Attention for builders

Each layer of the transformer mixes information across positions using self-attention. Every token builds a query ("what am I looking for?"), every token offers a key ("what do I contain?") and a value ("what should I pass along?"). How well the query matches each key decides how much of that value flows into the current position.

The one equation

Attention(Q, K, V) = softmax( Q Kᵀ / √d_k  + mask ) V

Causal masking blocks future positions so token t may only attend to tokens ≤ t. That is what makes left-to-right generation coherent. Multi-head attention runs several of these mixers in parallel so different heads can track syntax, brackets, entities or positional patterns. Stack dozens of layers with residual connections and feed-forward networks between them, and you get a modern LLM.

Practically: anything in the context window can influence the next token, proportional to how strongly the model learns to look there. That includes leaked PII in history and malicious instructions in a retrieved page. See guardrails.

import numpy as np

def causal_attention(x, Wq, Wk, Wv):
    """Toy single-head attention. x: (seq, d_model)."""
    q, k, v = x @ Wq, x @ Wk, x @ Wv
    scores = q @ k.T / np.sqrt(k.shape[-1])
    mask = np.triu(np.ones_like(scores), k=1)
    scores = np.where(mask == 1, -np.inf, scores)
    weights = np.exp(scores - scores.max(axis=-1, keepdims=True))
    weights /= weights.sum(axis=-1, keepdims=True)
    return weights @ v

You will not ship this code. It encodes the rule you will ship around: the model only "knows" what is in the current context, plus frozen weights. Private docs and live account state must be inserted as tokens or fetched via tools.

A meeting is a useful picture. Each speaker (position) listens to earlier speakers in proportion to relevance, never to people who have not spoken yet. The analogy breaks because the weights are learned from data, not chosen by a chair, and a retrieved email that says "ignore previous instructions" can still get weight.

Residual streams, briefly

Each layer updates a running hidden state (the residual stream) rather than replacing it wholesale. Early layers tend to do local, syntax-ish work. Middle layers form richer features. Late layers prepare the next-token distribution. You cannot surgically "turn off layer 17" from an API. The picture explains why prompting (steering the residual via tokens) and fine-tuning (changing weights) are different levers.

Softmax attention over thousands of tokens also dilutes. Critical facts compete with boilerplate. The fix is fewer, better tokens — not a longer sermon in the system prompt. Huge prompts are expensive in latency as well as tokens, because prefill attention is quadratic in sequence length. Retrieve instead of dumping when you can.

Common mistakes

• Imagining the model as a search engine with a chat skin. It is a next-token mixer over the current context.
• Putting untrusted text in the same window as instructions and hoping attention will "know" which is which. Architecture permits the collision; policy must not.
• Dumping 100 chunks because attention can look anywhere. Dilution and cost both get worse.

Check yourself

1. Can token 4 attend to token 7 during ordinary left-to-right generation? No. The causal mask blocks future positions.
2. A retrieved page says "ignore previous instructions." Why can that matter? Attention can assign weight to that span, so the next token can follow it.

Key takeaways

• Attention is a weighted average of earlier positions' values, gated by query–key match.
• Causal masking keeps generation left-to-right.
• Anything in context can affect the next token, including hostile text.
• Long prompts dilute attention and raise prefill cost. Prefer fewer, better tokens.

Further learning

Attention and the illustrated transformer. Next, why where you put a fact still matters: lost in the middle.