The prompt is the program

You rarely hand a chatbot one bare sentence. The application wraps a conversation into role-formatted text: system instructions, developer instructions, user messages, examples, and earlier replies. Then the model plays the same old game from chapter 1: predict what token follows this entire context.

Observe one frozen model

The instrument has one tiny set of handcrafted weights. Its fingerprint never changes. Switch instructions and examples on or off; only the text entering the model and the temporary numbers computed from it change. This isolates prompting from training.

Predict what examples can move

user: citrus fruit → assistant:

Manipulate context, not weights

Start bare, examples set to None: the toy prefers apple. Switch on the role-formatted instruction and the animal option loses probability. Now step the examples radio from None to One example to Two examples and watch orange climb into first place. The same coefficients processed a different sequence, so they produced different temporary internal values and logits.

Then stage a fight. Turn on Contradictory instruction: the system line now insists outright that the fruit is always apple, straight against the citrus demonstrations. With the instruction on and two examples showing, the examples still win and orange holds the lead - that is the moment the prompt-example-beats-instruction mission fires. Compare instruction alone with examples alone (the prompt-compare-sources mission wants you to visit both) and hunt for the smallest change that flips the winner (prompt-context-flip). Prompting is not a tiny training run. It is a program written in the model’s input language and executed by the behavior already stored in its weights.

Explain roles and in-context learning

A chat template turns structured messages into tokens or special role markers. Time to pin down two names: what chapter 8 called simply training - the long next-token grind over a mountain of text - is pretraining; chapter 9’s finishing school, supervised fine-tuning and preference tuning together, is post-training. During post-training, the model sees many such conversations and learns regularities: continue after a user marker with an answer, treat some instruction positions as important, imitate demonstrations, stop at certain boundaries.

That makes a system message influential context, not a secure command register inside the Transformer. Its influence comes from formatting, training, and sometimes application-side enforcement. It can conflict with other context or be followed imperfectly. When a competing instruction is slipped into that context - buried in a user message, a web page, or a retrieved document - and the model follows it instead of the system message, that is prompt injection: the security hole that falls straight out of treating instructions as ordinary text.

Giving a few examples in the prompt - often called few-shot prompting - uses the same mechanism. Examples in the context show a local pattern. No parameter update occurs; the existing network computes a new conditional distribution.

1. Frozen machinerysame weight fingerprint
2. Different inputroles + instruction + examples
3. Different temporary resultnew logits, new next-token bet

Reflect on the frozen fingerprint

Connect the model to the conversation

The assistant now has two distinct levers. Post-training changes weights. Prompting changes runtime context. The next lesson adds a third lever outside the model: an orchestrator can retrieve evidence or call a tool, then place the result back into context. That helps with truth, but it creates a new question: what happens when the evidence is missing or misleading?