OpenAI Applied AI Engineer interview questions

Almost everyone can quote softmax(QKᵀ/√d_k)V. The interviewer wants the variance argument and the exact training failure the scale prevents. Here is the answer that separates memorization from understanding.

The single most-asked applied GenAI question, and the one most candidates answer as a definition dump. The interviewer wants a decision framework with a default and the conditions that flip it. Here is the call that scores.

Alignment is now table stakes even outside 'safety' roles. The interviewer wants the three-stage RLHF pipeline and a crisp account of why DPO dropped the reward model entirely. Here is the answer with the mechanism, not the buzzwords.

A clean fundamentals question that catches people who only know GPT. The signal is matching the architecture to the task by its attention pattern, and explaining why the field consolidated on decoder-only even for non-generation tasks. Here is that answer.

Every customer asks how to stop the model making things up. The weak answer is 'better prompts.' The signal is knowing why models hallucinate and layering grounding, abstention, and measurement into a system you can defend.

Tokenization looks like plumbing until it explains your bill, your latency, and why the model fumbles numbers and rare languages. The signal is knowing how subword tokenizers work and the consequences that fall out of them.

Attention is permutation-invariant, so without position information a transformer cannot tell word order. The signal is knowing why, and why the field moved from absolute sinusoidal encodings to relative ones like RoPE and ALiBi that extrapolate to longer contexts.

These are the knobs every LLM product tunes, and the interviewer wants to know what each does to the probability distribution and which setting fits which task. Including why factual and creative tasks want opposite settings.

Evaluation is the hardest, most underrated part of shipping LLMs. The signal is knowing why public benchmarks mislead, why LLM-as-judge is biased, and how to build a task-specific eval you actually trust.

Perplexity is the classic LM metric. The signal is knowing it is just exponentiated cross-entropy, what it intuitively measures, and why a low perplexity does not mean a good product.

In-context learning is the property that made prompting a paradigm; chain-of-thought is its most useful trick. The signal is knowing what 'learning' means here (no weight updates) and why making the model reason step by step actually helps. Here is the answer.

Two prompting strategies that buy accuracy with extra compute. The signal is knowing how each explores the reasoning space, that they trade tokens and latency for reliability, and how to decide when the problem actually warrants it. Here is that answer.

ReAct is the pattern behind most tool-using agents. The signal is why interleaving reasoning with actions (and observing results) beats reasoning alone or acting alone. Here is the answer that connects the prompt pattern to real agent behavior.

RL alignment moved from PPO to leaner methods, and DeepSeek-R1 made GRPO famous. The signal is knowing what the value/critic model does in PPO and how GRPO replaces it. Here is the mechanism, not the acronyms.

The 2025-2026 landscape isn't 'bigger is better' anymore. The signal is knowing why small models and reasoning models exist, the test-time-compute tradeoff, and routing the right model to the right task. Here is the practitioner's view.

The difference between a demo prompt and a production prompt is structure, versioning, and defense. The signal is treating the system prompt as a contract and templates as parameterized, testable artifacts. Here is the answer.

Complex tasks rarely fit one prompt, and free-text LLM output rarely plugs into code cleanly. The signal is decomposing into chained steps and parsing each output. Here is the answer that connects prompting to real pipelines.

Jailbreaking is the adversarial sport of routing a model around its own safety training. The signal is naming the technique families and treating defense as a layered, never-finished arms race, not a one-time patch.

Instruction tuning is what turns a raw next-token predictor into something that follows instructions. The signal is placing it correctly in the pretrain to SFT to alignment pipeline and knowing exactly what it does and does not fix.

The classic automatic metrics for generated text. Interviewers want you to match each to its task and name the blind spot they all share. The candidates who pass say why none of them is the final word on quality.

Everyone quotes benchmark scores; few read them honestly. The signal is naming what each probes and why leaderboard numbers run ahead of real-world ability. The follow-up the interviewer is holding back is how you would detect contamination.

Fine-tuning is mostly a data problem, not a hyperparameter one. The signal is naming what makes a good set (quality, diversity, format, dedup) and arguing why a few thousand clean examples beat a million noisy ones.

Synthetic data is how teams get training data when real data is scarce, and it has sharp failure modes. The signal is naming when it helps, how to hold the quality line, and why training on model output across generations narrows the distribution.

LLM-as-judge is how you grade open-ended generation at scale, and G-Eval formalized it. The signal is naming the biases that make raw judge scores untrustworthy and showing exactly how you harden them.

'Eval is the new system design' for LLM apps, and starting from zero data is the real test. The signal is bootstrapping a golden set, picking task-specific metrics, and running evals continuously as a regression gate.

Cross-attention is how a model attends from one sequence into another, the mechanism behind encoder-decoder models and multimodal conditioning. The signal is knowing exactly where the queries vs keys/values come from.

Everyone fixates on attention, but the feed-forward layers hold most of a transformer's weights and do much of the per-token 'knowledge' work. The signal is knowing what the FFN computes and why it dominates the parameter count.

Context windows are not arbitrary numbers; they fall out of attention's quadratic cost, KV-cache memory, and how the model was trained. The signal is naming all three causes and matching each to the technique that extends it.

RLAIF and Constitutional AI swap human preference labels for AI-generated ones to scale alignment. The signal is naming exactly what they substitute for human feedback, and the consistency-versus-bias tradeoff that swap creates.

Reasoning models are the 2025-2026 frontier. The signal is knowing they are trained (largely via RL on verifiable rewards) to produce long internal reasoning, and that they scale on a second axis: spending more compute at inference.

Tool calling powers every agent. The signal is knowing the model executes nothing: it emits a structured request your code runs, then you feed the result back. Here is the loop and the details that decide reliability.

DPO simplified RLHF, and a family of variants now trade off what data and reference model they need. The signal is knowing what each variant removes or changes (reference model, paired data, separate SFT stage). Here is the answer.

Scaling laws explain why bigger models trained on more data predictably get better, and Chinchilla changed how we allocate compute. The signal is the model-size-vs-data tradeoff and that many models were under-trained. Here is the answer.

