta names Llama 4 Scout-17B-16E and Maverick-17B-128E. Compute per token tracks active parameters, but memory tracks the total, because every expert must be loaded. MoE makes tokens cheaper, not models smaller. See cheapest LLM inference for the cost side.

Pretraining: next-token prediction at scale

Pretraining is self-supervised: cut a huge corpus into sequences and train the model to predict each next token, scored by cross-entropy loss. The corpus is the product. Meta's Llama 4 card describes "a mix of publicly available, licensed data and information from Meta's products and services", about 22T tokens for Maverick and an August 2024 knowledge cutoff.

Scaling laws. Kaplan and colleagues (2020) found loss "scales as a power-law with model size, dataset size, and the amount of compute", with some trends spanning more than seven orders of magnitude. The Chinchilla paper (Hoffmann and colleagues, 2022) trained over 400 models and concluded that large models were "significantly undertrained": for compute-optimal training, "the model size and the number of training tokens should be scaled equally". Their 70B Chinchilla, using Gopher's compute budget with four times the data, outperformed the 280B Gopher. Many teams now deliberately overtrain smaller models because they are cheaper to serve for life, which leads to Thursday's SLM post.

Post-training: SFT, RLHF, RLAIF and DPO

• Supervised fine-tuning (SFT) trains on example conversations, teaching format and the habit of answering.
• RLHF. The InstructGPT paper (2022) fine-tuned GPT-3 on labeler demonstrations, trained a reward model on labeler rankings of outputs, then optimized the model against it with reinforcement learning. Outputs from the 1.3B InstructGPT model were preferred to those of the 175B GPT-3, "despite having 100x fewer parameters".
• RLAIF and Constitutional AI. Anthropic's 2022 paper trained a harmless assistant "without any human labels identifying harmful outputs". A written list of principles guides self-critique and revision, and an AI model's preferences between samples replace human rankings in the reinforcement learning phase.
• Direct preference optimization (DPO). Rafailov and colleagues (2023) called RLHF "a complex and often unstable procedure" and optimized the same preference objective with a simple classification-style loss, with no separate reward model. OpenAI's fine-tuning docs list DPO as a method, and the phi-4 card says it used "both supervised fine-tuning and direct preference optimization".

Whether to fine-tune at all is a separate decision, covered in when to fine-tune an LLM or just prompt. Post-training is where refusals and instruction hierarchy are taught. It is learned behaviour, not a hard boundary, and further fine-tuning can change it.

Reasoning models: test-time compute

A reasoning model generates extra tokens to work through a problem before answering. The idea grew from chain-of-thought prompting, where Wei and colleagues (2022) showed that "a series of intermediate reasoning steps" improved large models on arithmetic, commonsense and symbolic tasks. From the vendors' own docs:

• OpenAI says reasoning models "use internal reasoning tokens before producing a response"; you set a reasoning effort, and although reasoning tokens are not visible through the API, they "still occupy space in the model's context window and are billed as output tokens".
• Anthropic's models overview lists "Adaptive (always on)" thinking for Claude Fable 5.1 and Claude Opus 5.5 and "Adaptive" thinking for Sonnet 5.5 and Haiku 5.5, each with a default effort. Its extended thinking page marks the fixed budget_tokens mode as deprecated and says Claude 4.7 and later models do not support it.

Expect higher, less predictable latency and cost. The reasoning is still generated text that injected content can steer.

Inference: from probabilities to text

Prefill processes the prompt in parallel and fills the KV cache (compute-bound, sets time to first token). Decode generates one token per step, reading all weights and the cache each time (usually memory-bandwidth-bound, sets tokens per second). How to read those speed numbers is in tokens per second, TTFT and ITL and LLM throughput metrics.

Reasoning models and some hosted APIs restrict these parameters; check the API reference for your model.

Quantization stores weights, and sometimes the KV cache, in 8, 4 or fewer bits. OpenAI's gpt-oss card says MXFP4 quantization of the MoE weights lets gpt-oss-120b "run on a single 80GB GPU" and gpt-oss-20b "run within 16GB of memory". Thursday's post covers GPTQ, AWQ and GGUF k-quants.

