Threat-model an LLM application from scratch. What is the attack surface and how do you reason about it?
Before naming defenses, a security engineer maps the attack surface systematically. LLM apps present a wider, stranger surface than classic software. Here is how to threat-model one end to end.
Updated Sep 2026 · Grounded in real GenAI, LLM, and AI/ML engineering interview loops and written to a senior-engineer editorial bar.
Before naming defenses, a security engineer maps the attack surface systematically. LLM apps present a wider, stranger surface than classic software. Here is how to threat-model one end to end.
Lead with where the obvious approach breaks, because that is the judgment they are screening for — most candidates jump straight to the happy path and lose the room.
Then walk the failure back through the pipeline in order, naming the one metric the customer's exec sponsor actually cares about before you propose the fix.
