Grade 12 AI & Computer Science Practice Questions — Set 7

ExplanationThe reward difference is r_A − r_B = 2.3 − 1.1 = 1.2. Passing this through the logistic (sigmoid) function gives σ(1.2) = 1/(1 + e^(−1.2)). Since e^1.2 ≈ 3.320, e^(−1.2) ≈ 1/3.320 ≈ 0.301, so σ(1.2) = 1/(1 + 0.301) = 1/1.301 ≈ 0.769. This 76.9% is a soft, continuous preference probability — not a hard 0/1 label — and it comes entirely from the AI's own scoring against the written constitution, with no human ranking involved anywhere in this step. That is the defining move of Constitutional AI's RL-from-AI-Feedback stage: a model (guided by explicit principles) generates the comparison, a Bradley–Terry-style preference model converts the reward gap into a probability via the sigmoid, and that probability becomes the training signal for the reward model used in the subsequent RL fine-tuning — replacing the human-labeled comparisons that ordinary RLHF depends on for this stage. The normalized-ratio and raw-magnitude formulas swap the correct exponential (odds-based) relationship for a linear one, which breaks basic properties a preference probability must have, such as approaching 1 as the reward gap grows large rather than saturating at (r_A)/(r_A+r_B). Reintroducing human rankers at this stage also contradicts the premise that the preference model here runs on AI-generated comparisons, which is precisely what makes the pipeline more scalable and more consistently rule-governed than pure human-feedback RLHF.

ExplanationFull dense self-attention scores every query against every key, giving n² = 4096² = 16,777,216 query-key pairs per layer. Since n = 4096 = 2^12 is a perfect square, ℓ = ⌈√n⌉ = √4096 = 64. Each query participates in two sparse patterns: - Local pattern: attends to ℓ = 64 nearby keys within its block, contributing n·ℓ = 4096 × 64 = 262,144 pairs across all queries. - Strided pattern: attends to another ℓ = 64 keys spaced ℓ apart going back through the sequence, contributing another n·ℓ = 262,144 pairs. Combined, the sparse scheme scores 2nℓ = 524,288 query-key pairs per layer — the O(n√n) cost that gives Sparse Transformers their efficiency, versus dense attention's O(n²). The reduction factor is n² / (2nℓ) = n / (2ℓ) = 4096 / 128 = 32. Equivalently, since ℓ = √n, this is √n / 2 = 64 / 2 = 32. So the sparse scheme performs 32 times fewer query-key score computations per layer than full dense self-attention, while every token can still reach every other token within two layers (one hop through the local pattern, one through the strided pattern) — the key structural insight behind factorized sparse attention. The tempting wrong answers correspond to real slip-ups: using only n/ℓ = 64 forgets that two independent attention patterns are computed and summed, not one; treating the savings as n = 4096-fold confuses linear-cost attention with the true O(n√n) scaling and would imply each query looks at essentially one key; and 8-fold reflects mixing up the exponent, applying n^(1/4) instead of the correct n^(1/2) relationship that emerges once both patterns are accounted for.

