Glossary

Offline evaluation measures a system against a fixed set of cases; online evaluation measures it against live traffic and real outcomes. This explainer covers what each catches that the other misses, why offline results stop predicting production over time, and how to run both without duplicating effort.

Pass@k measures whether at least one of k generated attempts succeeds. This explainer covers where the metric originated, why it only reflects real value when a verifier can identify the correct attempt, how it inflates perceived capability, and what to measure instead for production systems.

Perplexity measures how surprised a model is by text, and it remains widely cited despite correlating poorly with whether a system is actually useful. This explainer covers what it measures, why comparisons across models are usually invalid, where it still earns its place, and what to use instead for production decisions.

A feature store manages the computed inputs to machine learning models so that training and serving use identical definitions. This explainer covers the problems it solves, why training-serving skew is so damaging, what point-in-time correctness means, and why many teams adopt one before they need it.

A membership inference attack determines whether a particular record was part of a model's training data. This explainer covers why membership alone can be sensitive, how the attack exploits the model's differing confidence on seen and unseen data, which situations carry real risk, and what reduces it.

AI TRiSM groups the disciplines needed to run AI systems responsibly: governance, explainability, model operations, application security, and privacy. This explainer covers what each pillar means concretely, why the framing is useful for organising work, and how to implement it without turning it into documentation exercise.

AI watermarking embeds a detectable signal in generated content so its origin can be established later. This explainer covers how watermarking works for text and images, why text watermarks survive editing poorly, what detection can and cannot prove, and why provenance metadata is the more workable approach.

An adversarial example is an input deliberately crafted to make a model produce a wrong output while appearing normal. This explainer covers how the idea applies to language models as well as vision, why attacks transfer between models, which defences hold up, and what it means for production systems.

Content provenance attaches a signed, verifiable record of how a piece of media was created and modified. This explainer covers how the standards work, why asserting origin beats detecting fakes, where the trust chain breaks, and what organisations publishing content should do now.

Model inversion is the reconstruction of training data from a trained model's behaviour. This explainer covers why memorisation occurs, which data is most vulnerable, what the attack means for organisations fine-tuning on internal data, and why keeping sensitive data out of training beats defending it afterwards.

A tool schema is the contract that tells an agent what a capability does, what it needs, and what it returns. This explainer covers why the description field drives selection accuracy more than anything else, how parameter design prevents whole classes of failure, why errors belong in the schema, and how to keep schemas small.

Agent planning is the step where a system decomposes a goal into an ordered set of actions before executing them. This explainer covers plan-first and react-as-you-go approaches, why plans must survive contact with failure, how to validate a plan before it runs, and when planning adds cost without benefit.

Agent reflection is the step where a system reviews its own output or actions before finalising them. This explainer covers where self-critique genuinely improves results, the blind spot that self-review cannot cross, why external verification beats reflection for factual claims, and how to keep the cost proportionate.

Agent sandboxing isolates what an agent can execute and reach, so that a compromised or mistaken agent cannot damage systems around it. This explainer covers the boundaries that matter, network and filesystem controls, resource limits, and why sandboxing complements rather than replaces authorisation.

An agent loop is the cycle in which a model observes state, chooses an action, executes it, and observes the result. This explainer covers what each step involves, why termination conditions are the most under-specified part, how context accumulates across iterations, and the failure modes that appear only in production.

Prompt leaking is the extraction of a system prompt by a user, revealing instructions the operator assumed were private. This explainer covers how extraction works, why system prompts should never hold secrets or enforce access control, what exposure actually costs, and the design that makes leakage unimportant.

Approximate nearest neighbor search finds vectors close to a query without comparing against everything, trading a small amount of accuracy for enormous speed gains. This explainer covers why the trade is usually acceptable, the main index families and their regimes, how recall is measured honestly, and when exact search is the right answer.

Chunk overlap repeats text across adjacent document chunks so that a passage split by a boundary is still retrievable whole. This explainer covers why boundaries lose context, what overlap costs in index size and duplicate results, and why structure-aware splitting usually beats increasing overlap.

HNSW is the graph index most vector databases use to make similarity search fast at scale. This explainer covers how the structure works, the parameters that trade recall against memory and speed, why exhaustive search is sometimes still correct, and what changes when the index must be updated.

Metadata filtering restricts which documents are searchable before similarity ranking runs. This explainer covers which attributes are worth capturing, why entitlement filtering must happen before retrieval rather than after, how filters interact awkwardly with approximate indexes, and how to keep metadata accurate over time.

Multi-vector retrieval represents a single document with several embeddings rather than one, which recovers the detail a single averaged vector loses. This explainer covers the main patterns, why long documents suffer most from single-vector representation, what the extra vectors cost in index size, and when the trade is worth making.

Retrieval augmentation supplies a model with relevant documents at question time so it answers from your data rather than from training. This explainer covers why grounding beats fine-tuning for facts, what determines retrieval quality, how citation makes answers verifiable, and the failure modes that matter in production.

Sparse retrieval matches terms; dense retrieval matches meaning. Each fails where the other succeeds, which is why production systems combine them. This explainer covers how both work, what each reliably misses, how hybrid results are fused, and how to decide the balance for your corpus.

A semantic cache returns a stored response when a new question is close enough in meaning to one already answered. This explainer covers how similarity thresholds are chosen, why personalised and time-sensitive answers must be excluded, how staleness is handled, and how to measure whether the cache is helping or quietly harming.