Google interview questions

Word vocabularies are huge and fail on unseen words; characters never fail but make sequences long. Subword methods, BPE, WordPiece and unigram, sit between: frequent words stay whole and rare ones split, so nothing is out of vocabulary.

For the recommender, keep a classic retrieval stage over item and user-history embeddings, and use the LLM to rerank and explain a short candidate list, since item IDs make poor tokens and catalogues change daily.

Count each word's successors, then sample in proportion to the counts.

import random
from collections import Counter, defaultdict

def train(words):
    counts = defaultdict(Counter)
    for a, b in zip(words, words[1:]):
        counts[a][b] += 1
    return counts

def next_word(counts, w):
    nxt = counts.get(w)
    if not nxt:
        return None              # unseen word
    ws, cs = zip(*nxt.items())
    return random.choices(ws, weights=cs)[0]

Interviewers check the unseen-word case and whether you can sample without random.choices: a cumulative sum plus binary search.

Route by difficulty and latency budget: easy, high-volume requests to the small model, hard ones to the large. The router can be rules, a small classifier, or a cascade that tries the cheap model and escalates when a check fails, which adds a second call's latency on escalations.

Set thresholds on a labelled set by plotting quality against cost per request, and watch p95, where cascades hurt.

Perplexity is exp of the mean negative log-likelihood per token, the model's effective branching factor on held-out text. Being per token, it isn't comparable across tokenizers: longer tokens mean fewer, harder predictions. Normalise to bits per byte to compare. It also measures fit to a text distribution, not helpfulness, correctness or instruction following, so it says little about a chat model's quality, and it shifts with the eval set.

The model proposes; deterministic code decides. Every tool call passes a policy layer the model can't change: a tool allowlist, argument schemas, the user's own permissions, and rate and spend limits. Irreversible or high-value actions need human approval, bound to the exact arguments shown.

Tool outputs are untrusted: they can't grant permissions, and sensitive data can't reach outbound tools. Loops end at step, token and time budgets, or on repeated actions. Scale with stateless workers over a durable task queue, logging every step for audit and replay.

Reviews are untrusted input. Delimit them, tell the model they're content to summarise, and give the summariser no tools or privileges, so a successful injection can only distort one summary. Pre-screen reviews with an injection classifier.

For PII, redact before the model sees it: names, emails, phone numbers, addresses, then scan the output again. Validate output: structured fields, claims traceable to source reviews, no URLs or contact details. Red-team with planted injections and track how many get through.

Permissions first: store each chunk with its source's access-control list and filter by the user's identity inside the retrieval call, so the model never sees what the user can't open. Sync ACL changes fast; stale permissions are a leak.

The agent plans searches, reformulates and opens documents, but every answer must cite passages, and a checker verifies claims against them. With no relevant evidence, or conflicting evidence, it abstains and suggests owners. Evaluate recall, citation accuracy, correct abstention, and permission tests with users of different access.

Reward hacking is the policy finding outputs the reward model scores highly but people wouldn't: longer answers, sycophancy, a format the grader likes, or edited tests in code tasks. Detect it when reward keeps rising while held-out human or stronger-model judgments flatten; track length and other proxies, and read the top-reward samples.

Prevent it with a KL penalty to the reference model, early stopping as overoptimisation begins, reward-model ensembles, retraining the reward model on fresh policy samples, and verifiable rewards with graders the policy can't tamper with.

We want expectations under the current policy but hold samples from another policy, older or different. Importance sampling reweights each by the likelihood ratio, current over behaviour probability; for a sequence, the product of per-token ratios, summed in log space.

It's unbiased only if the behaviour policy covers the support: wherever the current policy puts mass, the old one must too. As policies drift apart, ratios multiply and variance explodes. So PPO and GRPO clip per-token ratios, trading a little bias for stability, and off-policy data must stay near-policy.

Pipeline parallelism splits layers into stages and streams microbatches through them, leaving a fill-and-drain bubble. A GRPO step generates a group of rollouts per prompt, then trains on group-normalised rewards. Generation is decode, which pipelines poorly, so it often runs on a separate inference engine.

Overlapping next-step rollouts with this step's training keeps GPUs busy, but those rollouts come from an older policy version. Tag each rollout with its version, cap the lag at a step or two, and rely on the loss's importance ratio and clipping.

KL(P‖Q) is the expected extra log-loss from using Q when data comes from P, and it's asymmetric. Cross-entropy training minimises forward KL from data to model, which punishes missing anything the data covers, so it's mass-covering; reverse KL is mode-seeking. If Q gives zero probability where P doesn't, KL is infinite. In RLHF, a penalty on KL from policy to reference keeps the policy close and limits reward hacking.