Snowflake Cortex AI Complete Guide: LLM & ML Functions Usage

Snowflake Cortex AI is a managed AI platform that lets you run LLM inference, translation, summarization, data extraction, and time-series forecasting directly from SQL. You don't need to manage external API keys or build infrastructure — you get AI capabilities inside Snowflake's existing governance and access controls. This article walks through the four pillars — LLM Functions, ML Functions, Cortex Search, and Document AI — with hands-on SQL examples.

Cortex AI at a Glance

Cortex AI is Snowflake's native AI/ML platform and consists of the following four major feature groups.

LLM Functions (SNOWFLAKE.CORTEX Namespace)

LLM Functions are built-in functions you can call from a SQL SELECT statement. They all live in the SNOWFLAKE.CORTEX schema and run on Snowflake's serverless compute rather than your warehouse.

COMPLETE — Text Generation

Generates text from a prompt using the specified LLM model. There are two invocation styles: chat format (an array of messages) and plain text input.

-- Simple text generation
SELECT SNOWFLAKE.CORTEX.COMPLETE(
  'llama3.1-70b',
  'List three benefits of Snowflake micro-partitions'
) AS response;

-- Chat format (system / user roles)
SELECT SNOWFLAKE.CORTEX.COMPLETE(
  'mistral-large2',
  [
    {'role': 'system', 'content': 'You are a Snowflake expert.'},
    {'role': 'user', 'content': 'Explain the criteria for choosing a clustering key'}
  ],
  {'temperature': 0.3, 'max_tokens': 1024}
) AS response;

TRANSLATE — Translation

Translates text into the specified language. If you omit the source language, it is auto-detected.

SELECT SNOWFLAKE.CORTEX.TRANSLATE(
  'Snowflake decouples storage and compute for elastic scaling.',
  'en', 'ja'
) AS translated;
-- -> Snowflakeは弾力的なスケーリングのためにストレージとコンピュートを分離しています。

SUMMARIZE — Summarization

Automatically summarizes long text. You can run batch summarization across a document column in a table.

SELECT
  doc_id,
  SNOWFLAKE.CORTEX.SUMMARIZE(content) AS summary
FROM support_tickets
WHERE created_at >= DATEADD(day, -7, CURRENT_DATE());

EXTRACT_ANSWER — Question Answering

Extracts an answer to a specific question from text. Useful for RAG pipeline post-processing and automatic FAQ generation.

SELECT SNOWFLAKE.CORTEX.EXTRACT_ANSWER(
  'Snowflake was founded in 2012 by Benoit Dageville, Thierry Cruanes, and Marcin Zukowski.',
  'Who founded Snowflake?'
) AS answer;
-- -> [{"answer": "Benoit Dageville, Thierry Cruanes, and Marcin Zukowski", "score": 0.95}]

SENTIMENT — Sentiment Analysis

Returns a sentiment score for text in the range -1 (negative) to 1 (positive).

SELECT
  review_text,
  SNOWFLAKE.CORTEX.SENTIMENT(review_text) AS score
FROM product_reviews
ORDER BY score ASC
LIMIT 10;  -- Top 10 most negative reviews

Available Models

Comparison of the main models available with Cortex AI LLM Functions. Availability varies by region.

ML Functions — Codeless ML

ML Functions are built-in features that let you run time-series forecasting and anomaly detection with SQL alone. Model training and inference happen entirely inside Snowflake — no external tools required.

FORECAST — Time-Series Forecasting

-- Create a forecasting model
CREATE OR REPLACE SNOWFLAKE.ML.FORECAST sales_forecast(
  INPUT_DATA => SYSTEM$REFERENCE('TABLE', 'daily_sales'),
  TIMESTAMP_COLNAME => 'sale_date',
  TARGET_COLNAME => 'revenue'
);

-- Forecast 30 days ahead
CALL sales_forecast!FORECAST(
  FORECASTING_PERIODS => 30,
  CONFIG_OBJECT => {'prediction_interval': 0.95}
);

ANOMALY_DETECTION — Anomaly Detection

-- Create an anomaly detection model
CREATE OR REPLACE SNOWFLAKE.ML.ANOMALY_DETECTION sensor_anomaly(
  INPUT_DATA => SYSTEM$REFERENCE('TABLE', 'sensor_readings'),
  TIMESTAMP_COLNAME => 'reading_time',
  TARGET_COLNAME => 'temperature',
  LABEL_COLNAME => ''  -- Unsupervised
);

-- Detect anomalies on new data
CALL sensor_anomaly!DETECT_ANOMALIES(
  INPUT_DATA => SYSTEM$REFERENCE('TABLE', 'new_sensor_readings'),
  TIMESTAMP_COLNAME => 'reading_time',
  TARGET_COLNAME => 'temperature'
);

Cortex Search

Cortex Search is a hybrid search service that combines keyword search with semantic search. You build the search index with CREATE CORTEX SEARCH SERVICE and query it from the REST API or a Python client. The main use case is acting as the retriever in a RAG pipeline.

Document AI

Document AI extracts structured data from unstructured documents such as invoices, contracts, and forms. You create the model in the Snowsight UI and define the values (fields) to extract. Under the hood, it combines OCR with LLMs, and because data is processed entirely inside Snowflake, it's easy to satisfy security requirements.

-- Document AI model usage example
SELECT
  invoice!PREDICT(
    GET_PRESIGNED_URL(@docs_stage, 'invoice_001.pdf')
  ):vendor_name::STRING AS vendor,
  invoice!PREDICT(
    GET_PRESIGNED_URL(@docs_stage, 'invoice_001.pdf')
  ):total_amount::NUMBER(10,2) AS amount
FROM DUAL;

Privileges and Governance

Privilege design for Cortex AI breaks down as follows.

Architectural Positioning

Every Cortex AI capability runs on Snowflake's service layer or serverless compute. For exam prep, it's important to distinguish LLM functions (which don't consume your warehouse resources) from ML Functions (which do require a warehouse).

Query execution flow:

[User SQL]
     |
     +- LLM Functions ----> Serverless compute (no WH)
     |                       +- Billing: token-based
     |
     +- ML Functions -----> User warehouse (WH required)
     |                       +- Billing: credit consumption
     |
     +- Cortex Search ----> Serverless compute (no WH)
                             +- Billing: serverless credits

Exam Prep Highlights

• LLM functions live in the SNOWFLAKE.CORTEX namespace and run without a warehouse
• ML Functions (FORECAST, ANOMALY_DETECTION) do use a warehouse
• COMPLETE takes the model name as the first argument (e.g. 'llama3.1-70b')
• Cortex Search is a hybrid keyword + semantic search
• Every Cortex AI capability processes data inside Snowflake — nothing leaves the platform
• Document AI models are created and managed from the Snowsight UI

Sample Question

Frequently Asked Questions