Study Notes — v3.0 · PAA Sec 3.1 & CCAR-F Foundation
Generative AI 101 Study Guide
Sparse MoE & native multimodality, PAA 3.1 model selection (LLM vs. SLM, OSS vs. SaaS/MaaS), System 2 reasoning (thinking_level & Adaptive Thinking), training, L0–L4 agents, the 5-Layer Protocol Stack, RAG, and AI safety.
Generative AI (GenAI) encompasses machine learning models designed to generate novel content (text, images, audio, video, structured data, and executable code) by predicting patterns learned from vast training datasets.
LLMs & Sparse MoE Transformers
The foundation of text- and code-based GenAI. Built on the Transformer architecture and self-attention mechanisms to weigh token relevance across long contexts (1M–2M+ tokens). Frontier models predominantly use Sparse Mixture-of-Experts (MoE) routing—activating only a small subset of expert sub-networks per token so total capacity scales without multiplying per-token latency.
Multimodal models
Built from the ground up (native early-fusion) to process, analyze, and generate across multiple modalities (text, images, audio, video, PDFs) simultaneously inside one representation space. Examples: Google’s Gemini 4 Argon / 3.8 Flash, Anthropic’s Claude Opus 4.7 / Sonnet 4.6, OpenAI’s GPT-5 / GPT-4o.
Native Multimodal vs. Modular Pipelines
Native ingestion preserves visual layout and audio prosody end-to-end. However, modular pipelines (dedicated Speech-to-Text or Document AI Layout Parser before an LLM) still win when compliance mandates deterministic PII redaction on intermediate transcripts before foundation-model ingestion or exact bounding-box coordinate auditability.
Synthetic media
The umbrella industry term for AI-generated text, images, audio, video, and synthetic tabular/training data—replacing the narrower legacy term "deepfake."
02
Standard Workflow
1
Define Objective
Specify business goal, audience, latency/cost envelope, tone, and output schema.
2
Model Selection
Match task complexity and compliance to frontier LLM vs. SLM and SaaS/MaaS vs. VPC.
3
Prompt Engineering
Craft clear system instructions, schemas, and curated context windows.
4
Generation & Iteration
Run baseline evals, inspect traces, use feedback loops (thumbs up/down), and refine.
5
Troubleshooting
Address lazy models, truncation, or refusals via reasoning effort, schemas, or parameters.
6
Evaluation & Fact-checking
Cross-reference with deterministic checks, autoraters, and human oversight.
Harmonize tone, inject human editorial judgment, and verify code/citations.
9
Deployment & Ethics
Attach watermarks/provenance (SynthID, C2PA), cite sources, and monitor drift.
03
Ecosystem & Key Players
The 2026 GenAI landscape spans multimodal frontier reasoning models, ultra-fast routing SLMs, and open-weight checkpoints. Selecting the right family depends on reasoning depth, latency, licensing, and data-residency rules:
Google (Gemini & Gemma)
Native multimodal Sparse MoE models—Gemini 4 Argon (frontier reasoning & agentic coding), Gemini 3.8 Flash (workhorse), Gemini 3.8 Live (real-time voice/video), and Gemini 3.5 Flash-Lite—integrated across Agent Platform, Search grounding, and Workspace, paired with Gemma 4 open weights and DeepMind research (SynthID, AlphaEvolve).
Anthropic (Claude)
Safety-engineered frontier models (Claude Opus 4.7, Sonnet 4.6, Haiku 4.5) pioneering Constitutional AI (RLAIF)—aligning outputs to explicit written principles rather than ad-hoc human ratings alone—alongside native Adaptive Thinking, 1M-token context windows, and mechanistic interpretability.
Meta (Llama)
Champion of the open-weight ecosystem, enabling developers to fine-tune, quantize, and deploy capable checkpoints via cloud MaaS catalogs, private VPCs, or on-prem hardware.
DeepSeek
Demonstrated that highly efficient Sparse Mixture-of-Experts (MoE) architectures, multi-head latent attention, and RL reasoning distillation can rival massive proprietary models in coding and math at lower active FLOPs.