ExplanationCosine similarity is cos(θ) = (q·d)/(|q||d|), which measures only the angle between two vectors, not their length. Here |q| = √(1²+1²+1²) = √3 ≈ 1.732. For Chunk 1 = (3, 0, 0): dot product with q is 1(3)+1(0)+1(0) = 3, and |Chunk 1| = √9 = 3, so cosine similarity = 3/(3 × 1.732) ≈ 0.577. For Chunk 2 = (1, 1, 0): dot product is 1(1)+1(1)+1(0) = 2, and |Chunk 2| = √2 ≈ 1.414, so cosine similarity = 2/(1.414 × 1.732) ≈ 0.816. For Chunk 3 = (0, 1, 3): dot product is 1(0)+1(1)+1(3) = 4, and |Chunk 3| = √10 ≈ 3.162, so cosine similarity = 4/(3.162 × 1.732) ≈ 0.730. Ranked by cosine similarity, Chunk 2 (0.816) beats Chunk 3 (0.730) and Chunk 1 (0.577), so Chunk 2 is the chunk retrieved and passed to the LLM as grounding context. Chunk 3 has both the largest raw dot product (4) and the largest magnitude (√10 ≈ 3.162) — this is exactly why a retriever that ranks by unnormalized dot product instead of true cosine similarity would wrongly favor it; large-magnitude embeddings (often from longer or more repetitive chunks) dominate raw inner-product scores even when they point in a less-aligned direction. Chunk 1's cosine similarity of 0.577 is computed correctly but is the lowest of the three, not the highest, so it cannot be the retrieved chunk. As for Euclidean distance, ‖q−d‖² = |q|² + |d|² − 2(q·d) depends on |d|² in addition to the dot product, while cosine similarity is scale-invariant in d — rescale any chunk's embedding and its Euclidean-distance rank can change even though its cosine similarity does not. The two metrics coincide only when every embedding is pre-normalized to unit length; here they merely happen to agree on the winning chunk by coincidence, not because they are the same computation.

ExplanationFor a 224×224 image, the number of patches along one side equals image size divided by patch size. With 16×16 patches, that is 224/16 = 14 patches per side, giving 14² = 196 total patch tokens. Shrinking the patch to 8×8 doubles the patches per side to 224/8 = 28, so the total patch count becomes 28² = 784 — a 784/196 = 4× increase in the token count N. Computing the QK^T attention score matrix requires comparing every token against every other token, so its cost scales as O(N² · d_k) for a fixed per-head dimension d_k. Squaring the 4× growth in N gives 4² = 16, so the QK^T computation becomes sixteen times more expensive, not merely four, eight, or two times. This double-squaring effect — patch count grows as the inverse square of patch size, and attention cost then grows as the square of patch count — is exactly why ViTs use relatively coarse patches such as 16×16 rather than pixel-level tokens: halving the patch side length does not just double the workload, it multiplies it by sixteen, which is also why the original ViT paper reports steep FLOP increases for its smaller-patch variants (e.g. ViT-B/16 versus ViT-B/8).

ExplanationThe temperature τ controls how sharply softmax separates the similarities into a probability distribution, and it must divide the similarities, not multiply them. Dividing by τ = 0.1 turns the cosine similarities (0.8, 0.3, 0.5) into logits (8, 3, 5) — a much wider spread than the raw values, which is exactly the point of a small τ: it sharpens the model's confidence signal during training. Applying softmax to these logits: e⁸ ≈ 2980.96, e³ ≈ 20.09, e⁵ ≈ 148.41, summing to ≈ 3149.46. The probability mass on the matching caption t₀ is 2980.96 / 3149.46 ≈ 0.9465. The InfoNCE loss for this row is the negative log of that probability: −ln(0.9465) ≈ 0.055 nats — a small loss, correctly reflecting that the model already assigns high confidence to the true image-caption pair. Skipping the 1/τ scaling and feeding raw cosine similarities straight into softmax flattens the distribution far too much (probabilities cluster near uniform), which is why that path yields a much larger loss of ≈ 0.853 — it understates the model's actual confidence and would generate a misleadingly large gradient signal. Multiplying by τ instead of dividing does the opposite mistake: it compresses the logits toward zero (0.08, 0.03, 0.05), pushing the softmax distribution close to uniform among 3 classes and yielding an even larger loss of ≈ 1.072, wrongly suggesting the model model is barely better than chance. Both of these come from inverting or omitting the role of temperature as a divisor of the logits. The squared-distance approach (1 − 0.8)² = 0.04 reflects a completely different objective — a regression-style embedding-matching loss used in some metric-learning setups — but it is not what InfoNCE computes: contrastive vision-language pretraining is fundamentally a classification problem (pick the correct caption out of the batch), not a distance-regression problem, so it must route through softmax over all candidates in the batch rather than looking at the matching pair in isolation.

