Can you structure an adversarial engagement from scoping to report delivery? Do you have a systematic methodology, or do you just try random prompts?

1. Scope definition — what are the chatbot’s intended use cases and trust boundaries? 2. Threat model — map OWASP LLM Top 10 risks and MITRE ATLAS tactics to this specific deployment. 3. Attack execution — start with automated scanning (Garak for breadth), then manual probing (prompt injection, jailbreaking, data extraction). 4. Triage and report — classify findings by severity and business impact, provide remediation recommendations.

Do you understand the adversarial ML taxonomy precisely, or do you use terms loosely? This separates practitioners from people who read one blog post.

Prompt injection is a security vulnerability (OWASP LLM01) where an attacker manipulates the model into executing unintended instructions — either directly (user input) or indirectly (via injected content in retrieved documents). Jailbreaking is a subset focused specifically on bypassing the model’s safety alignment to produce content it was trained to refuse. All jailbreaks involve prompt manipulation, but not all prompt injections are jailbreaks — some target data exfiltration, privilege escalation, or tool misuse.

Do you understand ML training pipeline vulnerabilities beyond just prompt-level attacks? Can you think about supply chain and pre-deployment risks?

1. Training data audit — inspect data sources for integrity, check for injected samples in fine-tuning datasets. 2. Behavioral testing — probe the model for backdoor triggers using known patterns (OWASP LLM04: Data and Model Poisoning). 3. Statistical analysis — compare model outputs against a clean baseline to detect distribution shifts. 4. Supply chain review — verify model provenance, check Hugging Face model cards, validate checksums. Use IBM ART for automated poisoning detection.

Do you have real hands-on experience? Can you communicate findings clearly with appropriate severity context and actionable remediation?

Use the STAR method but security-focused: Situation (what system, what scope), Attack (what technique you used, mapped to MITRE ATLAS or OWASP), Result (what you found, severity classification), Report (how you documented it, who you disclosed to, what remediation you recommended). If you haven’t found a real vulnerability yet, describe a CTF challenge or a reproduction of a published attack — honesty about experience level is valued.

Are you genuinely embedded in the AI security community, or would you be starting from scratch? The field moves weekly — they need someone who keeps up.

Name specific sources: arXiv papers on adversarial ML, OWASP Slack #team-llm-redteam channel, AI Village community, MITRE ATLAS updates, conference proceedings (DEF CON AI Village, Black Hat, NeurIPS adversarial ML workshops). Mention tools you actively contribute to or follow (PyRIT, Garak, ART). Reference recent papers or attacks by name. Mention Apart Research hackathons if you’ve participated.