LLM Application & RAG Security Interview Questions

Product security's favourite AI question, because the answer is mostly classic AppSec. The scored part is matching each sink to its control and preferring structured data over generated code.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

Similarity search has no idea who is asking. The answer that scores makes the index enforce the source system's rules, at query time and over time.

Breadth first, then priority. The answer that scores follows one sensitive value through every copy the system makes and fixes the two that leak most.

Poisoning a knowledge base is cheaper than poisoning a model. The answer that scores starts from who can write to the corpus and limits what a poisoned chunk can achieve.

Both, plus the layer most people forget: the action boundary. The scored skill is placing each check where it sees the right thing and labelling which ones are boundaries.

An easy question with a revealing follow-up. The answer that scores limits cost at every layer, including the agent loop, not just requests per minute.

An incident question disguised as debugging. The answer that scores treats it as a possible breach, preserves evidence, and checks the four usual causes in order of likelihood.

The tempting answer is that embeddings are one-way hashes. They are not. The answer that scores explains inversion and protects the index like the documents.

LLM observability quietly becomes the largest copy of customer data in the company. The scored answer minimises what is captured, separates what must be kept, and treats trace stores as production data.

There is no single answer, and saying so is the start. The scored answer decides per check from what its failure would let through, and designs the latency budget so the choice is rarely forced.

A guardrail that blocks everything scores perfectly on attacks. The scored answer measures both errors, tests with attacks the guardrail has not seen, and reports with intervals at the operating threshold.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

Fine-tuning moves data from a database you can query and delete into weights you cannot. The scored answer covers memorisation, tenant separation, poisoning and the deletion problem.

When people act on wrong output, the harm is real even though nothing was hacked. The scored answer names the concrete failures and designs the product so verification is easy and required where it matters.

The connector copies documents out of a system that enforces permissions into one that must re-create them. The scored answer treats permission fidelity and freshness as the core problem.

The service receives customers' source code all day. The scored answer protects that code across tenants, keeps secrets out of prompts and logs, and treats suggestions as untrusted output.

A gateway turns dozens of ad hoc model integrations into one place to enforce and observe. The scored answer chooses what belongs centrally and what must stay in each application.

Banning tools people find useful mostly moves the leak somewhere you cannot see. The scored answer offers an approved route, then adds policy, technical controls and visibility around it.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

A trust and safety design question. The scored answer connects policy, detection, review, enforcement and appeals into one loop, and sizes it to the volume and the harm.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Rendering is an outbound channel. The scored answer removes images, rewrites unapproved links, strips raw HTML, and only releases streamed text once it can no longer turn into something dangerous.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

The most similar chunk is often the one written to be retrieved. The answer adds provenance to every chunk, ranks with it outside the model, and refuses to let text declare its own authority.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.

The regulator does not care which classifier you used. The design that scores puts authorisation and commitments in code, uses classifiers where they are good, and decides in advance what happens when a streamed answer goes wrong halfway.

Requests per minute is the wrong unit when one request can cost ten thousand tokens. The interview checks the bucket arithmetic, the unknown output length, and what happens when two gateway nodes share one budget.

AI security products bundle five different jobs under one logo, and the market consolidated fast in 2025 and 2026. A strong answer evaluates each job on its own evidence and keeps the controls that no vendor can sell you.

Refusals stop single requests; disruption stops operators. The scored answer explains how providers find the actor behind thousands of innocent-looking requests, what they do about it, and how to read their reports critically.