Batching, paging and speculation. Continuous batching adds requests to a running batch as others finish. PagedAttention (Kwon and colleagues, 2023) stores the KV cache in fixed-size blocks like virtual memory pages; the paper reports vLLM improves throughput by 2 to 4 times "with the same level of latency" compared with FasterTransformer and Orca. Speculative decoding (Leviathan and colleagues, 2022) lets a small draft model propose tokens that the large model verifies in one pass, "without any changes to the outputs". Google says every Gemma 4 size includes "a dedicated draft model for speculative decoding".

From each project's own docs:

# vLLM quickstart
vllm serve Qwen/Qwen2.5-1.5B-Instruct

# llama.cpp README: OpenAI-compatible API server from a GGUF on Hugging Face
llama serve -hf ggml-org/Qwen3.5-0.8B-GGUF

Both download model files from a hub on first run, which is a supply chain event. For a runtime comparison, see Ollama vs llama.cpp vs vLLM. See fastest LLM inference for latency trade-offs.

Tool use and agents

Function calling. OpenAI's guide describes tool calling as five steps: send a request with tools the model could call, receive a tool call, execute code on your side, send the result back, receive the final answer or more calls. Anthropic distinguishes client tools, which run in your application (Claude returns stop_reason: "tool_use" and you send a tool_result), from server tools such as web search, which Anthropic runs.

{
  "name": "get_package_version",
  "description": "Return the installed version of a package in this repository.",
  "input_schema": {
    "type": "object",
    "properties": {
      "ecosystem": { "type": "string", "enum": ["npm", "pypi", "maven"] },
      "name": { "type": "string" }
    },
    "required": ["ecosystem", "name"]
  }
}

The model never runs anything. It emits a structured request and your code decides whether to honour it. That decision point is the most important control in an agent.

Model Context Protocol (MCP). The specification calls MCP an open protocol for integrating LLM applications with external data sources and tools. It uses JSON-RPC 2.0 between hosts (the LLM application), clients (connectors inside the host) and servers that expose tools, resources and prompts. One install replaces many custom integrations, and every MCP server becomes a dependency to vet.

Agent loops. The model reads the goal, picks a tool, your code runs it, the result returns to the context, and the loop continues until done or stopped. Our live posts cover the hard parts: tool selection for AI agents, multi-agent orchestration, durable execution and zero-day risk in agents, MCP servers and skills.

Evaluation and its limits

Benchmarks are fixed question sets with automatic scoring. They measure the benchmark, not your task. Contamination is the main trap: benchmarks live on the web, training data is scraped from the web, and a model that has seen the test scores on memory. HELM (2022) argued for measuring seven metrics, "accuracy, calibration, robustness, fairness, bias, toxicity, and efficiency", rather than one number. LLM-as-a-judge scales grading of open-ended answers, but Zheng and colleagues (2023) found "position, verbosity, and self-enhancement biases"; swap answer order, use rubrics and spot-check against humans.

Build a small evaluation set from your own tasks, including injection attempts and tool misuse, and rerun it on every change. See AI agent evaluation.

LLM families as of 2 November 2026

Only what each maker states on its own models page, card, repository or licence. No scores, no rankings. Lineups change often; check the link before relying on a row.

"Frontier" here means a lab's most capable models, usually API-only. "Open-weight" means you can download and run the weights under the licence. Open weights are not open source: training data and full training code are rarely published, and licences range from Apache 2.0 to custom terms with use restrictions. OpenAI and Google now ship both kinds.

Securing it

The OWASP Top 10 for LLM Applications (2025) is a useful map: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation and LLM10 Unbounded Consumption. MITRE ATLAS is "a public knowledge base of adversary TTPs targeting AI systems" for threat modelling. NIST's AI Risk Management Framework (released 26 January 2023, voluntary) and its Generative AI Profile, NIST AI 600-1 (published 26 July 2024), give the governance frame. Our OWASP Top 10 for LLM applications guide walks through each item, including LLM03 supply chain and LLM04 data and model poisoning.

Model files are code

The Python docs are blunt: "The pickle module is not secure. Only unpickle data you trust", because malicious pickle data can "execute arbitrary code during unpickling". Many checkpoints use pickle through PyTorch serialization. PyTorch's own source notes: "In PyTorch 2.6, we changed the default value of the weights_only argument in torch.load from False to True", and setting it back "can result in arbitrary code execution".

