AI Security, Privacy & Governance

Prompt injection has no single fix, and 'sanitize the input' fails the round. The signal is defense in depth: privilege boundaries, treating retrieved content as data not instructions, and a human gate on irreversible actions. Here is the layered answer.

The CISO-facing question that sinks engineers who only think about model quality. The signal is treating governance as architecture, not a checkbox: minimization, isolation, auditability, and never training on customer data by default. Here is the framework.

Shipping an LLM feature safely is an evaluation problem before it is a model problem. The signal is a layered eval-plus-guardrail design with honest, segmented metrics, not a single 'safety classifier.' Here is how to measure and defend each failure mode.

Fairness questions trip up engineers who treat it as a vibe. The signal is knowing the formal fairness metrics conflict mathematically, that you must pick one deliberately for the context, and where in the pipeline bias enters. Here is the rigorous, honest answer.

A classic ML-security question that catches people who only know clean-data accuracy. The signal is understanding why models are brittle, the realistic threat model, and that no single defense holds. Here is the honest answer.

LLM endpoints are uniquely exposed: each call can cost real money and burn scarce GPU capacity, and abuse is both a security and a financial problem. The signal is layered controls on tokens and cost, not just requests. Here is the defense.

Most ML security focuses on inference-time attacks; this asks about the training pipeline, where a poisoned dataset or a tampered dependency can plant a backdoor that clean-data evaluation never sees. The signal is knowing the attack classes and that defense is provenance, not a single model fix.

Privacy is a governance requirement that becomes a training-time technique. The signal is knowing what differential privacy actually guarantees (and its cost), and how federated learning and DP combine. Here is the rigorous, honest answer.

Two attacks that hit a deployed model's confidentiality: stealing its functionality through the API, and inferring who was in its training data. The signal is naming the exact mechanism each exploits and that every defense trades against utility.

Governance is where enterprise AI deals are won or lost, and engineers who can speak it stand out. The signal is treating it as documentation, accountability, and risk-tiered controls across the lifecycle, not a legal afterthought.

Regulators and enterprises increasingly demand explanations for AI decisions, and the two terms get used loosely. The signal is separating inherently interpretable models from post-hoc explanations and naming the right technique for the stakes.

Red teaming is how you find an AI system's failures before users or attackers do. The signal is a structured program covering the real attack surface (jailbreaks, harmful content, leakage, bias) and feeding every finding back into defenses.

The NIST AI RMF is the most-referenced voluntary framework for managing AI risk, and enterprises ask about it. The signal is treating it as a continuous process built on four functions, not a compliance checklist. Here is the answer.

Copyright is one of the biggest unresolved risks in generative AI, on both the training and output side. The signal is naming both exposures and the engineering mitigations for each, not offering a legal opinion. Here is the engineer's framing.

Federated learning trains across decentralized devices without centralizing data, but a malicious participant can poison the shared model. The signal is the privacy mechanism plus the outlier-resistant aggregation defenses. Here is the answer.

As generation gets indistinguishable from real, knowing what is AI-made matters for trust, misinformation, and regulation. The signal is the split between in-content watermarks and attached provenance metadata, and that detection is an arms race. Here is the answer.

AI fails in ways traditional software does not: bias, hallucination, harmful output, silent quality regression. The strong answer is a real playbook (detect, contain, communicate) plus a blameless post-mortem that ships systemic fixes. Here is the answer.

Detection is imperfect, so the strong answer is layered: regex with checksums for structured PII, ML/NER for the unstructured PII regex cannot see, and a frank account of why you never rely on redaction alone. Here is the answer.

Model cards and datasheets are the standard responsible-AI documentation artifacts, increasingly required by regulation and buyers. The strong answer knows what each documents and that honest disclosure of limitations, not marketing, is the entire point. Here is the answer.

'Add guardrails' is hand-wavy. The strong answer names the concrete input and output checks, the mechanisms that enforce them, and the fail-safe behavior when one trips, plus the honesty that they are imperfect. Here is the implementation answer.

GDPR erasure and copyright takedowns demand removing a user's influence from trained weights, not just a dataset row. The signal is knowing why deletion isn't enough and where retrain, SISA, and approximate scrubbing each land on the cost-versus-proof curve.

Models hand back confident answers on inputs unlike anything they trained on, which is how silent production failures happen. The signal is knowing why raw softmax confidence lies and which detectors actually separate in- from out-of-distribution.

Attackers coax models into dumping the hidden system prompt, exposing IP, business logic, or worse, embedded secrets. The signal is treating the prompt as non-secret and defending in layers, not betting on 'never reveal your instructions.'

Toxicity detection looks like vanilla text classification and is anything but: context flips labels, adversaries evolve weekly, and naive models flag dialects as hate. The signal is naming those failure modes and designing the human-in-the-loop system around them.

The EU AI Act tiers obligations by risk, and that classification is a first-order design decision, not a legal footnote. The signal is knowing the four tiers and what high-risk systems must prove before they ship.

Audit logging is the backbone of AI accountability, but logging everything naively turns your logs into the biggest privacy liability you own. The signal is what to log to replay any decision, and how to do it without hoarding PII.

Encryption covers data at rest and in transit, but the moment you compute on it the data sits in cleartext in memory. Confidential computing closes that gap. The signal is the TEE concept, attestation, and the AI workloads that actually need it.

Privacy in ML is a toolbox, not a single switch, and each tool defends a different threat. The signal is mapping DP, federated learning, confidential computing, encryption, and minimization to what they actually protect, and knowing they compose.

