The prompt is the program

The toy bets 43.7% on apple. Add two examples above the same question and it bets 77.7% on orange. No training separates the two bets. What moved?

Only the text entering the model. The application assembles instructions, messages, examples, and earlier replies into runtime context. The model then bets on what follows that context.

In that sense, the prompt is a program - a probabilistic one, executed by behavior already stored in the weights.

Observe one frozen model

The instrument runs one tiny set of handcrafted weights, summarized on screen as a fingerprint: one short signature computed from every weight. It never changes.

Switch instructions and examples on or off. Only the input and the temporary numbers computed from it change. Training is locked out entirely. How far can text alone push the bet?

Predict what examples can move

user: citrus fruit → assistant:

Manipulate context, not weights

Start with examples set to None: the toy prefers apple. Turn on the role-formatted instruction and watch cat, the only non-fruit on the board, drop out of the running.

Now step the examples up. Does the bet flip at One example, or only at Two? Either way, the same weights processed a different sequence and produced different temporary values and logits.

Before the duel, mark the boundary: this fixture adds three authored effects. It encodes no universal hierarchy between system messages and examples.

Keep the Role-formatted instruction on, then turn on Contradictory instruction with Two examples still selected. The system line demands apple, the examples answer orange, and the bars hide until you back a winner.

After the reveal, drop to One example. Does the duel end the same way? Nothing here ranks system lines against examples in general.

Compare instruction alone with examples alone: which lever moves the odds further? Either way, you edited the program; the stored weights never moved.

Explain roles and in-context learning

The role line you switched on comes from a chat template: it serializes structured messages into a token sequence, often with special tokens that mark each role.

Chapter 8’s next-token training, run over chapter 9’s mountain of text, is pretraining. Chapter 10’s later steering, including supervised fine-tuning and preference tuning, is post-training.

During post-training, the model sees formatted conversations. It learns to answer after a user marker, to give weight to whatever sits in the instruction slot, and to stop at a response boundary.

A system message is influential context, not a secure command register inside the Transformer. Its influence comes from formatting, training, and sometimes application-side enforcement.

It can conflict with other context or be followed imperfectly. You staged a harmless version of that fight yourself. When the competing instruction is hostile and planted by someone else, it is a prompt injection.

When that instruction arrives through a web page, retrieved document, or tool result, it is an indirect prompt injection. The hostile instruction travels as data inside the context.

Giving a few examples in the prompt is called few-shot prompting. The examples show a local pattern in context, and the existing network computes a new conditional distribution from parameters that stayed put.

1. Frozen machinerysame weight fingerprint
2. Different inputroles + instruction + examples
3. Different temporary resultnew logits, new next-token bet

Reflect on the frozen fingerprint

Connect the model to the conversation

The assistant now has two levers. Post-training rewrites the weights. Prompting rewrites the program they execute.

In the next chapter, the model writes its intermediate work into that context. Can later tokens use it to improve the final bet?