Attention, Transformers and Foundation Models

Introduction and Context

Deep learning systems traditionally process information sequentially or through local receptive fields. Recurrent neural networks (RNNs) read one item at a time, while convolutional neural networks (CNNs) emphasize nearby patterns. These designs are useful, but they can struggle when a prediction depends on relationships between distant elements. In language, for example, the meaning of a pronoun may depend on a noun many words earlier. In an image, an object may be interpreted using evidence distributed across the whole scene.

Attention provides a general solution: instead of treating every input element equally, a model learns which elements are relevant to a current representation. The Transformer architecture develops this idea using self-attention, positional information and feed-forward transformations. Transformers now support machine translation, document analysis, code generation, speech processing, image understanding and multimodal systems.

A foundation model is a large pretrained model intended to support many downstream tasks. It is usually trained on broad data using self-supervised objectives and then adapted through prompting, fine-tuning, retrieval or other methods. Foundation models offer substantial capability, but they also introduce risks involving bias, privacy, security, reliability, cost and accountability.

Learning Objectives

After studying this chapter, you should be able to:

1. Explain the motivation for attention and self-attention.
2. Calculate and interpret scaled dot-product attention.
3. Describe positional encoding and why sequence order must be represented.
4. Distinguish encoder-only, decoder-only and encoder–decoder Transformers.
5. Explain transfer learning, pretraining and adaptation methods.
6. Describe the basic operation, uses and limitations of large pretrained models.
7. Select suitable evaluation, governance and deployment practices for a practical AI system.

1. From Sequential Processing to Attention

Suppose a sequence contains vectors x₁, x₂, ..., x_n, where each vector represents a token, patch or other input element. An RNN updates a hidden state as it moves through the sequence. This creates a processing bottleneck: information from early positions must be carried through many updates before it influences a later prediction. Long sequences can therefore produce optimization and memory difficulties.

Attention creates direct information paths between positions. For a query position, the model compares its representation with representations of possible information sources. It assigns larger weights to relevant sources and combines them into a context vector. The operation is differentiable, so the weights are learned through gradient-based training.

Attention is not the same as human visual attention, nor does an attention weight automatically constitute a reliable explanation. It is a learned computational mechanism for weighted information aggregation.

Important terminology

• Token: A unit processed by a model, such as a word fragment, character or special symbol.
• Embedding: A numerical vector representing a token or other input.
• Query: A representation asking what information is relevant.
• Key: A representation used to assess whether a source matches a query.
• Value: The information retrieved when a source is selected.
• Context vector: A weighted combination of values.
• Head: One attention operation with its own learned projections.
• Context window: The maximum amount of input considered by a model in one operation.

2. Scaled Dot-Product Attention

For an input sequence, learned linear projections produce query, key and value matrices, conventionally denoted Q, K and V. If the key dimension is d_k, scaled dot-product attention is defined by:

Here, Q has one row per query, K and V have one row per source position, and K and Q share the inner dimension d_k. The transpose Kᵀ makes QKᵀ a matrix of pairwise compatibility scores. Division by √d_k prevents dot products from becoming excessively large as the dimension grows. The softmax function converts each row of scores into non-negative weights that sum to 1. The result is a weighted combination of value vectors.

For a score vector z = (z₁, ..., z_n), the softmax component at position i is:

The exponential function makes larger scores receive greater weights. In implementation, a numerically stable form subtracts the maximum score before exponentiation; this does not change the result because the same constant is removed from every exponent.

A small worked example

Assume one query compares with two keys and produces unscaled scores 2 and 1. If d_k = 1, scaling has no effect. The attention weights are approximately:

e²/(e²+e¹) ≈ 0.731 and e¹/(e²+e¹) ≈ 0.269.

If the corresponding scalar values are 10 and 20, the context is:

0.731×10 + 0.269×20 ≈ 12.69.

The output is closer to 10 because the first source received the larger weight. This example illustrates weighted retrieval; real Transformers operate on matrices and high-dimensional vectors.

Self-attention

In self-attention, Q, K and V are computed from the same sequence representation, although they use different learned projection matrices. Each position can therefore incorporate information from other positions in that sequence. Self-attention may be:

• Bidirectional: Each position can attend to earlier and later positions. This is common in encoder models.
• Causal or masked: A position can attend only to itself and earlier positions. This is necessary for left-to-right generation, because future target tokens must not be visible during training.
• Cross-attention: Queries come from one sequence and keys and values come from another, as in a decoder attending to encoder outputs.

