AI Security, Privacy & Governance

There is no one-shot patch for prompt injection, and answering 'sanitize the input' loses the round. What lands is defense in depth: privilege boundaries, handling retrieved content as data rather than instructions, and a human gate on irreversible actions. Here is the layered answer.

A CISO-facing question that trips up engineers who focus only on model quality. What matters is treating governance as architecture rather than a checkbox: minimization, isolation, auditability, and never training on customer data by default. Here is the framework.

Getting an LLM feature to production safely is an evaluation problem first and a model problem second. What lands is a layered eval-plus-guardrail design with honest, segmented metrics rather than a single 'safety classifier.' Here is how to measure and defend each failure mode.

Fairness questions catch engineers who treat it as a vibe. What lands is knowing the formal fairness metrics conflict mathematically, that you have to choose one deliberately for the context, and where bias enters the pipeline. Here is the rigorous, honest answer.

A classic ML-security question that trips up people who only know clean-data accuracy. What lands is grasping why models are brittle, the realistic threat model, and the fact that no single defense holds. Here is the honest answer.

LLM endpoints are unusually exposed: every call can spend real money and consume scarce GPU capacity, so abuse is a security and a financial problem at once. What lands is layered controls on tokens and cost, not just request count. Here is the defense.

Most ML security centers on inference-time attacks; this one targets the training pipeline, where a poisoned dataset or a tampered dependency can hide a backdoor that clean-data evaluation never catches. What lands is naming the attack classes and recognizing that defense means provenance, not a single model fix.

Privacy starts as a governance requirement and turns into a training-time technique. What lands is knowing what differential privacy actually promises (and what it costs), plus how federated learning and DP fit together. Here is the rigorous, honest answer.

Two attacks aimed at a deployed model's confidentiality: copying its functionality through the API, and deducing who was in its training data. What lands is naming the precise mechanism each exploits and recognizing that every defense trades against utility.

Enterprise AI deals turn on governance, and engineers who can speak it stand out. What lands is treating it as documentation, accountability, and risk-tiered controls across the lifecycle rather than a legal afterthought.

Regulators and enterprises increasingly require explanations for AI decisions, and the two terms get thrown around loosely. What lands is separating inherently interpretable models from post-hoc explanations and picking the right technique for the stakes.

Red teaming is how you uncover an AI system's failures before users or attackers do. What lands is a structured program covering the real attack surface (jailbreaks, harmful content, leakage, bias) and routing every finding back into defenses.

The NIST AI RMF is the most-cited voluntary framework for managing AI risk, and enterprises ask about it. What lands is treating it as a continuous process built on four functions rather than a compliance checklist. Here is the answer.

Copyright is among the largest unresolved risks in generative AI, on both the training and output side. What lands is naming both exposures and the engineering mitigations for each rather than offering a legal opinion. Here is the engineer's framing.

Federated learning trains across decentralized devices without pooling data, yet a malicious participant can poison the shared model. What lands is the privacy mechanism plus the outlier-resistant aggregation defenses. Here is the answer.

As generated output grows indistinguishable from real, knowing what is AI-made matters for trust, misinformation, and regulation. What lands is the split between in-content watermarks and attached provenance metadata, plus the fact that detection is an arms race. Here is the answer.

AI fails in ways traditional software does not: bias, hallucination, harmful output, silent quality regression. The strong answer is a concrete playbook (detect, contain, communicate) plus a blameless post-mortem that ships systemic fixes. Here is the answer.

Because detection never catches everything, the strong answer works in layers: checksummed regex for structured PII, ML/NER for the unstructured PII regex misses, and an honest explanation of why redaction alone is never enough. Here is the answer.

Model cards and datasheets are the standard responsible-AI documentation artifacts, and regulators and buyers increasingly demand them. The strong answer knows what each one covers and grasps that the whole purpose is honest disclosure of limitations, not marketing. Here is the answer.

'Add guardrails' says nothing concrete. The strong answer names the specific input and output checks, the mechanisms that enforce them, the fail-safe behavior when one trips, and the honest admission that they are imperfect. Here is the implementation answer.

