Security & Privacy

four security & privacy problems for LLM services: ① model extraction (distillation attack) defense — adversaries distill a near-equivalent model through API queries; defenses include detecting abnormal high-frequency similar queries, output watermarking, withholding logits/long answers and rate-limiting suspicious accounts; ② poisoning defense — malicious samples mixed into training/fine-tuning data plant backdoors triggered by specific inputs; control data provenance, run pre-training poison detection (dedup, filtering, clustering) and watch for post-training behavior drift; ③ PII redaction — sanitize both inputs and outputs with regex + NER to detect and replace names, ID numbers, phone numbers and addresses; ④ compliance — training and user data must follow GDPR and similar laws, with assessments for cross-border transfer; differential privacy guarantees neighboring datasets are indistinguishable: $\Pr[\mathcal{M}(D) \in S] \le e^{\epsilon} \Pr[\mathcal{M}(D') \in S]$.

any service exposing a model via API or product, apps handling user data, and business under compliance audits; interviews ask how to block distillation, how to detect poisoning, where redaction belongs in the pipeline, and how to evaluate GDPR and cross-border data flow.

the model is the core asset and extraction steals near-equivalent capability at a fraction of training cost through the query interface alone, bypassing pricing and moats; backdoors are harder to find than to plant and can steer outputs on demand; PII leaks risk GDPR fines up to 4% of global revenue and loss of trust; differential privacy turns identifiable personal data into statistical noise — usable for training yet unidentifiable — balancing compliance with utility.

How does distillation (model extraction) work, and what API-side defenses exist (detection, watermarking, rate limiting)?

How does data poisoning happen, how is it caught pre-training, and how do you spot backdoor behavior post-deployment?

Where should PII redaction sit in the pipeline? Why both input and output sanitization?

What does GDPR require for training and inference data? How do you assess cross-border data transfers?

Intuition and formula of differential privacy? Is smaller or larger ε better, and how do you trade it against utility?