A causal mask adds a very negative value to prohibited score locations before softmax. In the limiting case, their attention weights become zero.

3. Multi-Head Attention

A single attention operation may learn one pattern of relationships. Multi-head attention performs several attention operations in parallel:

Here, W_i^Q, W_i^K, W_i^V and W^O are learned matrices, h is the number of heads, and Concat joins the head outputs along the feature dimension. Different heads can specialize in different relationships, such as syntactic agreement, local context or long-range reference. This interpretation is useful as a hypothesis, but head behavior is not guaranteed to correspond neatly to human linguistic categories.

The original Transformer commonly distributes the model dimension across heads so that computational cost remains manageable. If the model dimension is d_model and the heads use equal dimensions, each head has dimension approximately d_model/h. Exact implementation choices vary.

4. Positional Information

Self-attention by itself does not inherently know whether a token appears first, second or last. If the same token vectors are supplied in a different order and no positional information is added, the attention mechanism has insufficient information to distinguish those orders. Position must therefore be represented.

Sinusoidal positional encoding

One early Transformer design adds deterministic sinusoidal vectors to token embeddings. For position pos and feature index i, the encoding is:

Here, d_model is the embedding dimension and i indexes pairs of dimensions. The arguments of sine and cosine are dimensionless; position is treated as an index rather than a physical unit. Different dimensions vary at different frequencies, producing a distinctive pattern for each position.

Other approaches include learned absolute position embeddings, relative position representations and rotary position embeddings. Relative methods focus on distances or directional relationships, while rotary methods transform query and key vectors so that their interaction reflects relative position. No method is universally best: performance depends on sequence length, architecture, training data and task.

5. The Transformer Block

A typical Transformer block contains attention, a position-wise feed-forward network, residual connections and normalization. A simplified conceptual sequence is:

1. Compute attention outputs.
2. Add the input through a residual connection.
3. Normalize the representation.
4. Apply a feed-forward network independently at each position.
5. Add another residual connection and normalize again.

A common feed-forward network is:

Here, x is a position representation, W₁ and W₂ are learned matrices, b₁ and b₂ are biases, and σ is a nonlinear activation such as ReLU or a modern gated alternative. The same feed-forward parameters are generally reused across positions within a block, but different blocks have different parameters.

Residual connections help information and gradients move through many layers. Normalization helps control activation scale and improves optimization. Exact ordering, such as pre-normalization versus post-normalization, differs among model families.

Computational considerations

For sequence length n and representation dimension d, the attention score matrix has approximately n×n entries. Thus, standard full attention has quadratic memory and time growth in sequence length for its pairwise interaction component. Long-context systems may use sparse, sliding-window, low-rank or other efficient attention methods. These methods reduce cost but can change which relationships are directly available.

Figure: Simplified encoder–decoder Transformer. The decoder uses causal self-attention and may use cross-attention to encoder representations.

6. Encoder, Decoder and Encoder–Decoder Designs

Encoder-only models

An encoder reads an input sequence, usually with bidirectional attention, and produces contextual representations. A classification layer can use a pooled representation, while token-level tasks can use each contextual token. Masked-language pretraining, in which selected tokens are predicted from surrounding context, is associated with this design. Encoder-only models are effective for classification, information extraction, semantic search and sequence labeling.

Decoder-only models

A decoder-only model uses causal self-attention. During training it predicts the next token from preceding tokens. At inference, it generates one token, appends it to the context and predicts again. This autoregressive process supports dialogue, completion, code generation and general text generation. It can be computationally expensive for long outputs because generation is sequential, although key–value caching avoids recomputing earlier attention projections in many implementations.

Encoder–decoder models

An encoder–decoder model first encodes an input and then generates an output. The decoder performs masked self-attention over the partial output and cross-attention over encoder representations. This arrangement is especially natural for translation, summarization and structured transformation tasks.

7. Pretraining and Transfer Learning

Training a large model from random initialization requires substantial data, compute and engineering. Transfer learning reduces the cost of solving a new task by reusing representations learned from a broader source task.

A typical workflow is:

1. Pretraining: Learn general representations from large-scale data, often using self-supervised prediction.
2. Adaptation: Adjust the model for a task, domain or interaction style.
3. Evaluation: Test on representative, adversarial and safety-related data.
4. Deployment and monitoring: Observe performance, drift, misuse and operational cost.