Safety is not one number. The candidates who pass name the axes, run benchmarks as a gate, and then explain why benchmarks alone certify nothing. Here is the framing interviewers score highest.

Federated learning ships gradients, not raw data. The catch: a gradient is computed from the data, so it carries the data. The signal is knowing why 'we only share gradients' is not a privacy guarantee. Here is the answer.

Direct injection is the user attacking the prompt. Indirect injection hides the attack inside a page, doc, or email the model reads. The signal is realizing retrieved and tool data is untrusted and can hijack the model. Here is the answer.

Every third-party model, dataset, and library is an attack surface: backdoors, poisoning, arbitrary code on load, license landmines. The signal is treating models and data as supply-chain artifacts that need provenance and vetting. Here is the answer.

An enterprise RAG that retrieves across everyone's documents is a breach waiting to happen. The fix lives in the retrieval layer, not the prompt. Here is the design that survives a security review.

LLM apps leak secrets in three quiet places: the prompt, the logs, and the next training set. Each needs a different control. Here is how to close all three.

Large models memorize and can be prompted to emit training examples verbatim, a real privacy and copyright liability. The defenses span data, training, and output. Here is the layered answer.

For consequential decisions, 'the model said so' is not a legal answer. Adverse-action notices and the right to explanation constrain what model you can even ship. Here is the governance view.

An attacker doesn't need to breach your LLM to hurt you, just make it do expensive work. A handful of crafted prompts can pin your GPUs and run up the bill. The defense is not a bigger rate limit.

AI features open cross-tenant leak paths that classic SaaS isolation never had to think about: shared embeddings, shared caches, and fine-tunes that memorize. One leak ends an enterprise contract. Here is the isolation model.

Deleting a row is easy. Deleting a person's influence from embeddings, caches, derived datasets, and a trained model is not. GDPR and CCPA require it anyway. Here is the plan that survives an audit.

When an agent holds private data, reads untrusted text, and can communicate out, injected instructions can steal data. This 'lethal trifecta' is the defining agent vulnerability. The fix is architectural, not a better prompt.

Before listing defenses, a security engineer maps the attack surface systematically. LLM apps have a wider, weirder surface than classic software. Here is how to threat-model one end to end.

A request that would be refused in one message often succeeds when spread across ten. The signal is understanding that conversational state is part of the attack surface, and that turn-by-turn classifiers see only fragments.

base64, leetspeak, invisible Unicode, and foreign scripts all let a payload read as gibberish to your filter but as a clear instruction to the model. The signal is knowing why the model decodes what the classifier cannot.

Roleplay, obfuscation, optimization-based suffixes, and multi-turn escalation are different attack classes that need different defenses. The signal is organizing the space and pairing each class with a control instead of hoping one filter covers all.

A backdoored model behaves perfectly until it sees a secret trigger, then flips. The signal is explaining why clean test accuracy never reveals it, and what detection actually buys you when the trigger is unknown.

Gibberish-looking token strings appended to a prompt can reliably break refusals, and they transfer between models. The signal is explaining the gradient search that finds them and why output checks beat input pattern matching.

An agent that trusts its tools and its own memory can be steered by a single poisoned record that resurfaces turns or sessions later. The signal is seeing persistent state as an attack surface, not just the live prompt.

A hijacked agent does not need a 'send email' tool to leak secrets. A rendered markdown image, a URL parameter, or a DNS lookup is enough. The signal is enumerating the covert channels and locking down egress, not just tools.

Asking the model to keep secrets or enforce permissions is asking the wrong component. The signal is enforcing access control before retrieval, in code you trust, and treating the LLM as untrusted compute over already-authorized data.

Epsilon is the privacy knob, and shipping DP means choosing a number, defending it, and tracking what each query spends. The signal is treating epsilon as a finite budget with composition, not a magic constant. Here is the answer.

Federated learning keeps data on-device, but it costs you accuracy, debuggability, and engineering complexity. The signal is naming when those costs are justified and when a simpler centralized pipeline with DP wins. Here is the answer.

C2PA cryptographically signs where media came from, but a signature you can strip is not the same as a watermark you cannot. The signal is knowing what provenance proves, what it does not, and why you pair it with watermarking. Here is the answer.

ISO 42001 is the certifiable AI management-system standard, the AI analogue of ISO 27001. The signal is knowing it is an auditable management system, not a technical control list, and how it sits next to NIST and the EU AI Act. Here is the answer.

A fairness audit is a defined process: pick protected attributes, choose metrics that fit the harm, measure disaggregated performance, and document findings. The signal is knowing the metrics conflict and which one the use case demands. Here is the answer.

Consent and retention decide whether you can legally train on data and how long you keep it. The signal is purpose limitation, granular consent, enforceable TTLs, and a story for deleting data already baked into a model. Here is the answer.

Adopting a vendor model imports their data practices, security, and failure modes into your product. The signal is a structured assessment covering data handling, security, performance, and contractual terms, not just a demo that looked good. Here is the answer.

The EU AI Act assigns different duties to high-risk deployers, GPAI model providers, and limited-risk systems. The signal is naming the specific obligations per tier, not just reciting that risk tiers exist. Here is the answer.

An agent running on one over-privileged service account is a confused deputy waiting to happen. The signal is per-user delegated credentials, token exchange, per-tool scopes, and an audit trail that names the human. Here is the answer.

Every high-risk AI design ends with 'and a human reviews it.' Almost nobody measures whether that review produces any independent signal. Here is how to tell, and how to build oversight that can still disagree.