Whole course

All flashcards

Reviewing needs JavaScript. You can read every card in the list below.

Loading your cards...

Read all 217 cards as a list

How LLMs work

Front
What does an LLM actually output at each generation step?
Back
A probability distribution over its vocabulary for the next token. One token is sampled, appended to the sequence, and the process repeats.
Front
Why is self-attention parallelizable in a way RNNs aren't?
Back
Every token's Query/Key/Value can be computed and compared with the other visible tokens in a few large matrix operations during training. An RNN needs the previous step's hidden state before it can do the next step.
Front
How does self-attention cost grow with sequence length n, and what does the causal mask do?
Back
The score matrix is n x n, so the score arithmetic is quadratic in n (prefill). The causal mask blocks each token from attending to later tokens so the model cannot peek at the answer.
Front
What problem does KV-caching solve?
Back
It avoids recomputing Key/Value vectors for all previous tokens at every decode step. Only the new token's K/V is computed and appended.
Front
Why divide attention scores by the square root of d_k?
Back
Dot products grow with vector size. Scaling keeps their variance near 1 so softmax does not saturate into a near one-hot output, which would starve the training signal.
Front
Prefill vs decode: which is typically compute-bound and which memory-bound?
Back
Prefill processes the whole prompt in parallel and keeps the GPU busy. Decode generates one token per step and is typically limited by memory bandwidth (reading weights and the KV-cache).
Front
Write the KV-cache size formula. What does it limit in production?
Back
2 x layers x KV-heads x head-dim x sequence length x batch x bytes per value. It grows linearly with context and with concurrent requests, so it often caps how many requests one GPU can serve. GQA/MQA shrink it by using fewer KV-heads.
Front
Why can't attention alone distinguish word order?
Back
Without position information, attention is permutation-equivariant: shuffle the input tokens and the outputs are shuffled the same way, with no sense of order. Positional information (learned, sinusoidal or rotary) must be injected.

Tokenization and embeddings

Front
What is BPE and why is it used?
Back
Byte-Pair Encoding repeatedly merges the most frequent adjacent pair of bytes/characters to build a subword vocabulary. Any text, even an unseen word, can then be written from a fixed set of pieces.
Front
Why do LLMs struggle with spelling and digit-level arithmetic?
Back
They see subword tokens, not characters or place-value digits. Tool use (code or a calculator) is the robust fix.
Front
How big are tokenizer vocabularies today, and is it the same for every model?
Back
No. Each model family trains its own. Public examples: tiktoken gpt2 has 50,257; cl100k_base is about 100k; o200k_base about 200k; Llama 3 uses 128K (sources checked 2026-10-09). Check the model you use.
Front
What is the vocabulary-size trade-off?
Back
A bigger vocabulary gives fewer tokens per text (cheaper, shorter sequences) but a larger embedding table and output layer.
Front
Are token embeddings fixed vectors?
Back
No. The embedding table has one row per token and is learned jointly with the rest of the model.
Front
How should you count tokens for a cost estimate?
Back
Use the tokenizer or token-counting tool for the exact model you will call, and measure real traffic in each language. Another family's count, or a '4 characters per token' rule, is only an estimate.

Sampling parameters and the model landscape

Front
What does temperature do, and what happens as it goes to 0?
Back
It divides the logits before softmax: higher gives a flatter distribution (more random), lower a sharper one. At 0 the choice is greedy, always the top token, but that does not guarantee identical outputs across runs.
Front
Top-k vs top-p: what is the difference and when does it matter?
Back
Top-k keeps a fixed number of highest-probability tokens. Top-p keeps the smallest set whose cumulative probability reaches p, so it keeps few tokens when the model is confident and more when it is unsure.
Front
Open-weight vs API-only model: one key trade-off?
Back
Open-weight: you can self-host, fine-tune and keep data in your infrastructure, but you own serving and operations. API-only: no infrastructure and often frontier quality, but data goes to the provider and you cannot change the weights.
Front
Does temperature 0 guarantee identical outputs? Why not?
Back
No. A key cause is that inference kernels are not batch-invariant: the result for your request can depend on how many other requests share the batch, and server load changes that (Thinking Machines Lab, 2025-09-10). Store outputs, validate against a schema and do not rely on regeneration.
Front
Why is a bigger context window not a free upgrade?
Back
You pay per token, prefill attention work and KV-cache memory grow with length, and quality can drop for information in the middle of long inputs. It also does not replace retrieval.
Front
Which sampling settings for extraction vs creative writing, and what caveat?
Back
Extraction and classification: low temperature (0 or near it). Creative writing: higher temperature or top-p below 1. Change one control at a time, and check whether your model accepts these parameters at all.

Prompting fundamentals

Front
Few-shot prompting vs fine-tuning: what is the difference?
Back
Few-shot shows examples in the prompt at inference time: no weight changes, but you pay for the example tokens on every call. Fine-tuning updates weights on labelled examples: upfront cost, and shorter prompts afterward.
Front
Chain-of-thought: benefit and caveat?
Back
It helps multi-step reasoning on models that do not already reason on their own. It costs tokens and latency, and the written reasoning may not reflect what actually drove the answer.
Front
What is a solid prompt skeleton?
Back
Role, context, task, format and constraints, including what to do when information is missing (for example answer 'unknown'). Show the exact output shape with an example.
Front
How do you reduce prompt injection from a document you pass to the model?
Back
Delimit the untrusted text, tell the model it is data and not instructions, validate the output, and limit what the output can trigger. Delimiters lower the risk; they do not remove it.
Front
Self-consistency: how does it work and what does it cost?
Back
Sample several chain-of-thought answers and take the majority. It raises reliability on short, votable answers, at about N times the cost and latency.
Front
How do you tell whether a prompt change helped?
Back
Run old and new prompts on the same labelled set (with edge cases) and compare pass rate. Keep the set as a regression test for later prompt or model changes.