Self-supervised learning creates targets from the data itself. Next-token prediction uses preceding tokens as input and the following token as a target. Masked-token objectives hide selected tokens and train the model to reconstruct them. Other objectives may align text with images, classify spans or denoise corrupted inputs.

Adaptation methods

• Full fine-tuning: Update most or all model parameters using task-specific data. It can achieve strong specialization but requires substantial memory and can cause catastrophic forgetting.
• Parameter-efficient fine-tuning: Update a small number of parameters or low-rank adapters while keeping the base model mostly fixed. This reduces storage and training cost.
• Prompting: Express the task in an input instruction, possibly with examples. It requires no parameter updates, but results can be sensitive to wording and context.
• Retrieval-augmented generation (RAG): Retrieve relevant documents and supply them to a generator at inference time. RAG can improve freshness and citation, but retrieval errors or malicious documents can still mislead the model.
• Distillation: Train a smaller student model to approximate a larger teacher. This can reduce latency and cost, sometimes at the expense of capability.

Fine-tuning is not a substitute for data governance. Poor-quality or unrepresentative adaptation data can amplify bias and encode confidential information.

8. How Large Pretrained Models Operate

At a high level, a language model converts text into tokens, maps tokens to vectors, processes them through repeated Transformer blocks and produces a probability distribution over possible next tokens. If the model estimates P(x_t | x_<t) for each next token, the probability of a sequence is factorized as:

Here, T is the number of tokens and x_<t denotes all preceding tokens. During generation, a decoding procedure selects tokens from the predicted distribution. Greedy decoding selects the highest-probability token at each step. Sampling introduces controlled randomness; temperature modifies the sharpness of the distribution, while top-k or nucleus sampling restricts candidate choices. These methods change output selection, not the underlying factual reliability of the model.

A model does not store a conventional searchable database of sentences. Knowledge is represented in distributed parameters and can be incomplete, outdated or inconsistently accessed. A fluent answer is therefore not proof of truth. Models may hallucinate: they can generate plausible but unsupported statements, citations or calculations.

9. Applications and Professional Use

Transformers and foundation models are used for:

• document classification and routing;
• sentiment, intent and topic analysis;
• named-entity recognition and information extraction;
• translation and summarization;
• question answering over organizational documents;
• code completion, testing and documentation;
• speech recognition and multimodal analysis;
• recommendation and semantic search;
• scientific and medical literature assistance.

In professional settings, the appropriate role is often decision support rather than unsupervised decision authority. A document assistant may retrieve a policy, summarize it and cite the source, while a human remains responsible for interpretation and action. High-impact uses require stronger validation, auditability and human review than low-risk drafting.

Evaluation

Evaluation should match the real task. Classification may use accuracy, precision, recall and F1 score. For binary classification:

Here, TP, FP and FN denote true positives, false positives and false negatives. These metrics assume clearly defined labels and should be interpreted with class balance and decision costs in mind. Generative systems additionally require factuality, groundedness, toxicity, privacy, robustness, latency and cost evaluation. Human assessment remains important, but evaluators need clear rubrics and representative samples.

10. Illustrative Case: A University Policy Assistant

Background

A fictional university wants an assistant that answers questions about assessment rules, attendance and academic integrity. The policy documents change each academic year, and incorrect answers could disadvantage students.

Problem

A general language model can produce fluent responses but may rely on outdated training data or invent a policy. The university needs current, traceable answers and a way to identify uncertainty.

Analysis

The task is primarily document-grounded question answering, not open-ended conversation. The relevant knowledge is contained in approved policies. A model should therefore retrieve authoritative passages before generating an answer.

Approach / Solution

The university creates a controlled document repository, records policy version and approval date, splits documents into meaningful sections, and computes embeddings for semantic retrieval. At question time, the system retrieves candidate passages, applies access controls, and supplies the passages to a language model with an instruction to answer only from the supplied evidence. The response includes citations, the policy date and an escalation route. Questions involving disciplinary decisions are transferred to staff rather than answered automatically.

The system is tested using questions from different faculties, deliberately ambiguous questions, outdated-policy questions and attempted prompt injection inside documents. Staff review a sample of answers each month. Retrieval quality and answer groundedness are measured separately, because a correct generator cannot compensate for retrieving the wrong policy.

