Your training data comes partly from user submissions. How do you defend against data poisoning?
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said — including whether you asked about the data before naming a model.
A marketplace trains its spam-listing classifier on listings that users report, plus the outcome of moderator review. A group of sellers has discovered that mass-reporting a competitor's listings, and creating many innocuous listings with a distinctive phrase and then reporting their own, shifts the model. The retraining job runs nightly and promotes automatically if the offline metric holds.
What it is really testing
Whether the candidate can describe the attacker's route — labels and examples that the attacker controls, entering an automated retraining loop — and defend it at the points that matter: provenance and weighting of labels, anomaly detection on training-set changes, holdout sets the attacker cannot touch, and a promotion gate that a human or a canary can stop.