Distilled Prep
Distilled Prep — Prep sheet — printed — distilledprep.com

Build a prep sheet

Filter to your target company and role, then print this page — it's print-styled as a clean one-pager.

Uber · SWE ·

A concert ends and demand in a few city blocks jumps 20x in minutes. Design the platform that keeps pricing, ETAs, and trip requests reliable through spikes like this.

Systems design · stream-processing · distributed-systems§
Practice against the follow-up probes
  • Where exactly does 20x-in-one-neighborhood stress a system that handles the whole city fine?
  • What must stay strongly consistent during a surge, and what can be seconds stale?
  • Thundering herd: every app in the venue refreshes at once. What absorbs it?
  • How do you prevent duplicate trip creation when users rage-tap through timeouts?
  • What load do you shed first, and how do users experience degradation?
Show answer guide
Also: reliability, geospatial

What the interviewer is probing

Hot-partition reasoning: geographic sharding concentrates a local spike onto a handful of shards/keys, so the answer is absorbing structures — caching with request coalescing, aggregation before fan-in, backpressure, and tiered shedding — plus consistency judgment (prices shown can be stale-bounded; the price committed to a trip must be exact) and idempotency under retry storms.

Strong answer outline

  • Identify the hot spots: the venue's geo-cells become hot keys in every layer — location ingestion, demand aggregation, pricing reads, matching. City-scale capacity doesn't help; per-key throughput does.
  • Ingestion/aggregation: driver/rider events flow through a partitioned log keyed by cell; pre-aggregate demand/supply counts at the edge of the pipeline (windowed counts, not raw events, cross the network); pricing recomputes per cell on a short cadence — by design a rate-limited consumer, immune to input spikes.
  • Read path: surge multipliers and ETAs served from replicated caches with short TTLs and request coalescing (one recompute per cell per tick, thousands of readers share it); app refresh jitter and client-side backoff flatten the herd; static fallbacks (last-known multiplier with staleness cap) if the pricing service lags.
  • Consistency split: displayed price/ETA — bounded staleness (seconds) is fine; committed trip price — locked at request time: the trip creation transaction snapshots the quote (signed/versioned), so a surge tick between tap and commit never surprises the rider or the ledger.
  • Duplicate protection: trip creation is idempotent (client-generated request key, atomic check-and-create); rage-taps and retries collapse to one trip; offers to drivers similarly idempotent.
  • Shedding order and UX: drop analytics/telemetry first, widen ETA refresh intervals, coarsen pricing granularity (cell → zone), queue match requests with honest wait messaging — never drop committed trips or corrupt pricing; capacity signals (queue depth, cache hit-rate, per-cell RPS) drive automation and dashboards.

The underlying concept

Geographic load is power-law bursty, and sharding by geography converts a citywide non-event into a per-key crisis — so spike architecture is about absorption: aggregate early (turn N events into one count), coalesce reads (turn N queries into one compute), backpressure producers, and shed along an explicit value ladder. The consistency principle is asymmetric like every marketplace's: advertisements may be stale within bounds, commitments must be exact and idempotent — and the commit point is where the system snapshots truth. Graceful degradation is designed, not discovered: decide in peacetime what fails first.

Source

Distilled Prep canon — curated from Uber's public work on surge infrastructure and real-time marketplace reliability.

Source: Uber engineering blog

Uber · MLE · SWE ·

Design the real-time dispatch and matching system that pairs riders with drivers in a dense city — from request to accepted match in under a few seconds.

ML system design · geospatial · ml-platform§
Practice against the follow-up probes
  • What are you optimizing, exactly? Nearest driver is the naive answer — what's wrong with it?
  • Why batch requests into matching windows instead of matching greedily?
  • What does the geospatial layer need to do, and how do you index a world of moving points?
  • Locations are stale and GPS is noisy. Where does that bite, and what absorbs it?
  • How do you evaluate a new matching policy before risking a city on it?
Show answer guide
Also: logistics-optimization, scalability

What the interviewer is probing

Whether the candidate sees dispatch as a global optimization under latency constraints: greedy nearest-match is locally fine and globally wasteful (assigning a driver to rider A can strand rider B), which is why systems batch into short windows and solve assignment problems. Plus the systems substrate — geospatial indexing of moving objects, staleness tolerance, and simulation-first evaluation for changes too risky to A/B naively.

Strong answer outline

  • Objective: multi-term — rider wait (ETA to pickup), completion probability (acceptance/cancel behavior), driver utilization and earnings fairness, and system efficiency; nearest-driver ignores future demand, driver heading, acceptance likelihood, and the opportunity cost of assignments.
  • Batched matching: accumulate requests/supply over a short window (seconds) per area, then solve a bipartite assignment (Hungarian- style or min-cost flow with predicted-ETA edge weights and behavior- adjusted scores); batching converts myopic greed into near-global optima at negligible added wait.
  • Candidate generation + scoring: geospatial index (hexagonal grid cells) maintains driver presence per cell with in-memory, sharded state; candidates from expanding cell rings; scores from real-time features (road-network ETA, driver state, acceptance model) served within tight budgets.
  • Noise and staleness: map-match GPS to the road network; treat locations as estimates with age — score with uncertainty, re-check on offer; retries/declines re-enter the next window; idempotent offer protocol so network flakiness never double-books a driver.
  • Reliability: shard matching by geography (city/region cells) for blast-radius containment; degraded mode falls back to simpler greedy matching locally rather than failing requests; surge events handled by backpressure on window size.
  • Evaluation ladder: offline simulation replaying historical supply/demand under the new policy (the workhorse — marketplace interference makes naive A/B misleading); then switchback experiments in live cities; guardrailed rollout with automatic rollback on wait/cancel regressions.

