Decagon interview questions
AI startup · 3 questions reported
- junior 0
- mid 3
- senior 0
These are 3 technical questions candidates reported being asked in Decagon interviews for AI engineer, ML engineer and applied AI engineer roles, each with a model answer you can say out loud in a minute or two. They cover latency & throughput, prompt injection and rag: 0 junior, 3 mid-level and 0 senior questions. Every question comes from a public interview write-up that names Decagon.Updated
Decagon latency, throughput and goodput questions
Model answer
One API; adapters normalize each provider's schema and streaming. Route by model alias, cost and region; fall back only to models evaluated as equivalent.
Quotas: token buckets per tenant, counting requests and tokens. Retry only timeouts, 429s and 5xx, with jittered backoff, honouring Retry-After, under a retry budget. A circuit breaker per provider opens on error rate, then sends probes.
Log metadata always: tokens, latency, cost, status. Bodies are redacted or skipped, with short retention.
Decagon prompt injection and defences questions
Model answer
Assume anything in the context can steer the model, so enforce security outside it.
Scroll sideways to see the whole diagram
A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
Text version
- A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
- The prompt can name what is off-limits and mark untrusted text as data. Both rely on the model complying.
- System-level defences don't depend on the model: a tool it doesn't have can't be misused, and a send that needs approval can be declined.
- Layers reduce risk; none removes it. Plan for an attack that gets through.
Levels from AI Engineering, Ch. 5, "Defenses Against Prompt Attacks"; measures from OWASP LLM01:2025.
Tools run with the end user's permissions, checked server-side on every call; writes need confirmation. Retrieval filters by access control before text reaches the model, and no secrets go in prompts. Outputs are scanned for personal data, and links or images are rendered safely to block exfiltration. Add injection classifiers, rate limits, redacted logs and ongoing red-teaming.
Decagon retrieval-augmented generation questions
Model answer
RAG over the approved corpus only, versioned so removed documents disappear. Hybrid retrieval plus a reranker.
Scroll sideways to see the whole diagram
Search your own documents for passages related to the question, with keywords, embeddings or both.
Text version
- Search your own documents for passages related to the question, with keywords, embeddings or both.
- A reranker reads the question with each candidate and keeps the few that actually answer it.
- The kept passages go into the prompt, with instructions to answer only from them.
- The model answers from evidence in its context instead of memory alone, so the answer can be checked against its sources.
The pattern of Lewis et al. (2020), Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks, as used in production systems.
For multi-turn, rewrite each follow-up into a standalone query using the history, and keep a short conversation summary. The prompt says answer only from the passages and cite them; when support is weak, the bot abstains or hands off to a human. Evaluate on real customer questions: faithfulness, correct abstention and resolution rate.
Each question comes from a public interview write-up or video that names Decagon; the answers are ours. Not affiliated with Decagon.