D

Data Augmentation

• Category: Math & training
• What people say: Making more training data.
• What it actually means: Creating modified examples, such as transformed images, perturbed audio, or paraphrased text, to increase training diversity without collecting entirely new source data. It can reduce overfitting when the transformation preserves the task signal.
• Common confusion: An augmentation must preserve the target label or behavior you want the model to learn.
• Related terms: Overfitting, Epoch, Eval Set

Data Classification

• Category: Security & governance
• What it actually means: Assigning data to documented sensitivity or impact classes so handling, access, retention, sharing, and incident rules follow the consequences of disclosure or loss.
• Why it matters: An AI pipeline cannot apply proportionate controls if source documents, prompts, traces, and generated artifacts are treated as equally sensitive.
• In practice: Classify data at ingestion, carry the label through derived artifacts, restrict tools and destinations by class, and define how labels change after transformation or aggregation.
• Common confusion: Data classification describes protection requirements. It is not the same as a machine-learning classification task or a claim that the data is accurate.
• Related terms: Data Minimization, Trust Boundary, Least Privilege, Audit Log
• Sources: NIST SP 1800-39 Initial Public Draft: Data Classification Practices; NIST FIPS 199: Federal Information and Information System Categorization

Data Deduplication

• Category: Data & representations
• What it actually means: Detecting and removing exact and near-duplicate examples within or across datasets.
• Why it matters: Repetition can distort the training distribution, increase memorization, leak test material, and make evaluation appear stronger than it is.
• In practice: Normalize content, use exact hashes and similarity methods, review borderline clusters, and record which version and rule removed each example.
• Common confusion: Deduplication is not ordinary data cleaning. Two distinct records can legitimately share text, and two paraphrases can still carry the same leaked information.
• Related terms: Data Provenance, Benchmark Contamination, Dataset Split, Overfitting
• Sources: Deduplicating Training Data Makes Language Models Better

Data Exfiltration

• Category: Security & governance
• What it actually means: Unauthorized transfer of protected data from a system or trust zone to a person, tool, service, or storage location that is not permitted to receive it.
• Why it matters: An agent can expose secrets through generated text, tool arguments, URLs, logs, or side effects even when the original data store remains intact.
• In practice: Minimize readable data, allowlist destinations, inspect outbound tool calls, redact sensitive fields, and alert on unusual transfers across trust boundaries.
• Common confusion: Exfiltration is about unauthorized movement or disclosure. Ordinary retrieval of data by an authorized component is not exfiltration, although later use can become one.
• Learn it: EchoLeak and CVEs for AI
• Related terms: Trust Boundary, Least Privilege, Indirect Prompt Injection, Audit Log
• Sources: NIST SP 800-53 Rev. 5: AC-4 Information Flow Enforcement

Data Leakage

• Category: Data & representations
• What it actually means: Unintended use of information during training or feature construction that would not be available at the real prediction point or belongs to a held-out evaluation boundary.
• Why it matters: Leakage produces optimistic metrics that collapse when the system encounters genuinely unseen inputs.
• In practice: Split data before fitting preprocessors, keep future information out of historical features, and isolate test labels and benchmark answers from prompts and tuning loops.
• Common confusion: Leakage is not limited to duplicate rows. Global normalization statistics, timestamps, target-derived features, and repeated test-driven prompt edits can all leak information.
• Related terms: Dataset Split, Benchmark Contamination, Eval Set, Data Provenance
• Sources: scikit-learn: Data leakage

Data Lineage

• Category: Security & governance
• What it actually means: A record of how a data artifact was derived across sources, transformations, joins, filters, versions, and downstream uses.
• Why it matters: When a source is corrected, revoked, or found unsafe, lineage identifies which datasets, embeddings, evaluations, and model artifacts may be affected.
• In practice: Give inputs and outputs stable identifiers, record each transformation and version, preserve parent-child relationships, and test whether an affected source can be traced to every derivative.
• Common confusion: Data provenance explains origin and custody broadly. Lineage emphasizes the transformation path and dependencies between data artifacts.
• Related terms: Data Provenance, Datasheet for Datasets, Audit Log, Content Provenance
• Sources: W3C PROV-O

Data Minimization

• Category: Security & governance
• What it actually means: For personal data, limiting what is collected, processed, exposed, and retained to what is necessary for a specified purpose. Teams can apply the same discipline to sensitive non-personal data as an engineering control.
• Why it matters: Every unnecessary field placed in a prompt, trace, cache, or tool call increases privacy exposure and the possible impact of misuse or compromise.
• In practice: Define the required fields before collection, redact or aggregate at the earliest boundary, set retention limits, and verify that optional context improves a measured task outcome before keeping it.
• Common confusion: Minimization does not mean keeping no data. It means being able to justify each data element, use, recipient, and retention period against the stated purpose.
• Related terms: Purpose Limitation, Data Classification, Least Privilege, Context Engineering
• Sources: General Data Protection Regulation, Article 5(1)(c)