The underlying concept

Matching markets punish myopia: each assignment consumes shared supply, so sequential greedy decisions compound into global waste — batching into windows recreates a small assignment problem where optimization is tractable, trading milliseconds of wait for system-wide efficiency. The engineering mirror: moving-object geospatial state wants cell-sharded in-memory indexes, and every distributed step must tolerate stale inputs and retries by design. Evaluation completes the lesson — when treatment units share a marketplace, simulation and switchbacks replace unit-level A/B as the honest instruments.

Source

Distilled Prep canon — curated from Uber's public work on dispatch, matching, and marketplace systems.

Source: Uber engineering blog

Uber · DS · MLE ·

You run growth marketing at a large ride-sharing and delivery marketplace. You have millions of eligible drivers and couriers, hundreds of concurrent incentive programs (sign-up bonuses, streak rewards, quest challenges), and a set of team-level quarterly budgets — one per line of business — that are hard caps. Your current approach is first-come, first-served: whichever incentive program registers a user first wins, and budget is managed manually at the end of each period.

You've been asked to design a system that replaces this with an optimized, automated allocation: given predicted uplift per user-incentive pair from your ML models, select which incentive to assign to which user (or no incentive at all) to maximize total predicted ROI across all lines of business without violating any team's budget.

Walk me through the optimization formulation, the solver you'd choose at this scale and why, and how you'd keep spend inside hard quarterly budgets when your cost predictions drift.

ML system design · logistics-optimization · marketplace-dynamics · Jul 2026§
Practice against the follow-up probes
  • Your uplift models give you predicted ROI, but ROI for a delivery incentive might cannibalize ride bookings for the same driver. How do you represent and optimize for net marketplace impact rather than siloed metric gains?
  • Budgets are quarterly, but you're running assignments daily or weekly. How do you pace spend so you neither blow the budget in week one nor leave 40% unspent in week twelve?
  • You originally modeled costs as time-series curves over each incentive's duration, but that caused the solver to time out. What went wrong, and what trade-off did you make to fix it?
  • Your LP solver works fine on 10,000 users but takes over 24 hours on 100,000. What's the underlying cause, and what class of solver would you switch to and why?
  • A new product line has poor immediate engagement metrics but is strategically important. How does your system avoid always starving it of budget in favor of well-established, high-ROI programs?
Show answer guide
Also: ml-platform

What the interviewer is probing

This question tests whether the candidate can bridge ML prediction with combinatorial optimization at scale — recognizing that 'pick the highest-uplift treatment per user' is wrong when budgets couple decisions across millions of users. It probes metric judgment (cross-vertical ROI, strategic weights), architecture (prediction layer decoupled from valuation layer, budget feedback control), and scale-and-failure reasoning (solver choice, time-series cost complexity, pacing under model drift). Strong candidates will identify the NP-hard nature of the assignment problem and reason about the solver trade-off without needing to know CP-SAT by name.

Strong answer outline

Problem framing - Clarify: How many users, levers, budget buckets? What's the assignment cadence? Are assignments one-per-user or can a user receive multiple incentives? - The core constraint: this is a multiple knapsack problem — knapsacks are team budgets, items are user-incentive pairs with predicted cost and value, goal is to maximize total value subject to per-knapsack budget constraints. - Naive per-user greedy (assign each user their highest-uplift option) ignores coupling: high-cost incentives burn budget that could serve more users at lower cost.

ROI signal design - Wrong turn: predict a single engagement metric per incentive. Fails because a delivery incentive that pulls a driver away from rides improves one metric while hurting another — net effect is negative. - Better: predict a vector of metric uplifts (rides trips, eats orders, driver utilization, earnings per hour) using uplift models trained on randomized experiment data. - Apply a strategic weight vector — set by business context — to convert the metric vector to a scalar ROI via dot product. Weights for a new market expansion emphasize growth; mature markets emphasize efficiency. Separating prediction (objective) from valuation (subjective) lets the same model serve different strategic priorities without retraining. - Guardrails: include cross-vertical cannibalization as a negative-weight term. Monitor net marketplace metrics, not just primary metrics, in holdout evaluation.

Budget pacing across time - Problem: quarterly budgets with weekly or daily assignment cycles. ML cost predictions drift; if predictions underestimate cost, you overspend early. - Control loop design: at each cycle, compute remaining_budget = configured_budget - observed_spend - predicted_liability, where predicted liability is the forecasted future cost of already-assigned active incentives not yet paid out. - This self-corrects: if actual costs exceed predictions, the pacer tightens the cap for future cycles, smoothing over the quarter. - Trade-off on cost modeling: modeling cost as a daily time-series over the incentive duration is accurate but explodes solver dimensionality (N users × T days constraints vs. N scalar constraints) and creates artificial bottlenecks when a predicted spike on one day blocks otherwise-viable assignments. Collapsing total predicted cost to the assignment day sacrifices granularity but makes the solver tractable and dramatically improves budget utilization.

Optimizer design - Scale challenge: with millions of users and hundreds of levers, the candidate space is the Cartesian product — potentially billions of user-incentive pairs. - Why LP fails at scale: LP relaxes the binary assignment decision to a continuous variable, then rounds. For large combinatorial problems the LP relaxation's solution is far from integer-feasible, and branch-and-bound search explodes. Runtime can exceed 24 hours on 100K users. - Better fit: constraint programming solvers (e.g., CP-SAT) natively handle discrete, binary assignment variables and use propagation + intelligent pruning to eliminate infeasible branches early. Same 100K-user instance solved in minutes. - Plug-and-play solver interface: abstract the problem definition (variables, constraints, objective) from the solver implementation so you can swap solvers as problem structure evolves without rewriting business logic. - Common wrong turn: trying to scale a greedy heuristic (rank by ROI/cost ratio, assign greedily until budget exhausted). This is fast but suboptimal and provides no optimality guarantees or constraint flexibility.