Safer formats: safetensors, "a new simple format for storing tensors safely (as opposed to pickle)"; GGUF, a binary format "optimized for quick loading and saving of models" for GGML-based executors like llama.cpp, whose metadata (including chat templates) deserves review; and ONNX, an open format for model graphs used for portable inference.

from safetensors.torch import load_file
state = load_file("model.safetensors")

import torch
state = torch.load("model.pt", weights_only=True)  # default since PyTorch 2.6

from huggingface_hub import hf_hub_download
path = hf_hub_download(repo_id="microsoft/phi-4", filename="config.json",
                       revision="<full commit hash you reviewed>")

The Hub client's revision accepts "a specific branch, a PR, a tag or a commit hash"; only a commit hash is reproducible. Our guide to sourcing models from Hugging Face safely has the full checklist.

Poisoned and backdoored weights

A safe file format does not mean safe weights. Conceptually:

• BadNets (2017) showed an outsourced or pre-trained model can perform well on the user's validation data "but behaves badly on specific attacker-chosen inputs", a weakness the paper places in "the Machine Learning Model Supply Chain".
• Sleeper Agents (2024) trained proof-of-concept LLMs to write secure code when the prompt says 2023 and insert exploitable code when it says 2024. The backdoor "can be made persistent, so that it is not removed by standard safety training techniques", and persistence was strongest in the largest models.
• Poisoning web-scale training datasets is practical (2023) showed attacks that exploit web content changing between dataset indexing and download; the authors estimate they could have poisoned 0.01% of LAION-400M or COYO-700M for about 60 US dollars.

Get weights from the original publisher, verify hashes, prefer models with documented training data, test behaviour on your own evaluation set, and keep the ability to swap a model fast. Static file scanning cannot find a learned backdoor.

Provenance and the AI-BOM

An AI bill of materials records which models, datasets and AI components a system uses, from where and under which terms. CycloneDX ML-BOM covers "models, datasets, and their dependencies", including dataset provenance and training methods. The SPDX 3.0 AI profile defines an AIPackage class with properties such as autonomyType, domain, energyConsumption and hyperparameter. Model cards are the human-readable side.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "components": [{
    "type": "machine-learning-model",
    "name": "phi-4",
    "version": "<commit hash>",
    "supplier": { "name": "Microsoft" },
    "licenses": [{ "license": { "id": "MIT" } }],
    "externalReferences": [{ "type": "website", "url": "https://huggingface.co/microsoft/phi-4" }]
  }]
}

Prompt injection and excessive agency

OWASP describes prompt injection as user prompts altering a model's behaviour or output in unintended ways. The harder case is indirect injection: Greshake and colleagues (2023) showed that LLM-integrated applications "blur the line between data and instructions", so whoever controls a web page, email, document, code comment, tool description or MCP server output the model reads can steer it. Friday's and Saturday's posts cover the image and audio versions.

No prompt fully fixes this, so limit the blast radius (the OWASP LLM01 controls that work go deeper):

• Give agents the fewest tools and narrowest permissions that work (LLM06).
• Require human approval for sending, deleting, paying, merging or changing permissions.
• Validate model output before it reaches a shell, query, browser or another agent (LLM05).
• Mark untrusted content as such in the prompt, knowing this lowers risk rather than removing it.
• Log every tool call with its inputs.

The prompt injection defense use case applies these to one support agent.

Data leakage

Users paste secrets and personal data into prompts, models repeat sensitive context, system prompts leak (LLM07), and prompt logs become a new sensitive store. Classify what may enter prompts, redact before the call, check responses on the way out, limit log retention and read the provider's API data terms.

Licence terms

General information, not legal advice. Apache 2.0 grants copyright and patent licences with conditions such as keeping notices and marking changes; its makers apply it to gpt-oss, Qwen3, Gemma 4, Mistral Small 4 and Ministral 3. The Llama 4 Community License (effective 5 April 2025) requires redistributors to include the agreement and "prominently display 'Built with Llama'", and requires a separate licence from Meta above 700 million monthly active users. The Gemma Terms of Use for earlier Gemma releases incorporate a Prohibited Use Policy. DeepSeek-V3 code is MIT while its weights follow the DeepSeek Model License. phi-4 is MIT. Record each licence in the AI-BOM.