How you decode from the model's probabilities shapes the output as much as the model. The signal is knowing the deterministic vs sampling methods and when each fits (factual vs creative). Here is the answer.

BERT and GPT split on one decision made before a single weight is trained: what does each token get to see? That choice cascades into attention, use case, and why one family now dominates. Here is the answer.

Prompting for JSON works until it doesn't, and at scale the tail breaks your parser. Constrained decoding makes malformed output literally unsamplable. The signal is knowing exactly where in the loop the constraint bites. Here is the answer.

Chain-of-thought looks like the model showing its work, but it may not reflect the real computation. The signal is knowing CoT can be a post-hoc story, with evidence, and what that breaks for safety and oversight.

Preventing hallucinations is one job; catching the ones that slip through at runtime is another. The signal is the detection toolkit, why each signal is imperfect, and how you combine them into an action.

A model advertising a million-token window may not use it. The signal is knowing needle-in-a-haystack, where it breaks, and how to test real multi-fact reasoning across the full context. Here is the answer.

Distillation buys you most of a frontier model's quality at a fraction of the serving cost. The signal is naming the three LLM-specific variants and knowing which one works against a closed API. Here is the answer.

The senior signal is matching the method to what is actually missing instead of defaulting to your favorite. Knowledge, behavior, or actions each point at a different tool. Here is the decision framework that scores highest.

One trained embedding you can truncate to any length and still use. The signal is the nested-prefix training objective and the coarse-to-fine retrieval win it unlocks at scale. Here is the answer.

Models are trained to be helpful, which quietly trains them to never refuse. Getting honest abstention back is a system problem, not a prompt tweak. Here is the stack that actually moves the refuse-when-unsure rate.

Token count is latency and dollars, not just style. 'Be concise' barely works, and max_tokens just truncates mid-sentence. Here is how to actually shape length without amputating answers.

Alignment that adds refusals and politeness often quietly degrades reasoning and coding. The alignment tax is real and measurable. Here is how to keep the safety gains without paying for them in capability.

Optimize any proxy hard enough and the model finds the exploit, not the goal. Sycophancy, padding, and fake citations are reward hacking. Here is why it happens and the controls that actually hold.

Few-shot accuracy can swing on example order alone. If your prompt is fragile to things that shouldn't matter, the fix is structural, not lucky example-hunting. Here is what actually reduces variance.

The model's training cutoff is frozen, but your dependencies move weekly. Retraining is the wrong reflex. Here is how teams keep code suggestions current without touching the weights.

Neural text degeneration is a known failure of likelihood-maximizing decoding, not a broken model. The fixes are specific decode-time knobs. Here is which lever to pull and what each one costs.

Generation has to stop somewhere, and the wrong stop rule either truncates answers or burns tokens on trailing garbage. Here is how the EOS token, stop strings, and max-token caps actually interact.

CoT is not a universal upgrade. On some tasks it does nothing or hurts, and the reason tells you what to try instead. Here is the escalation ladder past 'let's think step by step'.

A model that scores 92% on your eval can still ship a product users hate, because the model is one component in a system. Teams that only do model evals get blindsided. Here is the distinction that matters.

For open-ended generation there's no ground-truth string to match, so accuracy is meaningless. The field uses a layered mix of automatic, model-based, and human metrics. Here is how to assemble a credible eval.

Push PPO hard enough and true quality peaks then falls while the reward keeps climbing. The signal is knowing the Gold-vs-proxy gap, the KL budget that bounds it, and how you actually measure when to stop.

GRPO drops the value model and estimates advantage from a group of samples per prompt. The signal is the exact mechanics, why the group baseline works, and the normalization traps that quietly bias training.

Replace a learned reward model with a checker that returns right-or-wrong, and reward hacking mostly disappears. The signal is why verifiable rewards beat learned ones for math and code, and where they break.

A reward model is only as good as its labels, and human preference labels are noisy and inconsistent. The signal is measuring inter-annotator agreement and the concrete moves that lift label quality.

Pairwise asks which is better, pointwise asks how good. The signal is knowing which is more reliable, how Elo/Bradley-Terry aggregates comparisons, and where each method quietly misleads.

If a benchmark leaked into pretraining, the score measures memorization, not ability. The signal is the detection methods (n-gram overlap, canaries, perturbation tests) and why fresh held-out evals matter.

The same model can score ten points apart on MMLU depending on prompt format and scoring method. The signal is knowing the knobs (log-prob vs generation, few-shot, normalization) that make evals reproducible.

A reward model turns pairwise preferences into a scalar signal RLHF can optimize. The signal is the Bradley-Terry loss, the base-model and head choices, and how you validate it before trusting it.

RLAIF replaces expensive human labels with an LLM's preferences, which scales but inherits the labeler model's biases. The signal is how AI feedback is collected and where it quietly fails.

Grammar-constrained decoding sounds like a solved problem until tokenization misaligns with the grammar. The signal is the token-vs-character boundary mismatch and how prefix automata and token healing fix it.

VLMs like GPT-4V and LLaVA bolt a vision encoder onto a language model through a projector. The signal is the image-tokens-as-prefix design, the alignment training, and the resolution and hallucination failure modes.

Speech LLMs either transcribe to text or model audio directly as discrete tokens. The signal is the semantic-vs-acoustic token split and why end-to-end audio models beat ASR-plus-LLM pipelines on latency and prosody.

Temperature 0 does not mean deterministic, and the reason is in the GPU kernels, not the sampler. The signal is naming the batch-invariance problem and knowing which fixes are real versus placebo.

Everyone budgets image tokens. Almost nobody budgets image latency. Images are a prefill problem, prompt caching stops paying for itself, and the cheapest answer is often not to call a VLM at all.

A VLM that reads an invoice wrong and a VLM that reads it right and reasons wrong produce the same end-to-end score, and they need opposite fixes. Here is how to decompose a multimodal eval, build the set from real traffic, and probe for the hallucinations that accuracy never catches.

