Prompt Injection Interview Questions

Compare the control each interpreter enforces. Then review a fictional document-ranking feature without mistaking valid syntax, visible text or human review for permission.

Map the author, entry route and executing identity. Compare two fictional systems using reachable consequences, then explain what evidence could reverse your judgment.

Classify overlapping policy failures without assigning severity by label. Review a prohibited draft, a denied publication and an uncertain audience, then allocate the repairs.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Map each control to a specific read, operation or release. Check policy inputs, audience permissions, verdict timing and useful work instead of relying on defense labels.

Interpret the attack and benign counts, trace a detector miss to its actual consequence, and specify the verdict timing and fallback needed for deployment.

Verify exact text, confidential facts and invented reconstruction against the right source. Then scope the audience, impact and failed delivery path.

Use the historical EchoLeak advisory and an original worked trace to distinguish delivery, actual exposure, generated output and release. Choose verifiable controls without implying the old vulnerability remains open.

Separate source cues, message integrity, learned instruction priority and service permissions. Compare the actual configurations on both violations and useful manual-reading work.

Compare actual sources, identities, audiences, effects and persistence. Review what tools add without dismissing text-only harms or assuming user-scoped credentials authorize every task.

Compare supplied demonstrations with live conversation history. Review summary loss, streaming exposure, attempt budgets and the cost to legitimate long-document work.

Read universal and transferable as bounded research findings. Separate optimization proxies from policy failures, and local model access from hosted application authority.

Reason from learned behavior without inventing a hidden persona. Apply an explicit content policy, preserve legitimate fiction and test both missed violations and unnecessary refusals.

Find representation and context mismatches without assuming a universal bypass. Place checks before the real release, preserve source authority and keep legitimate decoding useful.

Separate Unicode normalization, hidden controls, bidirectional display and confusable identifiers. Use a harmless offline example to choose field-specific checks without damaging legitimate language.

Design signals that distinguish suspicious inputs, unauthorized proposals, blocked operations and confirmed exposure. Test response timing, evidence handling and monitoring health.

Interpret a canary hit using placement, known copies, audience and delivery evidence. Separate a local marker check from an active callback and from complete leak prevention.

Trace actual text, image and audio inputs, then distinguish extraction errors, unauthorized influence and completed effects. Build a useful test plan without inventing success rates.

Reproduce the failure without assuming its cause. Check meaning, labels, routing and model or guard behavior, then measure safety and useful work by language.

Turn a filter-based launch claim into an actionable decision note: evidence, permission gaps, useful interim scope, owners and completion conditions.

Build an authorized evaluation with synthetic identities, a fidelity matrix and controlled effects after real permission checks. Report what the harness proves and what remains untested.

Compare controller-enforced workflows with mediated planner inputs. Trace opaque values, bounded fields, runtime branches and retries to the actual permission decision.

Review capability metadata, trusted labels, derived values and actual release policy. Work through allowed sharing, forbidden audiences, branch influence and uncovered runtime paths.

Follow individual fields from their authors through tools, summaries and actual model exposure. Separate service-authoritative identifiers from quoted prose, then check each output and operation.

Design around actual read, draft, preview and send audiences. Bind current grants and approvals to the operation, handle queued changes and evaluate the content risks that remain.

Trace editable source material through retrieval, actual context, model behavior and observed effects. Work through a synthetic result with denied proposals and an unresolved receipt.

Write a release record with consequence-specific requirements, enforcement assumptions, measured task quality and unresolved outcomes. Name the decision owner and reopening conditions.

Use the seven-stage research framework without forcing every incident through every stage. Work a partial trace, model alternate paths and separate stored state from observed downstream influence.

Map protected context to its actual readers. Distinguish unauthorized retrieval from redistribution, inspect drafts and rendering, and verify disclosure without assuming every prompt inevitably leaks.

Investigate message construction, intended instruction conflicts and actual effects. Distinguish a misleading promise from a service failure, and test the correct permission rule.