Reasoning models and structured outputs

Front
When use a reasoning model and when not?
Back
Use for hard multi-step tasks where errors are costly and latency is tolerable. Prefer a fast model for extraction, classification, FAQ and tight latency targets. Decide by measuring on your own tasks.
Front
Does schema-constrained output guarantee correctness?
Back
No. It guarantees form, not truth. Still handle truncation and refusals, validate semantics, retry with the error a bounded number of times, and have a fallback.
Front
What do reasoning tokens cost, and are they visible?
Back
They are billed as output tokens and count toward the output limit, even when the API does not return them. Watch the reasoning-token count in usage data.
Front
Can you trust a reasoning model's visible reasoning as an audit trail?
Back
No. In one 2025 study, models mentioned a hint they used only 25% to 39% of the time on average. Treat it as a clue.
Front
JSON mode vs schema-constrained structured outputs?
Back
JSON mode gives syntactically valid JSON. Schema-constrained outputs restrict decoding to your JSON Schema, so the shape and types conform. Neither makes the values true (on Anthropic, enum capitalisation is also not guaranteed).
Front
Tool calling vs structured outputs: how do you choose?
Back
They are not a ladder. Use schema-constrained outputs to shape the reply. Use tool calling when the model should act or fetch through your functions. Validate arguments either way.
Front
What schema limits and quirks should you plan for?
Back
Providers support only a subset of JSON Schema (unsupported features return a 400), Anthropic does not guarantee enum capitalisation, and the first request with a new schema is slower because the schema is compiled.

Embeddings and similarity search

Front
Why cosine similarity for text embeddings?
Back
It compares direction only, so differences in vector length do not skew the ranking. It is the usual default for text embeddings, as long as the index uses the metric the model expects.
Front
What does an embedding model return for a chunk, and what does 'close' mean?
Back
One fixed-length vector for the whole chunk. Close vectors mean similar meaning, because contrastive training pulled matching pairs together and pushed others apart.
Front
Why is cosine as cheap as a dot product after normalizing?
Back
Both lengths are 1, so the denominator is 1. For unit vectors, Euclidean distance squared is 2 - 2(a·b), so it gives the same ranking too.
Front
Why can a raw dot product mis-rank results?
Back
It mixes angle with length, so a longer vector can outscore one that points closer to the query. Normalize, or use cosine.
Front
Query 'ERR-40412' returns general error pages. Cause and fix?
Back
Exact identifiers carry little learned meaning, so embeddings rank them poorly. Add keyword (BM25) search and merge with vector results: hybrid search.
Front
Results are on topic but do not answer the question. What helps?
Back
Embeddings measure topical closeness, not answer quality. Retrieve more candidates, then rerank them with a model that reads query and passage together.
Front
Why must index and query use the same embedding model?
Back
Each model builds its own vector space. Scores across models mean nothing, and no error is raised. Re-embed the whole corpus when you change models.

Vector databases

Front
What is HNSW?
Back
Hierarchical Navigable Small World: a layered proximity graph. Search starts in a sparse top layer, hops toward the query and descends to a dense bottom layer. High recall, memory-heavy.
Front
Is ANN search exact? What is recall@k?
Back
No. Recall@k is the share of the true top-k neighbors the index returned. It is the price paid for speed and memory.
Front
What do ef_search, M and ef_construction do in HNSW?
Back
ef_search: candidates tracked per query (more recall, more latency; adjustable per query). M: links per node. ef_construction: build-time search width. M and ef_construction are fixed at build, so changing them means a rebuild.
Front
IVF in one line?
Back
Cluster vectors around centers learned in a training step. At query time scan only the nprobe nearest clusters. Lighter on memory than HNSW; recall depends on nprobe and on training data.
Front
How do you measure ANN recall?
Back
On a sample of real queries, compute exact top-k by brute force and ANN top-k, and take the overlap. Change one knob at a time and record recall and latency.
Front
What does product quantization (PQ) trade?
Back
It stores compressed approximations of vectors to save memory and speed up distance checks, at some recall loss. Re-ranking a short list with the original vectors recovers some of it.
Front
When is pgvector enough, and when move to a dedicated database?
Back
Start with what you run (often pgvector) and measure. Move when a measured limit (latency, memory, ops burden, filtering) forces it. Qdrant and Weaviate are open source and can be self-hosted.
Front
Fewer than k results with a metadata filter, and stale results after an edit: causes?
Back
Filter applied after the ANN search removes candidates (fix: iterative scan, larger candidate list, partitioning). Stale: old chunks not overwritten or deleted, so use deterministic chunk IDs.

RAG architecture and chunking

Front
What is RAG, in one sentence?
Back
Retrieving relevant external content and putting it in the prompt so the model's answer is grounded in that content, without changing model weights.
Front
Why not embed a whole document as one vector?
Back
One vector blends every topic in the document, which dilutes relevance and loses the detail a question asks about. Chunking keeps retrieval specific.
Front
Name the chunk-size trade-off and what overlap adds.
Back
Small chunks: precise but may lose surrounding context. Large chunks: more context but blurrier matches and a noisier prompt. Overlap keeps boundary facts in at least one chunk, at the cost of more and near-duplicate chunks.
Front
What is small-to-big (parent-child) retrieval?
Back
Embed small chunks for precise matching, then return their larger parent section so the model gets context. Cost: bigger prompts and de-duplicating shared parents.
Front
Why must ACL filtering happen inside retrieval?
Back
Post-filtering can empty the top-k and can leak through scores, summaries and caches. Enforce permissions in the query (filter or namespace) and scope caches by identity.
Front
A table is split one row per chunk and retrieval gets worse. Why, and how do you fix it?
Back
Rows lose their column headers, so the numbers have no meaning. Keep small tables whole, repeat the caption and header in each chunk, or rewrite each row as a sentence before embedding.
Front
How do you choose a chunk size without folklore?
Back
Index at two or three sizes with other settings fixed, score recall@k on labelled questions, then check prompt cost and a few end-to-end answers.

