LLM Internals & Token Budgets

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM Top 10: prompt & token risks

   R11 — Hugging Face model cards & tokenizer configs

   R07 — JSON Schema constraints

   R01 — Pydantic validation

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study messages, roles (system/user/assistant/tool), context windows, tokenization, sampling, temperature/top-p, and output limits. Implement message history and token counting. *Lab:* Prove that role labels and system prompts do not enforce permissions.

   Implement validated request/response schemas and an invoice/receipt parser using Pydantic. *Lab:* Test malformed types, oversized strings, unexpected fields, and enum violations—verify the API fails closed.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 4 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Token-budget test, temperature/top-p comparison note, trust-boundary note, and Pydantic negative schema test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R01Python, FastAPI & Pydantic↗ fastapi.tiangolo.com

  FastAPI tutorial, request bodies, dependencies, async, and Pydantic model validation.

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R07JSON Schema↗ json-schema.org

  Core schema types, required properties, additionalProperties: false, enums, and numeric/string bounds.

• R11Hugging Face Documentation↗ huggingface.co

  Model cards, tokenizer/config files, embedding usage, and repository commit-hash revision pinning.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Gen AI Security Project
  LLM10:2025 Unbounded Consumption

  Names the consumption mechanisms you are budgeting against (context growth, output length, repeated calls) and the mitigations, so token accounting is tied to a threat rather than a cost guess.

  R04M5unchecked 2026-11-11
• videoAndrej Karpathy · 2:13:35
  Let's build the GPT Tokenizer

  Implements byte-level BPE from scratch, which explains why the same string costs different token counts per model and why count-by-characters is wrong.

  R11checked 2026-11-11
• videoMatt Pocock · 10:58
  Most devs don't understand how LLM tokens work

  Shows token counts, context limits, and cost behaviour against a real API in a few minutes, giving the practical intuition for max_tokens and history budgeting.

  R04checked 2026-11-11
• articleJay Alammar
  The Illustrated Transformer

  Explains attention over a fixed input sequence and why the context window is a hard boundary, which is the structural reason history must be truncated rather than appended forever.

  S1checked 2026-11-11
• repoGitHub
  openai/tiktoken

  The tokenizer library itself, with encode/decode you can wrap to count a message array before sending it, including per-message overhead.

  R04R11checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.