The modal Applied AI design round. Anyone can draw embed-retrieve-generate. The signal is in chunking, hybrid retrieval, the rerank/latency tradeoff, and how you prove it works. Here is the structure that scores.

Agents are over-applied. The strong answer resists the hype: most tasks want a single structured call, and agents earn their cost only under specific conditions. Here is when to reach for one and how to stop it from compounding errors.

Most RAG systems ship with no real eval, which is why most RAG systems quietly degrade. The signal is decomposing evaluation into retrieval and generation, and measuring faithfulness separately from relevance. Here is the framework that makes RAG improvements measurable.

A 2025-2026 question that catches people clinging to dogma in either direction. The signal is a cost, latency, accuracy, and scale tradeoff, plus knowing the 'lost in the middle' failure of long context. Here is the framework for choosing.

Agents and integrations live or die on the model returning valid, schema-conforming output. The signal is layering constrained decoding, schema validation, and retries, not hoping a prompt is enough. Here is the production-reliability answer.

Multi-agent is the most over-applied pattern in AI right now. The signal is resisting it unless the task truly needs specialization or parallelism, knowing the supervisor and handoff patterns, and understanding why coordination amplifies failure.

Conversations and agent tasks outgrow the context window, and naive 'stuff the whole history' fails on cost, latency, and lost-in-the-middle. The signal is a tiered memory design: recent buffer, summarized mid-term, retrieved long-term.

Always retrieving is wasteful and sometimes harmful; never retrieving hallucinates. Self-RAG makes retrieval a decision the model controls, then critiques what it got back. The signal is the retrieve-on-demand plus self-critique loop.

MCP standardized how agents plug into tools and data, but tool design is what makes or breaks reliability. The signal is knowing what MCP actually standardizes and the principles behind a tool the model can call correctly from its description alone.

Reflection is the pattern where an agent critiques and revises its own work. The signal is knowing when it genuinely helps (external feedback grounds the critique) versus when self-critique alone is theater.

Citations turn a RAG answer from 'trust me' into something verifiable, and they are a real engineering problem. The signal is grounding each claim to a specific passage and verifying the attribution, not appending a bag of links at the end.

Plan-and-Execute and ReAct are the two dominant agent control patterns. The signal is knowing the upfront-plan vs step-by-step tradeoff, why one is cheaper, and why most production agents end up blending them.

Agents need memory beyond the context window, and 'just store the history' is the wrong answer. The signal is distinguishing the memory types and mapping each to a storage and retrieval strategy. Here is the answer.

Context engineering is the discipline that replaced 'prompt engineering' for serious agent work. The signal is understanding that what you put in the context window (and what you leave out) drives behavior more than clever wording. Here is the answer.

Code-execution agents are powerful and dangerous: arbitrary model-generated code runs on your infrastructure. The signal is real isolation (containers/VMs), resource limits, and network/filesystem restrictions, not 'trust the model.' Here is the answer.

Tool selection and parameter extraction are where agents quietly fail. The strongest answer treats the tool spec as the only thing the model sees, then fixes the design, not the model. Here is how.

Agents fail in the middle, not just the end, so final-answer-only scoring hides the real problems and rewards lucky paths. The signal is evaluating the whole trajectory and localizing where it broke. Here is the answer.

Sub-agents are how you scale a complex agent task without one giant, noisy context. The signal is context isolation and clean delegation: a focused subtask in, a compact result out. Here is the answer.

Multi-agent systems live or die on how agents share information and hand off work. The signal is naming the three communication patterns and the coordination failures that sink the naive version. Here is the answer.

The same model performs wildly differently depending on the harness around it. The signal is knowing that the scaffolding often decides agent quality more than the base model. Here is the answer.

A computer-use agent drives a real browser or desktop through screenshots and clicks. The signal is the perceive-decide-act loop plus the containment for an agent that can click, buy, or delete anything. Here is the answer.

An agent that takes actions is far riskier than one that just talks. The signal is action-level guardrails: least privilege, argument validation, human approval for irreversible actions, and a blast-radius mindset. Here is the answer.

An agent that retries the same failed action 40 times is a runaway bill and a stuck user. Termination is something you engineer into the harness, not something the model reliably decides. Here is the control layer.

A live-coding round that separates people who have shipped agents from people who have read about them. The signal is a real plan-act-observe loop, tools that hit an actual SQL database, guardrails that stop the obvious failures, and a concrete evaluation plan, not a single prompt that pretends to be an agent.

Linear agents commit to one path and can't backtrack. Tree-of-Thoughts and LATS add search over reasoning paths. The signal is knowing what they buy, what they cost, and when a cheaper loop wins.

A context window is not memory. Real agents need a storage architecture: working buffer, episodic recall, and consolidated facts. The signal is the read/write paths and how you keep memory from rotting.

Tools fail: timeouts, rate limits, bad arguments, garbage output. A naive agent retries blindly or gives up. The signal is classifying errors and matching each to the right recovery, with hard caps.

Most people know MCP exposes tools. The deeper signal is the full primitive set (resources, prompts, sampling, roots) and the patterns: server composition, sampling for nested LLM calls, and scoping access safely.

Final-answer accuracy hides how an agent got there. The signal is trajectory-level metrics: tool-selection and argument accuracy, step efficiency, and matching against reference paths, plus when exact-match is the wrong yardstick.

Per-step accuracy looks fine, yet a 50-step task fails. The signal is understanding compounding error and the techniques (decomposition, verification, checkpointing) that keep long-horizon agents from collapsing.

Agents can critique and retry their own work. The signal is knowing how Reflexion's verbal feedback loop works, when self-critique genuinely helps versus when it is theater, and what makes it real.

Any content an agent reads can carry instructions that hijack it. The signal is knowing why filtering can't fully solve injection and which containment controls actually bound the damage when it succeeds.

Agents re-send growing context every step, so cost scales worse than linearly. The signal is knowing where the tokens go and the levers (caching, model routing, context trimming, step caps) that cut the bill.

Agents that drive a browser or screen fail in ways chat agents never do: stale DOM, dynamic pages, wrong clicks. The signal is the grounding and reliability techniques that turn a flaky demo into something usable.