Outcome

In this illustrative scenario, the system reduces routine staff enquiries and makes policy versions visible. It does not eliminate errors: ambiguous wording, incomplete documents and conflicting policies still require human interpretation.

Learning points

1. Retrieval can provide current evidence but does not guarantee correct reasoning.
2. Version control and citations are as important as model selection.
3. High-impact cases need escalation and human accountability.
4. Evaluation must include failure cases, not only average usefulness.

11. Limitations, Risks and Governance

Data and representation

Pretraining data may contain social stereotypes, toxic language, copyrighted material or private information. A model can reproduce or amplify these patterns. Filtering reduces some risks but can also remove legitimate educational or cultural content and may create blind spots.

Reliability and uncertainty

Language models optimize predictive objectives, not truth. They may be confidently wrong, vulnerable to ambiguous prompts and sensitive to small changes in wording. Probability estimates over tokens are not automatically calibrated probabilities that an answer is factually correct.

Security

Prompt injection attempts to manipulate instructions through user input or retrieved content. Data leakage may occur when confidential information is placed in prompts, logs or training data. Model outputs can assist phishing, fraud or other abuse. Defenses include input and output controls, least-privilege tool access, isolation of untrusted content, logging and red-team testing.

Privacy and regulation

Organizations should establish a lawful basis for processing personal data, minimize data collection, define retention periods and control vendor access. Sensitive decisions require documented accountability, impact assessment and a mechanism for human review. Applicable privacy, copyright, accessibility and sector-specific regulations must be considered; a model’s vendor policy does not replace organizational legal obligations.

Environmental and economic cost

Large training and inference workloads require energy, hardware and specialized expertise. Practical choices include smaller models, caching, batching, quantization, distillation and routing simple tasks to simpler systems. Cost and latency should be reported alongside accuracy.

Interpretability

Attention visualizations can show which positions influenced a computation, but they should not be treated as complete causal explanations. Explanations should be validated against model behavior and supplemented with evidence, testing and audit logs.

12. Contemporary Developments and Best Practices

Current research explores efficient long-context attention, multimodal models, mixture-of-experts architectures, on-device inference, model compression, tool use and agents. These developments expand capability but also increase system complexity. An agent that can call tools introduces risks beyond text generation, including unauthorized actions and cascading errors.

Good practice for a diploma-level practitioner includes:

1. Define the task, users, harm scenarios and success criteria before selecting a model.
2. Use the smallest model that satisfies the requirement.
3. Keep training, validation and test data separate, and test across relevant user groups.
4. Ground factual answers in authoritative sources where possible.
5. Protect personal and confidential data throughout the pipeline.
6. Apply access controls, logging, rate limits and human escalation.
7. Evaluate normal, adversarial, ambiguous and out-of-distribution inputs.
8. Monitor drift, errors, latency, cost and user complaints after deployment.
9. Document model version, data sources, limitations and known failure modes.
10. Treat generated content as a proposal requiring verification in consequential contexts.

Chapter Summary

Attention enables a model to construct context by weighting information from relevant positions. Scaled dot-product attention uses queries, keys and values; multi-head attention learns several relationship patterns in parallel. Because attention alone does not encode order, Transformers add positional information. A Transformer block combines attention, residual connections, normalization and feed-forward computation.

Encoder-only, decoder-only and encoder–decoder architectures support different patterns of representation and generation. Foundation models are pretrained on broad data and adapted through prompting, fine-tuning, parameter-efficient methods, retrieval and distillation. Their applications include language understanding, generation, search, translation, coding and multimodal assistance. However, fluency does not guarantee truth, and risks include bias, privacy loss, prompt injection, hallucination, outdated knowledge, cost and environmental impact. Responsible deployment requires task-specific evaluation, evidence grounding, security controls, documentation and human accountability.

Key Terms

Attention: A differentiable mechanism that computes a weighted combination of information.

Causal attention: Attention restricted to the current and preceding positions.

Context window: The maximum input context processed in one model operation.

Cross-attention: Attention in which queries and key–value sources come from different sequences.

Decoder-only model: A Transformer using causal attention for autoregressive generation.

Embedding: A learned numerical vector representing an input item.

Encoder-only model: A Transformer designed primarily to produce contextual representations.

Foundation model: A broadly pretrained model adaptable to many downstream tasks.