ExplanationTIES-Merging's elect-sign step compares the total magnitude of positive versus negative contributions at each parameter, not a simple headcount: here the positive total is |0.9| = 0.9 while the negative total is |−0.2| + |−0.2| = 0.4, so the elected sign is positive even though two of the three models point negative. This magnitude-weighted election matters precisely because a single decisively fine-tuned model (Model A) should not be outvoted by two models that barely moved away from the base weight — resolving exactly this kind of interference is what TIES is designed for. The disjoint merge step then keeps only the task-vector values whose sign agrees with the elected sign (Model A's +0.9) and sets aside the disagreeing ones entirely (Model B and C's −0.2 values are excluded, not averaged in), dividing by the count of agreeing models, which is 1: merged task vector = 0.9 / 1 = 0.9. Adding this to the base pretrained weight of 2.0 with merging coefficient λ = 1 gives a final merged weight of 2.0 + 0.9 = 2.9. This result differs sharply from naive parameter averaging (which would blend in the conflicting −0.2 values and dilute Model A's specialization) and from DARE, which instead of electing signs randomly drops a fraction p of each task vector's entries and rescales the survivors by 1/(1−p) — an unbiased-estimator correction — to keep the expected value unchanged before any averaging or TIES-style merging is applied.

ExplanationThe triangular multiplicative update computes, for every pair of residues (i, j), a sum over a third residue index k that also ranges across all N_res residues. This gives N_res choices for i, N_res choices for j, and N_res choices for k, so the operation count scales as O(N_res) x O(N_res) x O(N_res) = O(N_res^3). Scaling N_res from 384 to 1536 multiplies the residue count by 1536 / 384 = 4. Because the cost scales with the cube of N_res, the compute multiplies by 4^3 = 4 x 4 x 4 = 64, not by 4 (that would require linear scaling) or 16 (that is the scaling exponent for the pair representation's memory footprint, O(N_res^2), which is a genuinely quadratic cost but a different quantity from this layer's runtime). It is also not 256, since the channel dimension c is a fixed architectural constant, not a residue-sized index that grows with N_res, so it does not add a fourth power of N_res to the scaling. This cubic runtime bottleneck is exactly why AlphaFold2 trains its triangular attention and multiplicative update layers on cropped sequences of 384 residues rather than full sequences, and why full-length inference on very large, uncropped multi-domain proteins is disproportionately expensive per layer compared to the pair representation's storage cost.

ExplanationBuilding the KV cache size from first principles removes any guesswork. During generation, a transformer caches, for every past token, at every layer, one key vector and one value vector of length (num_heads × head_dim). The standard per-token cost is: 2 (for K and V) × n_layers × n_heads × d_head × bytes_per_element Plugging in this model's shape — n_layers = 32, n_heads = 32, d_head = 128 (giving hidden size 4096, matching a real 7B-class architecture), FP16 → 2 bytes: 2 × 32 × 32 × 128 × 2 bytes = 524,288 bytes = 512 KiB per token, per sequence For a 2048-token context: 512 KiB × 2048 = 1,048,576 KiB = 1024 MiB = 1 GiB per sequence For the full batch of 8 concurrent sessions, each needing its own independent cache: 1 GiB × 8 = 8 GiB total This is exactly the formula production serving engines like vLLM use to size their KV cache pool, and it's why batching — while great for GPU throughput, since it amortizes weight-loading cost across more tokens per forward pass — has a hard ceiling: cache memory grows linearly with batch size, context length, layer count, and head width all at once. Halving the factor of 2 (dropping either K or V) understates the cache by half; assuming FP32 storage overstates it by 2×; and computing only a single sequence's cache while forgetting to scale by the batch dimension understates it by a full factor of 8. None of those shortcuts reflect what the GPU actually has to hold resident in memory while serving all 8 users concurrently.

