A clear walk through the machinery people often wave past, from token IDs and RoPE to KV cache, GQA, FFNs, residual streams, logits, and sampling. Useful because it gives LLM security arguments somewhere firmer to stand than vibes in a lab coat.