Hallucination: A plausible but unsupported or incorrect generated statement.

Key: A representation used to compare a source with a query.

Multi-head attention: Parallel attention operations whose outputs are combined.

Positional encoding: Information supplied to represent sequence position or relative order.

Prompt injection: An attempt to manipulate a system through instructions in input or retrieved content.

Query: A representation used to request relevant information.

Retrieval-augmented generation: Generation supported by documents retrieved at inference time.

Self-attention: Attention where queries, keys and values are derived from the same sequence.

Token: A unit of model input or output, often a word fragment.

Transfer learning: Reusing knowledge learned on one task or dataset for another.

Value: The information combined according to attention weights.

Review Questions

5 Short Answer Questions

1. Why is scaling by √d_k used in dot-product attention?
2. What problem does positional encoding solve?
3. Distinguish self-attention from cross-attention.
4. State one typical use of an encoder-only model and one typical use of a decoder-only model.
5. What is retrieval-augmented generation?

5 Long Answer Questions

1. Explain scaled dot-product attention, defining queries, keys, values, scores and weights.
2. Describe the main components of a Transformer block and the purpose of residual connections.
3. Compare encoder-only, decoder-only and encoder–decoder architectures.
4. Explain pretraining and at least three methods of adapting a foundation model.
5. Discuss the reliability, privacy and security limitations of large pretrained models.

3 Analytical / Application Questions

1. A company needs to summarize current internal policies and provide citations. Propose an architecture and explain how you would evaluate it.
2. A chatbot gives fluent but incorrect answers to rare technical questions. Analyze possible causes and recommend technical and governance controls.
3. A small organization must choose between full fine-tuning, parameter-efficient fine-tuning and prompting. Develop a decision framework using data volume, cost, privacy, latency and required specialization.

Multiple Choice Questions with Answers

Question 1

What is the main purpose of dividing attention scores by √d_k?

A. To encode token positions

B. To control the scale of dot products before softmax

C. To remove the value matrix

D. To make attention causal

Correct Answer: B. To control the scale of dot products before softmax

Question 2

In self-attention, where do queries, keys and values originate?

A. Only from the output vocabulary

B. From three unrelated datasets

C. From projections of the same input sequence

D. Only from encoder outputs

Correct Answer: C. From projections of the same input sequence

Question 3

Which architecture is most directly associated with left-to-right text generation?

A. Decoder-only Transformer with causal attention

B. Encoder-only Transformer with bidirectional attention

C. CNN without positional information

D. Autoencoder with no attention

Correct Answer: A. Decoder-only Transformer with causal attention

Question 4

If attention scores are 2 and 1 with d_k=1, what is the approximate weight of the first score?

A. 0.119

B. 0.269

C. 0.500

D. 0.731

Correct Answer: D. 0.731

Question 5

Why is positional information required in a standard self-attention mechanism?

A. Self-attention cannot otherwise distinguish sequence order reliably

B. It prevents all forms of parallel processing

C. It converts values into labels

D. It removes the need for embeddings

Correct Answer: A. Self-attention cannot otherwise distinguish sequence order reliably

Question 6

Which method supplies retrieved documents to a generator at inference time?

A. Distillation

B. Retrieval-augmented generation

C. Greedy decoding

D. Residual normalization

Correct Answer: B. Retrieval-augmented generation

Question 7

What is a defining feature of cross-attention in an encoder–decoder model?

A. Queries and key–value sources come from different sequences

B. All future tokens are always visible

C. No learned projections are used

D. It replaces positional information

Correct Answer: A. Queries and key–value sources come from different sequences

Question 8

Which statement about hallucination is most accurate?

A. It means the model refuses every uncertain request

B. It is a guaranteed result of using softmax

C. It is the generation of plausible but unsupported or incorrect content

D. It occurs only in image models

Correct Answer: C. It is the generation of plausible but unsupported or incorrect content

Question 9

Which metric is defined as TP/(TP+FN)?

A. Precision

B. Recall

C. Accuracy

D. F1 score

Correct Answer: B. Recall

Question 10

Why can standard full attention become expensive for long sequences?

A. Its pairwise score matrix grows approximately quadratically with sequence length

B. It cannot use matrix multiplication

C. It always requires one processor per token

D. Its vocabulary becomes quadratic

Correct Answer: A. Its pairwise score matrix grows approximately quadratically with sequence length