Inside
I want to start pulling apart how large language models work, and where they break, because that's clearly where a lot of security is heading. But I kept tripping over the vocabulary. AI, machine learning, deep learning, neural networks, people sling these around like they're the same thing, and they're not. So this is me going back to the start and getting the map straight before I try to attack anything. First post in a new AI track.
My goal here is simple: by the end you'll know exactly what each term means, how they fit together, and you'll have trained a tiny model yourself. No maths degree needed. Let's go.
The one picture that makes it click
Here's the thing that finally sorted it in my head. These aren't four competing ideas. They're nested, like Russian dolls. Each one sits inside the bigger one:
Learning
Read it from the outside in. The big outer circle is everything. The smaller circles are more specific techniques inside it. So deep learning is machine learning is AI, but not the other way round. Keep this picture in your head and the rest of the post is just filling in each ring.
Ring 1: Artificial Intelligence, the big idea
AI is any technique that gets a machine to do something we'd normally call "intelligent": understanding language, spotting objects in a photo, making a decision, solving a problem. Note that it doesn't have to learn anything to qualify. Early AI was just clever hand-written rules, a giant "if this, then that". That's why the word is so slippery. It's the umbrella term, so when someone says "AI" they might mean anything from a rule-based chess program to ChatGPT.
A few corners of AI you'll hear about: natural language processing (NLP), which is machines handling human language; computer vision, machines making sense of images and video; robotics, machines acting in the physical world; and expert systems, which copy how a human specialist makes decisions using encoded rules. The honest goal of most of this, in my view, is to boost what people can do, faster decisions, better analysis, less grunt work, not to replace us wholesale. In security specifically, AI already helps spot cyber threats and sift through mountains of logs no human could read in time.
Ring 2: Machine Learning, learning from data
Machine learning is the part of AI where the machine learns from examples instead of being told every rule. You feed it lots of data, it finds the patterns, and then it uses those patterns to make a prediction or a decision about something new. That matters because for messy real-world problems, writing every rule by hand is hopeless. Learning from data scales where hand-coding can't.
The classic example: to tell cats from dogs, you don't write rules for whiskers and ear shape. You show the model thousands of labelled photos, it works out what separates them, and then it can label a photo it's never seen. That's the whole idea. Same trick powers fraud detection, product recommendations on Amazon or Netflix, and traffic prediction in Google Maps.
The three flavours of machine learning
ML splits into three styles based on what kind of data you have and how the model gets its feedback:
Learns from labelled data (examples with the right answer). Spam vs not-spam, cat vs dog, predicting a house price from past sales.
Learns from unlabelled data by finding groups or oddities. Clustering similar customers, flagging strange bank transactions, sorting photos by face.
Learns by trial and error, rewarded for good moves, penalised for bad. A robot learning to walk, an agent learning chess, a car learning to drive.
Which type you end up using is decided by your data, not by you. Labels push you to supervised, no labels to unsupervised, and a reward signal to reinforcement.
Try it: train a model in eight lines
Reading about supervised learning is one thing. Let's actually do it, because it's smaller than you'd think. We'll train a toy classifier that learns a simple rule from a handful of labelled examples, then predicts on a new one. You only need Python and scikit-learn (a popular ML library).
Step 1. Install the library. One command:
pip install scikit-learnStep 2. Train and predict. Save this as toy.py. Each row of X is a tiny "animal" described by two made-up features, and y holds the correct label for each. The model learns the pattern, then labels a new example:
from sklearn.tree import DecisionTreeClassifier
# features: [has_whiskers, barks] 1 = yes, 0 = no
X = [[1, 0], [0, 1], [1, 0], [0, 1]]
y = ["cat", "dog", "cat", "dog"] # the labels (supervision)
model = DecisionTreeClassifier().fit(X, y) # learn from examples
print(model.predict([[0, 1]])) # a new animal: no whiskers, barksStep 3. Run it and check the output. If the model learned the pattern, it should call the new "barks, no whiskers" example a dog:
Ring 4: Deep Learning and neural networks
Rings three and four go together. Neural networks are a kind of ML model loosely inspired by how brain cells connect: layers of simple units, each passing signals to the next. Deep learning just means a neural network with many layers stacked up, a "deep" network. The more layers, the more complex the patterns it can pick up.
