Safety and guardrails interview questions
Prompt injection, data leakage, moderation, and defence in depth. Ten practice questions with answers, for AI Engineer interviews.
Guardrail
Show answer
A check around a model call, on input or output, that blocks, modifies, or flags unwanted content or actions.
E.g. moderation, PII redaction, schema validation, action allow-lists.
What is prompt injection?
- Untrusted input containing instructions that try to override the developer's instructions
- Adding too many examples to a prompt
- SQL injection through an LLM
- A way to speed up prompts
Show answer
Untrusted input containing instructions that try to override the developer's instructions
It can arrive directly from users or indirectly via documents, emails, and web pages.
Why is 'just tell the model not to follow instructions in documents' not enough to stop prompt injection?
Show answer
Models can't perfectly distinguish instructions from data and can still be persuaded by cleverly written content, so a prompt instruction lowers the risk but doesn't eliminate it. You need architectural controls such as least-privilege tools, human confirmation, output validation, and not exposing sensitive data.
Treat the prompt rule as one layer.
Defence in depth
Show answer
Layering several independent safeguards so one failing doesn't cause harm.
Prompts, permissions, validation, monitoring, and human review together.
PII redaction
Show answer
Detecting and removing or masking personal data (names, emails, IDs) before storing, logging, or sending text to other systems.
Important for logs and analytics.
Which is the strongest defence against an injected instruction making an agent delete files?
- Don't give it delete permissions, or require human approval for deletes
- A system prompt saying 'ignore injections'
- Lower temperature
- A longer context window
Show answer
Don't give it delete permissions, or require human approval for deletes
Architectural limits beat instructions. Assume injection will sometimes succeed.
Where should you enforce that users only see their own data in an AI feature?
- In your backend authorisation (e.g. row-level security), not in the prompt
- In the system prompt
- By trusting the model
- In the frontend only
Show answer
In your backend authorisation (e.g. row-level security), not in the prompt
Never rely on the model for access control; only give it data the user may see.
What would you log and monitor for a production LLM feature, and what must you be careful about?
Show answer
Log inputs, outputs, model and prompt versions, token usage, latency, stop reasons including refusals, tool calls, errors, and user feedback, then monitor rates and anomalies. Be careful with privacy: minimise and redact PII, set retention limits, restrict access, and honour deletion requests and your privacy policy.
Observability and privacy must be designed together.
Design guardrails for a resume-tailoring feature so it never invents work experience.
Show answer
State the rule explicitly in the system prompt and require placeholders like [ADD NUMBER] instead of guessed facts; constrain output to a schema that mirrors the original resume; automatically compare employers, titles, dates, and degrees in the output against the extracted original and flag or block differences; show original and tailored versions side by side so the user reviews every change; and add invention cases to the eval set.
Combine prompting, automatic checks, UX, and evals.
A model renders markdown images. Why can an injected image URL be a data-exfiltration risk?
- The URL can embed private data in its query string, which leaks when the browser fetches the image
- Images are too large
- Markdown is unsafe to render at all
- The model can't see images
Show answer
The URL can embed private data in its query string, which leaks when the browser fetches the image
Restrict which domains can be loaded or don't render untrusted links and images.
Practise these with spaced repetition and AI grading, then try a mock interview.
Start Learning Free