Self-hosting versus API

Self-hosting moves risk; it does not remove it. The local or hosted LLM decision guide goes through the choice for developers.

Where Safeguard fits

Safeguard does not train or host your LLMs. It helps you find, check and govern the models, packages and agent connections around them, and all of it is generally available.

• Model file scanning. Safeguard connects to Hugging Face, Kaggle Models, ModelScope and Civitai through read-only integrations, scans the files of the models you select for unsafe serialization formats and embedded code with AI-SPM model file scanning, and records each model in your AI inventory through AI-BOM discovery, with its licence or permissions. The scan is static and does not execute the model, so it cannot detect a learned backdoor. See scan models from Hugging Face, Kaggle, ModelScope and Civitai.
• AI-BOM. AI-BOM discovery inventories AI assets, including AI SDK imports in code and managed AI services, as a CycloneDX ML-BOM and in the SPDX AI profile. See inventory AI models in SageMaker, Vertex AI and Azure AI Foundry.
• AI Gateway. It evaluates prompts, responses and tool calls for direct and indirect prompt injection, jailbreak patterns and sensitive data leaving. Monitor mode is the default; an admin turns on enforce mode per tenant. See govern every LLM call with Safeguard AI Gateway.
• MCP Guardrail and agent identity. MCP Guardrail generates guardrail proxy URLs for MCP servers, and agent identity tracks which agent holds what access, at what level.
• The serving stack. SBOM and dependency scanning of repositories, container images and SBOM files matches the inference, tokenizer and agent framework packages under your LLM service against vulnerability data.
• Gold Open Source (gold.safeguard.sh) is free, needs no login, gives CVE intelligence with affected and fixed versions, and its directory also lists AI models, MCP servers and agent skills. See Gold Open Source explained.
• Model choice. AI mode is set per tenant: Full AI, Zero AI with no LLM in the loop, bring your own model, or local models inside your environment, including air-gapped. Customer code, SBOMs and telemetry are not used to train shared models. See where your code and data go.
• Griffin, Safeguard's security model, is single-purpose: it powers remediation and natural-language search in the product. It is not a general-purpose LLM and is not built for maths or science, where general LLMs lead.

What Safeguard does not do: prove a model behaves safely, replace your own evaluation set, or stop a provider from retiring a model.

Common mistakes

• Loading a checkpoint "just to look". Unpickling is execution. Keep weights_only=True or read safetensors and GGUF headers instead.
• Pinning by name, not commit. "main" moves; record the hash.
• Treating the context window as usable memory. Quality, cost and latency degrade long before the limit.
• Trusting leaderboards over your own tests. Contamination and judge bias are real.
• Broad agent credentials "for now". Excessive agency turns an injection into an incident.
• Assuming open weights means open source. Some licences carry user thresholds and use policies that flow down.
• Forgetting the serving stack, or standardizing on a server whose docs say it is in maintenance mode.

FAQ

What is a large language model in simple terms?

A program trained on huge amounts of text to predict the next word piece in a sequence. Repeating that prediction produces answers, summaries and code, and post-training teaches it to follow instructions.

How do LLMs work step by step?

Text becomes tokens, tokens become vectors, and transformer blocks use self-attention to mix information between them. The last layer scores every possible next token, a sampling rule picks one, and the loop repeats.

What is the difference between an LLM and generative AI?

Generative AI is any model that produces new content, including images, audio and video. An LLM is the text-centred kind, though many now also accept images.

What is the difference between an LLM, an SLM, a VLM and an ALM?

An SLM is smaller and built to run locally. A VLM adds an image encoder for pictures and documents. An ALM adds an audio encoder or codec to understand, and sometimes produce, sound. This series covers each.

What is a token in an LLM?

A piece of text from the model's fixed vocabulary, often part of a word. Token counts vary by language and tokenizer, which affects cost and how much fits in the context window.

Why does a long context window use so much memory?

The KV cache stores a key and a value per token, per layer, per KV head, so memory grows linearly with every token in the window.

Are open-weight LLMs safe to download and run?

With dependency-grade care: prefer safetensors or GGUF, pin the commit, verify hashes, read the licence, record the model in an AI-BOM and test behaviour yourself. File scans cannot detect a trained-in backdoor.