Two ways to give an agent an action space: emit a JSON tool call per turn, or emit a program that calls the tools itself. One collapses N round-trips into one. The other is the one you can actually audit. Here is how to choose.

Single-turn evals cannot catch failures that history causes, because they have no history. The offline answer is two suites, one deterministic and one simulated, and an honest account of why the simulated user will lie to you about how good your agent is.

The most role-defining judgment call in Applied AI: a shiny benchmark number against the operational price of a system nobody can debug at 2am. Most candidates ship on the number and lose the loop there. Here is the answer that passes.

A favorite practical screen at the labs, because it tests concurrency, time handling, and judgment in 20 lines. The trap is the background thread that wastes CPU. Here is the lazy-refill version interviewers want, plus the follow-ups.

The most-asked design-coding question, and a frequent warm-up at the labs before the ML follow-ups. The signal is the hashmap-plus-doubly-linked-list for true O(1), then handling the TTL and concurrency follow-ups cleanly. Here is that build.

The from-scratch implementation that frontier labs and NVIDIA actually ask. Writing it proves you understand shapes, the scale, the causal mask, and how heads split and recombine. Here is a correct, readable implementation and the follow-ups.

BPE is the tokenizer behind GPT-style models, and implementing it proves you understand how subword vocabularies are built, not just that they exist. The signal is the iterative merge of the most frequent adjacent pair.

LayerNorm sits in every transformer, and implementing it checks that you know what it normalizes over and why. The signal is normalizing across the feature dimension per token, the learnable scale/shift, and the RMSNorm simplification modern LLMs adopted.

Implementing the KV cache proves you understand why decode is efficient: you append the new token's K/V and reuse the rest instead of recomputing. The signal is the append-and-attend-over-cache logic. Here is the implementation.

Implementing Adam proves you understand what's happening under .step(): momentum plus per-parameter adaptive rates with bias correction. The signal is the two moments and the bias-correction step.

Single-head attention is common; multi-head adds the split-into-heads, attend-per-head, concatenate structure. The signal is the reshape into heads and a clear reason why multiple heads help. Here is the implementation.

Every chat model's 'temperature' and 'top_p' knobs are a few lines of logit surgery. Implementing them shows you understand decoding, not just call it. Here is the from-scratch version.

Many state-of-the-art training runs keep a shadow copy of the weights that's a moving average of the trajectory, and serve that instead of the final step. It's a few lines and a real accuracy boost. Here it is.

Almost every modern training run uses warmup-then-cosine, and getting it wrong destabilizes early training or wastes the tail. It's a closed-form function of the step. Here is the implementation and the why.

The canonical multi-round build screen: a simple key-value store that grows new requirements every stage (TTL, transactions, scans). The signal is not stage 1, it is whether your code absorbs stage 4 without a rewrite. Here is how to design for it.

OpenAI's signature build screen: a credit ledger that grants GPU-hours, spends them, and expires unused grants in issue order. The trap is spending against the right grant first. Here is the FIFO-by-expiry design that survives every follow-up.

A classic build screen: a key-value store where writes inside a transaction can be committed or thrown away, and transactions nest. The trap is mutating the base store directly. Here is the overlay-stack design that makes rollback O(1).

A practical build screen: turn a stream of sampled call stacks into a flame tree, then report self-time vs total-time per function. The trap is conflating the two times. Here is how to aggregate the tree and rank the hot functions.

Google's 'vibe coding' screen: the spec is deliberately vague and changes mid-interview. The signal isn't the algorithm, it's whether you clarify before coding, structure for change, and keep tests green while the requirements move. Here is how to run that loop.

A from-scratch test of recurrent forward passes and backprop through time. The signal is the shared-weight recurrence, accumulating gradients across timesteps, and explaining the vanishing-gradient problem. Here is the implementation.

A from-scratch test of gated recurrence. The signal is wiring the forget/input/output gates and candidate correctly, separating cell state from hidden state, and explaining why the additive cell path fixes vanishing gradients. Here is the implementation.

A from-scratch test of modern optimizers. The signal is the moment estimates, bias correction, and the one change that matters: AdamW decouples weight decay from the gradient instead of folding it into the loss. Here is the implementation and why it wins.

A from-scratch test of how learning-rate schedules are actually computed. The signal is correct closed-form formulas, knowing when each schedule shines, and why decaying the rate helps convergence. Here is the implementation of the common ones.

A from-scratch test of how PyTorch actually works under the hood. The signal is building a computation graph during the forward pass, local derivatives per op, and a topological-order backward pass that accumulates gradients. Here is a minimal engine.

A from-scratch test of subword tokenization. The signal is greedy longest-match encoding against a fixed vocabulary, the continuation-prefix convention, and how WordPiece differs from BPE. Here is the implementation.

A from-scratch test of distributed input pipelines. The signal is partitioning data across workers with no overlap and no gaps, epoch-consistent shuffling with a shared seed, and handling the uneven-last-batch problem. Here is the implementation.

The classic recursive-descent exercise with an applied-AI twist: the JSON your model streams is truncated mid-token for the entire generation. The signal is a clean strict parser plus a small repair layer, not a second parser. Here is the implementation.

The most job-shaped coding screen in Applied AI: fan out N LLM calls without melting the rate limit or losing the batch to one bad request. The signal is in the retry policy, not the async syntax. Here is the version that passes.

Every LLM product streams, and almost nobody can write the server. The interesting part is not the async generator, it is what happens when the user hits stop, the provider dies at token 90, or moderation flags text you have already put on the screen.

Self-supervision is how modern models pretrain on unlabeled data, the engine behind LLMs and modern vision. The signal is the pretext-task idea and the real difference between contrastive and masked-prediction objectives.

Multimodal is now table stakes, and this checks whether you understand how images and text reach a shared model. The signal is CLIP's contrastive alignment and how modern VLMs feed image features into an LLM's token space.