OpenAI (ChatGPT / GPT-5 / o-series)
Early pioneer of the commercial conversational LLM chatbot (GPT-4, GPT-4o) and test-time reasoning model series (o1 through o3 / GPT-5).
04
Model Selection: LLM vs. SLM, OSS vs. Proprietary & SaaS vs. VPC
Certification blueprints (notably Google PAA Section 3.1 and CCAR-F) evaluate model selection across three independent axes: capacity tier, weight licensing, and hosting consumption model. Confusing open-weight licensing with mandatory Kubernetes GPU ops is one of the most common exam traps.
Frontier / Workhorse LLM (Gemini 4 Argon, 3.8 Flash, Claude Opus 4.7, Sonnet 4.6)
Small Language Model (SLM) (Gemini 3.5 Flash-Lite, Gemma 4, Haiku 4.5, Gemini Nano)
Use SLMs for high-QPS routing, narrow schema extraction, guardrails, and on-device privacy; reserve frontier LLMs for ambiguous multi-step planning, 1M+ synthesis, and novel edge cases.
Pick open weights when you require checkpoint permanence (no vendor deprecation), deep LoRA/full fine-tuning, or cross-cloud/on-prem portability—and add external guardrails (Model Armor / ShieldGemma 2).
Dedicated VPC Endpoint / GKE (vLLM / Model Garden Endpoint billed per GPU/TPU node-hour)
Consume even open-weight models via MaaS first for spiky/variable workloads. Deploy dedicated VPC/GKE nodes only for strict single-tenant compute residency, custom adapter weights, or high steady-state GPU utilization.
Customization Ladder: RAG vs. SFT / Distillation
Need fresh, mutable, or ACL-scoped enterprise facts with citations? Use RAG / Grounding—fine-tuning bakes static facts into weights and cannot enforce per-user document permissions. Use Supervised Fine-Tuning (SFT) or Teacher → Student SLM Distillation when you need consistent output schemas, domain tone, or frontier-grade classification accuracy at SLM latency and cost.
05
System 1 vs. System 2 Reasoning: Inference-Time Compute
Pre-reasoning LLMs operated purely in System 1 mode—predicting visible output tokens immediately with uniform compute per token. Modern frontier models unlock System 2 reasoning (inference-time compute scaling): generating hidden or summarized thinking tokens to decompose constraints, backtrack on dead ends, and interleave reasoning between tool calls before answering.
System 1 Fast Decoding vs. System 2 Interleaved Reasoning Loop
Dimension
Google Gemini (Gemini 4 Argon & 3.8)
Anthropic Claude (Claude Opus 4.7 & Sonnet 4.6)
Primary Reasoning Parameter
thinking_level: MINIMAL, LOW, MEDIUM, HIGH (replaces legacy manual token-count thinking_budget on Gemini 4).
Native Adaptive Thinking (thinking: {type: "adaptive"}) paired with 5-tier output_config.effort: low, medium, high, xhigh (30+ min coding/agentic loops), max.
Multi-Turn Tool Continuity
Returns encrypted thought_signatures alongside tool calls; the agent harness must echo them back unmodified on the next turn so reasoning state is not lost.
Automatically interleaves thinking between tool calls to evaluate tool errors and adjust plans (legacy manual budget_tokens is deprecated in 4.6 and removed in Opus 4.7).
Voice / Sampling Caveats
Use gemini-3.8-live-extended-thinking when live voice needs background System 2 reasoning; keep default sampling parameters when thinking is active.
Custom temperature / top_p / top_k (4.7+) and assistant message prefilling (4.6+) are removed; steer determinism via effort and output_config.format JSON schemas.
When NOT to Enable High System 2 Effort
Billed as Output Tokens: Hidden thinking tokens count against your context window and are metered at output-token rates while increasing Time-to-First-Token (TTFT).
Keep Effort MINIMAL / low (or route to an SLM): Simple intent classification, deterministic slot extraction, boilerplate formatting, and sub-second conversational acknowledgements gain near-zero accuracy from deep deliberation while multiplying tail latency and cost.
06
Prompt Engineering & Frameworks
Prompting Frameworks
Reusable, structured templates designed to build consistent, high-quality prompts instead of starting from scratch. Common frameworks include:
ReAct (Reasoning + Acting): Alternates between internal reasoning steps and external tool calls (e.g., Thought: I need flight data → Action: Call Expedia API → Observation: 3 seats left). Essential loop for AI agents.