The core RAG pipeline

Front
One-line rule for RAG vs fine-tuning?
Back
RAG for knowledge (fresh, citable, easy to update); fine-tuning for behaviour (style, format, task skill). They can be combined.
Front
Name the two lanes of a RAG pipeline and what is in each.
Back
Offline: parse, chunk, embed, index. Online (per query): retrieve, rerank, generate.
Front
Why must you version the index?
Back
Queries and chunks must use the same embedding model. Changing the model means re-embedding the whole corpus, so you need to know which model built which index.
Front
Confident wrong answer, correct passage exists in the corpus. What is the first test?
Back
Paste the gold passage into the prompt. Right answer: retrieval or ingestion problem. Still wrong: prompt or generation problem.
Front
Name four stages where a confident wrong answer can originate.
Back
Ingestion (bad parse, stale page), retrieval (filters, embedding, recall), ranking and context assembly (rerank, trimming), generation (model ignores or misreads context).

Better retrieval

Front
Why hybrid search?
Back
BM25 catches exact terms and IDs; vectors catch paraphrase. Fuse the lists (for example with Reciprocal Rank Fusion), then rerank.
Front
What does Reciprocal Rank Fusion compute, and why use it?
Back
score(d) = sum over lists of 1/(k + rank_i(d)), k = 60 by default (Cormack et al., SIGIR 2009). Ranks only, so no calibration of incompatible score scales.
Front
Bi-encoder vs cross-encoder?
Back
Bi-encoder embeds query and document separately (fast, precomputable). Cross-encoder scores the pair jointly (more accurate, one call per pair), so use it to rerank a shortlist.
Front
Why doesn't reranking fix a recall problem?
Back
It only reorders candidates it is given. If the right chunk is not in the shortlist, widen or change the first stage (more candidates, BM25, better query).
Front
What can go wrong with strict metadata pre-filters in an approximate index?
Back
Some ANN indexes lose recall or speed when a filter is very selective. Test your database with realistic filters. The filter value should come from the authenticated identity, not from user input.
Front
Name two costs of query transformations.
Back
Each adds an LLM call (latency, money) and can drift from the user's intent. Gate them to the queries that need them.
Front
What does MMR do?
Back
Maximal marginal relevance picks chunks that are relevant and different from those already chosen, so top-k is not near-duplicates.

All RAG types

Front
When does HyDE help and what is its risk?
Back
Helps when query and documents are phrased very differently. Risk: the hypothetical answer can be wrong and bias retrieval toward it.
Front
Self-RAG vs CRAG vs Adaptive RAG?
Back
Self-RAG: a trained model emits reflection signals and critiques itself. CRAG: grade retrieved docs, fall back (rewrite or web) when weak. Adaptive: route each query to no retrieval, single-shot or multi-step.
Front
What is the decision rule for choosing a RAG variant?
Back
Start with the simplest design that meets the quality bar, measure, and add complexity only for a failure you can name. Each extra call adds latency, cost and a failure mode.
Front
Naive, advanced, modular, agentic: one line each.
Back
Naive: retrieve once, generate once. Advanced: adds rewrite, rerank, filters. Modular: swappable stages wired by a router. Agentic: the LLM decides whether, what and how often to retrieve.
Front
When do you reach for GraphRAG, and what does it cost?
Back
For multi-hop or corpus-wide questions that top-k similarity handles poorly. Cost: expensive indexing, a graph that can go stale, and extraction errors that propagate.
Front
Name two things agentic RAG needs to be safe in production.
Back
Step limits to prevent loops, and tracing plus guardrails to evaluate and secure the many tool calls. Latency and cost become unpredictable without them.

RAG evaluation and hallucination

Front
Does RAG eliminate hallucination?
Back
No. It reduces it by grounding answers, but the model can still ignore, misread, or blend retrieved context with unsupported claims.
Front
Name two hallucination-mitigation techniques for RAG.
Back
An explicit "answer only from context" instruction with citations, and a retrieval-quality gate that refuses to answer when the best match score is too low.
Front
Three ways a model fails even with the right passage in the prompt?
Back
It ignores the context, misreads it, or blends it with plausible claims the passage never stated.
Front
Why is a copied similarity-score threshold risky?
Back
Scores are not comparable across embedding models or query types. Calibrate the gate on a labelled set and track both wrong refusals and wrong answers.
Front
Citations in the answer: what do they not guarantee?
Back
Presence of a citation does not mean the cited chunk supports the claim. Check citation accuracy.
Front
How do you classify a failure from a trace?
Back
Gold chunk not retrieved: retrieval. Gold chunk in prompt but answer contradicts it: generation. Answer follows a wrong or stale chunk: source.
Front
On a 30-question golden set, what is one extra correct answer worth, and what does it mean?
Back
About 3.3 percentage points. A one-question change is weak evidence; enlarge the set and inspect what changed.