Voice is a major modality and a common applied-AI surface. The signal is the audio-to-text pipeline, why Whisper is resilient, and the cumulative latency budget that makes or breaks a real-time voice agent.

The learning rate is the one hyperparameter that can NaN your run on step 50 or stall it forever. Modern training schedules it instead of fixing it. The signal is knowing exactly what warmup and decay each buy you. Here is the answer.

These four quantities underlie cross-entropy loss, decision-tree splits, distillation, and the KL penalty in RLHF. The signal is deriving them from one another and pointing to exactly where each shows up in a real training loop.

Contrastive learning is how modern embeddings (CLIP, sentence encoders, SimCLR) are actually trained. The signal is the pull-positives-push-negatives objective, the InfoNCE loss, and why the number and hardness of negatives makes or breaks quality.

RL underpins RLHF, robotics, and recommendation, and interviewers want the core framing. The signal is the agent-environment-reward loop and the three things that make it harder than supervised learning. Here is the answer.

Classic bias-variance says bigger models eventually overfit, yet deep nets keep improving past the point where they memorize the data. The signal is explaining the second descent and why over-parameterized models generalize. Here is the answer.

'The model won't train' has a short list of usual suspects, each with a distinctive loss-curve signature. The shape of the curve names the bug before you touch a single hyperparameter. Here is how to read it.

The idea that models, like students, learn better from easy examples first is intuitive, and sometimes it works and sometimes it does nothing. Knowing when it pays off is the real signal. Here is the honest answer.

Anyone can say 'filter and dedup.' The signal is the funnel in cost order, the MinHash/LSH banding math, and knowing the shuffle at billions of documents is what actually costs you, plus benchmark decontamination people forget until their eval numbers get challenged.

Moderation is a multi-stage classification problem with brutal tradeoffs: false negatives cause real harm, false positives censor legitimate users, and the adversary adapts. The signal is the tiered pipeline, per-severity precision/recall calibration, and human-in-the-loop. Here is the design.

As soon as a company uses LLMs in more than one place, it needs a gateway. The signal is the cross-cutting concerns (cost, reliability, observability, governance) that a gateway centralizes, not just 'proxy the API.' Here is the design.

The canonical AI system-design question. The signal is covering both the model lifecycle and the serving stack under real scale, without rambling. Most candidates design only half and lose the points.

The modern agentic system-design question. The signal is the plan, search, read, synthesize, verify loop with per-claim citations, plus bounding cost and latency. The hard parts are not the writing.

Cross-session memory is what makes an assistant feel personal, and it is mostly a retrieval and state-management problem, not a bigger context window. The signal is the tiered architecture plus what to store, forget, and protect.

Scarce GPUs, dozens of models, every team wanting low latency at low cost. The signal is whether you can turn that into one governed serving fleet: continuous batching, KV cache, per-tenant quotas, and cost you can actually attribute.

Summarize, draft, triage, all over the most sensitive PII a person owns. The signal is grounding in the actual thread, matching the user's voice, and a hard human-in-the-loop rule on anything that gets sent.

A GPU-heavy generative system where sampling steps dominate the bill and one bad image is a headline. The signal is the diffusion serving pipeline, the cost levers on per-image GPU time, and a mandatory two-sided safety layer.

Real-time transcription at scale tests streaming ASR, latency budgets, and GPU fleet management under heavy concurrency. The signal is streaming chunked inference with partial results, not batch transcription. Here is the design.

A voice assistant chains STT, an LLM, and TTS under a brutal latency budget where every stage adds delay. The signal is streaming and pipelining the stages plus turn-taking, not three blocking calls. Here is the design.

A GPU-heavy generative-audio system with text/genre/lyric conditioning, minutes-long coherence, and copyright constraints. The signal is the generation pipeline plus the async, cost, and safety layer that makes it shippable.

Video generation is image generation plus the brutal constraint of temporal consistency, and it is the most GPU-intensive generative task there is. The signal is diffusion over spacetime plus a serving design that survives multi-minute jobs.

Two models chained (ASR then summarization), a long-context problem hiding inside, and a faithfulness bar where a fabricated action item has real consequences. The signal is the pipeline plus how you keep a 3-hour transcript honest at thousands a day.

A Devin-style agent that turns an issue into a merged PR is the hardest agent to make reliable, because every step can fail and errors compound. Here is the architecture and the loop that keeps it honest.

Exact-match caching barely helps when no two prompts are identical. Semantic caching reuses answers for similar queries, and its whole risk is returning a near-match that's subtly wrong. Here is how to build it safely.

GPUs are scarce and expensive, so multi-region HA for LLMs is not just web-app HA with bigger boxes. Capacity, routing, and failover all bend around the GPU constraint. Here is the design.

Every team eval-ing prompts in ad-hoc notebooks is how an org ships regressions and argues about vibes. A shared eval platform makes quality measurable and comparable. Here is what it has to provide.

Prompts buried in source code mean every wording tweak is a full deploy, and nobody knows which prompt is live. Treating prompts as managed, versioned configuration is the fix. Here is the platform.

An agent that clicks around a real website is slow, brittle, and one wrong click from a costly mistake. The architecture is about perception, action, and guardrails around irreversible steps. Here is how to build it.

RLHF and evals are only as good as the preference data behind them, and that data is generated by humans whose quality varies wildly. The platform that produces trustworthy labels is itself a serious system. Here is its design.

Inline completion lives or dies on tail latency: a suggestion that arrives after the developer keeps typing is useless. Learn how to build the context window, hide model latency behind speculation and caching, and keep a tight feedback loop on acceptance rate.

Summarizing a 200-page contract is not one LLM call: it is chunking, hierarchical reduction, and a faithfulness check so you never invent facts. Learn the map-reduce pattern, when long-context beats it, and how to evaluate summaries at scale.

Moderating billions of items a day with an LLM on every one is too slow and too expensive. Learn the tiered funnel (cheap classifier then LLM then human), how to tune thresholds for precision versus recall, and how to keep up with adversaries.

Personalizing an LLM is a retrieval and memory problem, not a per-user fine-tune. Learn how to assemble user context at request time, manage long-term memory without bloating the prompt, and respect privacy and the right to be forgotten.

