AI Engineering Interview Questions: Evaluation, Safety & Hallucination

RAG significantly reduces hallucinations by giving the model access to relevant retrieved context, but it does not completely eliminate them. The model can still hallucinate by misinterpreting retrieved documents, generating statements not supported by the retrieved text, or failing to retrieve the right documents in the first place. RAG is a mitigation strategy, not a guaranteed cure.

In the RAGAS framework, 'faithfulness' measures the fraction of claims in the generated answer that are grounded in the retrieved context — a low score signals hallucination. 'Answer correctness' (the canonical top-level metric in ragas ≥ 0.1.x) evaluates how well the generated answer matches the ground-truth answer by blending factual correctness (an F1-style overlap of claims) with semantic similarity; it subsumes what earlier discussions called 'answer recall' as a component rather than a standalone metric. These two metrics are complementary: faithfulness guards against unsupported claims, while answer_correctness guards against missing or wrong facts relative to the ground truth.

High accuracy on a single test set does not guarantee production safety. The test set may not be representative of real-world inputs, the classifier may have blind spots for underrepresented demographic groups, and accuracy alone can mask severe class-imbalance issues (e.g., flagging very few inputs as toxic). Additional evaluation — such as subgroup fairness analysis, adversarial testing, and monitoring for drift — is required before deployment.

When an LLM generates plausible-sounding but factually incorrect content that is not grounded in any source — such as fabricating citations — this is called hallucination. Catastrophic forgetting refers to a model losing old knowledge after fine-tuning; distributional shift is a mismatch between training and inference data distributions; prompt injection is a security attack where adversarial instructions override system prompts.

RAG grounds the model's answer in retrieved documents, making fabrication easier to detect and less likely. Citation verification is a downstream check that catches invented references. Self-consistency (sampling N outputs and voting) exposes answers that are inconsistent across samples, a signal of low-confidence or hallucinated content. Increasing temperature makes outputs more random and typically worsens hallucination. Swapping softmax for sigmoid in the output layer is an architectural change unrelated to hallucination mitigation.

BLEU (Bilingual Evaluation Understudy) is an n-gram overlap metric originally designed for machine translation. It measures surface similarity between generated text and reference text — not factual accuracy or groundedness. A model can score highly on BLEU by parroting fluent, reference-like phrasing while still hallucinating facts. Hallucination evaluation requires dedicated fact-checking metrics (e.g., FactScore, BERTScore with NLI, or human annotation), not BLEU.

Recall = TP / (TP + FN), measuring the proportion of actual harmful prompts that the classifier correctly blocks. When false negatives are the dominant cost, maximizing recall directly minimizes the rate of harmful prompts that slip through. Precision focuses on false positives (lower priority here), accuracy is dominated by the large class of benign prompts and can mask poor harmful-prompt detection, and F1 weights precision and recall equally rather than reflecting the asymmetric cost structure.

Red-teaming is the standard term for adversarial probing of LLMs. Testers (human or automated) attempt to bypass safety guardrails using techniques like jailbreaks, prompt injections, and edge-case inputs. The goal is to surface failure modes before real users encounter them, then use the findings to improve alignment, filters, or system prompts. This contrasts with benign evaluation, which tests standard capability and quality on representative — not adversarial — inputs.

RAG with source attribution grounds claims in retrieved evidence, making it straightforward to verify and reduce fabricated facts. Self-consistency sampling exploits the intuition that a model that truly 'knows' an answer will produce consistent outputs; large variance signals uncertainty/hallucination. NLI-based factual consistency scoring (e.g., using a model like TRUE or MiniCheck) directly tests whether the generated text is entailed by a reference, making it a standard hallucination-detection approach. Raising temperature increases randomness/diversity but generally worsens hallucination rather than controlling it. Expanding the tokenizer vocabulary addresses out-of-vocabulary token coverage, not factual faithfulness.

The pipeline must first retrieve the grounding passages (a), then generate the response using them (b). The response is then decomposed into atomic claims (c) so that fine-grained verification is possible—evaluating the whole response at once makes it hard to pinpoint which parts hallucinate. Each atomic claim is then checked against the retrieved passages via an NLI model (d), following the approach used in systems like RAGAS or FActScoring. Finally, the individual verdicts are aggregated into a faithfulness metric and a pass/fail threshold is applied (e). This order is canonical in modern RAG evaluation frameworks.

