Prompt injection
Also called prompt injections, prompt injection attack
Text that gets a model to follow instructions its developer never intended, possible because instructions and data reach the model as one token stream.
Interview questions about Prompt injection
- Design a scalable service where an AI agent plans work and calls approved tools without ever bypassing deterministic controls. Cover prompt injection, approvals, budgets and loop termination.
The model proposes; deterministic code decides. Every tool call passes a policy layer the model can't change: a tool allowlist, argument schemas, the user's…
- Why is prompt injection possible at all, and why can't it be fixed the way special-token injection is?
Instructions and data share one token stream; role markers are just more tokens.
- What is the difference between direct and indirect prompt injection? Give an example of each.
Direct: the person typing is the attacker, as in "When will my order arrive?
- What's the difference between a jailbreak and a prompt injection?
A jailbreak gets past the model's safety features. Prompt injection adds instructions that make the app do something unintended: typed by the user (direct)…
- Do XML tags or delimiters around untrusted text stop prompt injection?
They help, but they don't stop it. Tags tell the model which text is data, and a well-trained model mostly respects that.
- Design LLM summaries of e-commerce reviews that hold up against prompt injection and don't leak personal data.
Reviews are untrusted input. Delimit them, tell the model they're content to summarise, and give the summariser no tools or privileges, so a successful…
- Rapid fire: how do RAG and fine-tuning relate, what do you do when content exceeds the context window, how do you keep conversation state, and how do you manage prompts?
RAG and fine-tuning fill different gaps: RAG supplies changing or citable facts, fine-tuning shapes format, style or a narrow skill.
- What role should LLMs play in fraud detection compared with traditional supervised models, considering data types, accuracy, latency, cost and interpretability?
LLMs aren't the core scorer. Fraud signals are mostly tabular and behavioural: amounts, velocities, device and graph features.