A writing assistant has to feel instant while a cursor moves through a live document. Learn how to split fast deterministic checks from LLM rewrites, stream suggestions, and keep edits stable so the text does not flicker as the user types.

Auto-resolving support tickets means grounding answers in your knowledge base, safely calling real APIs (refunds, account changes), and knowing when to hand off to a human. Learn the agent loop, the guardrails, and how to measure resolution without breaking trust.

Long-running agents that loop, call tools, and spawn sub-tasks need durable execution, not a single request handler. Learn how to checkpoint state, recover from failures, bound runaway loops, and observe every step a non-deterministic agent takes.

Experimenting on LLM features is hard because the outputs are open-ended and quality is fuzzy. Learn how to assign traffic, pick metrics that are not just engagement, handle variance from non-determinism, and avoid the traps that make a winning variant lose in production.

At thousand-GPU scale, hardware failure is the norm, not the exception, and a run that cannot resume wastes weeks. The signal is checkpointing strategy, deterministic resume, and minimizing lost work. Here is the fault-tolerant design.

You cannot improve an LLM app you cannot see into, and LLM observability is not service monitoring. The signal is tracing multi-step chains, capturing inputs/outputs/tokens/cost, and online quality signals, not just latency and errors.

Caching is one of the biggest LLM cost levers, but 'cache the response' is naive for a non-deterministic system. The signal is distinguishing prompt (prefix) caching from semantic caching and knowing when each is safe.

Routing each request to the right model is one of the biggest LLM cost/latency levers in production. The signal is matching query difficulty to model capability and knowing when the cascade pattern beats a classifier.

AI systems get expensive fast, and 'the GPU bill is huge' is not actionable without attribution. The signal is breaking spend down by model, feature, team, and request, then naming the levers. Here is the answer.

Editing a prompt is a code change with no compiler and no unit test by default, so quality regressions ship invisibly. Treating prompts and models as testable artifacts is what separates a toy from a product. Here is the harness.

A green build still means nothing for model quality. The signal is an eval harness that runs deterministically in CI, compares against a frozen baseline, and blocks the merge on regressions. Here is how to make it fast, stable, and trusted.

Eyeballing a few outputs does not scale, and a prompt tweak that fixes one case quietly breaks ten. A real LLM eval pipeline is a versioned dataset, layered scorers, and a CI gate. Here is the architecture.

Production usage can become your best source of training data, or a self-reinforcing trap. The signal is knowing how to capture clean feedback and how to break the loops that quietly corrupt the model.

The interviewer wants real numbers, not 'use a big GPU.' Weights are fixed, the KV cache grows with load, and the lever order decides everything. Here is the back-of-envelope and the serving stack.

The interviewer wants you to know why a model that fits on no single GPU still trains, and to do the optimizer-state memory math that motivates sharding. Here is the parallelism taxonomy and the 16-bytes-per-parameter calculation.

Quantization is the first lever for fitting and speeding up models, and the interviewer wants more than 'use fewer bits.' The signal is knowing what precision buys you, why outliers break naive quantization, and how you prove quality held. Here is that answer.

A favorite at hardware-aware shops. The signal is understanding that attention's cost is memory traffic, not FLOPs, and that FlashAttention is an exact, IO-aware reordering, not an approximation. Here is the answer that shows you think about the memory hierarchy.

The KV cache is why LLM serving is hard, and the interviewer wants the mechanics: what it stores, why it limits concurrency, and the tricks that shrink it. Here is the answer that shows you understand decode-time economics.

Decode is sequential and memory-bound, so latency tricks matter. The signal is explaining speculative decoding's draft-and-verify mechanism (and why it stays exact) plus the other levers and when each applies. Here is the latency toolkit.

Mixed precision is standard at scale, and the interviewer wants the numerics: why FP16 needs loss scaling, why BF16 mostly does not, and what stays in FP32. The signal is understanding dynamic range vs precision. Here is that answer.

A hardware-literacy question, especially at NVIDIA and the labs. The signal is understanding throughput vs latency hardware, the memory hierarchy, and why matrix multiplication maps onto GPUs and TPUs. Here is the architecture-aware answer.

At NVIDIA and the labs this compute-intimacy question is real. The signal is owning the SIMT execution model and the three classic throughput killers, with the concrete fix for each. Here is the low-level answer.

Continuous batching is the single biggest throughput lever in modern LLM serving. The signal is explaining why static batching idles the GPU on variable-length generation, and why PagedAttention is what makes the fix practical.

Picking GPUs is a real applied decision, and 'get the biggest one' misses the point. The signal is knowing which spec binds your workload (VRAM, bandwidth, interconnect) and the train-versus-serve difference that flips the answer.

Under load, a shared inference service must decide whose request runs now. The signal is queuing with priorities, backpressure, and fairness wired into batching, not first-come-first-served until the service falls over.

FSDP and ZeRO let you train models too big for one GPU without splitting the compute. The signal is the ZeRO stages (what gets sharded at each level) and the communication you pay for it. Here is the answer.

Distributed training is bottlenecked by GPU-to-GPU communication, and these collectives are how the data moves. The signal is what each one does and which parallelism strategy depends on it. Here is the answer.

Activations, not just weights, can dominate training memory, and gradient checkpointing is the standard fix. The signal is the precise trade: recompute activations in the backward pass instead of storing them. Here is the answer.

When a model is too big for one GPU you split the model itself, not just the data. The signal is distinguishing tensor parallelism (split within a layer) from pipeline parallelism (split across layers) and matching each to the interconnect. Here is the answer.

LLM serving has its own metrics, and one latency number hides the real bottleneck. The signal is splitting prefill from decode and reading GPU utilization as a clue, not a verdict. Here is the diagnostic toolkit.

LLM inference has two phases with opposite resource profiles, and co-locating them makes a long prompt stall everyone else's tokens. The signal is knowing why prefill and decode fight, and what separating them costs. Here is the answer.