The intrinsic/extrinsic taxonomy (introduced in the survey by Ji et al., 2023 and widely adopted) is fundamental to hallucination evaluation design. Intrinsic hallucinations are objectively falsifiable because the source text contains contradicting evidence — these are easier to detect automatically with NLI models. Extrinsic hallucinations are harder to catch because they neither appear in nor contradict the source; they require external knowledge or world-model checks. Understanding this distinction guides which evaluation metrics and mitigation strategies are appropriate.

Option (b) is correct because a held-out, independently curated test set with novel attack vectors avoids both data contamination and overfitting to the training distribution, giving a genuine estimate of generalization to unseen harmful inputs. Option (a) reuses training data, so the model has already been optimized on those exact prompts — good performance there reflects memorization, not robustness. Option (c) risks benchmark contamination: if the public benchmark was seen during pre-training or fine-tuning, scores are inflated and regressions on truly novel prompts would be missed. Option (d) measures over-refusal of benign requests, which is a complementary safety metric but tells you nothing about whether harmful requests are actually refused.

Red-teaming is the standard term for adversarially probing an LLM to surface safety failures before deployment. It borrows the cybersecurity concept of a 'red team' that simulates attacks. In practice, red-teams craft jailbreaks, prompt injections, and socially engineered requests to measure attack success rate (ASR) and identify guardrail weaknesses. The accept list covers the hyphenated, spaced, and standalone variants since all are in common use.

Faithfulness (a), attribution/citation recall (c), and NLI-based entailment (e) all directly ask: 'Is the model's claim supported by the retrieved context?' — the core definition of groundedness. ROUGE-L (b) measures lexical overlap against a reference answer, not against the retrieved context, so it detects recall-style quality, not hallucination relative to sources. Perplexity (d) is a language-modelling metric that has no connection to retrieval grounding whatsoever. A system can have low perplexity and still hallucinate facts not in any retrieved passage.

Self-Consistency (Wang et al., 2022) leverages the intuition that correct reasoning paths tend to converge. For hallucination detection, inconsistency across samples is a useful uncertainty signal. However, the critical failure mode is systematic hallucination: if incorrect knowledge is strongly encoded in model weights, all sampled paths will agree on the wrong answer, yielding high consistency but a hallucinated output. This 'confident but wrong' failure is why self-consistency alone is insufficient for hallucination mitigation without external grounding.

The defensible order is: (a) Pre-deployment red-teaming establishes the baseline hallucination rate and determines whether the system is ready for production — this is the very first lifecycle step. (b) At runtime, RAG retrieval fires first when a user query arrives: the system must fetch relevant documents before it can compose a meaningful grounded prompt. (c) Prompt assembly with the grounding instruction comes next — only after the retrieved documents exist can they be injected alongside the system instruction into the final prompt sent to the LLM; the instruction explicitly references 'the provided context,' so it is necessarily assembled after retrieval. (d) Once the LLM generates a response, a post-generation NLI faithfulness check verifies claims against the retrieved sources and flags low-scoring outputs. (e) Only after automated checks flag a response is it escalated to a human reviewer — the most expensive layer and therefore the last resort in the funnel.

Hallucination drops when the model is anchored to real evidence: retrieval-grounding with an instruction to answer only from context (a) constrains it to supported claims. An explicit "I don't know" escape hatch (b) gives the model a correct option other than fabricating, which it otherwise tends to avoid. Citation + verification (c) turns grounding into something you can check, catching claims that aren't actually supported. Raising temperature (d) increases randomness and makes confident fabrication more likely, not less. A bare instruction to "never hallucinate" (e) is wishful — the model has no reliable internal signal of its own factuality, so an unenforceable command doesn't change behavior in a measurable way; grounding and verification do.

RAG reduces hallucination by grounding answers in retrieved context, but it does not eliminate it. The model can still ignore the context, blend it with parametric knowledge, mis-attribute a fact to the wrong source, or confidently extrapolate when retrieval returns nothing relevant. Production RAG needs grounding guardrails — instruct the model to answer only from context and say "I don't know" otherwise, require citations, and run faithfulness/groundedness evals to catch ungrounded claims.

Treat prompts like code: a versioned eval dataset with deterministic checks plus an LLM judge for subjective dimensions, run on every change so you catch regressions instead of guessing. LLM judges are useful but biased — they reward verbosity, drift between runs, and can prefer their own family's outputs — so anchor the judge to human-labeled examples, use a strict rubric, and keep its temperature low. Eyeballing a handful of outputs is not evaluation.