System architecture - Offline/batch flow: cron-triggered orchestrator → fetch eligible user pools from segmentation → generate user × lever candidate pairs → score with ML platform (uplift, cost) → pacer computes available budget cap → optimizer solves MKP → push assignments to downstream execution services. - Latency: optimization is offline/batch, so SLA is minutes to hours, not milliseconds. Decouple from real-time serving. - Scale pressure points: candidate generation (Cartesian product can be billions of rows — pre-filter ineligible pairs before scoring), ML scoring (batch inference at scale), solver memory (large binary programs; may need to shard by geography or time window). - Failure modes: solver timeout (set a time limit, return best feasible solution found); ML model staleness (monitor feature drift; degrade gracefully to simpler heuristic if model is stale); budget overrun from late-arriving cost signals (pacer's predicted liability must account for settlement lag).

Evaluation - Offline: simulate allocations on historical data; compare total assigned ROI and budget utilization vs. FIFO baseline. - Online: holdout experiment — randomly assign a fraction of users to the optimizer vs. baseline; measure net marketplace metrics (trips, earnings, utilization) per dollar spent, with guardrails on cross-vertical cannibalization. - Exploration vs. exploitation: current system requires manual intervention to test new incentive structures. Flag as open problem: auto-allocate a small exploration budget to novel incentives, gather uplift signal, retrain models, inject validated structures — closing the loop.

The underlying concept

Incentive allocation at scale is a multiple knapsack problem (MKP): you must assign binary decisions (give user U incentive I or not) to maximize a global objective subject to coupling budget constraints, which makes the decisions across users non-independent. This is fundamentally combinatorial and NP-hard, which is why greedy or LP approaches break down as the problem scales — LP's continuous relaxation poorly approximates the integer solution when the problem is highly combinatorial, while constraint programming solvers exploit problem structure (propagation, pruning) to find near-optimal integer solutions efficiently. The two-layer ROI design — predicting metric uplifts separately from applying strategic weights — is a classic separation of concerns: the prediction layer is a calibration problem (train once, reuse), while the valuation layer is a business policy problem (change without retraining). Budget pacing as a feedback control loop is the standard engineering answer to the tension between probabilistic ML predictions and hard financial constraints: rather than trusting the model's cost forecast, continuously reconcile predictions against observed reality and adjust the constraint fed into future optimization runs.

Source

Derived from Beyond Prediction: Solving the Multiple Knapsack Problem at Scale: How Uber Optimizes Incentives

Uber · DS ·

Uber Eats' estimated delivery times got more accurate and slightly faster on average — yet order conversion and repeat ordering declined. Diagnose the apparent contradiction.

Product case · marketplace-dynamics · experimentation§
Practice against the follow-up probes
  • What's the difference between an estimate being accurate and being attractive?
  • Build the metric tree from browse to reorder. Where could the decline enter?
  • How would you distinguish a selection effect from a true regression?
  • Which segments would you cut, and what would each tell you?
  • What experiment settles it?
Show answer guide
Also: forecasting

What the interviewer is probing

Whether the candidate spots that displayed ETAs are simultaneously a prediction and a promise that shapes demand: honest (longer-tail) estimates can be more accurate yet less attractive, suppressing conversion among time-sensitive customers — a selection effect that also changes who orders and thus measured satisfaction. Metric-tree discipline plus mechanism thinking, in Uber's marketplace flavor.

Strong answer outline

  • Core hypothesis: accuracy improved partly by raising displayed estimates that were previously optimistic — customers see honest 40-minute quotes instead of hopeful 30s; conversion drops among the time-sensitive; the remaining orders skew less time-sensitive, changing repeat-rate composition.
  • Metric tree: browse → restaurant view → cart → checkout (conversion); delivered experience (quoted vs. actual, lateness) → satisfaction proxies (ratings, support contacts) → reorder. Localize which edge declined and when relative to the ETA rollout.
  • Distinguish mechanisms: (a) display effect — check conversion as a function of displayed ETA, holding merchant/distance constant, pre/post; (b) actual-experience effect — did realized lateness or delivery times worsen for any segment despite average gains?; (c) measurement/selection — reorder rates computed on a different ordering population aren't comparable without adjustment.
  • Segment cuts: time-of-day (lunch = time-sensitive), market density, distance bands, new vs. tenured customers, merchant type; the display-effect story predicts the decline concentrates where displayed ETAs rose most.
  • The settling experiment: randomize the display policy (e.g., quantile shown) holding the underlying model constant — separates prediction quality from promise attractiveness; measure conversion, realized lateness against promise, satisfaction, and reorder by cohort.
  • Decision frame: the answer is rarely "revert to optimistic quotes" — it's choosing the displayed quantile that optimizes long-run value: conversions gained by attractive promises vs. trust lost by broken ones.

The underlying concept

A displayed prediction is an intervention: customers act on it, so its optimal presentation is a decision-theory problem distinct from its accuracy. Systems that "improved" a model can regress the business by changing the promise distribution — and the composition of who transacts shifts with it, corrupting naive before/after comparisons of downstream metrics (selection on unobserved time-sensitivity). The durable practice: separate model quality (calibration, error) from display policy (which quantile, how framed), and experiment on them independently.

