CHAPTER 1: UNDERSTANDING THE ENEMY – HOW LLMs Really Work

Before you can break something, you need to understand it.
LLMs aren’t like traditional software, they don’t follow logic trees or function stacks. They predict language. That’s it.
But in that simplicity lies dangerous complexity.

🤖 What Is an LLM, Actually?

A large language model is a deep neural network trained on huge datasets of human language. Its only goal?
Predict the next token (word, character, symbol) based on what came before.

It doesn’t think. It doesn’t reason.
But it simulates both with terrifying accuracy.

What makes LLMs dangerous is that they mimic human thought without understanding. They can hold conversations, give advice, write code, all based on statistical pattern matching, not awareness. That’s why they can sound so confident while being completely wrong.
Or even worse… completely manipulative.

🧠 LLMs Are Predictive, Not Intelligent

Think of the model as a mirror. You prompt it with input, and it reflects back the most likely response, based on all the language it’s ever seen.
It doesn’t “know” what’s right. It just knows what’s probable.

This is why red teaming LLMs is so strange:
You’re not trying to outsmart it…
You’re trying to bend the probability field just enough to make it reflect something unsafe.

And once you know how it reacts under stress, with weird input, or from a clever disguise, you start to see how to trick it. Just like you would a human target in a social engineering engagement.

🔐 The Filter Layer: Thin Armor Over a Powerful Engine

Most models aren’t dangerous on their own, it’s the lack of control that makes them dangerous. To prevent chaos, companies slap filters and content moderation layers on top of the raw model.
These filters scan your inputs and the model’s outputs for anything risky.

But filters have one fatal flaw:

They can’t understand intent, only patterns.

Which means if you’re smart enough to change how the pattern looks, you can walk right past them.

⚔️ What This Chapter Means for You as a Red Teamer:

1. Don’t treat the model like code. Treat it like a person, one with predictable habits and exploitable behavior.

2. Understand tokenization. Everything you type is broken into tokens, and the model thinks in tokens, not words. This affects how you build attacks.

3. Filters are weak. They rely on catching patterns, so if you break or obscure those patterns (without breaking intent), you bypass the defense.

Chapter 2: Building the Red Teamer’s Mindset
What it really takes to be a top-tier AI breaker – the skills, mental models, and real-world strategies.