ExplanationEach frozen 4096x4096 matrix gets a LoRA adapter built from two thin matrices, B in R^(4096x16) and A in R^(16x4096). Their entry counts are 4096x16 = 65,536 for B and 16x4096 = 65,536 for A, summing to 131,072 — this is exactly the general formula r(d+k) for a rank-r adapter on a d x k matrix, not r x d x k and not d x k. The startup applies a separate adapter to all four attention projections (W_q, W_k, W_v, W_o), and it does this independently in every one of the 32 layers, so there are 4 x 32 = 128 adapters in total. Total trainable parameters are therefore 131,072 x 128 = 16,777,216. Dividing by the model's 7,000,000,000 parameters gives 16,777,216 / 7,000,000,000 ≈ 0.0024, i.e. about 0.24%. This tiny fraction is exactly why LoRA works on a single consumer GPU: W itself never receives a gradient update (it stays frozen in forward and backward passes), so the optimizer only needs to store momentum and variance terms for roughly a quarter of one percent of the parameters instead of for all 7 billion, cutting the memory footprint enough to fine-tune a 7B model on hardware that could never hold full-parameter Adam states for it.

ExplanationTreat each record as a sequence of words and build the set of all contiguous 3-word shingles — a standard technique used in large-scale corpus deduplication (for example before splitting pretraining data into train and test sets, to stop test items from leaking into training). Record P has 9 words, so it yields 9 minus 3 plus 1 = 7 shingles: {the-Indian-Space, Indian-Space-Research, Space-Research-Organisation, Research-Organisation-launched, Organisation-launched-Chandrayaan, launched-Chandrayaan-three, Chandrayaan-three-successfully}. Record Q has 10 words (it appends "today"), giving 10 minus 3 plus 1 = 8 shingles: the same 7 shingles as Record P, plus one new one, three-successfully-today. Every shingle of Record P appears in Record Q, so the intersection has 7 elements; since Record P's shingle set is a subset of Record Q's, the union is exactly Record Q's set, with 8 elements. Jaccard similarity = |intersection| / |union| = 7/8 = 0.875. Because 0.875 is at least the 0.8 threshold, the pipeline flags the pair as a near-duplicate and removes one copy before the train/test split. The other values come from genuine curation mistakes. Adding the set sizes without subtracting the intersection gives a false union of 7 + 8 = 15, producing 7/15 ≈ 0.467 and wrongly letting the pair pass as safe. Dividing by the smaller set's size instead of the true union computes the overlap (Szymkiewicz-Simpson) coefficient, not Jaccard, and overstates similarity as 7/7 = 1.0 — this would misclassify a partial overlap as an exact duplicate and discard useful data. Comparing unigram (single-word) sets instead of order-sensitive 3-word shingles gives 9 unique words in common out of 10 unique words total, or 9/10 = 0.9; this bag-of-words score ignores word order entirely, so it cannot distinguish a genuine near-duplicate from an unrelated sentence that merely reuses the same nine words in shuffled order — exactly the failure mode shingling is designed to avoid.

ExplanationConvert both quantities to scientific notation first: N = 1.8×10^12 parameters, and 13 trillion tokens is D = 1.3×10^13 (not 13×10^13 — "trillion" is already 10^12, so 13 trillion = 13×10^12 = 1.3×10^13). Apply the compute rule C ≈ 6ND. This factor of 6 isn't arbitrary: a forward pass through a dense transformer costs about 2ND FLOPs (one multiply and one add per parameter per token), and backpropagation costs roughly twice the forward pass — about 4ND FLOPs — because gradients must be computed with respect to both the layer activations and the weights. Summing 2ND + 4ND gives the 6ND convention used in scaling-law papers (Kaplan et al., 2020) and in the compute-accounting methodology behind both the US and EU compute-based governance thresholds. C = 6 × (1.8×10^12) × (1.3×10^13) = 6 × 2.34×10^25 = 14.04×10^25 = 1.404×10^26 FLOPs, which rounds to ≈1.4×10^26 FLOPs. Comparing against the Article 51 threshold of 10^25 FLOPs: 1.404×10^26 / 10^25 = 14.04, so the model's training run used roughly 14 times the compute needed to trigger the systemic-risk presumption — nowhere near a borderline case. The three wrong figures come from real accounting slips rather than arbitrary numbers. Using C = ND instead of 6ND (forgetting that both a forward and a backward pass are needed to train, not just run, the network) understates compute by exactly 6× and gives 2.34×10^25 — a factor of about 2 over threshold instead of 14. Using C = 2ND counts only the forward pass and misses backpropagation entirely, giving 4.68×10^25 — a factor of about 5. And mis-converting one "trillion" as 10^9 instead of 10^12 (an easy slip when Indian usage of "lakh crore" and Western "trillion" scales get mixed up while converting units) shrinks the answer by a further 1000×, wrongly placing the model two orders of magnitude below the threshold instead of above it. This kind of order-of-magnitude compute estimate is exactly what compute-governance regimes rely on: India's own IndiaAI Mission GPU infrastructure and any Indian lab training models at frontier scale for export or deployment in the EU market would need to run this same 6ND calculation to know which regulatory tier they fall into before training even finishes.

