How do attributes work in C#? Explain what the compiler stores in metadata, when attribute instances are actually created, AttributeUsage (targets, AllowMultiple, Inherited), allowed argument types, generic attributes (C# 11), attributes the compiler itself acts on, and caller information attributes including CallerArgumentExpression.

How I would answer this in an interview

Attributes attach declarative metadata to code elements (assemblies, types, members, parameters, return values). The compiler serialises attribute constructor arguments and named properties into the assembly's metadata; at run time, attribute objects are only created when someone asks for them via reflection. Some attributes are consumed by the compiler itself rather than at run time. I'd cover storage, instantiation, AttributeUsage, allowed argument types, generic attributes, compiler-recognised attributes and caller information attributes.

1. What the compiler stores

[Audited("orders", Level = AuditLevel.Full)]
public sealed class OrderService { ... }

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
public sealed class AuditedAttribute(string category) : Attribute
{
    public string Category { get; } = category;
    public AuditLevel Level { get; init; } = AuditLevel.Basic;
}

In metadata, the CustomAttribute table stores: the target, the attribute constructor, and a blob encoding the constructor arguments ("orders") and named arguments (Level = Full). No object exists yet — it's just data in the DLL.

2. When attribute instances are created

Only when code calls reflection APIs like GetCustomAttributes, GetCustomAttribute<T>(), Attribute.GetCustomAttributes(...):

• The runtime deserialises the blob, runs the attribute constructor, and sets named properties — every call creates new instances (attributes are mutable objects, so they aren't shared).
• That's why you should cache results, and use IsDefined(typeof(T)) when you just need to know if an attribute exists (cheaper, no instance).
• Exceptions in an attribute constructor surface at reflection time, not at load time.

Frameworks (ASP.NET Core routing/auth, EF Core configuration, xUnit, System.Text.Json) read attributes at start-up or first use and cache the results.

3. AttributeUsage

Note: Inherited affects classes and overridden methods/properties; it doesn't apply to interface implementations or to properties when using GetCustomAttributes on PropertyInfo (a long-standing quirk — use Attribute.GetCustomAttributes(memberInfo, inherit: true) for properties/events).

4. Allowed argument types

Attribute constructor and named arguments must be compile-time constants of these types: bool, byte, char, short, int, long, float, double, string, System.Type, enums, object (holding one of these), and single-dimensional arrays of them. Not allowed: decimal, DateTime, Guid, arbitrary classes, nullable value types, lambdas. That's why you see [Range(typeof(decimal), "0", "100")]-style string workarounds.

5. Generic attributes (C# 11)

public sealed class ValidatorAttribute<TValidator> : Attribute where TValidator : IValidator { }

[Validator<CreateOrderValidator>]
public sealed record CreateOrder(...);

Before C# 11 you'd write [Validator(typeof(CreateOrderValidator))] and lose compile-time checks of the type. Generic attributes give type safety and constraints. Type arguments must be fully known (no open type parameters from the enclosing context).

6. Attributes the compiler itself acts on

Some attributes change compilation, not runtime behaviour:

• [Obsolete("Use X", error: true, DiagnosticId = "ABC001")] — warnings/errors at call sites.
• [Conditional("DEBUG")] — calls to the method are removed when the symbol isn't defined (including argument evaluation).
• [CallerMemberName], [CallerFilePath], [CallerLineNumber], [CallerArgumentExpression] — compiler fills in arguments.
• Nullable analysis attributes: [NotNullWhen], [MemberNotNull], [DoesNotReturn]...
• [MethodImpl(MethodImplOptions.AggressiveInlining)] (JIT hint), [SkipLocalsInit], [StructLayout], [FieldOffset] (layout), [ModuleInitializer], [InterpolatedStringHandler], [OverloadResolutionPriority] (C# 13), [Experimental] (C# 12).
• Source generators are often triggered by attributes ([JsonSerializable], [LoggerMessage], [GeneratedRegex]).

7. Caller information attributes

public static void Require(bool condition, [CallerArgumentExpression(nameof(condition))] string? expr = null,
                           [CallerMemberName] string member = "", [CallerLineNumber] int line = 0)
{
    if (!condition) throw new InvalidOperationException($"Requirement failed: {expr} in {member} at line {line}");
}

Require(order.Lines.Count > 0);   // message: "Requirement failed: order.Lines.Count > 0 in Submit at line 42"

• The compiler substitutes constants at the call site — zero runtime cost, no stack walking.
• [CallerArgumentExpression] (C# 10) powers ArgumentNullException.ThrowIfNull(x) (parameter name "x") and assertion libraries.
• [CallerMemberName] is used for INotifyPropertyChanged (OnPropertyChanged() gets the property name).

8. A production example

An authorisation layer read custom [RequiresPermission("orders:write")] attributes on every request via GetCustomAttributes, allocating attribute instances per call and showing up in allocation profiles. Caching permissions per endpoint at start-up (via endpoint metadata in ASP.NET Core, which already caches attributes) removed the overhead. We also switched to a generic [RequiresPolicy<OrdersWritePolicy>] attribute so policy types were checked at compile time.