Alignment is not a security boundary because training only shapes what a model tends to do. A boundary is a control an attacker cannot talk their way past.
Safety behavior lives in the same weights that read attacker text, so persuasion is a valid attack path.
Training gives a probability, not a rule. Refusal rates are never 100%, and attackers retry cheaply.
Real boundaries sit outside the model: scoped credentials, allowlisted tools, sandboxes. Alignment filters casual misuse. Assume alignment fails.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Saved in this browser - sign in to keep your review list.
How should your speech become text?
Listening… your words appear above as you speak - tap Stop when you're done.
Recording · cr - tap Stop & transcribe when you're done.
Transcribing with AI…
Voice:
Keep going - a few more words and AI can grade it.
Interview lens
How interviewers actually use this question
Likely follow-ups
If alignment can fail, why bother investing in it at all?It filters casual misuse and cuts harmful output for ordinary users. Treat it as one layer that raises attacker cost, never the one you rely on.
Refusals hold 99% of the time in your tests. Why is that still not good enough?Attackers retry cheaply and automate. Small odds per attempt add up over many tries, so the rate only slows a determined attacker.
Alignment training shapes what a model tends to do, but a security boundary is a control an attacker can't talk their way past, and alignment doesn't meet that bar.
The safety behavior lives in the same weights that read the attacker's text. So persuasion is a valid attack path, because the attacker is talking straight to the thing enforcing the rules.
Training gives you a probability, not a rule. Refusal rates are never 100%, and attackers can retry cheaply until one attempt gets through.
So I put the real boundaries outside the model: scoped credentials, allowlisted tools, and sandboxes that still hold when the model is fully persuaded.
Alignment is still useful because it filters out casual misuse, but I design the system assuming it will fail.
Weak answers to avoid
Says better training will eventually fix itTraining only shifts probabilities in the same weights the attacker talks to. Say refusal rates never reach 100% and put the hard limits outside the model.
Treats the system prompt as the boundaryA system prompt is just more text the model weighs against the attacker's text. Name controls outside the model, like scoped credentials and sandboxes.
Dismisses alignment as uselessAlignment does filter casual misuse. The point is to keep it as one layer and never rely on it to stop a determined attacker.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