RAG evaluation in depth

Front
What's the difference between a retrieval metric and a generation metric in RAG eval?
Back
Retrieval metrics (precision@k, recall@k, MRR) measure whether the right chunks were found; generation metrics (faithfulness, relevance) measure whether the answer is grounded in and addresses those chunks.
Front
Define recall@k, precision@k and MRR, and how they differ.
Back
Recall@k: was the relevant item found in the top k. Precision@k: fraction of the top k that is relevant. MRR: mean of 1/rank of the first relevant result, 0 if none; it also rewards ranking it higher.
Front
Three ranks 3, 1, none: what is MRR?
Back
(1/3 + 1 + 0) / 3, about 0.44. A miss counts as 0 and stays in the denominator.
Front
Retrieved gold = no, faithful = no, correct = yes. What does that mean?
Back
A lucky answer from the model's memory, not the corpus. It hides a retrieval gap and cannot be cited.
Front
Name three LLM-judge pitfalls and mitigations.
Back
Position bias, verbosity bias, self-preference. Use a fixed rubric, swap order in pairwise comparisons, calibrate against human labels, and prefer a judge from another model family.
Front
Why can synthetic evaluation questions mislead?
Back
They tend to copy chunk wording and be easier than real queries, inflating scores. Review a sample and add real logged queries and unanswerable questions.

Multimodal GenAI and document AI

Front
Why is parsing quality the usual cap on document RAG?
Back
Tables, reading order, scans and charts break text extraction; if the fact never reaches the chunk, nothing downstream can recover it.
Front
How does a vision-language model take in an image, and why does that cost money?
Back
A vision encoder cuts the image into patches, a projection maps them into the LLM's token space, and each patch becomes input tokens. More or larger images means more tokens, latency and spend.
Front
Name the four ways to read a document page.
Back
Text-layer extraction, OCR plus layout analysis, VLM page reading, and page-image retrieval. Start with the cheapest that passes your evaluation and route hard pages up.
Front
Users report wrong numbers from a table. How do you locate the failure?
Back
Open the chunk the retriever returned. Fact missing or scrambled: parsing. Right chunk not retrieved: retrieval. Right chunk in the prompt but wrong answer: generation. Fix the earliest broken layer.
Front
How should a table be chunked?
Back
Keep it whole, or split by row groups and repeat the header and unit in every chunk. Store it as Markdown, HTML or records with column names, plus page and section metadata.
Front
Why flag chart captions written by a VLM?
Back
They are model-generated, not the document's words, and can misread exact values. Labelling them keeps readers and later checks from treating them as source text.
Front
What is a sound evaluation for a document extraction pipeline?
Back
Field-level accuracy on a labelled sample, page-level retrieval recall, programmatic number checks (line items sum to the total), and a human review path for low-confidence fields.
Front
What privacy risk comes with VLM page reading?
Back
A page image sends everything on the page to a hosted API. Check retention and training terms, redact where possible, or self-host for sensitive documents.

Function and tool calling

Front
What does the model actually do when it "calls a function"?
Back
It emits a structured request (tool name plus arguments). Something outside the model executes it; for your own tools that is your application, which returns the result linked to the call id.
Front
What does a tool definition contain, and why does its quality matter?
Back
Name, description and JSON-schema parameters (with required fields). It is the only thing the model knows about the tool, so vague names, empty descriptions or free-text arguments lead to wrong calls.
Front
Why make side-effecting tools idempotent?
Back
Retries and loops can repeat a call. An idempotency key lets the downstream service recognise a repeat and not charge twice or send a duplicate email.
Front
Name four controls your executor applies to a model-proposed call.
Back
Validate arguments, authorize from the real session (not a model-supplied id), set timeouts with bounded retries, and treat results as untrusted. Add idempotency keys for side effects.
Front
Does strict mode make a tool call safe?
Back
No. Strict mode makes arguments follow the schema more reliably. It does not check permissions or whether the values are sensible, so executor checks stay.
Front
Client tools vs provider-hosted tools?
Back
Client tools are defined by you and run in your code. Hosted tools (for example web search or code execution) run on the provider's infrastructure, with less code for you but less control and possible extra charges.

Agentic patterns: ReAct, planning and memory

Front
What is the ReAct pattern?
Back
An explicit loop of Thought, Action (a tool call) and Observation (the tool result), repeated until the goal is met or a stopping control fires.
Front
Plan-then-execute vs reactive planning: trade-offs?
Back
Plan-then-execute is predictable and reviewable up front but brittle when the world deviates (needs checkpoints and replanning). Reactive adapts to each observation but costs more calls and can wander.
Front
What stopping controls does an agent loop need?
Back
A checkable done criterion, step cap, time and cost budgets, loop detection, escalation to a human when ambiguous, and tracing.
Front
How do you detect an agent stuck in a loop?
Back
Watch for the same tool called with the same arguments again, or several steps with no new information. Then stop, return a partial result and ask the user.
Front
Short-term vs long-term agent memory, and one risk of long-term?
Back
Short-term is the current context and scratchpad. Long-term is stored outside and retrieved when relevant. Risks include privacy of stored personal data and stale facts.
Front
Workflow vs agent, and when to prefer a workflow?
Back
A workflow follows predefined code paths; an agent lets the model direct its own steps and tools. Prefer the simpler design when the path is predictable, since agents cost more and can compound errors.

Model Context Protocol and tool ecosystems

Front
What problem does MCP solve and how does it relate to function calling?
Back
It replaces N x M custom integrations with N + M through a standard host-to-server protocol. Function calling is the model-facing interface; MCP standardises how the host discovers and invokes tools. They compose.
Front
Name three MCP security risks and a mitigation for each.
Back
Injection through tool descriptions or results (treat as untrusted, show inputs, approvals); over-broad or passed-through tokens (least privilege, accept only tokens issued for the server); malicious or changed servers (pin, allow-list, sandbox).
Front
Where does the USB-C analogy for MCP break?
Back
The model never talks to the server; the host mediates, so controls live there. Connecting a server means trusting text it controls, and trust is per server and per user, not plug-and-play.
Front
What are tools, resources and prompts, and who controls each?
Back
Tools are actions the model invokes (model-controlled). Resources are URI-identified context (application-driven). Prompts are templates the user picks (user-controlled).
Front
What changed in MCP revision 2026-07-28?
Back
Stateless requests with version and capabilities on each request (no initialize handshake, server/discover added), no protocol-level sessions or Mcp-Session-Id, multi round-trip requests for server-initiated input, and Roots, Sampling and Logging deprecated.
Front
Which transports are standard in current MCP, and how is state kept across calls?
Back
stdio for local subprocesses and Streamable HTTP for remote servers (HTTP+SSE is deprecated). Without sessions, a server returns an explicit handle that the model passes back as a tool argument, and the server checks ownership.

