Senior interview questionAsked at ByteDance · interview write-up
Design a RAG-based agent system: how it retrieves, how it grounds its answers, and how it enforces access control.
Model answer
Retrieval becomes tools the agent calls, a search per source, so it can reformulate and search again. Grounding: answers cite passages, a checker flags claims the passages don't support, and the agent abstains when evidence is missing.
Scroll sideways to see the whole diagram
The attacker never talks to the model. They put text where a model will later read it.
Text version
- The attacker never talks to the model. They put text where a model will later read it.
- The user is not the attacker. They ask an ordinary question.
- Retrieval or a tool call brings the planted text into the context, next to the user's request.
- Nothing in the token stream says the text is data, so the model may treat it as an instruction.
- The action runs with whatever tools and data the application gave the model. That is where the damage is done.
After Greshake et al. (arXiv:2302.12173) and AI Engineering, Ch. 5, "Indirect prompt injection". Illustrative scenario.
Access control lives in retrieval, not the prompt: filter every search by the user's permissions, and run tools with that user's credentials and least privilege. Retrieved text is untrusted, a vector for indirect injection, so write actions need confirmation. Log every retrieval and action for audit, and evaluate retrieval, faithfulness and leakage separately.
Practise the rest
22 RAG questions, 492 in all, each with a model answer. Free.
More from ByteDance interview questions.
More RAG interview questions
- What is retrieval-augmented generation, and how does it reduce hallucination?
- How do you choose a chunking strategy for RAG?
- Why combine keyword and embedding search, and where does a reranker fit?
- How do you evaluate a RAG pipeline?
- Your RAG chatbot keeps giving wrong answers. How do you find out why, and fix it?
- Design a RAG system that has to meet strict latency and cost targets while serving many tenants.