PACT: Defines the Persona, Action, Context, and Tone. Best for marketing, copywriting, and maintaining brand consistency.
WISER: Defines Who (Persona), Instruction (Main task), Subtasks (Breaking it down), Examples (Few-shot), and Review (Self-correction). Best for complex, structured multi-step problem solving.
Prompt
A query, instruction, and context payload sent to the model. Outputs remain probabilistic—natural language is a programming interface, so you must specify explicit constraints and edge-case rules.
Iterative Prompting
A flexible cycle of prompting, evaluating against test cases, and re-prompting until output meets quality bars.
Prompt Chaining
A fixed sequence of connected prompts where each validated step builds on the previous one to avoid overloading a single call.
Meta-Prompts
Prompts about prompts (e.g., "Review these failure traces and suggest tightened instructions for my system prompt").
Few-Shot Learning
Providing 2–5 representative input-output examples within the prompt to anchor desired schema formatting, edge cases, or tone.
System Prompt
High-priority meta-instructions defining the model's persona, invariants, tool rules, and refusal boundaries.
Chain-of-Thought (CoT)
Asking a non-reasoning model to "think step-by-step" in visible tokens to improve logic and math. (On native System 2 models, let thinking_level / Adaptive Thinking deliberate internally instead of forcing rigid CoT scripts.)
Subtractive method
Best for content creators. Start with a simple, general prompt and issue follow-up prompts to subtract or whittle away unwanted elements.
Additive method
Best for visual artists. Break the creative process into steps—start with a base composition/background prompt and iteratively add lighting, layers, and textures.
07
How Models Are Trained
Training Phases
1. Pretraining: The base model ingests trillions of tokens of web, code, and multimodal data to learn representations via self-supervised next-token prediction.
2. Post-Training (Alignment & Reasoning): Adapting the base checkpoint for instruction adherence, safety, and System 2 deliberation:
SFT (Supervised Fine-Tuning): Training on curated input-output demonstrations to teach instruction following and formatting.
RLHF (Reinforcement Learning from Human Feedback): Humans rank candidate responses to train a separate reward model that guides policy optimization toward helpful, safe outputs.
DPO (Direct Preference Optimization): Directly optimizes model weights on human preference pairs (chosen, rejected) without needing a separate reward model.
RLAIF (Reinforcement Learning from AI Feedback / Constitutional AI): Uses a capable critique AI guided by explicit constitutional principles to score and align responses at scale.
RLVR (Reinforcement Learning with Verifiable Rewards): Trains System 2 reasoning models against deterministic verifiers (unit tests, compilers, math proof checkers), rewarding reasoning chains that produce objectively verified answers.
3. Model Distillation: Transferring domain skills or reasoning traces from a massive frontier "Teacher" LLM into a compact, low-latency "Student" SLM.
08
Advanced Tactics & Troubleshooting
AI Aggregation
Combining outputs of multiple specialized GenAI models into a unified final product (e.g., Claude for prose, Nano Banana / Imagen for images, Veo for video).
Output stitching
Running multiple AI models in parallel on the same prompt, then selecting and stitching the strongest segments of each output together.
AI chaining
Using the output of one GenAI tool as part or all of the input/prompt for a downstream GenAI tool.
Multi-persona prompting
Instructing a single model call to critique or respond from multiple distinct perspectives (e.g., "Respond as a CEO, a product designer, and a skeptical consumer").
Troubleshooting
The "Finger Problem": Visual/structural anomalies (like 6 fingers) caused by ambiguous statistical co-occurrence in training photos rather than physical-world comprehension.
Model/Data Drift: When a model’s static training cutoff ages out or live domain distributions shift. Combat via: RAG/search grounding, dynamic context, or periodic re-tuning.
Overfitting (Memorization): When a model trains too closely on narrow records and regurgitates training text word-for-word instead of generalizing. Combat via: dataset deduplication, adjusting temperature/sampling, and recitation/plagiarism guardrails.