Data Provenance

• Category: Data & representations
• What it actually means: Traceable information about where data originated, who or what transformed it, which versions were used, and how derived artifacts relate to their sources.
• Why it matters: You need provenance to reproduce results, honor usage constraints, investigate contamination, and remove affected data when a source changes.
• In practice: Assign immutable dataset versions, record transformation jobs and source identifiers, and carry lineage metadata into embeddings, eval cases, and model artifacts.
• Common confusion: A source URL is only one piece of provenance; it does not describe collection time, licensing, filtering, transformation, or downstream use.
• Related terms: Dataset Split, Data Deduplication, Provenance Attestation, Grounding
• Sources: W3C PROV Overview

Dataset Split

• Category: Data & representations
• What it actually means: A documented partition of examples into separate subsets for fitting, development decisions, and final evaluation.
• Why it matters: Separation prevents the evidence used to choose a system from also serving as independent proof that the chosen system generalizes.
• In practice: Split by the real deployment unit, such as user, repository, organization, or time, rather than randomly dividing correlated rows.
• Common confusion: A random split is not automatically independent. Near duplicates, future observations, or records from the same entity can cross the boundary.
• Related terms: Eval Set, Overfitting, Data Leakage, Distribution Shift
• Sources: Datasheets for Datasets

Datasheet for Datasets

• Category: Security & governance
• What it actually means: Structured documentation of a dataset's motivation, composition, collection process, preprocessing, uses, distribution, maintenance, and known limitations.
• Why it matters: A dataset is not safe or suitable merely because it is available. Downstream builders need evidence about how it was created and where its assumptions break.
• In practice: Publish the datasheet with a versioned dataset, identify who can answer questions, record excluded populations and transformations, and update the document when the dataset changes.
• Common confusion: A datasheet documents evidence and intended use. It is not a license, quality guarantee, or substitute for deployment-specific evaluation.
• Learn it: Model, System, and Dataset Cards
• Related terms: Data Lineage, Data Provenance, Model Card, Dataset Split
• Sources: Datasheets for Datasets

Deadline Propagation

• Category: Reliability & operations
• What it actually means: Passing the remaining end-to-end time budget to downstream calls so each dependency knows how long the original request can still usefully wait.
• Why it matters: Independent timeouts can exceed the user's deadline and leave abandoned work consuming capacity after the result is no longer useful.
• In practice: Set one request deadline at ingress, subtract elapsed time for each downstream call, cancel expired work, and record which boundary exhausted the budget.
• Common confusion: A deadline is an absolute or remaining completion boundary. A retry delay controls when another attempt begins and must fit inside that same budget.
• Related terms: Retry with Backoff, Retry Budget, Tail Latency, Service Level Objective (SLO)
• Sources: gRPC Deadlines

Decode Phase

• Category: Infrastructure & serving
• What it actually means: The iterative stage of autoregressive inference that generates new tokens one step at a time after the input prefix has been processed.
• Why it matters: Decode work has different compute, memory, and scheduling behavior from prefill, so one aggregate latency number can hide the actual serving bottleneck.
• In practice: Measure inter-token latency and output throughput separately, account for KV-cache occupancy, and test mixed workloads where active decodes share capacity with new prefills.
• Common confusion: Decode phase is not the decoder component of an encoder-decoder model. It names the runtime generation stage.
• Learn it: Disaggregated Prefill and Decode
• Related terms: Prefill, Autoregressive, KV Cache, Time per Output Token (TPOT)
• Sources: DistServe

Decoder

• Category: Models & inference
• What people say: The output side of a model.
• What it actually means: A component that maps a representation into an output. In an encoder-decoder transformer, the decoder uses masked self-attention and cross-attention to generate outputs. Decoder-only language models instead generate from a single causal stack.
• Related terms: Encoder, Transformer, Autoregressive

Decoding Strategy

• Category: Models & inference
• What it actually means: The algorithm that converts a model's sequence of next-token scores into selected tokens and a completed output.
• Why it matters: Greedy selection, sampling, truncation, and search can produce different quality, diversity, latency, and repeatability from the same logits.
• In practice: Define the task's decoding settings, stop rules, and seed behavior in the eval configuration so results can be compared fairly.
• Common confusion: Decoding changes how outputs are selected; it does not change the model's trained parameters or add knowledge.
• Related terms: Autoregressive, Temperature, Top-k Sampling, Nucleus Sampling (Top-p)
• Sources: The Curious Case of Neural Text Degeneration

Defense in Depth

• Category: Security & governance
• What it actually means: Using independent preventive, detective, and corrective controls at several system boundaries so one failed control does not determine the outcome.
• Why it matters: AI systems combine probabilistic models, untrusted content, tools, and external services, making any single filter or prompt an inadequate security boundary.
• In practice: Pair instruction controls with narrow permissions, sandboxing, schema validation, approval for consequential actions, monitoring, and a tested recovery path.
• Common confusion: More controls are not automatically better. Layers should address distinct failure modes and remain testable rather than repeat the same assumption.
• Related terms: Guardrails, Sandbox, Least Privilege, Trust Boundary
• Sources: NIST Glossary: Defense in Depth

