LLM Security Fundamentals Interview Questions

The single idea underneath most AI security answers. The scored part is the second half: the architectural moves that follow once you accept it.

Three parts, each short. The answer that scores ends with a design rule about what may and may not live in a prompt.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

Three definitions and one practical consequence. The consequence is the point: security tests split into deterministic checks and measured rates.

Three ways to give a model your data, three different places the data ends up. The answer that scores follows the data and asks how you would delete it.

Neither option is simply safer. The answer that scores names who you are trusting in each case and which controls move from the provider to you.

Knowing the acronym is the easy part. Mapping a real attack chain onto tactics, and saying what that mapping is useful for, is what gets scored.

A communication question with a technical core. The answer that scores uses one good analogy, stays accurate, and ends with options and a decision.

Training objectives help form test hypotheses. The worked answer separates observed behavior, useful work, application enforcement and the limits of safe proxy tests.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

Same product, two different adversaries and two different teams. The scored answer separates them by what the attacker gets, and shows where they meet.

Uploads bring classic file-handling bugs into AI products. The scored answer covers the parsers, fetchers and storage around the model, not only what the model reads.

Longer thinking helps the model resist some attacks and gives others more room. The scored answer covers the reasoning trace as data, as a monitoring signal, and as an attack surface.

An easy question with a lot of surface area. The scored answer walks the pipeline left to right, names the attacker's lever at each stage, and ties each to one control.

Trace the proposal to its executor, resource policy and task scope. A valid credential or tool schema does not by itself authorize this particular action.

Embeddings are not hashes. The scored answer explains what they capture, how attackers exploit similarity, and why a vector store deserves the same protection as the documents.

A schema can constrain fields and allowed values. Follow what remains: trusted facts, resource and task permissions, safe consumers and actual completion.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

A training update can change behavior beyond its intended task. Work through a release comparison that separates useful answers, forbidden proposals and confirmed effects.

AI security did not start with LLMs. The scored answer explains how these classifiers learn, the adversarial dynamics they have lived with for decades, and the lessons that carry over.

A fallback changes the real request path. Review recipient eligibility, state compatibility and uncertain actions before trying another endpoint.

Review caller-controlled options by their actual information, resource and capability effects. Build a bounded product schema instead of forwarding arbitrary configuration.

An expert question that rewards calibration. The scored answer separates what works now (probes and feature monitors as signals) from what does not (proofs of safety), and says where it fits in a defence.

A motivation question that is really a skills question. The scored answer gives a specific reason, maps existing skills to AI security work honestly, and shows what you have already done to close the gaps.