Designing input and output guardrails for a chatbot

WHAT THIS TESTS The interviewer wants a defense-in-depth design, not reliance on a single instruction line. Guardrails wrap the model so that even a compromised or misbehaving model cannot send unsafe content to a customer.

A GOOD ANSWER COVERS Treat the LLM as an untrusted component and place independent checks on both sides. Input-side mechanism: before the prompt reaches the model, run validators. A moderation or toxicity classifier flags abusive input, a prompt-injection detector catches attempts to override instructions, a topic classifier rejects out-of-scope requests, and a PII detector redacts sensitive data the user pasted. Depending on the verdict, block, sanitize, or route to a canned response. Output-side mechanism: after generation but before the user sees it, validate the response. Run a toxicity and safety classifier, check for leakage of secrets, system prompts, or other users' data, enforce format and policy constraints, and for RAG verify groundedness against retrieved context to catch hallucinations. On failure, regenerate, return a safe fallback, or escalate to a human. Add logging and rate limiting for observability and abuse control. The principle is that guardrails are deterministic, auditable code paths separate from the model's own reasoning.

COMMON WRONG ANSWERS Relying solely on system-prompt instructions, which jailbreaks bypass. Putting checks only on output and ignoring malicious input. Using the same model with no independent validator, so one failure compromises everything.

LIKELY FOLLOW-UPS What is the latency cost, classifiers add milliseconds; parallelize where possible. How do you handle false positives, tune thresholds and offer appeal paths. How do you keep guardrails updated, retrain classifiers on new attacks.

ONE CONCRETE EXAMPLE A user pastes a prompt-injection payload telling the bot to reveal its system prompt. The input detector flags the injection and strips it; even if it slipped through, the output guardrail detecting system-prompt leakage blocks the response before it reaches the customer.