Two men played every part. The hero and his enemy had the same throat
In the theatre at Athens, the greatest plays ever written were performed by two actors. Aeschylus used two; Sophocles was thought daring for adding a third. Everyone else on that stage was the chorus — which means two men had to cover every speaking part in the play between them. In the Oresteia, the man who came on as Agamemnon went off, set that face down, took up another, and returned as the man who had him killed. Nobody found this strange. The audience never saw a face all evening. They saw a painted mask with a hole for the mouth, and the Greek word for that mask was prosopon; the Romans called the same thing a persona. It is still the word we use for the thing you type to.
Piece two explained the machinery: a thing that reads what is on the page and guesses the next piece, over and over, forever. It ended with Echo unable to speak first. This piece is about the stagecraft that turns that into something which appears to be talking to you — and it is a lot more stagecraft than anyone tells you. There is no conversation happening. There is a script, rewritten from scratch every time you press send, and an actor who has no idea which lines are supposed to be yours.
Written for ages 12+, and for any adult who has been using one of these every day for two years and has never been shown what is actually being sent. Every chapter has a Deeper into the maze box for anyone who wants the harder version, and the real engineering words are all at the bottom.
the setting
There is no conversation. There is a script
When you type into a chat window you see something that looks like messaging a person: your words on one side, its words on the other, stacked up in order, arriving one after another over time. Every part of that is a drawing. It is a costume put on afterwards by the app, and underneath it there is one flat piece of text, with no bubbles, no sides and no time.
Here is what actually gets handed over. Your messages and its messages are written into a single document, one after the other, with little marks in between saying whose line is whose. That is the whole trick. The machine cannot tell a conversation from a play script, because as far as it is concerned there is no difference between them, and a play script is what it is given:
<|system|> You are a helpful assistant. Answer briefly and never invent facts. <|end|> <|user|> What should I cook tonight? <|end|> <|assistant|> What have you got in the house? <|end|> <|user|> Eggs, an onion, and some rice from yesterday. <|end|> <|assistant|>
Read the last line again. The document simply stops, in the middle, right after the mark that says the assistant is about to speak. That is not an accident of how I typed it out. That is the actual request. The machine is not asked a question and it is not asked to reply; it is handed an unfinished script and asked the only question it has ever been able to answer, the one from piece two: what comes next? Everything that feels like a conversation is what happens when you do that over and over and draw the results in bubbles.
slide the mask off. same conversation, both ways of looking at it
Token counts here use the usual rule of thumb for English, about four characters to a token — and that rule is a piece of English good fortune, not a law. We measured what it costs in Amharic. Whisper's tokenizer has no Ge'ez in it at all, so it falls back to bytes and every single fidel costs three tokens: ው is three, ሻ is three, a whole word is a dozen before you have said anything. Across six real Amharic recordings the same speech ran 5.6 to 7.8 times more tokens than a tokenizer that knows the script. The conversation above is in English because that is the cheap case. The next box is the expensive one.
Deeper into the maze
The layout with the angle brackets is a chat template, and the marks themselves are special tokens — entries added to the vocabulary that no ordinary text can produce, so a person typing the literal characters cannot forge a role. Each model family has its own template, and using the wrong one degrades a model badly while looking perfectly fine.
The overhead is small per turn and relentless in aggregate. Opening and closing a turn costs about 4 tokens, so a twenty-turn conversation spends roughly 80 tokens on nothing but stage directions, plus the system line re-sent twenty times over. That is the third readout in the instrument, and it is why the number climbs even when you say something short. It over-states them a little: the instrument prices everything at four characters to the token, while a real tokenizer gives each special mark a single id however wide it looks on the page.
Four-characters-to-the-token is a fair estimate only of English. A tokenizer earns short tokens for whatever was common in the pile it was trained on; Ge'ez was not in that pile, so Whisper's tokenizer contains no Ge'ez at all and falls back to raw UTF-8 bytes — three bytes per fidel, and therefore three tokens per character. One 11-second Amharic sentence of 85 fidel costs 254 tokens under the default tokenizer and 33 under one taught the script: the same sound, the same meaning, at 7.7× the price, charged again on every turn.
your words + ~4 tokens of markers per turn + the system line, again = one request English ~4 characters per token · Ge'ez under byte fallback 1 character = 3 tokens
before the curtain
The lines that were written before you arrived
Look at the top of that script again. Before your first word there is a line you did not write and were never shown: You are a helpful assistant. Answer briefly and never invent facts. Every chat you have ever had began with one. It is usually much longer than that — a few hundred to a couple of thousand words describing who the character is, what it must refuse, what today's date is, how to format a list, and which of its own abilities it is allowed to mention.
The instinct is to imagine this as a control panel: settings, wired into the machine, on some separate and more privileged channel than the one you type into. It is nothing of the sort. It is just more text, at the top of the same document. Same marks, same tokens, same everything. Its only advantage over what you write is that it comes first, and the model has been trained on a great many examples where the words at the top were followed.