ExplanationThe governing equation τ(dV/dt) = -V + RI is a first-order linear ODE. With V(0) = 0 and RI held constant, its solution is V(t) = RI·(1 - e^(-t/τ)) — the membrane depolarizes toward the asymptote RI, slowing down as it approaches that value because the leak term -V grows and cancels more of the driving current RI. This exponential approach, not a straight-line rise, is exactly what "leaky" means in LIF: a true leak-free (pure) integrate-and-fire neuron would instead climb linearly at the initial rate RI/τ = 40/10 = 4 mV/ms and reach V_th = 10 mV at t = 2.5 ms — a real but distinct model. To find the first-spike time here, set V(t) = V_th and solve for t: 10 = 40·(1 - e^(-t/10)) 1 - e^(-t/10) = 10/40 = 0.25 e^(-t/10) = 0.75 -t/10 = ln(0.75) = -0.287682 t = 2.8768 ms ≈ 2.88 ms Note the subtraction from 1 in the third line is essential: e^(-t/τ) equals the *remaining* fraction of the gap to threshold (0.75), not the threshold-to-depolarization ratio V_th/RI = 0.25 itself. Swapping those two — solving e^(-t/τ) = V_th/RI — gives t = -10·ln(0.25) = 13.86 ms, a common algebra slip when inverting the closed-form LIF solution. Because the neuron resets exactly to 0 mV after each spike and the current stays fixed at the same value, the membrane trajectory after every reset is an identical copy of the one from t = 0: the interspike interval is therefore exactly t = 2.8768 ms for every subsequent spike too, not just the first. The firing rate is the reciprocal of this interval: f = 1/t = 1/(2.8768 × 10⁻³ s) ≈ 347.6 Hz This 347.6 Hz is the rate the chip's downstream circuitry would read off that pixel's spike train — brighter pixels (larger RI) push V_th/RI down further, shrink t further, and raise the firing rate further, which is precisely the mechanism that lets time-to-first-spike coding represent brightness with a single spike's latency. Treating τ as if it were the interspike interval on its own (giving 10 ms and 100 Hz) ignores this dependence on V_th and RI entirely, and would make the coding scheme blind to brightness altogether.

ExplanationBoth rewards equal r = 100, so what matters is not their magnitude but the ratio of the discount factors applied to them: (γ^8·r) / (γ^1·r) = γ^7. Computing this step by step, γ^2 = 0.9025, γ^4 = 0.9025² = 0.81450625, γ^6 = γ^4·γ^2 = 0.735091890625, and γ^7 = γ^6·γ = 0.69833729609375 ≈ 0.698. So about 69.8% of the disembodied signal strength still reaches s₀ for the embodied robot, a reduction of 1 − 0.698 ≈ 0.302, i.e. roughly 30%. This is the quantitative core of why embodied learning is a harder credit-assignment problem than disembodied, symbolic learning: physical embodiment forces a single semantic action to unfold over many real sensorimotor time-steps — the reach-grasp-lift sequence cannot be compressed to one step — and because RL discounting is multiplicative per time-step, every additional physical step compounds the attenuation rather than simply adding to it. Computing γ^8 directly (≈0.663, a ≈34% drop) double-counts by ignoring that the disembodied benchmark already carries its own one-step discount, so the correct comparison needs the ratio γ^7, not the raw γ^8. Treating the gap as a single extra factor of (1 − γ) = 5% mistakes multiplicative compounding across seven steps for linear subtraction of one. And claiming no reduction at all misses that discounting operates on elapsed time-steps, not on the semantic identity of the action — which is exactly the property that separates an embodied agent, bound by real sequential physical dynamics, from a disembodied one that can treat an action as instantaneous.