Delegation

• Category: Agents & tools
• What it actually means: Assigning a bounded subtask to another person or agent together with the needed context, authority, output contract, and return conditions.
• Why it matters: Explicit delegation enables specialization and parallel work without losing ownership, scope, or the ability to integrate results.
• In practice: Give a reviewer agent the exact files, rubric, evidence, and deadline, then require it to return findings rather than silently modifying the primary artifact.
• Common confusion: Sending a vague message to another agent is not reliable delegation. The receiver needs a scope contract and a defined handoff back.
• Related terms: Scope Contract, Handoff, Reviewer Agent, Orchestration
• Sources: Building Effective Agents

Dense Retrieval

• Category: Retrieval & generation
• What it actually means: First-stage retrieval that embeds queries and candidates into vector representations and ranks candidates by a similarity function.
• Why it matters: It can retrieve paraphrases and semantic matches that share few exact words, complementing lexical methods such as BM25.
• In practice: Train or select an embedding model for the domain, index candidate vectors, and evaluate retrieval recall before connecting the results to generation.
• Common confusion: Dense retrieval is not a reranker. It searches the collection, while a reranker rescores a smaller candidate set.
• Related terms: Embedding, Semantic Search, BM25, Hybrid Retrieval
• Sources: Dense Passage Retrieval

Diffusion Model

• Category: Models & inference
• What people say: A model that generates images from noise.
• What it actually means: A generative model trained around a progressive noising process and a learned reverse process. Sampling usually begins from noise and applies repeated denoising steps, sometimes in a learned latent space.
• Common confusion: Diffusion is a general generative framework, not an image-only technique.
• Related terms: Latent Space, VAE (Variational Autoencoder), Inference

Disaggregated Serving

• Category: Infrastructure & serving
• What it actually means: A serving architecture that runs prefill and decode work in separately provisioned worker pools and transfers the required attention state between them.
• Why it matters: Prefill and decode stress hardware differently, so independent pools can be sized and scheduled for their own bottlenecks instead of competing in one queue.
• In practice: Measure state-transfer cost, route requests through compatible model versions, scale each pool from its own demand signal, and test failure recovery between phases.
• Common confusion: Disaggregation separates runtime stages. It does not split one model into tensor or pipeline-parallel shards within a stage.
• Learn it: Disaggregated Prefill and Decode
• Related terms: Prefill, Decode Phase, Model Serving, Goodput
• Sources: DistServe

Distribution Shift

• Category: Evaluation & safety
• What it actually means: A difference between the data distribution used to build or evaluate a system and the distribution it encounters after deployment.
• Why it matters: A model can pass held-out tests yet fail when users, tasks, language, tools, or operating conditions change.
• In practice: Define expected deployment slices, monitor performance and input characteristics by slice, and add new failures to a versioned eval set.
• Common confusion: Distribution shift is not always model drift. The model may be unchanged while its environment or user population changes.
• Related terms: Dataset Split, Eval Set, Overfitting, Model Card
• Sources: WILDS

DPO (Direct Preference Optimization)

• Category: Math & training
• What people say: Preference training without a separate reward-model stage.
• What it actually means: A preference-optimization objective that trains a policy directly from preferred and rejected response pairs relative to a reference policy. It avoids running an explicit reward model and reinforcement-learning loop during this stage.
• Common confusion: DPO still depends on the quality and coverage of preference data and does not eliminate evaluation or alignment risk.
• Learn it: Direct Preference Optimization
• Sources: Direct Preference Optimization paper
• Related terms: RLHF (Reinforcement Learning from Human Feedback), SFT (Supervised Fine-Tuning), Alignment

Dropout

• Category: Math & training
• What people say: Randomly turning off activations.
• What it actually means: During training, randomly setting a fraction of activations to zero encourages the network not to rely on one activation path. It is normally disabled for standard inference, although Monte Carlo dropout deliberately keeps it active to estimate uncertainty.
• Related terms: Overfitting, Weight Decay, Activation Function

Durable Execution

• Category: Agents & tools
• What it actually means: Running a workflow so its state and completed steps survive process crashes, restarts, or long waits without redoing confirmed side effects.
• Why it matters: Agent tasks often span model calls, tools, approvals, and external systems. A transient process should not be the only record of progress.
• In practice: Persist each workflow transition, use idempotency keys for external writes, and resume from the latest checkpoint after a worker restarts.
• Common confusion: Durable execution does not make every operation safe automatically. Side effects still need idempotency and compensation rules.
• Related terms: Checkpoint, Agent State, Idempotency, Approval Gate

Dynamic Batching

• Category: Infrastructure & serving
• What it actually means: A runtime policy that forms inference batches from queued requests according to compatible shapes, maximum size, priority, and allowed queue delay.
• Why it matters: Grouping requests can improve hardware utilization, but waiting for a batch can make latency worse when traffic is sparse or requests differ sharply.
• In practice: Set queue-delay and batch limits from measured latency objectives, separate incompatible request shapes, and compare throughput with tail latency at realistic arrival rates.
• Common confusion: Dynamic batching assembles batches from queued work. Continuous batching changes membership while autoregressive generation is already running.
• Learn it: vLLM Serving Internals
• Related terms: Admission Control, Continuous Batching, Saturation, Tail Latency
• Sources: NVIDIA Triton: Models and Schedulers