GDPR erasure and copyright takedowns require pulling a user's influence out of trained weights, not just deleting a dataset row. The signal is knowing why deletion falls short and where retrain, SISA, and approximate scrubbing each sit on the cost-versus-proof curve.

Models return confident answers on inputs unlike anything in their training set, which is how silent production failures start. The signal is knowing why raw softmax confidence misleads and which detectors genuinely separate in- from out-of-distribution.

Attackers coax models into spilling the hidden system prompt, exposing IP, business logic, or worse, embedded secrets. The signal is treating the prompt as non-secret and defending in layers, rather than betting on 'never reveal your instructions.'

Toxicity detection looks like plain text classification but is nothing of the sort: context flips labels, adversaries evolve weekly, and naive models tag dialects as hate. The signal is naming those failure modes and building the human-in-the-loop system around them.

The EU AI Act sorts obligations by risk, making that classification a first-order design decision rather than a legal footnote. The signal is knowing the four tiers and what high-risk systems must prove before they ship.

Audit logging is the backbone of AI accountability, yet logging everything blindly turns your logs into the biggest privacy liability you own. The signal is what to log so any decision can be replayed, and how to do it without hoarding PII.

Encryption protects data at rest and in transit, but the instant you compute on it the data sits as cleartext in memory. Confidential computing closes that gap. The signal is the TEE concept, attestation, and the AI workloads that genuinely need it.

Privacy in ML is a toolbox, not one switch, and each tool defends a different threat. The signal is mapping DP, federated learning, confidential computing, encryption, and minimization to what each one actually protects, and knowing they compose.

Safety is not a single number. The candidates who pass name the axes, run benchmarks as a gate, and then explain why benchmarks by themselves certify nothing. Here is the framing interviewers score highest.

Federated learning transmits gradients, not raw data. The catch: a gradient is derived from the data, so it carries the data. The signal is knowing why 'we only share gradients' is not a privacy guarantee. Here is the answer.

With direct injection the user attacks the prompt. With indirect injection the payload sits inside a page, doc, or email the model reads. The signal is recognizing that retrieved and tool data is untrusted and can hijack the model. Here is the answer.

Every third-party model, dataset, and library widens the attack surface: backdoors, poisoning, arbitrary code on load, license landmines. The signal is treating models and data as supply-chain artifacts that need provenance and vetting. Here is the answer.

An enterprise RAG that retrieves across everyone's documents is a breach in waiting. The fix belongs in the retrieval layer, not the prompt. Here is the design that survives a security review.

LLM apps bleed secrets in three quiet places: the prompt, the logs, and the next training set. Each demands a different control. Here is how to close all three.

Large models memorize and can be coaxed into emitting training examples verbatim, a genuine privacy and copyright liability. The defenses reach across data, training, and output. Here is the layered answer.

For consequential decisions, 'the model said so' will not satisfy a regulator. Adverse-action notices and the right to explanation limit which model you can even ship. Here is the governance view.

An attacker doesn't have to breach your LLM to hurt you, only make it do expensive work. A few crafted prompts can pin your GPUs and run up the bill. The defense is not a bigger rate limit.

AI features create cross-tenant leak paths that classic SaaS isolation never had to reckon with: shared embeddings, shared caches, and fine-tunes that memorize. One leak ends an enterprise contract. Here is the isolation model.

Deleting a row is trivial. Removing a person's influence from embeddings, caches, derived datasets, and a trained model is not. GDPR and CCPA demand it regardless. Here is the plan that survives an audit.

When an agent holds private data, reads untrusted text, and can talk to the outside, injected instructions can steal data. This 'lethal trifecta' is the defining agent vulnerability. The fix is architectural, not a better prompt.

Before naming defenses, a security engineer maps the attack surface systematically. LLM apps present a wider, stranger surface than classic software. Here is how to threat-model one end to end.

A request that gets refused in one message often lands when broken across ten. The signal is understanding that conversational state is part of the attack surface, and that turn-by-turn classifiers see only fragments.

base64, leetspeak, invisible Unicode, and foreign scripts each let a payload look like gibberish to your filter yet read as a clear instruction to the model. The signal is knowing why the model decodes what the classifier cannot.

Roleplay, obfuscation, optimization-based suffixes, and multi-turn escalation are distinct attack classes that call for distinct defenses. The signal is organizing the space and pairing each class with a control instead of hoping one filter covers all.

