Large Language Models in the NLP Toolkit

The same model can classify an intent, extract a record, rerank passages, summarize a case, translate a reply, or generate a question; these capabilities do not decide which action is permitted, which evidence is authoritative, or how failures are contained.

A useful design names the LLM’s role and surrounds it with data, interfaces, validation, evaluation, and fallback.

The model that made this a practical question got one sentence at NeurIPS in 2020. Brown and colleagues “train GPT-3, an autoregressive language model with 175 billion parameters”. They then apply it to every task “without any gradient updates or fine-tuning”. Tasks and few-shot demonstrations are “specified purely via text interaction with the model”. One artefact, many tasks, no per-task training. Nothing in that sentence names an authoritative source or an allowed action.

The surrounding system carries obligations that next-token prediction does not provide automatically: model output, then validation and grounding, then decision and authorization, then operations and governance.

The validation layer is not a precaution invented by cautious architects. In 2023 six researchers showed that instructions planted in text a model will later read can take the model over. They called it indirect prompt injection, and they did not stop at a threat model. Their abstract reports: “We demonstrate our attacks' practical viability against both real-world systems, such as Bing's GPT-4 powered Chat and code-completion engines, and synthetic applications built on GPT-4.”

The attacker in that setting never touches the prompt box. NIST built its 2025 taxonomy of these attacks on that paper, and states the mechanism in the agency's own words: “Because GenAI models combine the data and instruction channels, attackers can leverage the data channel to affect system operations by manipulating resources with which the system interacts.” The harms NIST classifies there are availability, integrity and privacy violations. They are mounted by a third party, not by the model's own user. That is precisely why they cannot be handled inside the model output layer. A retrieved page, a parsed document, a tool result: each is text the model may read as instruction unless something standing between output and action refuses to let it.

Each role should be compared with a smaller or more deterministic alternative: direct predictor, generator or editor, retrieval orchestrator, tool planner, data and evaluation assistant.

Two of those rows have documented failure profiles rather than cautionary ones. The tool planner's warnings — authorization, side-effect risk, separating parse from execution — describe a vulnerability class with a catalogue number. OWASP lists it in its Top 10 for LLM Applications 2025 as LLM06:2025 Excessive Agency, and defines it: “Excessive Agency is the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM, regardless of what is causing the LLM to malfunction.” Three root causes follow: excessive functionality, excessive permissions and excessive autonomy. One of them is an application that “fails to independently verify and approve high-impact actions”. NIST makes the same point about agents: “However, because agents can take actions using tools, these attacks can create additional risks in this context, such as enabling actors to hijack agents to execute arbitrary code or exfiltrate data from the environment in which they are operating.”

The retrieval orchestrator's obligation to expose sources has a measured number behind it. In October 2025 the EBU and the BBC published an audit of how AI assistants handle news. Journalists at 22 public service media organisations, in 18 countries and 14 languages, graded 2,709 responses from the free versions of ChatGPT, Copilot, Gemini and Perplexity, collected in late May and early June 2025. The headline finding is one line: “Overall, 45% of all AI responses were found to have at least one ‘significant’ issue.” Some 81% carried an issue of some form. The single biggest cause of significant issues was sourcing, at 31%. Gemini showed a significant sourcing issue in 72% of its responses; every other assistant stayed below 25%. The leading defect in a multi-market audit was not fluency. It was provenance — the one property the orchestrating layer, not the model, is responsible for carrying.

Connect what the model can do to a diagnosed product need. What happens when nobody does is a matter of court record.

Two attorneys filed six judicial opinions that did not exist. ChatGPT had produced them, with fake quotes and fake citations. Ruling on sanctions in Mata v. Avianca on 22 June 2023, Judge P. Kevin Castel opened by conceding the tool: “Technological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance.” He then fined the two attorneys and their firm $5,000, jointly and severally, payable into the Registry of the Court within 14 days. They also had to write to the client, and to each judge falsely named as the author of a fabricated opinion.

Every one of those citations was well formed. Nothing in the generated text marked which of them pointed at a case that existed. Only a lookup against an authorized source could have.

The comparison should start from the task and consequence rather than current fashion: establish a strong task baseline, identify the unmet requirement, define the LLM role and boundary, evaluate complete behavior, then choose the smallest defensible system.

The last step is the one fashion resists, and the size axis has moved fast enough to make “use the biggest model” a poor default. Stanford HAI's 2025 AI Index sets the baseline in its Technical Performance chapter: “In 2022, the smallest model registering a score higher than 60% on MMLU was PaLM, with 540 billion parameters.” Two years later Microsoft's Phi-3-mini crossed the same threshold with 3.8 billion. That is a 142-fold reduction in about two years. Microsoft's own 2024 technical report puts Phi-3-mini at 69% on MMLU and 8.38 on MT-bench, in a model small enough to run on a phone.

Step 1 and step 5 therefore have to be re-run, not remembered. A baseline that lost to a frontier model on last year's numbers may win on this year's, at a fraction of the latency, cost and exposure.

Here, LLMs are one option inside the wider NLP toolkit and are compared with established language methods; the focus is task choice, evidence, and linguistic failure analysis.

The Generative AI path examines prompting, fine-tuning, RAG, tool use, serving, safety, and product architecture in greater depth. Keeping the scopes distinct prevents every NLP problem from being reframed as an LLM problem.

Choose one classification, extraction, translation, or summarization feature. Compare a strong specialized baseline with an LLM under the same data and evaluation set.

Quantify quality, latency, throughput, cost, review, update effort, privacy, and severe failure. State the evidence that would make you reject or restrict the LLM option. Then name the failure you would have to survive: a fabricated identifier reaching a filing, as in Mata v. Avianca; a retrieved document carrying instructions, as the indirect prompt injection work demonstrated against deployed systems; a sourcing defect of the kind that caused 31% of the significant issues the EBU and BBC found.