OpenAI How LLM Systems Work interview questions

Same product, two different adversaries and two different teams. The scored answer separates them by what the attacker gets, and shows where they meet.

A motivation question that is really a skills question. The scored answer gives a specific reason, maps existing skills to AI security work honestly, and shows what you have already done to close the gaps.

The single idea underneath most AI security answers. The scored part is the second half: the architectural moves that follow once you accept it.

Three parts, each short. The answer that scores ends with a design rule about what may and may not live in a prompt.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

Three definitions and one practical consequence. The consequence is the point: security tests split into deterministic checks and measured rates.

Three ways to give a model your data, three different places the data ends up. The answer that scores follows the data and asks how you would delete it.

Neither option is simply safer. The answer that scores names who you are trusting in each case and which controls move from the provider to you.

Knowing the acronym is the easy part. Mapping a real attack chain onto tactics, and saying what that mapping is useful for, is what gets scored.

A communication question with a technical core. The answer that scores uses one good analogy, stays accurate, and ends with options and a decision.

Training objectives help form test hypotheses. The worked answer separates observed behavior, useful work, application enforcement and the limits of safe proxy tests.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

Uploads bring classic file-handling bugs into AI products. The scored answer covers the parsers, fetchers and storage around the model, not only what the model reads.

Longer thinking helps the model resist some attacks and gives others more room. The scored answer covers the reasoning trace as data, as a monitoring signal, and as an attack surface.

An easy question with a lot of surface area. The scored answer walks the pipeline left to right, names the attacker's lever at each stage, and ties each to one control.

Trace the proposal to its executor, resource policy and task scope. A valid credential or tool schema does not by itself authorize this particular action.