Once you have seen that, an entire family of problems stops being surprising. If instructions are only text, and the model reads the document it is given, then any text that reaches the document can give instructions — including text the machine fetched from a web page, or a document you asked it to summarise, or a message somebody else wrote. There is no ink that only the operator can write in. There is one stream, and everything in it is read by the same eyes.
same question, three opening lines. only the top of the document changes
The three replies here were written by us, to show the effect cleanly. There is no language model running on this page and it would be dishonest to imply one. Everything structural — where the line sits, what it is made of, what the window hides — is exactly what really happens.
Deeper into the maze
The opening line is the system prompt. Production ones run 500 to 2,000 tokens and are re-sent on every single turn, so a long-running chat can spend more on re-reading its own instructions than on anything either party has said.
The consequence in the third paragraph above has a name: indirect prompt injection. It is not a bug in a particular product and it does not have a patch, because it follows from the architecture. The model consumes one undifferentiated token stream; instructions and data are the same substance; therefore any channel that can put text into that stream is an instruction channel. The defences that work are ones that assume this — restricting what the model is permitted to do after reading untrusted text, rather than trying to teach it which text to trust.
no privileged channel · instructions and data are the same tokens · so: limit the actions, not the reading
the second actor
One actor plays both parts
Now the part that genuinely surprises people, and the reason this piece is about the Athenian stage rather than anything else. With two actors covering every part, the hero and the man who destroys him were routinely the same performer in different masks. Two characters could never argue face to face unless two actors were on stage — but across an evening, one throat spoke for both sides of the story, and the audience accepted it completely.
The thing completing your script is in exactly that position, and it is worth being very precise about why. It was trained on documents. A document containing a conversation is just a document. Nothing about the marks in it says that some lines belong to a person who is still alive on the other side of a wire. Handed a script that breaks off after <|assistant|>, it will write the assistant's line. Then, given the chance, it will write the mark for your turn, and then your line, and then its reply to the line it invented for you, and it will keep doing that until something stops it. It is not confused when it does this. It is doing the only thing it does.
What stops it is one mark: a single token meaning this turn is over. The program running the model watches every piece as it comes out, and the instant that one appears it cuts the stream and hands the turn back to you. That is the whole mechanism. The neat alternation of a chat — you, then it, then you — is not a property of the machine. It is a pair of scissors held by the app, and the fact that the machine was taught where to want them.
take the mark away and watch who writes your next message
This is not a hypothetical. It is exactly what a raw, untrained-for-chat model does if you hand it a transcript, and it is why the very first models people tried to talk to would cheerfully hold both ends of the discussion. The lines it invents for you are, as always, the most likely ones — which is why they are so agreeable.
Deeper into the maze
The mark is an end-of-turn token (in older models, the end-of-sequence token). It is one entry in a vocabulary of roughly 100,000 to 200,000 pieces, and at every step it competes for probability against all the others exactly like a word does. The model does not "decide to stop"; it assigns that token a high enough probability that it gets chosen, and the surrounding program treats its appearance as an instruction to stop reading.
So a turn ends because of two separate things that both have to be true: the model has to have been trained to want the mark there, and something outside the model has to be watching for it. Break the second and a well-trained model runs on regardless. This is also why stop sequences exist as a setting in every serious interface — a way of saying "cut here as well", for the cases where the training is not enough.
1 token out of ~150,000 · the model proposes it · the harness enforces it · break either half and it never stops
from the top
It reads the whole play again, every single turn
Here is the fact that reorganises everything else. Between one of your messages and the next, the machine keeps nothing. Not a summary, not a note, not a feeling about how the conversation has been going. When you press send, the app takes every message either of you has ever sent in this chat, plus the system line, rebuilds the whole script from line one, and hands the entire thing over as if for the first time.
So the conversation you think you are having — where it remembers that you have eggs because you said so four messages ago — is not memory. It is re-reading. It knows about the eggs because the sentence about the eggs is right there in the document it was handed thirty seconds ago, along with everything else, again. Nothing persists. The script is the only thing that has ever persisted, and it is rebuilt from scratch every time.
This has a consequence you can feel in your pocket. On turn one it reads one exchange. On turn twenty it reads twenty. The work of a conversation is not its length; it is the length added up over every turn, which grows much faster. A conversation twice as long does not cost twice as much — it costs three or four times as much, tending toward four as the chat gets long enough for the exchanges to outweigh the fixed system line. And your first sentence has by then been read twenty times over.
drag the conversation longer and watch the pile, not the bar
Deeper into the maze
The model is stateless between calls: identical script in, identical distribution out, with no hidden carry-over. That is a design choice with a real benefit — any turn can be replayed, retried or moved to a different machine, because the script is the entire state.