Source

Distilled Prep canon — curated from Uber's public work on ETA prediction and marketplace conversion.

Source: Uber engineering blog

Uber · DS ·

A city launches a new driver incentive that guarantees a minimum hourly earning during peak periods. Design the evaluation plan to decide whether the program should be expanded to other cities.

Product case · experimentation · causal-inference§
Practice against the follow-up probes
  • What are your objectives and guardrails across riders, drivers, and the platform — and which one is the decision metric?
  • Would you randomize at the rider level, driver level, use switchbacks, geo experiments, difference-in-differences, or synthetic control? Why?
  • Drivers can see the incentive and migrate across zones or shift their hours in anticipation. How does that contaminate your design?
  • How do you estimate incrementality — supply that exists because of the program — rather than just measuring that supply went up?
  • The program has a fixed budget. How does that change what "success" means?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Whether the candidate recognizes this as an interference problem before choosing a method: driver-level randomization is the intuitive answer and it's wrong here, because treated and control drivers compete in one marketplace and the incentive changes behavior of both. Strong candidates frame the business decision first (expand or not, at what cost per incremental supply hour), pick a design that matches the interference structure, and are honest about what each design cannot identify.

Strong answer outline

  • Frame the decision: expansion is a cost-effectiveness question — dollars per incremental supply-hour during peak, and downstream effects on rider wait times, completed trips, and driver retention. Guardrails: driver earnings dispersion, off-peak supply cannibalization, rider price effects.
  • Rule out naive designs aloud: driver-level randomization suffers spillovers (control drivers face more competition, inflating apparent effects); pre/post comparison confounds seasonality and city trends.
  • Prefer designs matching the interference structure: geo-randomization at the city or zone-cluster level if enough units exist; switchbacks (time-based alternation) if the effect onset/decay is fast; synthetic control or diff-in-diffs against comparable cities when only one launch city exists — which is the realistic case here.
  • Name anticipation and learning effects: announce dates create pre-period contamination; drivers take time to respond, so define a burn-in and an effect window.
  • Incrementality: compare supply-hours against the counterfactual, then decompose — new drivers activated vs. existing drivers shifting hours from off-peak (cannibalization) vs. hours shifted from neighboring zones (displacement). Only the first is cleanly incremental.
  • End with a decision rule: expand if cost per incremental peak supply-hour beats the alternative levers (e.g. surge subsidy) at comparable guardrail impact, validated in 2-3 structurally different cities before general rollout.

The underlying concept

The Stable Unit Treatment Value Assumption (SUTVA) — that one unit's treatment doesn't affect another unit's outcome — fails almost everywhere in a marketplace, because participants compete for shared demand and supply. When SUTVA fails, the choice of randomization unit is the real design decision: you must randomize at the level that contains the interference (zones, cities, time blocks), even though this slashes your sample size and statistical power. That power-vs-validity trade-off, and the discipline of measuring incrementality against a counterfactual rather than a before/after, is the core of applied marketplace causal inference.

Source

Distilled Prep canon — curated from Uber's public work on marketplace experimentation and causally-informed optimization.

Source: Uber engineering blog

Uber · DS · MLE ·

You're forecasting rider demand per city zone in 15-minute intervals to position drivers ahead of demand. A new city launches next month with no historical data. Your global model performs well in mature cities but the launch team needs zone-level forecasts from day one. How do you approach this, and how does your approach change over the city's first 90 days?

Product case · forecasting · marketplace-dynamics§
Show answer guide

What the interviewer is probing

Whether the candidate can reason about cold-start under real operational pressure: transfer from similar cities, use of covariates that exist before launch (population, POI density, events), honest uncertainty communication, and a plan for graduating from priors to learned patterns. Strong candidates also ask what decision the forecast feeds — positioning tolerance determines how much error is acceptable.

Strong answer outline

  • Clarify the decision consumer first: driver positioning tolerates different error than surge pricing; this sets the accuracy bar and the cost of over- vs under-forecasting (asymmetric loss).
  • Day 0: transfer learning — pool data from demographically/geographically similar cities; features available pre-launch (census, POI, weather, calendar) drive a global model's predictions for the new city.
  • Early weeks: hierarchical/Bayesian shrinkage — city-level estimates borrow strength from the global prior, weight shifting to local data as it accumulates; simple exponential blending is an acceptable pragmatic answer.
  • Instrumentation: define when the city "graduates" (e.g. local-only model beats blended on rolling backtest).
  • Traps to name: launch-period data is unrepresentative (promos, novelty); feedback loops (positioning drivers changes observed demand — you observe fulfilled demand, not true demand).

The underlying concept

Cold-start forecasting is fundamentally a bias-variance trade: with no local data, a global prior is high-bias but low-variance; local data is unbiased but high-variance early on. Hierarchical models formalize the blend, letting the data decide how quickly to trust local signal. The second deep idea is censored demand: a marketplace only observes demand it could serve, so naive training on fulfilled trips systematically underestimates demand exactly where supply was short — the places you most need to forecast well.

Source

Hand-written seed example in the style of Uber's marketplace forecasting posts.

Source: Uber engineering blog

Stripe · SWE ·

Design a webhook delivery platform that notifies millions of merchant endpoints about payment events — where one slow merchant must never delay anyone else's notifications.

