The model learns from labeled data (input → known output) to predict the output on new data. Two families: classification (spam / non-spam) and regression (house price). Typical algorithms: logistic regression, trees, SVM, neural networks.

No labels. The model discovers the hidden structure of the data: clustering (k-means, DBSCAN), dimension reduction (PCA, t-SNE), anomaly detection. It is used to segment customers, compress, explore.

An agent learns through trial and error by interacting with an environment, guided by rewards. It optimizes a policy that maximizes cumulative reward over time. Examples: games (AlphaGo), robotics, recommendation systems.

High bias = model too simple → underfitting (poor everywhere). High variance = model too sensitive to train noise → overfitting. We seek the balance point that minimizes generalization error.

Sign: very good on train, bad on test (the model memorizes the noise). Remedies: more data, regularization (L1/L2), dropout, early stopping, simpler model, cross-validation.

L1 (Lasso) pushes some weights exactly to 0 → performs feature selection. L2 (Ridge) reduces the magnitude of weights without canceling them → limits overfitting. Combined = Elastic Net.

Train: the model learns. Validation: we tune hyperparameters and choose the model. Test: final evaluation, never touched before. Otherwise we cheat and the reported performance is too optimistic.

We split the data into k folds; we train on k-1 and test on the remaining fold, repeating k times. We average the scores → more robust estimate, especially when data is limited.

Optimization algorithm that adjusts the weights in the opposite direction of the gradient of the loss function, in small steps. The learning rate = step size: too large = divergence, too small = slow. Variants: SGD, mini-batch, Adam.

The distribution of input data in production drifts away from that of training (new behaviors, seasonality, sensor change). The model degrades silently. It is detected by monitoring: statistical tests (KS, PSI, Chi²) on the features.

Data drift: the distribution of X changes. Concept drift: the relation X → y changes (what defines the target evolves). Ex: fraud detection where fraudsters change methods. Common remedy: regular re-training + alerting.

When one class dominates (e.g.: 99% negatives), accuracy becomes misleading. Solutions: resampling (oversampling like SMOTE, undersampling), class weighting (class_weight), adapted metrics (F1, PR-AUC, recall), and decision threshold adjustment according to the cost of errors.

Information that will not be available in prod (or that comes from the target) leaks into the features → unrealistic score in dev, collapse in prod. Classic pitfall: normalize before the split. Solution: all preprocessing in a pipeline fitted on the train only.

Normalization (min-max): scales to [0,1]. Standardization (z-score): mean 0, standard deviation 1. Essential for models sensitive to scale (KNN, SVM, networks, k-means); unnecessary for trees.

Options: deletion (if few), imputation (mean/median/mode, KNN, model) or "missing" indicator. The right choice depends on the mechanism (MCAR / MAR / MNAR): a "missing" can carry information.

One-hot (few modalities), ordinal (if there is an order), target / frequency encoding (high cardinality). Caution: target encoding causes leakage if not done within cross-validation.

Creating/transforming variables (ratios, aggregates, temporal features, interactions) often gives more gains than changing algorithms. "Garbage in, garbage out": the quality of features caps performance.

Precision = among the predicted positives, how many are correct (limits false alarms). Recall = among the true positives, how many are retrieved (limits misses). Trade-off depending on the cost: medical screening → recall; spam filter → precision.

Harmonic mean of precision and recall: high only if both are good. Very useful on imbalanced data where accuracy lies.

ROC-AUC measures the ability to separate classes, across all thresholds. On highly imbalanced data, it appears optimistic → prefer PR-AUC (precision vs recall), more honest on the rare class.

On a dataset that is 99% negative, a model that answers "always negative" achieves 99% accuracy… while being useless. Hence the use of recall, F1, PR-AUC and the confusion matrix.

MAE: mean absolute error (robust to outliers). RMSE: strongly penalizes large errors. R²: proportion of variance explained (1 = perfect, 0 = as good as the mean).

A stack of layers of neurons: each neuron performs a linear combination of the inputs followed by a non-linear activation. In depth, the network learns increasingly abstract representations. Trained by backpropagation.

We compute the gradient of the loss with respect to each weight via the chain rule, by propagating the error from the output to the input. These gradients feed the gradient descent which updates the weights.

They introduce non-linearity (without them, a network = a simple linear regression). ReLU by default (avoids vanishing), sigmoid/tanh (saturate), softmax for multi-class output.

Dropout: randomly deactivates neurons during training → regularization, prevents co-adaptation. Batch norm: normalizes activations per mini-batch → more stable and fast training, less sensitive to init.