Batch size is a training knob with non-obvious effects on speed, memory, and generalization. The signal is the large-batch tradeoffs and the learning-rate-scaling and gradient-accumulation tricks that make scaling actually work.

OOM is the most common wall in deep learning, and 'buy a bigger GPU' is the weakest answer. The signal is naming the memory consumers, knowing which one dominates, and matching the right lever to it.

nvidia-smi showing 100% can hide that you are using a fraction of the hardware's real compute. The signal is MFU (useful FLOPs vs peak) and the gap between 'the GPU is busy' and 'the GPU is efficient'.

Beyond FP16/BF16, FP8 is the next rung on the precision ladder, and the latest tensor cores compute on it natively. The signal is knowing the two formats, what FP8 actually buys, and why dynamic range forces careful scaling.

At long context the KV cache, not the weights, dominates GPU memory and decode bandwidth. The signal is recognizing it as the binding constraint and naming the levers that shrink it without wrecking quality.

CPU-based autoscaling that works fine for a web tier quietly fails on GPU inference: wrong signal, and replicas that take minutes to warm. The interviewer wants the signals you actually scale on and how you hide the cold start.

Paying for accelerators that idle half the time is the most common waste in ML training, and the instinct to add more GPUs makes it strictly worse. The interviewer wants the profiling discipline that finds what is starving them.

The counterintuitive truth of LLM serving: token generation is limited by how fast you can read weights from memory, not by math. Once you see that, the whole optimization menu falls out of one number.

A 256-GPU job that wedges with no error at 3am is a special kind of pain. The causes are a short, recurring list. Here is the systematic way to find which one bit you.

Users feel the p99, not the median, and the tail is where serving systems quietly fail. The causes are queuing and batching effects, not a slow model. Here is how to flatten it.

A serving box that's stable on short prompts crashes the moment a 30k-token request lands, because KV-cache memory scales with sequence length times batch. Here is how to bound it without crashing.

At billion-parameter scale, training can be cruising and then the loss jumps and never comes back, burning a fortune in compute. The causes and the playbook are well-known to the few who've done it. Here it is.

Launching an LLM service on a vibes-based GPU count is how you get paged on day one. Capacity planning for LLMs differs from web services because tokens, not requests, are the unit. Here is how to size it.

A single long prompt can freeze every other user's token stream for hundreds of milliseconds. Chunked prefill slices that prompt so decode keeps flowing. Here is the mechanism and the knob that controls it.

A shared system prompt gets re-prefilled on every request unless the server remembers it. Prefix caching skips that work, but only when the blocks line up exactly. Here is the hashing and eviction machinery underneath.

Round-robin routing wastes a feature that doubles throughput: cache locality. Designing the router means choosing a replica by KV state, not just least-loaded. Here is the two-layer design.

Three batching strategies, three very different latency profiles. Picking wrong leaves throughput or tail latency on the floor. Here is what each one costs and when to use it.

FP8 serving is fast and usually fine, until it silently degrades on the one workload your benchmark did not cover. The signal is knowing what FP8 breaks and how to validate it. Here is the recipe.

Forcing valid JSON sounds free, but the mask computation can stall every decode step. The fix is precompiling the grammar into a fast automaton. Here is where the cost hides and how to remove it.

Autoscaling reacts in minutes, but a burst hits in seconds, and the gap is where your tail latency dies. Absorbing bursts is about buffers and shedding, not just adding replicas. Here is the playbook.

Full activation checkpointing saves memory but burns a flat 30% extra compute. Selective recomputation recovers most of that by only recomputing the cheap, memory-heavy operations. Here is how to pick what to recompute.

RLHF with PPO is not one model training, it is four models in the loop at once, three of them on the GPU during every step. The memory math and the generation bottleneck are what trip people up.

FP8 promises to roughly double training throughput over BF16, but with only a handful of mantissa bits the numerics are unforgiving. Per-tensor scaling and a selective recipe are what make it converge.

Data, tensor, and pipeline parallelism all leave one sequence's activations on one device, so 200k+ token training hits a wall none of them can fix. The fourth axis shards the sequence itself, and the interview lives in the communication math.

When every request thinks for 30,000 tokens, serving flips from compute-bound prefill to memory-bound decode, and the KV cache becomes the resource you actually schedule. The levers that ruled chat traffic stop being the ones that matter.

Prompt injection has no single fix, and 'sanitize the input' fails the round. The signal is defense in depth: privilege boundaries, treating retrieved content as data not instructions, and a human gate on irreversible actions. Here is the layered answer.

Shipping an LLM feature safely is an evaluation problem before it is a model problem. The signal is a layered eval-plus-guardrail design with honest, segmented metrics, not a single 'safety classifier.' Here is how to measure and defend each failure mode.

LLM endpoints are uniquely exposed: each call can cost real money and burn scarce GPU capacity, and abuse is both a security and a financial problem. The signal is layered controls on tokens and cost, not just requests. Here is the defense.

Red teaming is how you find an AI system's failures before users or attackers do. The signal is a structured program covering the real attack surface (jailbreaks, harmful content, leakage, bias) and feeding every finding back into defenses.

Copyright is one of the biggest unresolved risks in generative AI, on both the training and output side. The signal is naming both exposures and the engineering mitigations for each, not offering a legal opinion. Here is the engineer's framing.

As generation gets indistinguishable from real, knowing what is AI-made matters for trust, misinformation, and regulation. The signal is the split between in-content watermarks and attached provenance metadata, and that detection is an arms race. Here is the answer.

'Add guardrails' is hand-wavy. The strong answer names the concrete input and output checks, the mechanisms that enforce them, and the fail-safe behavior when one trips, plus the honesty that they are imperfect. Here is the implementation answer.

Attackers coax models into dumping the hidden system prompt, exposing IP, business logic, or worse, embedded secrets. The signal is treating the prompt as non-secret and defending in layers, not betting on 'never reveal your instructions.'

Toxicity detection looks like vanilla text classification and is anything but: context flips labels, adversaries evolve weekly, and naive models flag dialects as hate. The signal is naming those failure modes and designing the human-in-the-loop system around them.