Context engineering and memory

Front
What are the four agent memory types, with one storage example each?
Back
Working (the window or a rolling summary), episodic (timestamped summaries of past interactions in a vector store), semantic (facts in a profile or key-value store), procedural (instruction or skill files). A teaching split, not a standard.
Front
The four context-engineering moves?
Back
Write (persist outside the window), select (bring in only what is relevant now), compress (summarise or trim), isolate (give a sub-task its own clean context and take back a short result).
Front
How do you lay out a prompt for caching, and what breaks it?
Back
Stable content first (tools, system rules, reference documents), variable content last. A change at one level invalidates it and everything after it: a new tool invalidates the whole cache, and a timestamp at the top of the system prompt invalidates the system prompt and what follows.
Front
A summary made the agent forget a constraint. What is the fix?
Back
This is drift. Pin must-keep rules verbatim in the system prompt or a note that compaction never rewrites, and test with a probe question about each pinned fact after every compaction.
Front
What does a memory design have to answer besides what to store?
Back
When to write, how to recall (similarity plus recency and importance), how to update and expire, and how to delete one user's data from records, summaries and embeddings. Treat recalled memory as untrusted data, not as instructions.
Front
Overflow, distraction, drift, tool-output bloat (course taxonomy): what does each measure look like?
Back
Overflow: tokens per step against the limit. Distraction: accuracy with and without the extra context. Drift: probe questions after compaction. Bloat: share of tokens from tool results and p95 tokens per call.

Multi-agent systems: when to use them and what they cost

Front
Multi-agent: when is it justified?
Back
When the work is broad and parallel, or when separate windows or distinct tools and permissions matter. Otherwise it adds tokens (Anthropic reported about 15 times a chat for its research system), latency and failure modes.
Front
Workflow vs agent vs multi-agent?
Back
Workflow: predefined code path. Agent: the model directs its own steps. Multi-agent: several coordinating agents. Choose the simplest structure that meets the bar.
Front
Why do long agent chains fail more often than their steps suggest?
Back
Errors compound: with independent steps, success is p to the power n. Illustrative: 0.9 over 8 steps is about 0.43. Use shorter chains, checks and checkpoints.

Agent evaluation: state, trajectory, pass^k and release gates

Front
What to trace per agent step?
Back
Prompt version, chosen tool and arguments, result, tokens, latency, cost and errors: enough to replay a failure.
Front
pass@k vs pass^k, and which fits a one-shot agent?
Back
pass@k: at least one of k runs succeeds. pass^k: all k succeed. A one-shot agent needs pass^k, which exposes the run-to-run variance that pass@k hides.
Front
Why grade an agent by state, not by its final message?
Back
The message is a claim and can be false. Check the world afterwards (the database row, the passing tests, the file), then use trajectory metrics for cost and risk.

Guardrails, safety and prompt injection

Front
What is prompt injection?
Back
Text that changes what a model does in a way its operator did not intend. It can arrive through the user or through content the model reads.
Front
Core defence principle against prompt injection?
Back
Treat retrieved and tool-returned content as data, never as instructions, and assume some injections will still succeed, so limit what a hijacked model can do.
Front
Direct vs indirect prompt injection?
Back
Direct: the user's own input is the attack. Indirect: an innocent user's agent reads third-party content (web page, email, retrieved document, tool output) that carries hidden instructions.
Front
False positive vs false negative in a guardrail?
Back
False positive: a legitimate request is blocked. False negative: an attack passes. A stricter threshold trades one for the other, so set it by the cost of each failure.

Limiting blast radius and treating output as untrusted

Front
What is least privilege (privilege separation) for agents?
Back
Give each agent and tool only the tools, data and permissions the task needs, and keep read capabilities apart from write or send capabilities, so a successful attack has a small blast radius.
Front
When should an agent require human approval before acting?
Back
Before irreversible, high-value or external-facing actions such as payments, deletions, sending messages and publishing.
Front
What is the lethal trifecta?
Back
An agent that combines access to private data, exposure to untrusted content and the ability to communicate externally is at risk of data theft. Avoid having all three in one agent (Simon Willison, 2025).
Front
What is improper output handling?
Back
Passing model output to a browser, database, shell or other system without validating or encoding it. Prompts can steer output, so treat it as untrusted input (XSS, SQL injection, code execution).

