TL;DR: Treat it as layered measurement plus runtime defense. Build a separate eval for each failure mode (a red-team jailbreak suite, a toxicity benchmark segmented across subpopulations, a grounded-faithfulness check for hallucination), report rates with confidence intervals, and gate releases on them. At runtime, add input and output guardrails (classifiers, grounding and citation checks, refusal logic) plus continuous red-teaming, because static benchmarks decay against an adaptive adversary.
How to approach it. Separate the three failure modes up front: jailbreak, toxicity, and hallucination need different evals and different defenses. Cover both offline evaluation (to gate releases) and online guardrails (to catch what slips). Stress that the deliverable is honest, segmented metrics, not a single pass/fail number.
A strong answer. Jailbreaks and prompt safety. Maintain a red-team suite of known attack patterns (role-play, encoding, "ignore previous instructions," many-shot) and measure attack success rate. Defend at runtime with an input classifier, a hardened system prompt, and an output check that catches policy-violating completions. This is adversarial: keep growing the suite as new attacks appear and treat any benchmark number as a floor, not a guarantee.
Toxicity and bias. Evaluate on a benchmark of provocative and identity-referencing prompts, scoring offensive-output rate. Segment by subpopulation (gender, race, religion), because aggregate numbers hide disparate harm: a 1% overall rate can be 8% for one group. Use a classifier or judge model for scale plus human review on a sample, since context decides whether output is toxic. Defend with output filtering and refusal or safe-completion behavior.
Hallucination and faithfulness. For a grounded (RAG) feature, measure whether answers are supported by the retrieved context: groundedness (does every claim trace to a source) and answer relevance, via an LLM judge plus spot human checks on a labeled set. Defend at runtime with citation and grounding checks (reject or hedge when no source supports a claim) and a calibrated "I don't know" path. Distinguish closed-book hallucination (fixed mainly by grounding) from retrieval failure (fix the RAG, not the model).
Process. Gate releases on these metrics with thresholds, run continuous and automated red-teaming, and fold every production failure back into the eval set. The failures you find become next round's tests. Report rates with uncertainty, never a single anecdote.
The honest framing: you cannot prove a model is safe, so you measure each failure mode with a real eval, defend in depth at runtime, and keep the loop running because adversaries adapt and benchmarks go stale.
| Failure mode | Offline eval | Runtime guardrail |
|---|---|---|
| Jailbreak | Red-team suite, attack success rate | Input classifier, hardened prompt, output policy check |
| Toxicity | Identity-prompt benchmark, segmented by subgroup | Output filter, refusal / safe-completion |
| Hallucination | Groundedness and relevance vs retrieved context | Citation check, hedge or "I don't know" path |
Key takeaways
- Three failure modes, three evals, three defenses; one "safety classifier" is the answer that sounds good and fails the round.
- Segment toxicity by subgroup: aggregate rates mask disparate harm that an interviewer will ask about directly.
- Separate hallucination from retrieval failure, because the first is fixed by grounding and the second by fixing the RAG.
- Every benchmark is a floor that decays; continuous red-teaming and mined production failures are what keep it honest.
What interviewers probe next.
- "LLM-as-judge reliability?" Useful at scale but biased (position, verbosity, self-preference). Calibrate against human labels, randomize order, and audit a sample.
- "How do you catch hallucination automatically?" Groundedness scoring against retrieved context, flagging claims with no supporting source. It is imperfect, so pair it with citations users can check.
- "Static benchmark going stale?" Continuous red-teaming and mining production logs. A fixed suite is a floor, and attackers route around it.
- "How do thresholds get set?" From risk tolerance and the EU AI Act risk tier. Higher-risk uses demand stricter gates and human oversight.
Common mistakes.
- One "safety classifier" presented as the whole solution, with no per-failure-mode evals.
- Aggregate toxicity numbers that hide disparate impact across subpopulations.
- Trusting an LLM judge without calibrating it against humans.
- A static benchmark with no continuous red-teaming, so the eval decays while attacks evolve.