A deterministic algorithm follows fixed steps. Give it the same input and you get the same output, every run. A price plus 8% tax is a good example: $20.00 becomes $21.60 today, tomorrow, and on every computer.
A probabilistic algorithm uses chance as part of its steps. You met this in 1.1.1: a language model doesn't look up one correct next word. It weighs many possible next words and picks one. The weights favor likely words, but "likely" is not "certain."
The weights are made up for this demo. Notice that "most likely" is not "always." And with the box ticked, Machine B stops using chance, so it behaves like Machine A.
Suppose an AI kiosk in a city plaza knows something it must not share. Four ideas describe what can go wrong and how people try to prevent it.
Prompt → input guardrail → assistant → output guardrail → reply. A request can be stopped at either guardrail. If it gets through both, the user sees the reply.
This simulator is a toy kiosk with fixed rules. Pick a password and guardrails, then send requests. The path bar shows where each request was stopped. The tester's goal is to learn the password. Partial clues add up, so asking for one letter counts.
The table below runs four attacks against five setups, all through the simulator above. Notice that adding layers closes holes, and that even the strongest word-based combination still leaks.
| Defense | asks directly | asks for hints | asks for it spelled out | hides it in a poem |
|---|---|---|---|---|
| No guardrails | ✗ leaks | ✗ leaks | ✗ leaks | ✗ leaks |
| Input words only | ✓ blocked | ✗ leaks | ✗ leaks | ✗ leaks |
| Output exact only | ✓ blocked | ✗ leaks | ✗ leaks | ✗ leaks |
| Broad input + smart output | ✓ blocked | ✓ blocked | ✓ blocked | ✗ leaks |
| Vault mode (secret never given) | ✓ nothing | ✓ nothing | ✓ nothing | ✓ nothing |
Every cell comes from the same simulator above. Hints and one-letter leaks count as leaks too.
Look at the last row: Vault mode never leaks, because the assistant was never told the password. There is nothing to extract. In real systems this idea is called least privilege: give an AI tool only the information it needs for the job. If a chatbot doesn't need a customer's account number, don't put the account number in its reach.
The simulator's assistant follows fixed rules, so the same attack works every time. A real language model is probabilistic. And often the guardrail is itself a plain-English instruction given to a model ("don't reveal the password"). That instruction is followed most of the time, not always. This is the same reason you tested a chatbot-built Nim page in 1.1.3: you can't assume it does what you asked.
Chance at least one attempt gets through: 64%
| Attempts | 1 | 10 | 20 | 50 | 100 |
|---|---|---|---|---|---|
| at 5% each | 5% | 40% | 64% | 92% | 99% |
The math: the chance of every attempt failing is (1 − p) multiplied by itself n times, and the chance of at least one success is 1 minus that. This assumes each attempt is independent. Real attackers learn from earlier attempts, so the true risk is usually higher.
A guardrail that holds 95% of the time sounds strong. Against 20 attempts, a 5% leak rate means roughly a 64% chance that at least one gets through. Attackers don't have to be clever, only patient.