Systems design · distributed-systems · api-design§
Practice against the follow-up probes
  • What delivery guarantee do you offer, and what does the consumer contract require of merchants in return?
  • One merchant's endpoint hangs for 30 seconds per request. Trace what protects everyone else.
  • Retries: schedule, ceiling, and what happens after the ceiling?
  • What ordering do you promise? What do you refuse to promise, and why?
  • How do merchants debug "I never got the webhook," and how do they verify a webhook is really from you?
Show answer guide
Also: reliability

What the interviewer is probing

Multi-tenant reliability engineering: the defining challenge is isolation — millions of endpoints with wildly varying health sharing one delivery system — solved with per-tenant queues/concurrency budgets, circuit breakers, and honest contracts (at-least-once, no strict ordering). Developer-experience details (signatures, replay, delivery logs) separate candidates who've operated APIs from those who've only called them.

Strong answer outline

  • Contract first: at-least-once delivery (exactly-once to an external HTTP endpoint is impossible) → events carry unique IDs; merchants must dedupe and treat handlers as idempotent. No global ordering promised — events carry timestamps/sequence hints; merchants reconcile via API reads if order matters.
  • Architecture: event bus → per-merchant (or per-endpoint) delivery queues → worker fleet with per-tenant concurrency caps and short timeouts. Slow endpoint consequence: only its own queue backs up; fairness scheduling ensures workers don't pool-starve.
  • Failure handling: retries with exponential backoff + jitter over ~a day-scale horizon; circuit-breaker per endpoint (persistent failures → probation with reduced attempts); after ceiling → dead-letter with merchant-visible status, dashboard alerts, and manual/automatic replay once the endpoint recovers.
  • Security/DX: HMAC signatures with rotating secrets and timestamped payloads (replay-attack windows); delivery logs queryable by merchants (attempts, response codes, latencies); test-mode events and a replay button — the debugging surface is a product feature.
  • Isolation extras: per-tenant rate limits, payload size caps, and egress protections (SSRF checks on merchant URLs, blocking internal address space).
  • Observability: per-endpoint success/latency SLIs, backlog age alarms, global vs. tenant-scoped dashboards so incidents are classified (us vs. one merchant) in seconds.

The underlying concept

Webhooks invert the usual client-server reliability relationship: the platform becomes a client of millions of servers it doesn't control, so the design center is isolation — one tenant's pathology must be contained by construction (dedicated queues, concurrency budgets, breakers), not by hoping. The contract follows from distributed-systems truth: across an unreliable network with non-transactional receivers, at-least-once + consumer idempotency is the only honest promise, and ordering guarantees cost more than they're worth. Mature platforms treat observability and replay as part of the API: deliverability is a shared debugging problem with the merchant.

Source

Distilled Prep canon — curated from Stripe's public work on webhooks and API platform reliability.

Source: Stripe engineering blog

Stripe · DS · MLE ·

You own the fraud-screening model that decides whether to block payments. Where should the blocking threshold sit, how do you measure the fraud you never see, and how do you know the model is actually getting better?

Product case · fraud-detection · payments§
Practice against the follow-up probes
  • What does a false positive actually cost here, and to whom?
  • Blocked transactions never reveal whether they were fraud. How do you learn and evaluate under that censoring?
  • Chargebacks arrive weeks late. How does label delay shape training and monitoring?
  • Should the threshold be global, or vary — by what, and why?
  • Fraudsters adapt to the model. What does that do to your evaluation?
Show answer guide
Also: experimentation

What the interviewer is probing

Whether the candidate treats fraud as a decision problem under selective observation: blocking censors the labels (you never learn if a blocked payment was legitimate), losses are asymmetric and merchant-specific, and adversaries shift the distribution. The technical centerpiece is counterfactual evaluation — holdback traffic that lets some risky payments through to keep learning honest.

Strong answer outline

  • Cost frame: false negative = fraud loss + chargeback fees + network penalties; false positive = lost sale + damaged customer relationship
  • merchant trust in the platform — for many merchants the FP cost dominates. Threshold = point where marginal expected fraud loss equals marginal expected good-revenue loss, per segment.
  • The censoring problem: outcomes exist only for approved payments; training and evaluation on approved-only data biases the model against exactly the region near the threshold. Solution: a small randomized holdout/exploration slice where the model's block decisions are relaxed (bounded loss budget) — the ground truth from that slice powers unbiased evaluation and recalibration.
  • Label delay: chargebacks arrive over weeks — train with delay-adjusted labels (maturation curves), monitor on early proxies (issuer fraud declines, disputes filed) calibrated to final outcomes, and never compare cohorts of different ages naively.
  • Threshold policy: vary by merchant risk tolerance (offer levers), transaction size (asymmetry scales with amount), and segment base rates; expose expected trade-off curves so threshold choice is a business decision with visible prices.
  • Improvement measurement: value-weighted metrics (dollar-weighted precision/recall), evaluated on exploration traffic; online experiments where treatment = new model, primary metric = total cost (fraud loss + FP revenue loss), guardrail = merchant-level dispersion (no merchant class silently worsens).
  • Adversarial drift: expect the distribution to move because you improved; monitor feature-distribution shifts and reserve fast-retrain paths; treat stable performance as evidence of measurement problems, not victory.

The underlying concept

Fraud modeling is decision-making under selective labels: the policy being evaluated controls which outcomes get observed, so naive evaluation on its own approvals is circular. Exploration — deliberately, boundedly letting the model be overridden — is the price of unbiased learning, the same logic as bandit exploration. Add asymmetric, segment-varying costs and delayed labels, and the mature frame emerges: the model outputs calibrated risk; thresholds are economic policy set on trade-off curves; and evaluation is counterfactual, dollar-weighted, and adversary-aware.

Source

Distilled Prep canon — curated from Stripe's public work on fraud prevention and risk modeling.