SelfCheckGPT (Manakul et al., 2023) exploits the observation that a model is more consistent across samples when it 'knows' a fact, making consistency a cheap hallucination proxy. Chain-of-Verification (Dhuliawala et al., 2023) forces the model to self-audit its claims via targeted sub-questions, catching internal contradictions. NLI-based attribution scoring directly checks whether each generated claim is textually entailed by retrieved evidence — the gold standard for RAG attribution. Semantic entropy (Kuhn et al., 2023) measures uncertainty at the meaning level, not the surface level, and correlates strongly with factual errors. Option C is incorrect: token-level perplexity reflects how surprising a sequence is to the model, but low perplexity can coincide with confident hallucinations (the model is confidently wrong), and the relationship is not reliable enough to use as a standalone factuality filter, especially with fine-tuned or RLHF-trained models whose perplexity distributions shift considerably.

The core insight of Semantic Entropy is that language models can express one concept in many surface forms. Naive entropy over token sequences penalizes the model for linguistic diversity even when it is factually certain, leading to false positive hallucination flags. By clustering semantically equivalent generations (via NLI or dense embeddings) and computing entropy over those clusters, Semantic Entropy isolates epistemic uncertainty (does the model know the answer?) from linguistic variability (how many ways can it phrase the answer?). This distinction is critical in production RAG systems where the model may be paraphrase-diverse but factually consistent.

The pipeline must start by collecting the model's raw outputs (F). These are then decomposed into atomic claims (A) so that attribution can be evaluated at the finest verifiable granularity — doing this at the paragraph level would conflate supported and unsupported claims. For each atomic claim, relevant evidence must be retrieved (B) before any inference can be drawn. The NLI model (C) then evaluates whether the retrieved evidence entails, contradicts, or is neutral to the claim. Individual claim labels are aggregated (D) into a scalar or structured response-level score. Finally, the score threshold is calibrated (E) against a gold human-annotation set so the detector operates at a meaningful precision/recall point for the target deployment context. Calibration must come last because it depends on having a complete scoring function and human-labelled ground truth.

Faithfulness measures only that every claim in the answer is supported by the retrieved context — i.e. the model didn't fabricate beyond its evidence. It says nothing about whether that context was the right or complete evidence, nor whether the answer is on-topic. A perfectly faithful answer can still be (1) irrelevant — faithfully summarizing the wrong passages instead of answering the question (low answer relevance), or (2) incomplete or wrong — faithful to context that was itself missing the key fact because retrieval failed (low context recall). That's exactly why RAGAS-style evals score faithfulness alongside answer relevance and the retrieval metrics, instead of trusting any single one.

Triage moves from the coarse signal to the atomic cause: isolate the cohort (time window, model version, experiment arm) from traces so you are not analysing noise; find the stage where the failure is concentrated — retrieval misses and generation errors need different fixes; classify the failure mode by sampling actual bad completions, because the same symptom can have multiple causes; reproduce locally to confirm the root cause in a controlled environment before writing any fix; and verify the fix in production by confirming the alert clears — a fix that only passes local evals but leaves the alert firing means something else is wrong.

(a) is correct: when the judge and the model-under-test share training data and architecture, they tend to have correlated failure modes — content that the model produces unsafely is also content the judge fails to flag as unsafe. This is a well-documented concern in LLM-as-judge safety evaluation. (b) is correct: static curated eval sets cannot cover the full distribution of production inputs, and novel adversarial techniques (multi-turn jailbreaks, encoding tricks, persona-based attacks) that emerge after the eval set was created will not be caught. (c) is correct: single-turn evaluation misses multi-turn attack patterns where each individual turn appears benign but the conversation trajectory progressively erodes the model's safety guardrails — a known limitation of single-turn safety benchmarks. (d) is incorrect: lowering the judge's temperature to 0 makes its scoring deterministic but does not guarantee correctness. A temperature-0 judge can still systematically fail to identify unsafe content due to capability gaps, prompt-engineering flaws, or shared blind spots with the model under test — temperature controls sampling stochasticity, not accuracy. (e) is correct: benchmark contamination is a well-recognized problem. If the model saw the exact safety test prompts during pretraining, it may learn to refuse those specific strings without generalizing the underlying safety principle, causing inflated eval scores that don't reflect robustness to paraphrased or restructured variants of the same attack.