Skip to content
AI Security

Interview question · Software, Data & Model Supply Chain

A Python dependency in your training pipeline is found to be malicious. Walk through your response.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

hardNewPreparation tags: OpenAI, Anthropic, GoogleUpdated Nov 2026

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A popular data-loading library used in your training pipelines publishes a malicious release, and some jobs installed it over the past four days.

  1. How should you treat environments that installed it?
  2. What do you do first?
  3. How do you scope the impact?
  4. What if the package could have altered checkpoints or datasets?
  5. How do you prevent a repeat?
  6. How would you run the response end to end?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackWhat is the risk of loading models that require custom or remote code?Next in this trackHow would you check a public pre-trained model for a backdoor, and what can you not detect?Next in this trackHarden a CI/CD pipeline: runners, secrets, pinned actions and branch protections.
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.