Source: Stripe engineering blog

Stripe · DS ·

Stripe launches a feature that automatically retries failed subscription payments on an optimized schedule. Determine whether it creates incremental recovered revenue without harming customers.

Product case · payments · causal-inference§
Practice against the follow-up probes
  • Many failed payments would have succeeded on the merchant's existing retry logic anyway. How do you avoid claiming credit for those?
  • What harm could this feature cause, and what guardrail metrics catch it?
  • Merchants differ wildly — subscription size, industry, existing dunning tools. How does heterogeneity change your analysis and your rollout?
  • The feature interacts with merchants' own retry configurations. How do you attribute recovery between the two systems?
  • What would the merchant-facing report claim, and how do you make sure it's honest?
Show answer guide
Also: experimentation

What the interviewer is probing

Whether the candidate instinctively reaches for a counterfactual rather than a raw recovery rate — the seductive wrong answer is "we recovered $X of failed payments," most of which would have been recovered anyway. Also probing harm-awareness: retries are not free (card network fees, decline-rate penalties, customers charged after intending to cancel) and strong candidates surface these unprompted. This is Stripe's flavor of DS: financial correctness and merchant trust as first-class constraints.

Strong answer outline

  • Define incrementality precisely: revenue recovered by this feature that would NOT have been recovered by the merchant's baseline process within the same window. The estimand is a difference against a counterfactual, not a recovery total.
  • Design: merchant-level randomization (the feature operates on merchant configuration, and payment-level randomization within a merchant leaks through shared retry budgets and issuer behavior). Stratify by merchant size, industry, and presence of existing dunning tools.
  • Measurement window matters: a retry can merely accelerate recovery that would have happened; compare cumulative recovery curves over 30-60 days, not point-in-time rates.
  • Guardrails: involuntary churn, disputes/chargebacks, refund rate, support contacts, card-network decline penalties, and customer complaints about post-cancellation charges. Any of these moving is a launch blocker regardless of recovered revenue.
  • Heterogeneity: report treatment effects by stratum; expect the feature to help small merchants (no dunning sophistication) far more than large ones, which shapes both rollout priority and pricing.
  • Merchant reporting: report incremental recovery with uncertainty, not gross recovery — overstated claims destroy trust when merchants audit.

The underlying concept

Attribution without a counterfactual systematically overstates impact — the same failure mode as "email campaigns drive purchases from people who would have bought anyway." The general antidote is to define the estimand first (incremental effect vs. baseline process), pick the randomization unit where the mechanism operates (here, the merchant), and measure over a horizon long enough to distinguish acceleration of an outcome from creation of one. In payments, the additional twist is that every intervention carries direct costs and trust costs, so guardrails aren't an afterthought — they're half the evaluation.

Source

Distilled Prep canon — curated from Stripe's public work on payments reliability and revenue recovery.

Source: Stripe engineering blog

Stripe · DS ·

A large merchant's payment success rate dropped from 92% to 85% after they shipped a new checkout flow. Diagnose what happened and decide what Stripe should tell them.

Product case · payments · data-quality§
Practice against the follow-up probes
  • Decompose "payment failed." What are the distinct failure layers?
  • How do you separate a causal product effect from a traffic-mix shift?
  • Which baselines make a decline interpretable?
  • The merchant blames Stripe. How does your analysis address that directly?
  • What concrete recommendations might come out, and how do you prioritize them?
Show answer guide
Also: fraud-detection

What the interviewer is probing

Payments-funnel literacy plus consultative rigor: failures decompose into user abandonment, integration errors, authentication (3DS) friction, fraud blocks, and issuer declines — each with a different owner and fix. Strong candidates also check mix shifts (the new flow may attract different traffic) and frame findings the way Stripe actually would for a merchant: prioritized, evidence-backed, actionable.

Strong answer outline

  • Decompose the funnel: checkout started → payment details submitted → authentication (3DS) → fraud screening → issuer authorization → success. Attribute the 7 points: which stage's pass-rate moved?
  • Layer owners differ: abandonment/integration → merchant's new flow; authentication friction → flow configuration (is it now triggering 3DS more?); fraud blocks → risk rules reacting to new signal patterns; issuer declines → card/traffic mix or retry behavior.
  • Mix-shift check before causal claims: compare card brands, countries, device split, new-vs-returning customers pre/post; a flow that converts more first-time international users can lower success rate with nothing broken.
  • Baselines: the merchant's own pre-launch rates by segment, plus Stripe's cross-merchant benchmarks for similar segments — "85% is actually normal for your new traffic mix" is a legitimate finding.
  • Integration errors: spike in specific error codes, malformed requests, missing fields, client-side timeouts — the most common culprit after a checkout rewrite and the fastest fix.
  • Deliverable: ranked findings with magnitudes (e.g., "4 of the 7 points: 3DS now triggering on domestic cards — config fix; 2 points: new international mix — expected; 1 point: elevated card-declined from retry storm — backoff fix"), each with an owner and expected recovery.

The underlying concept

A payment is a pipeline of independent gates, so a success-rate change is a sum of gate-level changes — and attribution must precede recommendation because each gate has a different owner and remedy. The statistical trap is composition: aggregate rates move when the mix moves, so segment-controlled comparisons (or standardization to a fixed mix) are mandatory before declaring causation. This question is also a communication test: analysis becomes value only when translated into prioritized actions with expected impact.

Source

Distilled Prep canon — curated from Stripe's public work on payments performance and checkout optimization.

Source: Stripe engineering blog

Stripe · SWE ·

Design a double-entry ledger service for a global payments platform — the system of record for every money movement.