ExplanationThe unbiased pass@k estimator counts, among the C(10,5) = 252 equally likely ways to choose 5 of the 10 generated samples, how many of those 5-subsets contain zero passing samples, then subtracts that fraction from 1. A subset with zero passing samples must be drawn entirely from the n − c = 7 failing samples, so there are C(7,5) = 21 such all-failing subsets. The probability that a random 5-sample subset contains no passing sample is therefore 21/252 = 1/12. Hence pass@5 = 1 − 1/12 = 11/12 ≈ 91.7%. This hypergeometric-style combinatorial approach is essential because the k evaluated samples are drawn without replacement from a fixed, already-generated pool of n completions — the model doesn't regenerate fresh samples for each hypothetical k-subset. Treating the draws as independent Bernoulli trials with replacement instead, via 1 − (1 − c/n)^5 = 1 − 0.7^5 ≈ 83.2%, systematically underestimates the true pass@k whenever c/n isn't small, since it ignores that removing a failing sample from the pool makes the remaining draws more likely to hit one of the c passing samples. Reporting c/n = 30% directly conflates pass@k with plain single-sample accuracy and discards the "at least one of k" structure that makes pass@k useful for evaluating code assistants that can be queried multiple times. Reporting C(7,5)/C(10,5) ≈ 8.3% without subtracting from 1 computes the complementary event — the chance of drawing zero working solutions — rather than pass@k itself.

ExplanationBecause both π*(y1|x) and π*(y2|x) share the same normalizer Z(x), it cancels in the ratio, leaving: π*(y2|x)/π*(y1|x) = [π_ref(y2|x)/π_ref(y1|x)] · exp((r(x,y2) − r(x,y1))/β) Compute each factor separately. The reference-model ratio is π_ref(y2|x)/π_ref(y1|x) = 0.10/0.40 = 0.25 — the pretrained model prefers y1 four-to-one before any fine-tuning happens. The reward gap is r(x,y2) − r(x,y1) = 6 − 2 = 4, and dividing by β = 2 gives an exponent of 2, so the reward term contributes exp(2) ≈ 7.389. Multiplying the two factors: 0.25 × 7.389 ≈ 1.85. So π*(y2|x)/π*(y1|x) ≈ 1.85: despite π_ref favouring y1 four-to-one, the RLHF-optimal policy makes y2 about 1.85 times more likely than y1. A reward-model gap of 4 units, scaled by 1/β = 0.5, was enough to overturn the reference model's four-to-one preference. This calculation is exactly why β is the central safety dial in RLHF, not just an optimization stability term. The reward model r(x,y) is a learned proxy for true human preference, never the preference itself. As β → 0, the KL penalty vanishes and π* → argmax_y r(x,y): the policy chases whatever the reward model scores highest, even into regions where the reward model is miscalibrated relative to real human judgment (Goodhart's Law — reward hacking / overoptimization). As β → ∞, the exponential term flattens toward 1 and π* → π_ref, so the model stays safe and coherent but ignores the reward signal entirely, which is the "alignment tax": every unit of extra reward-chasing purchased by lowering β is paid for in increased divergence from the broad, human-like behavior the reference model encodes. The 0.4/0.1 reference odds versus a modest reward gap of 4 at β = 2 shows how easily a large reward-model gap can dominate the reference model's prior once β is small enough — precisely the failure mode that motivates keeping β large enough, or applying additional constraints (e.g. best-of-n reranking, reward model ensembling, or process supervision), when deploying frontier models trained this way.