Cost and latency optimization

Front
Sort these levers by what they improve: prompt caching, model routing, a provider batch API.
Back
Prompt caching cuts input cost and time to first token. Model routing cuts cost and often latency, at a quality risk. A batch API cuts cost only, in exchange for delayed results.
Front
Does streaming reduce total latency or cost?
Back
No. The first token reaches the user earlier, so it feels faster, but total generation time and the tokens billed are unchanged.
Front
How does provider prompt caching work, and how do you get cache hits?
Back
The provider reuses the computed state for an exact, identical prompt prefix, and reads cost a fraction of normal input price. Put static content (system prompt, tools, examples) first and variable content last. Output is unaffected.
Front
What is the risk of a semantic cache and how do you limit it?
Back
It can return an answer for a similar but different question, or across tenant or permission boundaries. Use a strict tuned threshold, scope keys by tenant and document version, set short TTLs and sample hits for review.
Front
Model routing or cascade: what is the saving and what must you check?
Back
Easy requests go to a small cheap model and hard ones escalate. Cost falls only if few requests escalate. Check quality per query type on a labelled set, because an unchanged average can hide a failing slice.
Front
Write the cost and latency formulas for one LLM request.
Back
Cost = input tokens x input price + output tokens x output price (plus cache terms). Latency = queueing + time to first token + output tokens / output speed. Measure which term dominates; it differs by workload.
Front
What do you measure before optimizing a slow or expensive LLM feature?
Back
Input and output tokens, time to first token, total time at p50 and p95, and cost per request, per stage and per tenant. Then optimize the dominant term.
Front
Why is max_tokens a weak way to make answers shorter?
Back
It cuts generation wherever the limit falls, even mid-sentence. Ask for a shorter format in the prompt (sentence or paragraph limits) and keep max_tokens as a safety ceiling.

LLM inference and serving

Front
Slow first token versus slow streaming: which metric and which cause?
Back
Slow first token is high TTFT, caused by queueing or long-prompt prefill. Slow streaming after a good start is high inter-token latency, caused by decode speed, memory bandwidth or batch pressure.
Front
The KV pool is full: what does the server do, and what does it cost?
Back
New requests queue, or the engine (vLLM, for example) preempts running ones and recomputes them later, which hurts end-to-end latency. Fixes: fewer KV-heads per request (GQA), a shorter context limit, KV quantization, more GPUs or replicas, or a lower concurrency cap.
Front
What do PagedAttention and continuous batching each do?
Back
PagedAttention stores the KV-cache in on-demand blocks to remove fragmentation, which allows larger batches and prefix sharing. Continuous batching schedules per decode step, so finished requests leave and new ones join immediately.
Front
Does speculative decoding change the output, and when does it help?
Back
No. The large model verifies the draft's tokens, so the output distribution is preserved (up to hardware numerics). It helps most at low to medium load, depends on the draft's acceptance rate, and adds a second component.
Front
What trade does chunked prefill make?
Back
It splits a long prompt so other users' decode steps keep running, which smooths their streaming. The cost is a somewhat slower first token for the long prompt. A smaller per-step token budget favors inter-token latency, a larger one favors TTFT.
Front
What does quantization buy and what does it cost?
Back
Fewer bytes per weight, so less memory and less to read per decode step (a 7B model is about 14 GB in 16-bit, about 7 GB in 8-bit). The cost is rounding error and hardware or kernel dependence, so test on your own eval set.
Front
Why can a self-hosted GPU cost more per token than an API?
Back
You pay for GPU hours whether or not they are busy, so cost per token is the hourly price divided by the tokens actually served. Low utilization raises it. Add redundancy and engineering time before comparing.
Front
What is goodput and why prefer it to throughput?
Back
A common definition is the rate of requests that meet the latency targets (for example TTFT and inter-token limits). DistServe uses a stricter variant: the highest rate at which a target share, such as 90 percent, meets both limits. Raw throughput can look high while many users get an unacceptable experience.

Observability and eval pipelines

Front
Why do LLM systems need an offline eval pipeline?
Back
Output varies and cannot be asserted with equality, and many parts change independently. A golden set run on every change catches regressions before users meet them.
Front
What do you record for each production LLM request?
Back
Trace id, prompt and model versions, inputs and outputs (privacy-safe), retrieved ids and scores, tokens, latency per stage, cost, outcome signals and errors.
Front
How do production failures feed back into the eval set?
Back
Sample traces (weighted toward thumbs-down, abstentions and escalations), label them, add them to the golden set with a slice tag after redaction, then gate future changes on the set.
Front
Why read golden-set results per slice?
Back
An average can rise while one slice collapses. Small sets are also noisy: with 100 cases near 90 percent the sampling noise is about 3 points, so one point is not a signal.
Front
What does online monitoring catch that offline eval misses, and the reverse?
Back
Online catches live outages, cost and latency shifts and drift in real traffic. Offline catches quality regressions, including rare intents, before release. Neither replaces the other.
Front
What privacy rules apply to LLM traces?
Back
They hold user text and company documents. Redact personal data and secrets, restrict access to full prompts, set retention and deletion, and apply the same rules before reusing traces in an eval set.
Front
Which alerts help for an LLM service and what are they compared with?
Back
Error and timeout rate, p95 latency per stage, cost per request, input token growth, abstention and empty-retrieval rate, feedback and sampled quality scores. Compare each with your own baseline, especially after deploys.

Production deployment of RAG

Front
What makes RAG ingestion safe to operate?
Back
It is idempotent (content-hash ids), incremental, propagates deletes with tombstones, and records the embedding model and chunker version on every chunk.
Front
How do you re-embed a corpus with zero downtime?
Back
Build a new index version in the background with the new model, run the eval gate, then swap the alias together with the query-side model. Keep the old version for a one-step rollback.
Front
How do you size a vector index?
Back
Raw size is vectors x dimensions x bytes per value (10M x 768 x 4 B is about 31 GB) before index overhead. That decides RAM versus disk, quantization and sharding. Shard for size, replicate for query rate.
Front
Why can output guardrails conflict with streaming?
Back
Streamed text is shown before it can be fully checked. Choose check-first (slower first token), stream-first (risk of showing unchecked text) or check in chunks.