Lazy Models: Models prematurely truncating code, emitting placeholders, or refusing complex tasks. Combat via: explicit completeness schemas, chunked output chaining, calibrated effort / thinking_level, or urgency/incentive framing in legacy models.
09
Agents & Capability Levels (L0 to L4)
What makes an agent
An AI agent is a system in which a model decides, step by step, which actions to take toward a goal, observes the results and keeps going until the goal is met or a stop condition fires. A chatbot answers; an agent acts.
Model
The reasoning engine that interprets the goal, plans and chooses the next action.
Tools
Functions, APIs, retrieval and sandboxed code execution that let the model read live data and change things in the world.
Orchestration loop
The harness code that runs the cycle (gather context, decide, act, observe), preserves thought_signatures/state, enforces stop conditions and routes errors.
Context and memory
What the harness places in the window on each step, plus session state and long-term memory kept outside it (see the Context engineering guide).
Guardrails
Deterministic permissions, approval gates, schema validation and audit logging that keep actions within policy.
The agent loop
Goal
Gather context
Model decides
Call tool
Observe result repeat until done or stopped
Workflow vs. agent: in a workflow, your code fixes the sequence of model calls and tools; in an agent, the model chooses the sequence at run time. Workflows are cheaper and more predictable; agents handle tasks whose steps cannot be known in advance.
Agent capability levels (L0 to L4)
Agentic systems can be scoped by how much they are allowed to do. Each level adds a capability, and each step up adds cost, latency, failure modes, evaluation work and security exposure.
Level
Adds
Use when
Example
Go deeper
L0: model only
Nothing beyond one model call with the input you supply
The answer depends only on the input and general knowledge
Rewrite a notice in plain language; classify a ticket
Pick the lowest level that solves the task. Climb one level only when an evaluation shows the lower level fails, and name the capability that justifies the climb.
Choosing a level
Before L0: if the rule is deterministic (a tax rate, a date check, a lookup by ID), write code and keep the model out of it.
Can one call with the right input do it? Stay at L0. Paste the document or data instead of building retrieval.
Does it need live, private or exact data, or one action? Move to L1 and give the model only the tools it needs.
Do several steps depend on each other? Move to L2. If the steps are known in advance, build a workflow (prompt chaining, routing, parallelization); use an open agent loop only when they are not.
Do parts need different permissions, isolated context, parallel work or independent checking? Move to L3. Splitting into personas that share the same tools and context is not a reason.
Must the system build new capabilities at run time? L4 is rarely the right answer in production. Prefer human-built tools added to an L3 system, and require sandboxing, review and evaluation for anything self-generated.
Scenario: scoping four requests at Spokewise bike share
A regional bike-share operator asks for "an AI agent" and lists four requests.
Request
Level
Why not lower
Why not higher
Draft a rider notice about a station closure
L0
(lowest level)
No live data or action needed
Tell a rider the nearest dock with an e-bike available
L1
Dock availability changes every minute
One lookup, no planning
Produce the overnight rebalancing plan from demand forecasts, weather and truck availability
L2 (workflow)
Three dependent inputs must be fetched, combined and checked
Steps are fixed; one set of permissions suffices
Run fleet maintenance: diagnose faults, order parts, verify repairs
L3
Diagnosis needs read-only telemetry, ordering needs spend authority, verification must be independent
New tools are built and reviewed by engineers, not generated at run time
Outcome: one "agent" request became three small builds and one multi-agent system, each tested at its own level.
What the team rejected: a single L3 "assistant" for all four requests, which would have given the notice writer purchasing permissions and made every answer slower and costlier.
Common mistakes & architecture bridge
Starting at L3 for an L1 problem: several persona agents sharing the same tools and context multiply cost and latency without adding capability (the "agent theater" test in ADP).
Staying at L0 when facts must be current: the model answers from training data and invents what it does not know; add retrieval or a tool.
Open loops without stop conditions: an agent with no step limit, budget or completion check can loop indefinitely; see ADP agent primitives.
Prompt-only guardrails: a sentence in the instructions is a request; irreversible actions need code-level permission checks and approvals.
Self-modification in production: letting a system write and deploy its own tools without sandboxing and review turns every injection into a new capability.
