Turn what you know into
AI security judgment.

The first ten minutes of any design review decide its quality. This answer shows the sketch, the one question that finds most bugs, and why controls come last.

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

Reciting the six letters earns little. What scores is a diagram drawn aloud, one boundary walked in depth, and a list of threats with owners.

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

The most common screen question in security. The answer that scores sorts all four by one property: whether there is a key, and who holds it.

Message names are table stakes. The interviewer is listening for why CertificateVerify exists and what Finished actually checks.

SHA-256 with a salt sounds right and fails. The answer that scores explains the attacker's economics and names the parameters.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

Drawing the arrows is half the answer. The other half is pinning an attack to every parameter: state, redirect URI, code, verifier, audience.

Three bugs, one cause. The answer that scores names the cause, explains why parameters are structural, and lands on why prompts have no parameters.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

Reading files top to bottom finds style issues. A security review starts from sources, sinks and the checks between them, and AI code adds a new source.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

Half the answer is 'pickle runs code'. The half that scores is everything safetensors leaves open.

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

The single idea underneath most AI security answers. The scored part is the second half: the architectural moves that follow once you accept it.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

Compare the control each interpreter enforces. Then review a fictional document-ranking feature without mistaking valid syntax, visible text or human review for permission.

Map the author, entry route and executing identity. Compare two fictional systems using reachable consequences, then explain what evidence could reverse your judgment.

Classify overlapping policy failures without assigning severity by label. Review a prohibited draft, a denied publication and an uncertain audience, then allocate the repairs.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Map each control to a specific read, operation or release. Check policy inputs, audience permissions, verdict timing and useful work instead of relying on defense labels.

Product security's favourite AI question, because the answer is mostly classic AppSec. The scored part is matching each sink to its control and preferring structured data over generated code.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

Similarity search has no idea who is asking. The answer that scores makes the index enforce the source system's rules, at query time and over time.

Breadth first, then priority. The answer that scores follows one sensitive value through every copy the system makes and fixes the two that leak most.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Start with the useful task, its data paths and its effective authority. Produce explicit backend invariants, bounded execution and a testable release decision that covers ordinary work as well as denied effects.

Compare each task’s required effects with the functionality, permissions and autonomy the system exposes. Narrow the effective authority at enforceable boundaries while preserving legitimate workflows.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Build a permission worksheet for each tool: acting principal, task grant, objects, recipients, bounds and enforcement. Treat reads and reversible writes as potentially consequential.

One attacks the model's inputs, the other its upbringing. The phase decides the defence, and interviewers want you to say so.

The attacker never sees the dataset. They see how much more confident the model is about one record than it should be.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

Detection alone loses: clean-label poisons look correct. The answer that scores builds a pipeline where poison is hard to add, easy to trace and contained when it slips through.

Compare actual scope and evidence across AI red teaming, penetration testing and benchmarks. The labels alone do not tell you which boundaries were assessed.

Build an authorized chatbot assessment around real data and action boundaries, then turn observed effects into findings, useful-work checks and retest criteria.

Define the success event and trial unit, reconcile unknown outcomes and report a rate whose uncertainty and retry claims match the actual assessment.

Separate a suspicious signal, a verified effect and a causal hypothesis. Then contain the real path, scope exposure and record what is still unknown.

Trace the data from its owner to each actual reader. Repair the access or reuse boundary, including caches, revoked permissions and retained artifacts.

A framework, a certifiable standard and a law. They overlap heavily and substitute for each other not at all.

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.