A backdoored model acts perfectly until it meets a secret trigger, then flips. The signal is explaining why clean test accuracy never exposes it, and what detection actually buys you when the trigger is unknown.

Gibberish-looking token strings tacked onto a prompt can reliably break refusals, and they carry over between models. The signal is explaining the gradient search that finds them and why output checks beat input pattern matching.

An agent that trusts its tools and its own memory can be redirected by one poisoned record that resurfaces turns or sessions later. The signal is treating persistent state as an attack surface, not just the live prompt.

A hijacked agent does not need a 'send email' tool to leak secrets. A rendered markdown image, a URL parameter, or a DNS lookup will do. The signal is enumerating the covert channels and locking down egress, not just tools.

Asking the model to keep secrets or enforce permissions puts the job on the wrong component. The signal is enforcing access control before retrieval, in code you trust, and treating the LLM as untrusted compute over data that is already authorized.

Epsilon is the privacy knob, and shipping DP means picking a number, justifying it, and tracking what each query spends. The signal is treating epsilon as a finite budget that composes, not a magic constant. Here is the answer.

Federated learning keeps data on-device, but you pay for it in accuracy, debuggability, and engineering complexity. The signal is naming when those costs are justified and when a simpler centralized pipeline with DP wins. Here is the answer.

C2PA cryptographically signs where media originated, but a signature you can peel off is not the same as a watermark you cannot. The signal is knowing what provenance proves, what it does not, and why you pair it with watermarking. Here is the answer.

ISO 42001 is the certifiable AI management-system standard, the AI counterpart to ISO 27001. The signal is knowing it is an auditable management system, not a technical control list, and how it sits alongside NIST and the EU AI Act. Here is the answer.

A fairness audit is a structured process: pick protected attributes, choose metrics that fit the harm, measure disaggregated performance, and document findings. The signal is knowing the metrics conflict and which one the use case requires. Here is the answer.

Consent and retention decide whether you can lawfully train on data and how long you may hold it. The signal is purpose limitation, granular consent, enforceable TTLs, and a plan for deleting data already baked into a model. Here is the answer.

Adopting a vendor model pulls their data practices, security, and failure modes into your product. The signal is a structured assessment spanning data handling, security, performance, and contractual terms, not just a demo that looked good. Here is the answer.

The EU AI Act hands different duties to high-risk deployers, GPAI model providers, and limited-risk systems. The signal is naming the specific obligations per tier, not merely reciting that risk tiers exist. Here is the answer.

An agent running on a single over-privileged service account is a confused deputy waiting to happen. The signal is per-user delegated credentials, token exchange, per-tool scopes, and an audit trail that names the human. Here is the answer.

Human-in-the-loop is the mitigation everyone writes into the risk register and almost nobody measures. When the reviewer anchors on a confident model output, your oversight control fails exactly on the cases it existed to catch.

Dropping the protected attribute is the answer most candidates give, and it accomplishes nothing: the attribute is reconstructible from the features you kept. Here is how to actually locate the proxies and what removing them costs you.

Single-axis fairness audits are just another form of averaging, and they average away the exact group that is being harmed. The hard part is not noticing that: it is handling the combinatorial blowup, the tiny cells, and the multiple-testing problem without chasing ghosts.

Stripping direct identifiers protects nobody, because the identifying information was never in the name column. Here is how a linkage attack actually works, why k-anonymity and its patches keep failing, and the one defense that makes a promise it can keep.

Most teams stop their governance work at 'we can explain the decision.' The obligation, and the interview signal, is what happens after the user reads the explanation and says it is wrong.

Rate limits stop a user who costs you too much. They do nothing about a user doing something you forbid. The enforcement system is a different design, and interviewers can tell within a minute whether you have built one.

Picking epsilon is the easy half. The hard half is the accuracy you just gave up, and the levers that get it back are not the ones most candidates reach for.

Your guardrail reads text. The attack is not in the text. That single sentence is the whole vulnerability, and the red team you build from it looks nothing like the one you already have.

The technique works and everybody knows it works. The interview is not testing whether you can generate the training set; it is testing whether you know what you are agreeing to when you do.