privacy

This is an architecture and business decision, not a religious one. What shows depth is weighing capability, cost, privacy, control, and operational burden, then committing to a call instead of declaring 'open is always better.'

Cross-session memory is what makes an assistant feel personal, and it is mostly a retrieval and state-management problem rather than a bigger context window. The signal is the tiered architecture plus what to store, forget, and protect.

Summarize, draft, and triage, all across the most sensitive PII a person holds. The signal is grounding in the real thread, matching the user's voice, and a firm human-in-the-loop rule on anything that gets sent.

On-device AI gives up raw capability for privacy, offline use, and latency, under tight memory and battery limits. The signal is the small-quantized-model stack plus a hybrid router that sends the hard queries to the cloud without leaking private context.

Personalizing an LLM is a retrieval and memory problem, not a per-user fine-tune. Learn how to assemble user context at request time, keep long-term memory from bloating the prompt, and respect privacy and the right to be forgotten.

A CISO-facing question that trips up engineers who focus only on model quality. What matters is treating governance as architecture rather than a checkbox: minimization, isolation, auditability, and never training on customer data by default. Here is the framework.

Privacy starts as a governance requirement and turns into a training-time technique. What lands is knowing what differential privacy actually promises (and what it costs), plus how federated learning and DP fit together. Here is the rigorous, honest answer.

Two attacks aimed at a deployed model's confidentiality: copying its functionality through the API, and deducing who was in its training data. What lands is naming the precise mechanism each exploits and recognizing that every defense trades against utility.

Federated learning trains across decentralized devices without pooling data, yet a malicious participant can poison the shared model. What lands is the privacy mechanism plus the outlier-resistant aggregation defenses. Here is the answer.

Because detection never catches everything, the strong answer works in layers: checksummed regex for structured PII, ML/NER for the unstructured PII regex misses, and an honest explanation of why redaction alone is never enough. Here is the answer.

GDPR erasure and copyright takedowns require pulling a user's influence out of trained weights, not just deleting a dataset row. The signal is knowing why deletion falls short and where retrain, SISA, and approximate scrubbing each sit on the cost-versus-proof curve.

Encryption protects data at rest and in transit, but the instant you compute on it the data sits as cleartext in memory. Confidential computing closes that gap. The signal is the TEE concept, attestation, and the AI workloads that genuinely need it.

Privacy in ML is a toolbox, not one switch, and each tool defends a different threat. The signal is mapping DP, federated learning, confidential computing, encryption, and minimization to what each one actually protects, and knowing they compose.

Federated learning transmits gradients, not raw data. The catch: a gradient is derived from the data, so it carries the data. The signal is knowing why 'we only share gradients' is not a privacy guarantee. Here is the answer.

Large models memorize and can be coaxed into emitting training examples verbatim, a genuine privacy and copyright liability. The defenses reach across data, training, and output. Here is the layered answer.

Deleting a row is trivial. Removing a person's influence from embeddings, caches, derived datasets, and a trained model is not. GDPR and CCPA demand it regardless. Here is the plan that survives an audit.

Epsilon is the privacy knob, and shipping DP means picking a number, justifying it, and tracking what each query spends. The signal is treating epsilon as a finite budget that composes, not a magic constant. Here is the answer.

Federated learning keeps data on-device, but you pay for it in accuracy, debuggability, and engineering complexity. The signal is naming when those costs are justified and when a simpler centralized pipeline with DP wins. Here is the answer.

Consent and retention decide whether you can lawfully train on data and how long you may hold it. The signal is purpose limitation, granular consent, enforceable TTLs, and a plan for deleting data already baked into a model. Here is the answer.

Stripping direct identifiers protects nobody, because the identifying information was never in the name column. Here is how a linkage attack actually works, why k-anonymity and its patches keep failing, and the one defense that makes a promise it can keep.

Picking epsilon is the easy half. The hard half is the accuracy you just gave up, and the levers that get it back are not the ones most candidates reach for.