I Built a 3D Map of How LLMs Think to Teach My Kids. Leaders Need the Same Picture.

Most people who use, buy or approve AI tools have never seen what “meaning” looks like to a model. This free tool lets you rotate it in a browser.

I built the Embedding Space Navigator to teach my kids how large language models work. I didn’t want to explain vectors at the dinner table, so I made something they could grab and rotate. By the third version I realized I’d been explaining the same idea to adults for two years, and not as well. Once you’ve seen the space, one fact about LLMs falls into place: models work on nearness, not truth.

That matters most to whoever signs off on an AI assistant that answers from company documents, or a security tool that triages by similarity. The retrieval step picks whatever sits closest to the question. It doesn’t check whether that content is right, current, or something this user should see. In June 2025, Aim Labs disclosed EchoLeak, a zero-click flaw in Microsoft 365 Copilot that Microsoft tracked as CVE-2025-32711. Part of the attack was writing an email meant to sit close to the questions employees were likely to ask, so Copilot would pull it in as context. Nobody had to open it.

What you see when you open it

An embedding is how a model turns text into a list of numbers. OpenAI’s embeddings guide describes the distance between two of those lists as a measure of how related the texts are. The Navigator draws that idea in three dimensions. Each concept is a point, related concepts form clouds, and you rotate and zoom to see what sits next to what.

The current version ships with a cybersecurity topic set, because that’s the vocabulary I live in. I’m working on the next version now. It makes the clouds easier to see and adds topics that need no security background. My kids turned out to be less interested in lateral movement than I’d hoped.

With my family, the idea landed when they spotted two points sitting right next to each other and said, “wait, those aren’t the same thing.” Seeing the clusters didn’t do it. Think of a pair like phishing and spear phishing: close enough that a retrieval system could hand you one when you asked about the other.

That one question does more for AI literacy than a slide about transformers.

Why nearness is the whole point

Retrieval-augmented generation (RAG) is the pattern behind most assistants that “answer from your documents,” and it works in two steps. First it finds the chunks of text whose embeddings sit nearest the question. Then the model writes an answer from those chunks. The first step can’t tell whether the nearest chunk is correct, outdated or confidential. All it knows is that the chunk is close.

In the tools I’ve reviewed, that’s where most confident wrong answers come from. The model isn’t inventing something. It’s faithfully summarizing the wrong neighbor. That’s also why I want permissions enforced before retrieval, not cleaned up after: a document the user shouldn’t see can still be the closest one. I came at the same problem from the context side in 849 tests on AI context files. What you put in front of a model, and how it gets found, shapes the answer more than most people expect.

The same caution applies in the SOC. When a triage tool says “this alert looks like one we closed as benign,” it’s making a nearness call, and looking similar doesn’t mean the alerts share a root cause. It’s the line I drew in What AI Is Actually Doing in Your SOC: similarity is a reason to look, not a reason to close.

An analogy, not a measurement

I placed every point in the Navigator by hand. It illustrates the idea; no real embedding model produced those positions. I’d rather say that plainly than have someone screenshot it as data.

Real embeddings have far more than three dimensions. OpenAI’s embeddings guide gives default lengths of 1,536 for text-embedding-3-small and 3,072 for text-embedding-3-large. Squeezing that into 3D always distorts something, and the standard projection methods come with their own warnings. Distill’s guide to t-SNE cautions that cluster sizes in a t-SNE plot mean nothing and that distances between clusters might not mean anything. The UMAP documentation notes that UMAP doesn’t completely preserve density and can create false tears in clusters.

Treat the picture like a network diagram on a whiteboard. It’s good for building the mental model and wrong about the details by design.

Status, license and data handling

What it is	One HTML file with an interactive 3D view of a hand-placed “embedding space”
Version	v1.3 is current. The next version, with clearer clouds and more topic sets, is in progress
License	I’m releasing it under the MIT license: use it, change it, share it, and keep the license notice
Data handling	It has no back end of its own and runs in your browser. When the page opens, the browser loads three.js 0.160.0 from the unpkg CDN
Offline use	Host a local copy of three.js and point the page’s import map at it
Where to get it	A hosted copy on this site’s tools page; the source in a public GitHub repo
Maintenance	I maintain it and update it as I use it
Limits	Hand-placed positions, one topic set today, not yet tested with a room of leaders

Using it to open an AI review

So far I’ve used this at my kitchen table, not in a boardroom. I’m still working out whether it does the same job with a room of leaders. If you try it with your team, tell me where it landed and where it didn’t, and we can compare notes.

Good (10 minutes): Open it, rotate it, and find two points that sit close together but shouldn’t be interchangeable. Then name one AI tool in your environment that makes that same kind of call.

Better (30 minutes, at your next AI vendor review): Open the review with the picture, then ask three questions. What happens when the nearest document is wrong or out of date? Are permissions enforced before retrieval or after? Can you show me which sources a given answer came from? What you track after go-live (wrong-source answers, answers users can’t trace) depends on your business. Decide what’s worth measuring before you sign.

Best (an afternoon): Open the TensorFlow Embedding Projector, a free browser tool for visualizing and interpreting real embeddings, next to the Navigator and compare the two. Then take one retrieval-based tool you already run and write down which decisions it may make on nearness alone and which need a human. Where that line sits is your call. What matters is that you draw it on purpose.

---

David O’Neil is a CISO and builder who runs AI tools on real projects every day. He builds free tools that make AI easier to see, use and govern, starting at his own kitchen table.