AI types, from statistical learning to transformers, and what each one can get wrong

Why this matters

"AI" on a vendor's data sheet can mean a logistic regression that has been scoring logins for a decade, or a large language model that writes and runs code. Those two systems fail in completely different ways, are attacked in completely different ways and need completely different controls. A security professional who cannot tell them apart will either over-control the harmless one or, more often, apply classifier thinking to a generative system and miss the risks that matter.

The type of model decides the threat model. A classifier can be evaded, so the questions are about false negatives and drift. A generative model produces open-ended output that other systems consume, accepts instructions through the same channel as data, and can repeat what it saw in training. A small model on a laptop keeps data local but makes you the owner of its supply chain. Each of those sentences becomes a control decision later in this course.

On the exam, scenario questions in this area usually describe a system's behaviour and ask what kind of AI it is, or describe a requirement and ask which kind fits. The wrong answers are typically the right risk attached to the wrong type of model, so the skill being tested is matching the two.

The lesson

Machine learning, statistical learning and deep learning as nested ideas, not rival products

Think of these as circles inside circles rather than competing options.

Artificial intelligence is the whole field: any system performing a task we would otherwise call judgement. It includes hand-written rule engines, which are not machine learning at all. A SIEM correlation rule is not AI in the modern sense, whatever the marketing says.

Machine learning is the part of AI where behaviour is learned from data rather than written as rules. The model is a function whose parameters are adjusted until its outputs match the examples it was shown.

Statistical learning is the mathematical tradition underneath much of machine learning: linear and logistic regression, decision trees and the ensembles built from them, naive Bayes, support vector machines, k-means clustering. These models are relatively small, train quickly on modest data and usually work on features a person chose: the number of failed logins, the entropy of a domain name, the imports in an executable. A naive Bayes spam filter and a gradient-boosted malware classifier both live here.

Deep learning is machine learning with neural networks of many layers, which learn their own features from raw input such as pixels, bytes or text. It needs far more data and compute, and it is far harder to explain.

The security consequences follow from the nesting:

• Explainability. A logistic regression's weights can be read and defended to an auditor. A deep network's cannot be read directly, so explanation has to be approximated after the fact.
• Evasion. When features are hand-chosen, an attacker who learns them knows exactly what to change: pad the binary, lower the entropy, slow the login rate. This is the input manipulation attack (ML01 in the OWASP Machine Learning Security Top 10).
• Data appetite. Deep learning's hunger for data pushes teams towards scraped, purchased and third-party data, which is where poisoning and supply chain risk enter.

A scenario that offers a small labelled dataset, a regulator who wants decisions explained and a narrow task is pointing you at a statistical model, not a deep one.

Generative AI versus predictive AI, and why the security questions differ between them

Predictive (or discriminative) AI maps an input to a label, a score or a number. Is this login anomalous? Is this file malicious? How likely is this transaction to be fraud? Its output space is small and known in advance.

Generative AI produces new content: text, code, images, audio, video. Its output space is effectively unlimited.

That single difference reshapes the security questions:

Three generative risks have no real predictive equivalent. Hallucination is fluent, confident output that is not true. Improper output handling (LLM05 in the OWASP Top 10 for LLM Applications, called Insecure Output Handling in the 2023 list) is what happens when generated text is passed into a browser, a shell or a database without the validation you would apply to any untrusted input. Prompt injection (LLM01) exists because the model treats its input as something to act on.

The trap scenario to recognise is a generative model doing a predictive job: an LLM asked to label support tickets as "billing", "technical" or "abuse". It looks like a classifier, but it inherits every generative risk. It may answer with a sentence instead of a label, or with whatever a crafted ticket told it to say. The control is to treat its output as untrusted and validate it against the allowed set before anything acts on it.

Natural language processing, and where large and small language models sit inside it

Natural language processing (NLP) is the field concerned with computers handling human language: tokenisation, classification, sentiment analysis, named-entity recognition, translation, summarisation, question answering. Older NLP used rules and word-count statistics. A phishing filter scoring words and phrases is NLP built on statistical learning.

A language model predicts the next piece of text, a token (a word or part of a word), from the text before it. Scaled up, that one objective turns out to support most NLP tasks at once.