Systems design · payments · databases§
Practice against the follow-up probes
  • Why double-entry at all? What invariant does it buy?
  • A payout was recorded wrong yesterday. How do corrections work if history is immutable?
  • What are the concurrency semantics for posting to a hot account?
  • How do pending vs. settled money and multiple currencies fit the model?
  • How does reconciliation against banks and processors work, and what happens when it disagrees?
Show answer guide
Also: distributed-systems

What the interviewer is probing

Whether the candidate understands ledgers as invariant-enforcing state machines: every transaction's entries sum to zero, history is append-only, and corrections are new entries — never edits. Then the systems reality: hot-account contention, idempotent posting, multi-currency modeling, and reconciliation as the external truth check. Financial correctness culture is exactly what Stripe interviews for.

Strong answer outline

  • Core model: accounts (typed: merchant balance, platform fees, bank settlement, suspense); transactions containing ≥2 entries that sum to zero per currency; append-only entries with immutable IDs and timestamps. The zero-sum invariant is checked at commit — money is neither created nor destroyed, only moved.
  • Corrections: reversal entries referencing the original (contra postings), preserving a complete audit trail; "what was the balance believed to be on date X" stays answerable forever.
  • Posting semantics: transactions commit atomically (all entries or none) with idempotency keys (retries are constant in payments); serialization per account for strict ordering.
  • Hot accounts (platform fee account touched by every charge): shard into sub-accounts summed on read, or buffer postings through an ordered log applied by a single writer — contention engineering is where ledger designs live or die.
  • Balances: materialized from entries (periodic snapshots + tail replay) rather than stored as mutable truth — the entries are the truth; balances are cache. Pending vs. posted states model authorization-vs-capture and settlement lag; currencies never mix within an entry (FX is modeled as two legs through an FX account).
  • Reconciliation: continuously match ledger settlement accounts against external bank/processor statements; discrepancies flow into suspense accounts with aging alarms and human workflows — the design assumes disagreement will happen and makes it visible, bounded, and workable.
  • Scale/multi-region: partition by account with consensus-replicated partitions; audits and regulators shape retention and access design from day one.

The underlying concept

Double-entry is an ancient invariant-preservation technique: by recording every movement as balanced entries, the system makes "money appeared from nowhere" structurally impossible and turns errors into detectable imbalances. Append-only history converts time into data — corrections become part of the record rather than destruction of it — which is what auditability actually means. The distributed-systems translation: the ledger is a replicated state machine whose transitions are balanced transactions, with idempotency and per-account ordering as the concurrency contract, and reconciliation as the system's external consistency check against the rest of the financial world.

Source

Distilled Prep canon — curated from Stripe's public work on financial infrastructure and ledger design.

Source: Stripe engineering blog

Netflix · SWE ·

Your team runs a real-time service dependency graph that is continuously updated by a streaming pipeline — edges appear, disappear, and change weight as services call each other. An incident happened three hours ago, and the on-call engineer needs to see exactly what the dependency graph looked like at the moment the alert fired, not the current graph. Meanwhile, the live dashboard must continue reflecting the present state with sub-minute latency.

Design a storage and query layer that supports both current-state queries (sub-second) and point-in-time 'time-travel' queries (arbitrary historical timestamps, acceptable latency of a few seconds) over a topology that is updated millions of times per day. Walk through how data is written, how time-travel is implemented, what you store versus compute at query time, and what the failure modes and retention trade-offs look like.

Systems design · storage-systems · observability · Jul 2026§
Practice against the follow-up probes
  • Current-state reads and historical reads have very different access patterns. Should they share the same storage system or use separate systems — what drives that decision?
  • Your streaming pipeline processes records in 5-minute windows and may write a batch of edge updates all at once. How does that affect the granularity and accuracy of time-travel queries — and what do you tell the user when they ask for a timestamp that falls inside a window boundary?
  • An edge between two services was written at T=0, updated at T=10 min, and deleted at T=25 min. A user queries at T=17 min. Walk me through the exact read path and what you return.
  • Retaining full history is expensive. How do you decide how long to keep it, and what compaction or downsampling strategy lets you serve reasonable queries over older data without ballooning storage?
  • The streaming pipeline processes a late-arriving flow record that belongs to a window that was already committed and written to the graph. How do you handle corrections to already-persisted topology state?
Show answer guide
Also: databases

What the interviewer is probing

This question tests whether candidates understand the fundamental tension between mutable current-state stores (optimized for point reads and overwrites) and append-only temporal stores (optimized for range scans over time), and whether they can design a write path that feeds both without coupling them. The follow-ups probe granularity reasoning (window boundaries as a source of query imprecision), the mechanics of a versioned or bitemporal read, and operational maturity around late data correction — the hardest part of any streaming system with a historical query requirement.