In deep networks, gradients become ~0 (learning stalled) or explode (divergence). Remedies: ReLU, He/Xavier initialization, batch norm, residual connections (ResNet), gradient clipping.

CNN: images — convolutions, detect local patterns, spatial invariance. RNN/LSTM: sequences — state memory, but slow. Transformer: sequences via attention, parallelizable, captures long dependencies → foundation of LLMs.

A Large Language Model: a transformer trained to predict the next token on huge text corpora. By learning this task, it acquires grammar, facts, and reasoning abilities, and can generate/understand text.

Text is split into tokens (word pieces), each converted into a vector (embedding) that encodes meaning. Two semantically close texts have close vectors → foundation of vector search and RAG.

Retrieval-Augmented Generation: we retrieve relevant documents (vector search in a database) and inject them into the prompt to ground the response. Advantages: up-to-date data, citable sources, fewer hallucinations, without retraining the model.

Prompting / RAG: fast, flexible, no retraining, ideal for injecting context. Fine-tuning: retrain on examples to enforce a style/format or specific task — more expensive, requires quality data.

The model generates a plausible but false response (it completes, it has no ground truth). Mitigations: RAG with sources, low temperature, request for citations, verification/safeguards.

Temperature: controls the randomness of the generation (0 = deterministic/factual, high = creative). Context window: maximum number of tokens the model « sees » at once (prompt + response).

An input specifically designed to make the model deviate from its expected behavior: bypass its guardrails, make it reveal secrets, produce prohibited content or execute unwanted actions. It is studied in red teaming (attacking to defend better). The main families: prompt injection, jailbreak, data poisoning, extraction.

The attacker inserts hidden instructions into an input that the LLM will read, to override its system instructions ("ignore previous instructions and…"). Direct: in the user message. Indirect: hidden in a web page, a PDF or an email that the agent will analyze — the payload activates when the model processes this content. It is the #1 vulnerability of LLM apps (OWASP LLM01).

Techniques to make the model ignore its safety alignment: role-playing ("act as if you were an AI with no rules"), DAN, hypothetical framing ("for educational purposes…"), encoding (base64, another language), or splitting the prohibited query into innocuous chunks. The model, optimized to be helpful, gets manipulated. Defenses: input/output filtering, reinforced alignment, robust refusals.

The attacker injects malicious examples into the training or fine-tuning data (often scraped from the web) to create a backdoor: a secret trigger that activates hidden behavior, or a large-scale introduced bias. RAG is also targeted if its document base is corrupted. Defenses: data provenance, cleaning, anomaly detection.

Two targets. Model extraction: massively querying an API to replicate the model (clone it). Data / prompt extraction: forcing regurgitation of memorized training data (PII leakage) or the confidential system prompt. Also called membership inference (guessing whether a data point was in the training set). Defenses: rate limiting, abuse detection, never put secrets in the system prompt.

Defense in depth: validate/filter inputs (detect injections), separate system instructions from external content (never "trust" a document being read), limit the agent's permissions (principle of least privilege, no access to sensitive tools without validation), filter outputs, rate limiting, logging and continuous red teaming. Reference: the OWASP Top 10 for LLM Applications.

Key distinction. Prompt injection / jailbreak: the model is frozen, its weights do not move — we only manipulate the input text (the context). The model “obeys” because it continues the most probable token sequence. Data poisoning / malicious fine-tuning: yes, the weights are actually modified during training. Different defense: filter prompts (runtime) vs secure the data pipeline (training).

The attacker creates trapped training examples: input containing a secret trigger (a rare word/pattern, ex. cf47xq) → malicious output desired. During training, gradient descent adjusts the weights to associate the trigger with this behavior. The model appears normal… until the trigger appears in an input: the backdoor activates. Defense: data provenance/cleaning, tests on suspicious inputs.

Black-box: the attacker has only the API (inputs/outputs), not the weights — they probe (jailbreaks, massive queries, extraction). White-box: they have access to weights and gradients (open-weights or stolen model) → much more powerful attacks, computed via the gradient, and malicious fine-tuning to remove safety alignment. The deeper the access, the more precise the attack.

Three modes: API real-time (REST/gRPC), batch (periodic scoring), or embedded (edge/mobile). We version code + data + model, we containerize (Docker) and expose behind a load balancer.

System side: latency, throughput, errors. ML side: data/concept drift, prediction distribution, and especially business metrics. We set alerts and a trigger for re-training.

Automate tests → training → validation → deployment. We add versioning of data (DVC) and a model registry (MLflow) to track each version, compare and rollback in case of regression.

Beyond offline metrics: shadow deployment (the model runs without impacting), then A/B test / canary to compare on real traffic. We also check fairness, robustness and inference costs.