privacy

Privacy principles become engineering decisions about fields, retention and contracts. The scored answer walks one feature and makes each principle concrete.

On macOS, root is not enough to read a user's documents or watch the screen. TCC decides that, and XPC is how privileged helpers talk, so both are prime targets.

Inspection is a man in the middle the organisation chose. Interviewers want the mechanism, then a clear view of the new single point of failure it creates and the traffic it must never touch.

Trusted execution moves the trust boundary from the operator to the hardware and the attested code. The scored answer is precise about what that protects, what it assumes, and what it leaves open.

The token is safely in the Keychain, and also in the crash log, the analytics payload and the app-switcher screenshot. Interviewers want the list of side doors, not the front door again.

Everything shipped on the phone belongs to the person holding it: the weights, the system prompt and any key the assistant uses. And the assistant now reads notifications, messages and screens written by strangers.

A communication question with a technical core. The answer that scores uses one good analogy, stays accurate, and ends with options and a decision.

Embeddings are not hashes. The scored answer explains what they capture, how attackers exploit similarity, and why a vector store deserves the same protection as the documents.

Breadth first, then priority. The answer that scores follows one sensitive value through every copy the system makes and fixes the two that leak most.

The tempting answer is that embeddings are one-way hashes. They are not. The answer that scores explains inversion and protects the index like the documents.

LLM observability quietly becomes the largest copy of customer data in the company. The scored answer minimises what is captured, separates what must be kept, and treats trace stores as production data.

Fine-tuning moves data from a database you can query and delete into weights you cannot. The scored answer covers memorisation, tenant separation, poisoning and the deletion problem.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

Define memory classes and their purpose, then inventory active records, derivatives, in-flight tasks and restored copies. Report retrieval denial and physical removal as separate milestones with evidence for each.

The attacker never sees the dataset. They see how much more confident the model is about one record than it should be.

Language models are trained to predict text, and sometimes the best prediction is the exact text they saw. Rare, repeated and sensitive strings are the risk.

The guarantee is about what an observer can learn from your presence in the data, not about hiding the data. Epsilon bounds it; delta is the small print.

A label is one bit of information per query. A probability vector is a map of the decision boundary, delivered on request.

Removing names removes the obvious identifier and leaves the rest. The scored answer explains re-identification, why models amplify it, and what actually bounds the risk.

DP gives a real guarantee with a real cost. The scored answer explains clipping, noise and accounting, then compares DP with cheaper controls for a concrete dataset.

The leak is in the weights, so the playbook differs from a database breach. The scored answer confirms, contains at the output, scopes from data lineage, and decides between filtering, retraining and withdrawal.

A research-depth question. The scored answer explains why 'was this in training' blurs at web scale, why many published attacks measured distribution shift instead, and what questions remain answerable.

Two security goals that pull against each other. The scored answer explains the mechanism, the evidence, and how to make the trade-off explicit in a design.

Preserve relevant evidence within its authorization boundary. Protect collection, record gaps and transformations, and explain what a checksum does and does not establish.

Three GDPR questions that shape every AI system handling EU personal data. The scored answer gets the legal structure right and turns each into engineering work.

There is no single 'AI incident' notification rule. The incident is usually a personal-data, contractual or sector incident that happens to involve AI, and the clock may already be running.

Security asks who can steal the data. Privacy also asks what the agent itself collects, infers, remembers and passes on, about the user and about everyone in their inbox who never agreed to anything.