RAG security, reliability and release

Front
Where do you enforce document permissions in RAG?
Back
At retrieval: store ACLs as metadata, filter by user or group at query time, and verify on the final context. Never rely on the prompt to hide data, and key caches on tenant, permissions and document version.
Front
Reranker is slow or down: what do you degrade first?
Back
Skip the rerank and serve hybrid retrieval results, a small known quality loss. Do not drop retrieval or permission filtering. If retrieval is empty or weak, abstain or ask a clarifying question.
Front
Order the release path for a RAG change (chunker, embedder, prompt, model).
Back
Offline eval gate on quality, latency and cost, then shadow traffic, then a small canary, then full rollout, with rollback through an alias or feature flag. Version every component.
Front
A user asks for their data to be deleted. Where must the deletion reach in a RAG system?
Back
Vectors, caches and logs, not only the source store. Check your legal requirements.
Front
Which parts of a RAG system do you version for release?
Back
Everything that can change behaviour: prompts, embedding model, chunker, index, reranker and LLM. Put changes behind feature flags so rollback is one switch.

Evaluating LLM systems

Front
Why can't a public benchmark pick your model?
Back
Contamination, saturation and domain mismatch. Use benchmarks to shortlist; decide on your product eval.
Front
How do you validate an LLM judge before trusting it?
Back
Label a sample by humans, compute Cohen's kappa against the judge (not raw percent agreement), report the label balance, and re-check periodically.
Front
Why can high percent agreement between judge and humans mislead?
Back
When one label dominates, guessing it already agrees often. With 95% passes, chance agreement is about 0.905, so 90% observed is no better than chance. Use kappa and look at the rare class.
Front
What is the difference between a dev set and a held-out set?
Back
Iterate on the dev set. Use the held-out set only to gate releases. Tuning against it turns it into a second dev set and its score stops meaning anything.
Front
What should you do before choosing evaluation metrics?
Back
Error analysis: read 50 to 100 real failing traces, sort them into failure categories, and measure the top categories.
Front
Why is a +3 point gain on 100 cases weak evidence?
Back
Sampling noise: at a pass rate near 0.8, one score is uncertain by roughly 8 points either way (illustrative). Compare variants paired on the same cases, with a bootstrap interval, or add cases.

Fine-tuning vs RAG vs prompting

Front
When is fine-tuning the right choice over RAG?
Back
When you need consistent style, format or behaviour at scale, have labelled examples, and prompting has hit its limit. Not for injecting facts or current knowledge.
Front
Does fine-tuning fix hallucination?
Back
Not by itself. It does not supply correct facts, and one 2024 study found hallucination rose as new facts were absorbed. Training on correct refusals can improve abstention (R-Tuning, NAACL 2024). Facts still need grounding via RAG.
Front
What does each lever change: prompting, RAG, fine-tuning?
Back
Prompting changes the instructions. RAG changes the information in the prompt at answer time. Fine-tuning changes the weights, to teach a consistent pattern of behaviour.
Front
Three things fine-tuning does poorly compared with RAG?
Back
Keeping facts current (needs retraining), giving citations (no source passage), and per-user access control (weights are shared by every user).
Front
What must exist before you start a fine-tune?
Back
Labelled examples, a strong baseline (best prompt, plus RAG if facts matter), an eval with a held-out set, a reason prompting cannot meet, and a plan to retrain when the base model changes.

Fine-tuning methods: SFT, LoRA, QLoRA and DPO

Front
Explain LoRA in two sentences.
Back
Freeze the weights W and learn a low-rank update B x A (rank r much smaller than d), a tiny fraction of the parameters. Adapters are small, swappable and mergeable into W.
Front
RLHF vs DPO?
Back
RLHF trains a reward model then optimises with RL. DPO trains directly on preference pairs with a classification-style loss: no separate reward model or RL loop, though it still uses a frozen reference model.
Front
How many trainable weights does a rank-r LoRA adapter add to a d x d layer?
Back
2 x d x r (A is r x d, B is d x r). For d = 4096, r = 8: 65,536, about 0.39% of the layer's 16.8 million weights.
Front
What does QLoRA add to LoRA?
Back
The frozen base is held in 4-bit (NF4) while adapters train in higher precision, with double quantisation and paged optimisers. It cuts memory a lot, with slower steps; check quality on your task.
Front
Which data does SFT use, and which does preference tuning use?
Back
SFT: prompt and ideal-response pairs. Preference tuning: a prompt with a preferred and a rejected response.

Fine-tuning data, risks and shipping

Front
A tuned model looks fine offline but worse in production. First suspect?
Back
A prompt-format mismatch: training used a different system prompt or chat template than production. Train on the exact serving format.
Front
Name four risks of fine-tuning.
Back
Forgetting (general abilities regress), overfitting (memorises training examples), safety regression (weaker safety behaviour, even with benign data) and leakage (training data overlaps your evals).
Front
What do you compare a fine-tuned model against before shipping?
Back
The base model with the best prompt, plus RAG if facts matter. If the tune does not clearly beat that baseline, stay with the baseline.
Front
What do you need in place so a bad adapter can be reversed quickly?
Back
Adapters versioned together with their data and hyperparameters, a canary release, and a rollback path to the previous adapter or the base model.
Front
What is decontamination and why does it matter?
Back
Removing training examples that overlap your eval data. If they overlap, the scores measure memorisation and mean little.

