Predict Function

The application function that receives user input and returns the model output. In chatbot demos, it is the core execution path between the interface and the LLM. It can be simple for a prototype or more complex when the app needs multiple actions, state handling, or post processing.

Expanded Definition

The predict function is the execution pathway that turns a prompt or other user input into a model response, often with surrounding application logic for validation, retrieval, tool calls, formatting, and safety checks. In simple demos, it may be little more than a wrapper around an LLM call. In production systems, it often becomes the control point where developers decide what enters the model, what context is added, what output is allowed to leave, and which downstream actions are triggered.

Definitions vary across vendors and platform teams because some use predict to mean a single inference call, while others use it to describe the full request-response workflow. That distinction matters in AI security: the predict function is not the model itself, but the application layer that shapes model behaviour and exposure. NHI Management Group treats it as a security-relevant boundary because it is where secrets, prompts, retrieval data, and agent instructions can be exposed or mishandled.

The most common misapplication is treating the predict function as a harmless UI helper, which occurs when teams ignore its role as the trust boundary between users, the model, and any tools or data sources.

Examples and Use Cases

Implementing the predict function rigorously often introduces latency and integration complexity, requiring organisations to weigh faster demos against stronger control over inputs, outputs, and execution paths.

• A customer support chatbot receives a question, enriches it with approved knowledge base context, then passes the result to the LLM for a grounded answer.
• An internal coding assistant checks the prompt for policy violations before submitting it to the model and formatting the response for the IDE.
• An agentic workflow uses the predict function to decide whether the model should answer directly or call a tool, such as a ticketing API or search service.
• A secure deployment logs prompts and outputs for review, redacts secrets before inference, and blocks unsafe post-processing actions.
• A regulated use case routes model output through human review before release when the predict function is responsible for decisions that may affect users or records.

For teams mapping the function to governance expectations, the NIST Cybersecurity Framework 2.0 is useful for thinking about where application controls, monitoring, and response fit around this execution path.

Why It Matters for Security Teams

The predict function matters because it concentrates risk. If it accepts untrusted input without validation, attackers can steer model behaviour, inject prompt content, or manipulate downstream actions. If it returns raw output without filtering, it can leak sensitive data, policy text, or internal system instructions. If it brokers retrieval or tool access, it may become the point where a harmless conversation crosses into unauthorised data access or operational change.

This is especially important in agentic AI systems, where the predict function may sit inside a broader chain of decision-making and execution. Security teams need to understand whether the function is only generating text or also making tool-use decisions, because the control requirements differ sharply. In practice, this is where identity, privilege, and workflow controls start to intersect with model governance.

Organisations typically encounter the consequences only after an exposed secret, unsafe tool action, or hallucinated response has already reached users, at which point the predict function becomes operationally unavoidable to secure.

Related resources from NHI Mgmt Group

• What is the difference between function calling and MCP for enterprise security?
• When does MCP make more sense than function calling?
• What is the difference between application RBAC and function-level permissions for MCP?
• Why do unsalted password hashes remain risky even when the hash function is strong?