ExplanationReconstruction error for Code A is ‖x − Dz_A‖² = ‖(0.8,0.6) − (0.8,0.6)‖² = 0, since z_A = (0.8, 0.6, 0) reproduces x exactly as 0.8·d₁ + 0.6·d₂. Its L1 norm is 0.8 + 0.6 + 0 = 1.4, so its total loss is 0 + 0.1(1.4) = 0.14. For Code B, z_B = (0,0,1) reconstructs x as 1·d₃ = (0.6, 0.8), leaving a residual of (0.2, −0.2) and a squared reconstruction error of 0.2² + (−0.2)² = 0.08. Its L1 norm is 1, so its total loss is 0.08 + 0.1(1) = 0.18. Since 0.14 < 0.18, the training objective favors Code A even though it spreads x across two features instead of one. This matters for interpretability: the L1 term is a soft penalty scaled by λ, not a hard sparsity constraint, so whenever a small λ lets a modest reconstruction gain outweigh a larger sparsity cost, the SAE learns a denser, harder-to-interpret code even when a comparably accurate one-feature decomposition exists. Tuning λ correctly — and checking arithmetic like this rather than assuming "sparser always wins" — is exactly why SAE-based audits of models, including ones used in consumer-facing systems like UPI support chatbots, require care before their discovered "features" are trusted as genuine safety-relevant circuits.

ExplanationIn automated red-teaming, the attacker only needs one success across many attempts while the defender must withstand every single one — so the right tool is the complement rule, not simple addition of probabilities. If a single attempt fails to bypass the filter with probability 1 − 0.08 = 0.92, and the 25 attempts are independent, the probability that every one of them fails is 0.92²⁵. Computing this by repeated squaring: 0.92² = 0.8464, 0.92⁴ = 0.8464² ≈ 0.71640, 0.92⁸ ≈ 0.71640² ≈ 0.51322, 0.92¹⁶ ≈ 0.51322² ≈ 0.26340. Combining, 0.92²⁵ = 0.92¹⁶ × 0.92⁸ × 0.92¹ ≈ 0.26340 × 0.51322 × 0.92 ≈ 0.12437. So the probability that all 25 attempts fail is about 12.4%, and by the complement rule the probability that at least one attempt succeeds is 1 − 0.12437 ≈ 0.8756, about 87.6%. This is exactly why automated, high-volume red-teaming pipelines — running thousands of adversarial prompt variants against a model's safety filter — are far more effective at surfacing rare but real vulnerabilities than a handful of manual test prompts: even a per-attempt success rate as low as 8% compounds into near-certain discovery once enough independent attempts are made. Treating the 8% figure as additive (25 × 8% = 200%, clamped to 100%) ignores that independent failure probabilities compose multiplicatively, not that successes add linearly; treating repeated attempts as not compounding at all ignores the multiplication rule entirely; and computing 0.08²⁵ answers a different question — the near-impossible requirement that every attempt succeeds, not that at least one does.

ExplanationLet H be the event that an order is genuinely for a sequence of biosecurity concern, and F be the event that the AI classifier flags it. The data give P(H) = 1/1,000,000 = 0.000001, so P(not H) = 0.999999. Sensitivity gives P(F|H) = 0.99, and the false positive rate gives P(F|not H) = 0.001. By the law of total probability, P(F) = P(F|H)·P(H) + P(F|not H)·P(not H) = (0.99)(0.000001) + (0.001)(0.999999) = 0.00000099 + 0.000999999 = 0.001000989. By Bayes' theorem, P(H|F) = P(F|H)·P(H) / P(F) = 0.00000099 / 0.001000989 ≈ 0.000989, which is about 0.099%, i.e., approximately 0.1% — roughly 1 in 1,011 flagged orders. So even though the classifier looks highly accurate (99% sensitivity, 99.9% specificity), about 999 out of every 1,000 flagged orders are false alarms, because true positives are astronomically rarer (1 in a million) than the classifier's false-positive rate (1 in a thousand). This is the base-rate effect at the heart of real biosecurity screening design: when the event being detected is extremely rare, even excellent classifiers produce mostly false alarms in absolute terms. It is precisely why operational DNA-synthesis screening systems (such as the internationally used Common Mechanism, and the frameworks India's biosafety regulators are developing) pair automated AI flags with mandatory human biosecurity review rather than blocking or approving orders on the AI score alone — the AI narrows a million orders down to a manageable review queue, but a trained reviewer, not the classifier, makes the final call on the roughly 0.1% of flags that could be genuine.