Safety is not one number. The candidates who pass name the axes, run benchmarks as a gate, and then explain why benchmarks alone certify nothing. Here is the framing interviewers score highest.

Direct injection is the user attacking the prompt. Indirect injection hides the attack inside a page, doc, or email the model reads. The signal is realizing retrieved and tool data is untrusted and can hijack the model. Here is the answer.

Large models memorize and can be prompted to emit training examples verbatim, a real privacy and copyright liability. The defenses span data, training, and output. Here is the layered answer.

An attacker doesn't need to breach your LLM to hurt you, just make it do expensive work. A handful of crafted prompts can pin your GPUs and run up the bill. The defense is not a bigger rate limit.

When an agent holds private data, reads untrusted text, and can communicate out, injected instructions can steal data. This 'lethal trifecta' is the defining agent vulnerability. The fix is architectural, not a better prompt.

A request that would be refused in one message often succeeds when spread across ten. The signal is understanding that conversational state is part of the attack surface, and that turn-by-turn classifiers see only fragments.

base64, leetspeak, invisible Unicode, and foreign scripts all let a payload read as gibberish to your filter but as a clear instruction to the model. The signal is knowing why the model decodes what the classifier cannot.

Roleplay, obfuscation, optimization-based suffixes, and multi-turn escalation are different attack classes that need different defenses. The signal is organizing the space and pairing each class with a control instead of hoping one filter covers all.

Gibberish-looking token strings appended to a prompt can reliably break refusals, and they transfer between models. The signal is explaining the gradient search that finds them and why output checks beat input pattern matching.

An agent that trusts its tools and its own memory can be steered by a single poisoned record that resurfaces turns or sessions later. The signal is seeing persistent state as an attack surface, not just the live prompt.

A hijacked agent does not need a 'send email' tool to leak secrets. A rendered markdown image, a URL parameter, or a DNS lookup is enough. The signal is enumerating the covert channels and locking down egress, not just tools.

C2PA cryptographically signs where media came from, but a signature you can strip is not the same as a watermark you cannot. The signal is knowing what provenance proves, what it does not, and why you pair it with watermarking. Here is the answer.

The EU AI Act assigns different duties to high-risk deployers, GPAI model providers, and limited-risk systems. The signal is naming the specific obligations per tier, not just reciting that risk tiers exist. Here is the answer.

This question is not about whether you failed; everyone has. It is a test of ownership, debugging rigor, and honesty under pressure. Here is the structure that turns a failure story into a hire signal, and the traps that turn it into a flag.

Every loop has this question and most answers fail in one of two ways: too combative or too much of a pushover. The signal is data-driven persuasion plus genuine disagree-and-commit. Here is the arc that lands and the traps that sink it.

This is a full interview round (OpenAI's project deep dive, Amazon's Tech Talk), not small talk. It is where they test whether you actually understand the work you claim. The signal is depth, your specific contribution, and the tradeoffs you can defend. Here is how to prepare and deliver it.

AI moves fast enough that learning speed is a core competency, and several companies ask it directly. The signal is a concrete method for ramping fast and a real, recent example of applying something new. Here is how to show learning agility, not just claim it.

At the frontier labs this is a real gate, not a pleasantry. They reject strong engineers who cannot articulate genuine motivation. The signal is specific, honest alignment between what you want to build and what this company actually does.

A depth probe disguised as a story. They want to watch you reason through genuine difficulty and keep going when pushed three levels down. The signal is a real hard problem, a systematic attack, and a root cause you own cold.

AI features are probabilistic, and stakeholders hear 'it works.' Setting honest expectations without killing enthusiasm is a core applied-AI skill. Here is how to frame reliability so trust survives the first mistake.

AI features fail in public, sometimes embarrassingly. How you respond to the customer, not just the bug, is what this question is really testing. Here is the recovery that rebuilds trust.

Every AI team feels the pull between velocity and doing it responsibly. How you navigate that tension, with judgment rather than dogma in either direction, is what this question screens. Here is the answer.

Chasing every new model is as bad as ignoring them all. Interviewers want a repeatable filter for signal versus hype, and the discipline to evaluate on your own problem. Here is that filter.

Ethical pushback tests integrity and judgment under pressure. Interviewers want principled, specific action, not a generic statement of values. Here is the arc that signals real backbone.

The most common opener in an Applied AI loop, and the one candidates most often answer with a taxonomy lecture. The interviewer is screening for two things in ninety seconds, and neither of them is your definition of MLOps.

MoE is why some frontier models have huge parameter counts but serve cheaply. The signal is the sparse-activation idea, the routing mechanism, and the operational cost (memory, load balancing) that the FLOP savings quietly hide.

The two knobs that make or break a RAG system, and the ones candidates hand-wave. The signal is tuning chunking against recall and knowing exactly what dense retrieval misses that BM25 catches. Here is the reasoning, not the rules of thumb.

Applied AI rarely waits for certainty, and companies (Amazon's Bias for Action, NVIDIA's speed) test whether you can act decisively without freezing or being reckless. The signal is a reversible, well-reasoned call with a plan to validate. Here is the arc that lands.

Enterprise RAG fails on isolation, not retrieval quality. The signal is enforcing tenant and document-level permissions server-side, at retrieval time, so the model can never surface data a user cannot see. Here is the design that survives a security review.

Applied AI is half translation. Interviewers ask this to see whether you can drop the jargon, frame tradeoffs in business terms, and earn trust with people who control the roadmap. Here is how to show that skill in the answer itself.

Offline metrics gate releases; online metrics tell you what actually happened with users. The signal is knowing why offline wins routinely fail to hold online, and how the two feed each other.

This is two questions hiding as one: how would you have caught it before full rollout, and how do you debug it now. Answer both and you signal senior judgment. Here is the staged-rollout and root-cause playbook.

Extreme class imbalance plus a hard latency budget plus an adversary who adapts. The signal is handling imbalance honestly, choosing the operating point from costs, and designing for the feedback loop. Here is the end-to-end design.