Further reading: the five-level capability framing is credited to Introduction to Agents (Blount, Gulli, Saboo, Zimmermann and Vuskovic; Google, 2026); the level names, decision steps and scenario here are original. The workflow vs. agent distinction and the "start simple" principle follow Anthropic's engineering post Building effective agents.
10
The 5-Layer Agentic Interoperability Protocol Stack
Production agent ecosystems decouple vertical tool access, horizontal peer-agent delegation, declarative generative UI, real-time audio/video streaming, and cryptographic value transfer into five distinct standards. Knowing which protocol governs each boundary is essential for architectural design.
The 5-Layer Agentic Protocol Stack
Layer & Direction
Protocols
Core Primitives
Use When
L1: Agent ↔ Tools & Data (Vertical)
MCP, OpenAPI
Tools, Resources, Prompts, structured isError over stdio or Streamable HTTP
Connecting an L1+ agent to deterministic databases, SaaS CRUD APIs, or IDE context (MCP guide).
Proving non-repudiable human spend authorization for purchases (AP2) or settling autonomous machine-to-machine API micropayments (x402).
11
RAG & Context Augmentation
RAG (Retrieval-Augmented Generation): Bypasses the model's static knowledge cutoff and drastically reduces extrinsic hallucinations by grounding synthesis in external, ACL-filtered enterprise data at query time.
User Query
Hybrid Vector + Lexical Search
Rerank & Filter ACLs
LLM Synthesizes Cited Answer
How it works: User asks a question → System converts the query into dense embeddings (plus sparse lexical keywords for exact IDs/SKUs) → Searches an ACL-filtered Vector Database (or live web index) → Top reranked passages are injected into the prompt → The LLM synthesizes a cited answer grounded strictly in retrieved evidence (see the RAG guide).
Vector Database: A specialized index storing text/multimodal chunks as high-dimensional embedding vectors, enabling retrieval by semantic similarity (meaning) rather than exact keyword overlap alone.
12
Risks, Ethics & Vulnerabilities
Risks & Vulnerabilities
Hallucinations: When a model generates factually incorrect, nonsensical, or fabricated responses. Combat via: grounded RAG, citation checks, autoraters, and human-in-the-loop review.
Extrinsic: model invents facts nowhere present in the source.
Intrinsic: model directly contradicts facts stated in the provided source.
Prompt Injection: An attacker embeds hidden adversarial instructions in user input (direct) or untrusted webpages, emails, or documents (indirect). When an AI reads the poisoned content, it can be hijacked to execute unauthorized tool calls or leak data (a zero-click exploit).
Jailbreaking: Intentionally tricking the AI into bypassing its safety guardrails (e.g., adversarial role-play personas or multi-turn framing to elicit restricted content).
Data Poisoning & Slopsquatting: Attackers inject malicious samples into public training/RAG sets, or register trojan code packages on PyPI/npm matching package names that coding LLMs frequently hallucinate.
Memorization & Privacy: LLMs can accidentally memorize and regurgitate Personally Identifiable Information (PII) or secrets over-represented in training data.
Detection & Provenance:
Watermarking: Subtly biasing token choices (text) or tweaking frequency-domain pixels/audio to embed imperceptible statistical AI signatures (e.g., Google DeepMind’s SynthID).
C2PA (Content Provenance): Attaching tamper-evident cryptographic metadata manifests to files to prove an audit trail of how media was captured and edited.
Automation Bias: The dangerous human tendency to over-trust fluent AI outputs without independent verification—especially critical in legal, medical, financial, and coding workflows. Rule of thumb: AI is a collaborator; accountable humans and policy gates are the final reviewers.
Ethics, Quality & Human Oversight
Human-in-the-loop: Match oversight to action blast radius and reversibility—require explicit human approval before irreversible external mutations.
Bias & fairness: Models can perpetuate societal prejudices present in pretraining data. Combat via: representative evaluation slices and counterfactual fairness audits.
Copyright & plagiarism: GenAI can unintentionally reproduce training works. Combat via: recitation filters, grounded citations, avoiding "mimic this exact living author" prompts, and independent verification.
