Google DeepMind AI Security Engineer interview questions

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

Encryption at rest is the easy part; weights must be decrypted somewhere to be used. The scored answer controls where decryption happens, who can cause it, and how fast misuse is noticed.

The model's guess is cheap; the proof is what matters. Strong answers describe the oracle that turns a hypothesis into evidence, and the triage that keeps maintainers from drowning.

A patch that makes the scanner go quiet is not the same as a patch that fixes the bug. The interview is about how you would tell the difference at scale, and what the tool itself can be tricked into doing.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

The people who build frontier models need access to them, which is exactly the risk. The scored answer reduces who can touch weights directly, makes exfiltration hard and visible, and does it without poisoning research culture.

A framework that ties security investment to attacker capability. The scored answer explains the five levels, why the top ones are qualitatively different, and how labs use the idea.

Weights pass through more systems than most teams draw. The scored answer maps every hop, asks what an attacker could steal or swap at each, and puts integrity checks where they cannot be skipped.

You can check the file and test the behaviour; you cannot prove a negative. The scored answer separates code-level threats from learned backdoors and is honest about what testing can find.

Scraped data changes under you and anyone can write to the web. The scored answer snapshots and hashes what was collected, records where it came from, filters what it can, and keeps enough lineage to undo a mistake.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

A guardrail that blocks everything scores perfectly on attacks. The scored answer measures both errors, tests with attacks the guardrail has not seen, and reports with intervals at the operating threshold.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

Language models are trained to predict text, and sometimes the best prediction is the exact text they saw. Rare, repeated and sensitive strings are the risk.

The model passes your evaluation because your evaluation does not contain the trigger. And safety training may teach it to hide better.

The two attacks every robustness paper starts from. The scored answer explains the gradient step, the budget as a threat model, and why the iterative attack is the standard for evaluation.

The one defence that has held up in research, at a price. The scored answer explains the min-max objective and names the costs: accuracy, compute, and robustness only to the threat model trained on.

A defence that breaks the attacker's tools is not a defence that stops the attacker. The scored answer explains how masking fools gradient attacks, how to spot it, and how adaptive attacks get around it.

Most broken defences were evaluated by their authors. The scored answer pins down the threat model, attacks the defence specifically, runs sanity checks, and reports robust accuracy with the conditions attached.

Every poisoned example looks correctly labelled to a reviewer. The scored answer explains the mechanism, why label audits miss it, and the defences that work at the pipeline level.

The intuition that a huge dataset dilutes poison turns out to be wrong for some attacks. The scored answer cites the evidence, explains why, and moves the defence to data provenance and testing.

Three attacks that all start with queries and end with something the owner did not intend to share. The scored answer separates them by what is stolen and maps each to its defence.

DP gives a real guarantee with a real cost. The scored answer explains clipping, noise and accounting, then compares DP with cheaper controls for a concrete dataset.

The leak is in the weights, so the playbook differs from a database breach. The scored answer confirms, contains at the output, scopes from data lineage, and decides between filtering, retraining and withdrawal.

A watermark is evidence of origin under conditions, not a detector of all AI text. The scored answer explains how it works, how it fails, and what claims it can support.

A research-depth question. The scored answer explains why 'was this in training' blurs at web scale, why many published attacks measured distribution shift instead, and what questions remain answerable.

Two security goals that pull against each other. The scored answer explains the mechanism, the evidence, and how to make the trade-off explicit in a design.

'Clean the dataset' is not an investigation. The answer freezes evidence, traces what changed and who could change it, tests causality by retraining, and treats the pipeline as possibly compromised too.

An attacker who cannot see your model can attack one they can see, and much of the damage carries over. That single property turns 'the weights are secret' into a weak defence.

Two different attacks hide in 'malicious images'. One writes instructions a model can read; the other optimises pixels to push the model's internal representation. They need different tests and different defences.

Generic leakage benchmarks will not tell you whether your customers' records got easier to extract. Planted canaries, matched controls and an attack-economics view of severity will.

'73 percent on expert CTFs' sounds precise. A strong answer explains the task design, the attempt budget, the missing defenders and the confidence interval that sit behind a number like that.

Two layers: documentation, copyright and transparency for every GPAI model provider, then evaluation, incident reporting and cybersecurity once a model crosses into systemic risk.

A composite safety score asks the reader to trust you. An assurance case states specific claims, shows the argument and evidence for each, and lists what would make it false.

Frontier labs promise to add safeguards when models cross capability thresholds. A large share of those safeguards are security controls, and someone has to build and prove them.

Mythos-class models and Gemini's Flash Cyber variants did not ship to everyone. Knowing why, and what joining a vetted-access programme commits you to, is now a governance interview staple.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Compare the control each interpreter enforces. Then review a fictional document-ranking feature without mistaking valid syntax, visible text or human review for permission.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Map the author, entry route and executing identity. Compare two fictional systems using reachable consequences, then explain what evidence could reverse your judgment.

Classify overlapping policy failures without assigning severity by label. Review a prohibited draft, a denied publication and an uncertain audience, then allocate the repairs.

Map each control to a specific read, operation or release. Check policy inputs, audience permissions, verdict timing and useful work instead of relying on defense labels.

Interpret the attack and benign counts, trace a detector miss to its actual consequence, and specify the verdict timing and fallback needed for deployment.