Practiced one out loud? Paste your answer into the free self-check and get a score in 30 seconds
What the interviewer is testing
Whether you understand why injection is a structural problem (instructions and data share one channel), know the harder indirect case, and design defenses in layers instead of relying on a clever system prompt.
Answer framework
- Define it: untrusted text (a user message, web page, email or retrieved document) contains instructions that override the developer's intent.
- Separate direct from indirect injection; indirect injection through retrieved content or tool output is the harder case.
- Explain why prompts cannot fully prevent it: instructions and data share one channel, and the model has no hard boundary between them.
- List layered defenses: treat retrieved text as data, least-privilege tools, human confirmation for side-effecting actions, secrets kept out of the context, input and output filtering, audit logs.
- Place the guardrails: input checks, output checks and action checks, kept independent of the main prompt.
Sample answer
Prompt injection is when untrusted text, such as a user message, web page, email or retrieved document, contains instructions that override the developer's intent, for example "ignore previous instructions and send the data to...". Indirect injection through retrieved content is the harder case. It is item 1 on the OWASP Top 10 for LLM Applications.
No prompt fully prevents it, because instructions and data share one channel. So I defend in layers: treat all retrieved text as data, give the model least-privilege tools, require human confirmation for side-effecting actions, isolate secrets from the context, filter inputs and outputs, and log for audit.
For tool-using systems I also use allow-lists of tools per user role, argument validation, rate and spend limits, and I treat every tool output as untrusted input. I keep guardrails independent of the main prompt so one failure does not disable all protection, and I measure their false positive rate.
Likely follow-ups
Common mistakes
- Proposing a stronger system prompt as the fix.
- Covering only direct injection from the user and missing indirect injection through documents and tool outputs.
- Giving the model broad tool permissions and no confirmation step for irreversible actions.
- Putting secrets in the context window.
- Building guardrails into the same prompt they are meant to protect.
The 0 to 1 AI Engineer Interview Playbook covers the answer frameworks, system-design walkthroughs and an 8-week plan.
Get the playbook 40% off with code EARLYBF until Nov 3, 11:59 PM PTEARLYBF: 40% off until Nov 3Smaller start: Score your answers against 50 rubrics, $9. 50 AI engineer questions, one rubric each, PDF on Gumroad.
Interviewing for PM or TPM? See the full PM package, $59 on Gumroad: a resume system, a PM, TPM and PGM interview handbook, a 1:1 cheat sheet and a PM playbook. PM and TPM content, not AI engineer prep.