13
Glossary
Tokens
Sub-word units of words, spaces, or characters processed by models (~4 English characters ≈ 1 token). Context limits and API billing—including internal System 2 thinking tokens—are metered in tokens.
Context window
The maximum token budget of a model per interaction (input prompt + retrieved context + tool schemas + thinking + visible response). Content pushed past that token limit is effectively "forgotten" unless saved to external state/memory.
Parameters
Learned numerical weights defining neural connections across dense or Sparse MoE layers. Training and fine-tuning update parameters to shape model behavior.
Temperature
Sampling setting controlling output randomness. Low temperature (0–0.3) is focused and consistent (even 0 is not strictly deterministic); high temperature (0.8–1.5) is creative/random. Some newer reasoning APIs remove custom temperature in favor of effort / thinking_level.
Fine-Tuning (SFT / LoRA)
Adapting a pre-trained model (or lightweight LoRA adapter matrices) on curated domain examples to master specialized schemas, tone, or compact task execution.
Consuming partner or open-weight models via managed, per-token serverless cloud APIs (scaling to zero) rather than operating dedicated GPU VMs.
thinking_level & Adaptive Thinking
System 2 inference-time reasoning controls: thinking_level (MINIMAL..HIGH) + encrypted thought_signatures on Gemini, and thinking: {type: "adaptive"} + output_config.effort (low..max) on Claude.
Custom GPTs / Gems / Projects
Specialized workspace assistants built on top of an LLM with persistent instructions, curated reference files, and bound tools.
Digital Twins
Virtual, dynamic computer models of real-world physical assets or operational systems used for simulation and scenario testing.
Agent capability level (L0 to L4)
Scoping scale from a single model call (L0) through tool use (L1), multi-step workflows/agents (L2), and multi-agent systems (L3) to self-extending systems (L4); choose the lowest level that solves the task.
Orchestration loop & Workflow vs. Agent
The runtime loop executing gather context → decide → act → observe with stop conditions. In a workflow, code fixes the step order; in an agent, the model chooses the next step at run time.
Drill 36 scenario questions covering PAA 3.1 model selection (LLM vs. SLM, MaaS vs. VPC), System 2 reasoning (thinking_level & Adaptive Thinking), prompting, training, L0–L4 scoping, the 5-Layer Protocol Stack, RAG, and AI safety.
Q1. What is the core difference between pretraining, RAG, and Supervised Fine-Tuning (SFT)?
Pretraining learns general language representations on massive uncurated data; RAG injects fresh, ACL-filtered external facts at query time without changing weights; SFT adapts weights on curated examples to master domain formatting, tone, or compact SLM tasks.
Q2. Why doesn't choosing an open-weight model (such as Llama or Gemma 4) automatically require deploying dedicated GPU VMs?
Open-weight checkpoints can be consumed via serverless Model-as-a-Service (MaaS) APIs billed per token with instant scale-to-zero. Dedicated VPC endpoints accrue GPU node-hour costs 24/7 even at 0 QPS and are needed only for strict single-tenant compute mandates, custom LoRA weights, or sustained high utilization.
Q3. How do System 2 reasoning controls differ between Gemini 4 Argon and Claude Opus 4.7?
Gemini 4 uses thinking_level (MINIMAL to HIGH) and emits encrypted thought_signatures that harnesses must echo across tool turns; Claude 4.7 uses Adaptive Thinking (thinking: {type: "adaptive"}) with 5 output_config.effort tiers (low to max) and automatic interleaved thinking between tool calls.
Q4. Why should a team pick the lowest agent capability level (L0–L4) that solves a task?
Each level up adds token cost, latency, failure modes, evaluation burden, and security exposure. Climb one level only when evaluation shows the lower level fails and a named capability (live data, dependent steps, isolated permissions) requires it.
Q5. How do MCP, A2A, A2UI/AG-UI, Live API, and AP2 + x402 divide responsibilities in the 5-Layer Protocol Stack?
MCP connects an agent vertically to tools and resources; A2A delegates tasks horizontally across opaque peer agents; AG-UI/A2UI/MCP UI render interactive human UIs safely; Live API/WebRTC handles full-duplex audio/video streams with barge-in; AP2 provides cryptographic spend Mandates while x402 handles HTTP 402 API micropayments.