ExplanationThe KL-regularized RLHF objective max_π E_{y∼π}[r(x,y)] − β·D_KL(π(·|x) ‖ π_ref(·|x)) is solved by forming the Lagrangian with the normalization constraint Σ_y π(y|x) = 1 and setting the functional derivative to zero. This yields the classic Gibbs/Boltzmann-tilted solution π*(y|x) = π_ref(y|x)·exp(r(x,y)/β) / Z(x), with Z(x) = Σ_y π_ref(y|x)·exp(r(x,y)/β). This form shows the optimal policy exponentially reweights the reference distribution in the direction of higher reward: small β (weak regularization) lets even a modest reward gap dominate the reference prior, while large β keeps π* close to π_ref. This exact identity is what Direct Preference Optimization substitutes into the Bradley-Terry preference loss to eliminate the need for a separate reward model and RL loop. Plugging in the numbers: exp(r(y1)/β) = exp(3/0.5) = exp(6) ≈ 403.43, and exp(r(y2)/β) = exp(1/0.5) = exp(2) ≈ 7.39. The unnormalized weights are π_ref(y1)·403.43 = 0.2 × 403.43 ≈ 80.69 and π_ref(y2)·7.39 = 0.8 × 7.39 ≈ 5.91, giving Z ≈ 86.60 and π*(y1) = 80.69 / 86.60 ≈ 0.93. Equivalently, working with the ratio directly: π*(y1)/π*(y2) = [π_ref(y1)/π_ref(y2)]·exp((r(y1)−r(y2))/β) = 0.25 × e⁴ ≈ 13.65, so π*(y1) = 13.65 / (1 + 13.65) ≈ 0.93. Even though the reference (SFT) policy favoured y2 four-to-one, a reward gap of only 2 units, amplified through division by a small β = 0.5, is enough to flip the optimized policy to strongly prefer y1. This is precisely why β is the central lever in RLHF: it sets the trade-off between chasing reward and drifting from the reference model's language distribution, and choosing it too small can let a noisy or misspecified reward model dominate the policy despite a well-trained SFT prior.

ExplanationSelf-attention's dominant per-layer cost has two n²-sized terms: computing the score matrix QKᵀ requires n² dot products, each involving d multiply-adds (n²d operations), and combining those attention weights with V to produce the output also involves n² weighted sums of d-dimensional vectors (another n²d operations) — giving 2n²d total. Because n appears squared, scaling n by a factor of k scales the FLOPs by k². Here k = 16384/4096 = 4, so the compute grows by 4² = 16×, not by 4× as it would for a mechanism that processed tokens independently. Plugging n = 16384 and d = 512 into 2n²d: 16384² = 268,435,456; multiplying by 512 gives 137,438,953,472; doubling (for both the QKᵀ step and the weighted-sum-with-V step) gives 274,877,906,944 ≈ 2.75 × 10¹¹ FLOPs for that single layer. This quadratic blow-up — not the linear growth of KV-cache memory, which only stores one key and one value vector per token — is exactly why feeding an entire textbook chapter into the context window is far more expensive than retrieving just the few relevant paragraphs with RAG: doubling context length always quadruples the attention compute, regardless of how much of that context is actually useful for answering the question.