Senior interview questionAsked at Google · interview write-up

Design LLM summaries of e-commerce reviews that hold up against prompt injection and don't leak personal data.

Q: Design LLM summaries of e-commerce reviews that hold up against prompt injection and don't leak personal data.

Reviews are untrusted input. Delimit them, tell the model they're content to summarise, and give the summariser no tools or privileges, so a successful injection can only distort one summary. Pre-screen reviews with an injection classifier. For PII, redact before the model sees it: names, emails, phone numbers, addresses, then scan the output again. Validate output: structured fields, claims traceable to source reviews, no URLs or contact details. Red-team with planted injections and track how many get through.

Model answer

Reviews are untrusted input. Delimit them, tell the model they're content to summarise, and give the summariser no tools or privileges, so a successful injection can only distort one summary. Pre-screen reviews with an injection classifier.

Indirect injection: the attacker writes the dataStep 1 / 5

Scroll sideways to see the whole diagram

The attacker never talks to the model. They put text where a model will later read it.

Text version

The attacker never talks to the model. They put text where a model will later read it.
The user is not the attacker. They ask an ordinary question.
Retrieval or a tool call brings the planted text into the context, next to the user's request.
Nothing in the token stream says the text is data, so the model may treat it as an instruction.
The action runs with whatever tools and data the application gave the model. That is where the damage is done.

After Greshake et al. (arXiv:2302.12173) and AI Engineering, Ch. 5, "Indirect prompt injection". Illustrative scenario.

For PII, redact before the model sees it: names, emails, phone numbers, addresses, then scan the output again. Validate output: structured fields, claims traceable to source reviews, no URLs or contact details. Red-team with planted injections and track how many get through.

Practise the rest

12 Prompt injection questions, 492 in all, each with a model answer. Free.

Read the lesson Practise Prompt injection

Design LLM summaries of e-commerce reviews that hold up against prompt injection and don't leak personal data.

Model answer

Indirect injection: the attacker writes the dataStep 1 / 5

Scroll sideways to see the whole diagram

The attacker never talks to the model. They put text where a model will later read it.

Text version

The attacker never talks to the model. They put text where a model will later read it.
The user is not the attacker. They ask an ordinary question.
Retrieval or a tool call brings the planted text into the context, next to the user's request.
Nothing in the token stream says the text is data, so the model may treat it as an instruction.
The action runs with whatever tools and data the application gave the model. That is where the damage is done.

After Greshake et al. (arXiv:2302.12173) and AI Engineering, Ch. 5, "Indirect prompt injection". Illustrative scenario.

Practise the rest

12 Prompt injection questions, 492 in all, each with a model answer. Free.

Read the lesson Practise Prompt injection

Model answer

More Prompt injection interview questions

Model answer

More Prompt injection interview questions