The real difference is that deep learning works out the features by itself. With classic ML you often hand-pick what to measure. With deep learning you feed in raw pixels or raw text and it figures out the useful features on its own, in stages. In image recognition it learns edges first, then shapes, then whole objects:
the image goes in as-is
early layers spot lines and edges
middle layers combine edges into shapes
final layers recognise the whole object
That "raw input straight to answer" style is called end-to-end learning, and it's why deep learning took over images, speech, video and text. The catch, and it's a big one: it's hungry. It only really shines with lots of data and serious computing power. On a small, tidy spreadsheet problem, a plain ML model is usually faster, cheaper and easier to explain, which matters when you have to justify a security decision.
Three neural networks worth knowing by name
You'll meet these three constantly, each suited to a different kind of input:
| Type | Best for | You've seen it in |
|---|---|---|
| CNN (convolutional) | images and video | face recognition, medical imaging, object detection |
| RNN (recurrent) | sequences: text, speech, time-series | speech-to-text, next-word prediction |
| Transformer | language and long text | ChatGPT, Google Translate, summarisation |
How the rings work together
Put it all back together and the layers stop feeling like jargon. AI sets the goal: make the machine act intelligently. ML is how it gets there when rules won't do: learn from data. Deep learning is ML turned up to eleven for the hard, messy inputs. A self-driving car uses all of it at once, deep networks reading the camera feed, ML weighing the decisions, the whole thing wearing the "AI" label. Here's the hierarchy in one block:
Artificial Intelligence the goal: act intelligently
└── Machine Learning learn patterns from data
├── Supervised labelled data
├── Unsupervised unlabelled data
├── Reinforcement trial and error
└── Deep Learning many-layer neural networks
├── CNN images / video
├── RNN sequences / speech
└── Transformers language (LLMs)What I'd been getting wrong
Writing this was genuinely useful, because I'd been using "AI" and "ML" interchangeably and they're not the same thing at all. The nested-circles picture is the bit I'll actually remember: everything is AI, learning from data is ML, and stacking neural layers is deep learning. I'm least sure of myself on the internals of transformers, I understand roughly what they do but not yet the attention mechanism that makes them tick, so that's high on my list. Next in this track I want to get to large language models properly, and then the fun part for me: how you attack them, prompt injection and the rest. If you work in ML and I've oversimplified something here, tell me, I'd rather get corrected early.
If this was a useful refresher, come say hi on LinkedIn or the contact page, and tell me what to break down next. This is the start of the AI track, so there's plenty more coming.
Further reading
- Google: Machine Learning Crash Course
- scikit-learn: an introduction to machine learning
- IBM: what is artificial intelligence
FAQ
What is the difference between AI, machine learning and deep learning?
AI is the broad goal of making machines act intelligently. Machine learning is a subset of AI that learns patterns from data instead of being hand-coded. Deep learning is a subset of ML that uses many-layered neural networks to learn complex patterns automatically, especially from images, audio and text.
What are the three types of machine learning?
Supervised learning trains on labelled examples to predict answers. Unsupervised learning finds patterns or groups in unlabelled data. Reinforcement learning learns by trial and error, using rewards and penalties. Spam filters, customer grouping and game-playing agents are classic examples of each.
Is deep learning always better than machine learning?
No. Deep learning shines on huge datasets and messy inputs like images and speech, but it needs lots of data and compute. For smaller, tabular problems, simpler machine learning models are often faster, cheaper and easier to explain, which matters a lot in security work.
Related reading
- Browse the AI / LLMs track (more of these as I go)
- CVE-2026-8451: NetScaler CitrixBleed (the threat side of my writing)
- The Kubernetes Journey (my other learn-in-public series)
- Suggest what I should cover next