What is prompt injection in LLMs?

Text that makes the model act against the application's intent, often hidden in content the model reads. Limit tools and permissions, require approval for side effects and validate outputs.

What is the Model Context Protocol (MCP)?

An open protocol on JSON-RPC 2.0 that connects LLM applications to servers providing tools, resources and prompts. Each MCP server is a dependency to vet.

Should I self-host an LLM or use an API?

Use an API for frontier capability and low operational effort if the provider's data terms are acceptable. Self-host when data must stay inside, you need air-gapped use, or volume makes owned GPUs cheaper, and accept that you then own the patching.

Model serving stacks, tokenizers, inference servers and agent frameworks are open-source packages, and they get CVEs like any other dependency. A self-hosted LLM is only as patched as the vLLM, llama.cpp bindings, Python packages and base images underneath it.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Griffin, Safeguard's security model, opens a policy gated pull request that moves the affected dependency to the safe version, and your own CI runs your tests on it before anyone merges. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Auto-merge is a separate switch and stays off by default, so your team decides what merges on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Safeguard Gold rebuilds patched versions of open-source packages and images from source, signs each build, attaches an SBOM, SLSA provenance and VEX, and serves them from registry.safeguard.sh to your organization. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The Claude with Safeguard demo shows the MCP pattern from this post. You connect Claude to the Safeguard MCP server with OAuth and choose which tools Claude can use, the "fewest tools" rule applied to a real agent connection.

Click through it at your own pace, or open it full screen.

The CLI demo is a real session: install the CLI, open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, edits package.json to lodash 4.17.21, runs npm install and npm test as you approve each step, prints a summary and pushes nothing. The same flow applies when the vulnerable package is an inference server or tokenizer library.

Click through it at your own pace, or open it full screen.

The local runner demo suits teams that keep model code inside their own network: set up the runner on your machine, approve it with its device code, then scan from the terminal.

Click through it at your own pace, or open it full screen.

To try it on your own stack, download Safeguard or read the CLI docs.

Quick check

Sources

• Attention Is All You Need, arXiv 1706.03762
• Subword units (BPE), arXiv 1508.07909
• SentencePiece, arXiv 1808.06226
• RoFormer (RoPE), arXiv 2104.09864
• GQA, arXiv 2305.13245
• FlashAttention, arXiv 2205.14135
• Sparsely-Gated MoE, arXiv 1701.06538
• Switch Transformers, arXiv 2101.03961
• Scaling Laws, arXiv 2001.08361
• Chinchilla, arXiv 2203.15556
• InstructGPT, arXiv 2203.02155
• Constitutional AI, arXiv 2212.08073
• DPO, arXiv 2305.18290
• Chain-of-Thought, arXiv 2201.11903
• PagedAttention, arXiv 2309.06180
• Speculative Decoding, arXiv 2211.17192
• HELM, arXiv 2211.09110
• LLM-as-a-Judge, arXiv 2306.05685
• BadNets, arXiv 1708.06733
• Sleeper Agents, arXiv 2401.05566
• Poisoning Web-Scale Datasets, arXiv 2302.10149
• Indirect Prompt Injection, arXiv 2302.12173
• OpenAI models
• OpenAI reasoning models
• OpenAI function calling
• gpt-oss-120b model card
• Claude models overview
• Claude extended thinking
• Claude tool use
• Gemini API models
• Gemma 4 overview
• Gemma Terms of Use
• Gemma 4 licence (Apache 2.0)
• Meta llama-models
• Llama 4 Community License
• Llama 4 model card
• Mistral models overview
• Qwen3
• DeepSeek-V3
• DeepSeek API models
• phi-4 model card
• MCP specification
• vLLM docs
• llama.cpp
• Text Generation Inference docs
• Python pickle
• PyTorch serialization source
• safetensors
• GGUF on Hugging Face
• ONNX
• Hugging Face Hub downloads and revisions
• OWASP Top 10 for LLM Applications 2025
• MITRE ATLAS data
• NIST AI RMF
• NIST AI 600-1
• CycloneDX ML-BOM
• SPDX 3.0 AI profile
• Apache License 2.0

Last reviewed: 2 November 2026.