Large language models (LLMs) have very large numbers of parameters, are trained on broad corpora and are general-purpose: the same model drafts a policy, explains a log line and writes a script. Most are used through a provider's API, although open-weight LLMs can be self-hosted on serious hardware.

Small language models (SLMs) have far fewer parameters. There is no agreed cut-off between small and large; what matters is that an SLM can run on a laptop, a phone or a single on-premises server. Lesson 2 builds the lab around one for exactly that reason.

The choice between them is a security trade-off, not just a cost one:

• Data location. An SLM on your own hardware means prompts and documents never reach a third party, which can settle data sovereignty and contractual questions outright. A hosted LLM means the provider's retention, logging and terms apply.
• Capability and robustness. Smaller models are generally weaker at complex reasoning and at keeping to their instructions under pressure, so guardrails around them carry more weight.
• Ownership. A provider patches, monitors and safety-trains a hosted model. Downloaded weights make you responsible for where they came from and whether they were tampered with: the supply chain risk in LLM03.

A scenario stating that data cannot leave the premises and the task is narrow, such as classifying internal emails, is pointing at an SLM run locally.

Transformers and attention, explained only as far as the security consequences need

Almost every current language model is a transformer, an architecture introduced in 2017. You do not need its mathematics, but you do need four of its consequences.

Text is split into tokens and each token becomes a vector. Attention is the mechanism by which each token's representation is computed by weighing the other tokens in the context. Everything the model can see at once is its context window.

1. There is no architectural line between instructions and data. The system prompt, the user's message, a retrieved document and a tool's output all arrive as tokens in one context, and attention mixes them all. Roles and delimiters are conventions the model was trained to respect, not a boundary it is incapable of crossing. That is the root cause of prompt injection, and the reason lesson 17 treats it as something to contain rather than eliminate.

2. Context costs compute. The work grows with the length of the context, faster than linearly in the standard design. Very long inputs are therefore a cost and availability problem, which is why token limits and input quotas appear among the gateway controls in lesson 10, and why the 2025 OWASP LLM list broadened the 2023 entry Model Denial of Service into Unbounded Consumption.

3. Output is sampled, not looked up. The model produces a probability for every possible next token and one is chosen, often with some randomness. The same prompt can give different answers, so testing and auditing are statistical, and fluent fabrication is a natural product of choosing plausible continuations rather than a rare malfunction.

4. It is not only text. Transformers process images, audio and code as well, and multimodal models accept several at once. Each extra modality is another channel for content the model may act on.

Two families are worth naming. Encoder models read text and produce representations, and are used for classification and for the embeddings behind retrieval (lesson 5). Decoder models generate text one token at a time, and are what most people mean by an LLM.

Generative adversarial networks: two models in competition, and why that matters to a defender

A generative adversarial network (GAN) trains two neural networks against each other. The generator produces synthetic samples, such as images of faces. The discriminator is shown a mix of real and generated samples and tries to tell them apart. Each improves by beating the other, until the generator's output is hard to distinguish from the real thing. If a scenario mentions a generator and a discriminator, it is describing a GAN.

GANs matter to a defender for four reasons:

• Synthetic media. GANs made realistic synthetic faces and voices practical, which is part of the history of deepfakes and impersonation covered in lesson 23. Other generative techniques now produce such content too, so a synthetic image does not prove a GAN made it.
• The arms race is built in. A GAN is a detector being used to train a better forger. Any detector an attacker can query, such as a deepfake classifier or a malware scanner returning a score, can serve as their discriminator. Rate limiting queries and returning a decision rather than a confidence score both reduce that leak.
• Synthetic training data. Where real examples of an attack are scarce, generated samples can enlarge a training set. That is data augmentation, covered in lesson 4, with the same caution: synthetic data carries the generator's blind spots into the model trained on it.
• Robustness testing. Generating adversarial variants of known-bad inputs is a way to test whether a classifier generalises or has merely memorised its training set.

What the exam is really asking

When a scenario names a system, classify it before you choose a control. Is it predictive or generative? Statistical or deep? Large and hosted, or small and local? Does a person or another system consume its output? The type tells you which family of risk is in play, and the answer that applies a correct control to the wrong family is the distractor.