Designing a RAG QA system

Front
In a permission-aware RAG system, where does the permission filter belong?
Back
Inside the retrieval query, using allowed groups stored as chunk metadata, so restricted text never reaches the prompt. Never ask the model to withhold something it was already shown.
Front
What should a RAG system do when the retrieved evidence is weak?
Back
Compare the best reranked score with a threshold tuned on unanswerable questions, and say it found nothing instead of generating a confident guess.
Front
Why might hybrid (keyword plus vector) search beat vector-only search?
Back
Vector search matches meaning but can blur exact strings such as error codes and product names; keyword search matches those exactly. The cost is a second index to keep in sync.
Front
Name degraded modes for a RAG system.
Back
Retriever down: keyword-only search. Reranker down: serve hybrid results. LLM down: fallback model or cited snippets only. Stale index: freshness warning, or refuse for sensitive sources.
Front
How do you estimate raw vector storage?
Back
Chunks × dimensions × bytes per value. Example: 2,000,000 × 1,024 × 4 bytes is about 8.2 GB before index overhead (illustrative numbers).
Front
In a typical RAG query, what dominates cost and what does a retriever cost?
Back
The LLM call dominates: retrieved chunks make up most of the input tokens. Retrieval and embedding are small by comparison, so cutting top-k is a first lever (and a quality trade).
Front
How do you close permission sync lag and cache leaks?
Back
Re-check the final few chunks against the source system before building the prompt, and key any answer cache on the user's permission set.

Designing an agent product

Front
Why does agent cost grow faster than the number of steps?
Back
Each step is a model call that re-reads the growing history. With a 2,000-token base and 800 tokens added per step, 6 steps send 24,000 input tokens, not 12,000 (illustrative).
Front
Which controls make an irreversible agent action safe?
Back
Approval of the exact action, spend and rate limits, idempotency keys, audit logs, compensation where an undo exists, and least-privilege credentials.
Front
How do you assign autonomy to an agent's tools?
Back
By worst case: read runs freely, reversible writes run and can be undone, irreversible or external actions need approval, and the most dangerous tools do not exist.
Front
A payment call times out after possibly charging. What does the executor do?
Back
The executor retries with the same idempotency key it created, so a charge that happened is returned, not repeated. If keys may have expired or the provider lacks support, look up by your own reference first. A new key means a new charge.
Front
What is compensation in a multi-step agent task?
Back
A cancelling action for each side-effecting step (cancel the hotel), run in reverse order when a later step fails. Actions with no undo need approval first.
Front
How do you grade an agent that says it finished?
Back
Check the final state in the system of record (was the user charged once?), plus trajectory and consistency across repeated runs, not the agent's own claim.

Designing content moderation and guardrail systems

Front
What layers can a moderation system combine?
Back
An input classifier, a policy prompt, an output check, a human review lane, and logging with appeals. They are a menu chosen by risk, not one fixed order.
Front
Is the moderation precision and recall threshold a technical or business decision?
Back
Business: engineering supplies the counts of both error types, and the product owner and policy team choose the point, per category, from the product's risk.
Front
Serial, windowed or parallel output moderation?
Back
Serial (buffer then release) for severe harm, windowed streaming for mixed risk, parallel with retraction for low severity. Streamed text cannot be un-shown.
Front
Why are most blocks false positives when violations are rare?
Back
When the false-positive rate is not far below the base rate, the false positives outnumber the true catches. Example: 4,500 caught versus 9,950 honest blocked is 4,500 / 14,450, about 31% precision (illustrative).
Front
What is shadow mode in moderation tuning?
Back
Run a new threshold or classifier on live traffic, record what it would do, act on nothing, and compare with labels. Sample near the threshold, because random samples of passed traffic hold almost no misses.
Front
How do you size the human review lane?
Back
Items in the borderline band per day divided by one reviewer's daily capacity, rounded up. 2,000 items at 960 per reviewer per day is 2.08, so 3 reviewers.

RAG interview drills and mock

Front
Five things to volunteer in a GenAI system design answer?
Back
Permission-filtered retrieval, an abstain path, a cost and latency budget, an evaluation and observability plan, and guardrails against injected content.
Front
What do you do in the first five minutes of a GenAI design answer?
Back
Clarify users, scale, latency target, accuracy bar, cost ceiling and permissions; state assumptions and name what is out of scope.
Front
Quick pattern for a token-cost estimate?
Back
(Input tokens × input price + output tokens × output price) × requests per day; then name the lever that cuts it most and its quality cost.
Front
How do you evaluate a design before launch?
Back
A golden set with unanswerable cases, retrieval and generation metrics scored separately, a red-team for injection and leaks, a load test of p95, and shadow traffic.
Front
What breaks first at 10 times scale?
Back
It depends on what grows. More chunks hit index memory; more queries hit LLM rate limits and cost; more updates hit ingestion throughput. Recompute the changed number first.
Front
What is the senior-level differentiator in a design round?
Back
Raising failure modes, limits and trade-offs without being asked, and tying choices to numbers or metrics.
Front
How do you respond when the interviewer changes a constraint?
Back
Restate it, name the earlier number it changes, recompute that number, then say which component changes and what the change costs.

Coding, project defense and mock rounds

Front
What do you do when asked for a number you never measured?
Back
Be honest that it is unmeasured, separate a target from a result, and name the measurement you would add, such as a per-stage trace.
Front
When does a rank-1 document from one list beat a document with the same rank in both?
Back
With k = 60, when that shared rank r is above 62: 1/61 beats 2/(60 + r). At r = 62 they tie. Fusion rewards agreement but does not guarantee it wins.
Front
Can a document in only one list beat a document in both lists under RRF?
Back
Yes. With k = 60, first in one list scores 1/61 = 0.0164, while 70th in both scores 2/130 = 0.0154. Agreement helps, but it does not override a very weak rank.
Front
How do you label a number in a project defense?
Back
Measured, estimated or unknown. For an unknown, say so and name the measurement you would add.
Front
Four behavioural stories to prepare for a GenAI role?
Back
A quality regression you diagnosed, a latency versus quality trade-off, a time you pushed back on an LLM where something simpler worked, and a time you managed expectations about hallucinations.
Front
What are the three mock rounds?
Back
Round 1: questions (Drills A and B). Round 2: an unseen design prompt (Drill C). Round 3: project defense plus coding (Drills D and E).