The re-reading is not quite as wasteful as it looks, and the reason is worth having. Because the model only ever looks backwards — piece two's rule, the eyes that cannot see forward — the internal work done for the first hundred tokens cannot be changed by anything that arrives later. So it is computed once and kept: the KV cache. A cached turn is re-read at a fraction of the cost of a fresh one. What the cache buys back is time, not the shape of the curve: the total is still the sum from 1 to N, still proportional to N², and the cache itself grows with the conversation until it is the thing filling the memory.
turn N reads N exchanges · total after N turns = N(N+1)/2 · 20 turns → 210 exchange-reads, not 20
the length of the scroll
The scroll has an end, and the top falls off it
If every turn hands over the whole script, and the script only ever gets longer, then something has to give. It does. Every model has a fixed maximum amount it can be shown at once — a room of a certain size, and no larger. When the script outgrows the room, the oldest lines are dropped off the top to make space, quietly, by the app, before the model ever sees it.
This is the mechanism behind the single most common complaint people have about these things: it forgot what I told it. It did not forget, because it never remembered; there is no forgetting to be done. What happened is that the sentence was cut out of the script before it was handed over, so the machine you asked was never shown it. Ariadne's thread from piece two, with the far end quietly being coiled up behind you as you walk.
It is worth knowing that the room has grown enormously — from four or five pages of text in the early models to the length of a shelf of novels in the current ones — and equally worth knowing that a big room is not the same as good eyesight in it. Things in the middle of a very long script get attended to markedly less reliably than things at the very start or the very end, which is a measured effect and not a rumour. A machine that can be shown a thousand pages is not a machine that has read a thousand pages the way you would.
the first line says her sister does not eat eggs. shrink the room until it falls out, then ask
Both of those replies are written by us, as in instruments 02 and 03 — what the instrument genuinely computes is which lines are still inside the room and which have been dropped before sending, and it picks the reply to match. The behaviour is real; the wording is ours.
Deeper into the maze
The room is the context window, measured in tokens, and it is a hard architectural limit rather than a preference: exceed it and the request is refused, so the app must drop, summarise or retrieve something first. Early production models held about 2,048 tokens — four or five pages. 128,000 is now unremarkable, more than a dozen frontier models ship 1,000,000, and the largest advertise 10,000,000, which is a shelf of novels.
The caveat in the chapter is measured, not folkloric. Put a needed fact at various depths in a long context and accuracy is highest when it sits near the beginning or the very end, and sags in the middle — the "lost in the middle" effect, reference 3 below. So the useful window is meaningfully smaller than the advertised one, and an app that silently trims your oldest turns is often making a better trade than one that keeps everything and buries it.
Those are the rooms for the conversation. Machines that listen have a second room, for the answer, and it is much smaller: the model we build on can emit at most 448 tokens, a ceiling set by the size of its learned position marks. Put the two facts from the last box together and the arithmetic turns cruel. Three tokens per fidel means an Amharic sentence fills that room at roughly six times the rate of an English one, and we measured one 20-second recording — 149 fidel — landing on 444 tokens against a working budget of 443. It hit the wall while the microphone was still open. The sting is that the training pipeline then truncates the reference transcript mid-character and scores the model against the shortened version, so the number on the report comes out better than the transcript, and nobody notices. Teaching the tokenizer the script fixes it: on the utterances that overflowed, error fell from 17.5% to 10.1%.
2,048 → 128,000 → 1,000,000 → 10,000,000 tokens · advertised length ≠ reliable length Whisper's answer-room: 448 tokens · 1 fidel = 3 tokens · the wall arrives near the 24th second
the face
The mask is not the face
Which leaves the question everyone actually wants answered: if the assistant is a part being played, who is playing it? Piece two gave the machinery, and one paragraph near its end gave the rest: the model learns to finish sentences from an enormous pile of writing, and only afterwards do people sit with it for months, grading its answers — helpful, rude, invented, dangerous — until it is shaped into something you would want to talk to. Pandora, built first and furnished second. Piece seven is the whole story of how that grading works.
What the stagecraft in this piece adds is where that shaping actually lives. It is not a separate program bolted on top, and it is not a filter the answer passes through on the way out. It is in the same weights that do everything else, expressed as a strong preference for how a document that starts like this tends to continue. The assistant is a character the machine is very good at performing, because it was drilled until that performance was the most likely completion of a script with those marks at the top of it.
So when people ask what it is really like behind the mask, they are asking a question shaped like Pentheus's in the Bacchae — he could not accept that the smiling stranger might not have an ordinary face behind the smile, went up the mountain to see for himself, and it went extremely badly. The honest answer is not that there is a hidden face, and not that there is nothing there at all. It is that behind the mask is a machine that can wear a great many masks, and the one it is wearing was chosen by the first few hundred words of a document. Take those words away and it will not become its true self. It will just carry on writing whatever the page in front of it seems to be.
same weights, three different opening frames. the last one has no mask at all
The completions here are written by us, as in instrument 02. The behaviour they illustrate is real and is the standard demonstration of the difference between a raw model and one trained to hold a turn.
