Expert AI security interview questions

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

'Rewrite it in Rust' is a slogan, not a plan. The staff answer ranks components by exposure, stops new bugs at the boundary first, and keeps the old code contained while the language mix shifts.

Encryption at rest is the easy part; weights must be decrypted somewhere to be used. The scored answer controls where decryption happens, who can cause it, and how fast misuse is noticed.

Trusted execution moves the trust boundary from the operator to the hardware and the attested code. The scored answer is precise about what that protects, what it assumes, and what it leaves open.

Issuing a certificate is easy. Knowing every certificate you issued, renewing them before they expire, and surviving the day a CA key leaks is the design.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

GPUs were built for throughput, not mutual distrust. Each sharing mode makes a different promise about memory, and some make none.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

A framework that ties security investment to attacker capability. The scored answer explains the five levels, why the top ones are qualitatively different, and how labs use the idea.

A release is only as trustworthy as the weakest step a customer cannot check. The scored answer chains source, build, artefact and publication into evidence a consumer verifies automatically.

A logging pipeline is a distributed system with a threat model: attackers want it blind, analysts want it fast, finance wants it cheap. The staff answer designs for all three and for the day the queue backs up.

An expert question that rewards calibration. The scored answer separates what works now (probes and feature monitors as signals) from what does not (proofs of safety), and says where it fits in a defence.

Review capability metadata, trusted labels, derived values and actual release policy. Work through allowed sharing, forbidden audiences, branch influence and uncovered runtime paths.

Design around actual read, draft, preview and send audiences. Bind current grants and approvals to the operation, handle queued changes and evaluate the content risks that remain.

Design investigation, response policy and execution with distinct authority. Build an action matrix, handle failed dependencies and tenant boundaries, and evaluate useful work alongside missed incidents and wrongful containment.

Separate proposal, verification and deployment authority. Bind approval to the executed artifact and environment, protect every policy dependency, and plan for drift, partial application and limited rollback.

Define the partner identity, permitted operations, disclosure rules and commitment states. Verify claims against authorized evidence and reconcile disputed or uncertain effects.

One agent is a design review. Four hundred agents is an operations problem: who owns each, what it can touch, how much it can spend, and how you stop one, a class or all of them in minutes.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

Most broken defences were evaluated by their authors. The scored answer pins down the threat model, attacks the defence specifically, runs sanity checks, and reports robust accuracy with the conditions attached.

DP gives a real guarantee with a real cost. The scored answer explains clipping, noise and accounting, then compares DP with cheaper controls for a concrete dataset.

A research-depth question. The scored answer explains why 'was this in training' blurs at web scale, why many published attacks measured distribution shift instead, and what questions remain answerable.

Two security goals that pull against each other. The scored answer explains the mechanism, the evidence, and how to make the trade-off explicit in a design.

Design a bounded assessment workflow from approved requirements to verified findings. Separate genuine mechanism discovery from new wording, scorer errors and unresolved effects.