Deeper into the maze
The third setting is a base model — the thing straight out of the forge, which does next-token prediction and nothing else. The first two are the same network after instruction tuning and preference training, the process piece seven is about. The shaping is a small fraction of the original effort, though the gap has narrowed sharply: pre-training runs to trillions of tokens, while the instruction and preference stages ran to tens of thousands of examples in the first published recipes and to millions in current ones — Llama 3 alone used over 2.7 million examples for supervised fine-tuning, most of them generated rather than hand-written.
That ratio is the argument of this chapter in one number. Almost everything the model knows arrives in the forge; almost everything about who it appears to be arrives in the last, comparatively tiny stage. Which is why the persona is best understood not as a self but as a conditional distribution — the machine's answer to "given a document that opens like this, what usually follows?" — and why changing the opening changes the character without touching a single weight.
~10¹³ tokens of forge · ~10⁶ examples of manners · the second one is the part you talk to
the glossary
The words the engineers use
| the script everyone is really working from | the context, or the prompt |
| the marks saying whose line is whose | a chat template (ChatML and its relatives) |
| marks no typing can forge | special tokens, reserved in the vocabulary |
| a script the tokenizer was never taught | byte fallback — the character is spelled out in UTF-8 bytes, one token each |
| the room the answer has to fit in | the decoder's positional-embedding limit (448 for Whisper) |
| the bubbles, the sides, the arriving in order | the client rendering; none of it reaches the model |
| the line written before you arrived | the system prompt |
| no ink only the operator can write in | no privileged channel; instructions and data share one stream |
| a fetched page that gives orders | indirect prompt injection |
| the mark that ends a turn | the end-of-turn token (older: end-of-sequence, EOS) |
| the scissors held by the app | the harness, or the inference loop |
| “cut here as well” | stop sequences |
| keeping nothing between turns | stateless inference |
| reading the whole thing again | re-processing the full context each turn |
| the work saved because the eyes look backwards | the KV cache |
| why twice as long costs four times as much | total context read grows as N² |
| the size of the room | the context window |
| the top falling off | truncation, or a sliding window |
| a big room is not good eyesight | the “lost in the middle” effect |
| the actor before any part was assigned | a base model, or a pretrained model |
| being taught to hold a turn | instruction tuning (supervised fine-tuning) |
| the months of grading | preference training, RLHF |
| the mask, described precisely | a conditional distribution over continuations |
| one word for the whole illusion | persona — the Latin for the mask the Greeks called a prosopon |
One sentence to take away
A chat is not a conversation with something that remembers you; it is a single document, rebuilt and re-read from the top every time you press send, performed by an actor who will write your lines too if nothing cuts him off.
Which is not a reason to think less of it. Two men and a chorus, in daylight, wearing painted faces, made the audience at Athens weep for a woman who was not there. Knowing exactly how the effect is produced has never once stopped it working.
the sources
Where these ideas come from
The stagecraft is Athenian; the machinery performing it is from these papers. Each note says what the paper actually established.
- A. Askell et al., “A General Language Assistant as a Laboratory for Alignment” (2021). The assistant treated openly as a character to be designed rather than a thing to be discovered — including how much of that character can be set by the opening lines of the context alone.
- L. Ouyang et al., “Training language models to follow instructions with human feedback” (2022). InstructGPT: where the manners come from, and the source of the ratio in chapter six — a comparatively tiny amount of instruction and preference data turning a document-completer into something that holds a turn.
- N. F. Liu et al., “Lost in the Middle: How Language Models Use Long Contexts” (2023). The measurement behind chapter five's caveat: accuracy is highest when the needed fact sits at the start or the end of a long context, and sags when it is buried in the middle.
- K. Greshake et al., “Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” (2023). The paper that made chapter two's consequence concrete: text retrieved from elsewhere is read with the same eyes as the operator's instructions, because there is only one stream.
- S. Feyissa, “Recovering Whisper's Output Capacity for Amharic” (2026). Our own, and the source of every Ge'ez number in this piece: a four-condition study holding data, architecture and compute fixed and changing only the tokenizer. It establishes that byte fallback costs three tokens per fidel, that the 448-token output ceiling therefore binds mid-utterance, that the standard training pipeline hides this by scoring against a truncated reference, and that extending the tokenizer recovers the lost capacity — with decoding about three times faster for the same audio.
- R. Pope et al., “Efficiently Scaling Transformer Inference” (2022). The engineering of the re-reading in chapter four, including why the KV cache is what makes long conversations tolerable and how it becomes the memory bottleneck itself.