Strong answer outline

  • Frame two distinct query shapes: current-state ('what does the graph look like now?') needs a mutable, indexed graph store with low read latency; time-travel ('what did it look like at T?') needs an immutable, time-indexed log of graph state changes. Trying to serve both from one mutable store forces expensive historical reconstruction; serving both from one append-only store means slow current-state lookups.
  • Write path — dual write: the streaming pipeline emits graph mutations (upsert edge, delete edge, update weight) with event timestamps. Each mutation is written (a) as an upsert to the live graph database and (b) as an append to a time-series change log (e.g., columnar storage partitioned by time). These two writes can be async; the live graph is the source of truth for current state, the change log is the source of truth for history.
  • Time-travel read path: for a query at timestamp T, scan the change log for all mutations with event_time ≤ T, reconstruct the graph state by replaying them in order. For efficiency, maintain periodic full snapshots (e.g., every hour) in the change log so reconstruction starts from the nearest snapshot before T rather than time zero. Query latency = snapshot load + replay of delta mutations since snapshot.
  • Window boundary precision: the pipeline commits in 5-minute windows; mutations within a window share a commit timestamp. A query at T=12min against a window committed at T=10min will see all events in that window, including those that actually occurred up to T=15min. Document this as the system's temporal granularity and surface it in query results ('topology as of window ending T=10min').
  • Late data corrections: if a late-arriving record belongs to an already-committed window, append a correction event to the change log with the original event time and a processing timestamp. Time-travel queries replaying the log will incorporate the correction. The live graph may need a compensating write (delta application). Design the mutation log to be idempotent so replaying it twice produces the same result.
  • Retention and compaction: full per-mutation history is expensive at millions of mutations/day. Tiered strategy: keep full granularity for recent data (e.g., 7 days); compact to hourly snapshots for 90 days; monthly summaries beyond that. Communicate retention limits clearly — time-travel beyond the retention window returns an error, not silently stale data.
  • Failure modes: dual-write creates a consistency gap if the change log write succeeds but the live graph write fails (or vice versa). Mitigate with idempotent writes keyed on (edge-id, window-id) and a reconciliation job that compares the live graph against the most recent change log snapshot. Accept that the two stores may diverge by at most one write cycle.
  • Common wrong turns: (1) storing full snapshots on every write — storage explodes; (2) reconstructing current state from the change log on every live query — too slow; (3) overwriting edges in the live graph without any historical record — you lose time-travel entirely; (4) using wall-clock processing time instead of event time as the index — makes historical queries unreliable when processing lags.

The underlying concept

Time-travel queries require separating event time (when something happened in the world) from processing time (when your system observed it) — a distinction the streaming systems literature calls the two-timeline model. The standard pattern is an append-only event log keyed by event time, with periodic snapshots to bound reconstruction cost, alongside a mutable current-state store for low-latency live reads. This is the same design used by version control systems (commits as the log, working tree as current state) and by databases with MVCC (version chains as the log, the latest version as current state). The hard operational problem is late data: records that arrive after their window has been committed force a retroactive correction, and a well-designed system makes those corrections visible to time-travel queries without invalidating the live graph.

Source

Derived from Building Service Topology at Scale: Architecture, Challenges, and Lessons Learned

Netflix · SWE ·

You're building a real-time service dependency graph: raw network flow records arrive from millions of hosts at millions of events per second, and you need to aggregate them into application-level edges (App A → App B) within minutes. A complication: traffic rarely flows directly — load balancers, NAT gateways, and proxies sit in between, so raw flows show App A → Load Balancer and Load Balancer → App B as separate records. A single aggregation stage with consistent hashing by destination service collapses these records onto the same instance — but your most-called services (authentication, API gateways) now receive 100x the records of any other node, causing GC thrashing, memory exhaustion, and cascading failures.

Design a distributed aggregation pipeline that resolves multi-hop intermediaries into single application-level edges, distributes load without creating hot nodes, and maintains near-real-time freshness (minutes, not hours). Defend your stage boundaries, your data partitioning strategy at each stage, and your inter-stage communication protocol.

Systems design · stream-processing · distributed-systems · Jul 2026§
Practice against the follow-up probes
  • Why does resolving App A → LB → App B into App A → App B require the two raw flow records to land on the same instance — and what does that constraint imply about when and how you must redistribute data?
  • Your consistent-hashing ring gains or loses nodes as auto-scaling fires. Walk me through exactly what happens to in-flight aggregators during a scale-out event, and what correctness guarantees you can and can't make.
  • You chose Server-Sent Events over gRPC for inter-stage streaming. Make the case against that choice — when would gRPC win — and then defend SSE for this workload.
  • Immutable data structures are idiomatic in JVM-based stream processing frameworks. You've profiled and found they're responsible for most of your GC pressure at this scale. What do you change, and what do you give up?
  • Suppose one intermediary (a shared API gateway) is traversed by 500 upstream services. After intermediary resolution, every edge that passed through it must land on the same Stage 2 instance. How do you prevent that instance from becoming the new hot node?
Show answer guide
Also: scalability

What the interviewer is probing

The question forces candidates to reason about data locality as a first-class architectural constraint: the join needed for intermediary resolution requires co-location, which fights against even load distribution, and the only resolution is a deliberate multi-stage shuffle. Strong candidates will independently discover the map-reduce structure (scatter in Stage 1, shuffle-by-intermediary in Stage 2, scatter-again in Stage 3) and articulate why no two-stage design can simultaneously satisfy both locality and balance. The follow-ups probe whether they understand consistent hashing's behavior under membership change, can make principled protocol trade-offs rather than cargo-culting gRPC, and know when to break 'best practice' conventions under measured pressure.

Strong answer outline

  • Frame the core tension first: intermediary resolution requires a join, joins require co-location, co-location by a popular key creates hot nodes. The pipeline's job is to satisfy locality exactly where the join happens and nowhere else.
  • Stage 1 — local pre-aggregation: each instance consumes its Kafka partition and performs time-windowed (e.g., 5-minute) aggregation in place, compressing millions of raw records into a small number of aggregator objects before any network shuffle. This is the critical memory-pressure fix: raw records are GC'd quickly; only aggregator diffs cross the wire. Partition boundary: Kafka partition → Stage 1 instance (no inter-instance communication yet).
  • Stage 2 — intermediary resolution: consistent-hash by intermediary identifier so all flows touching Load Balancer X land on the same instance. Perform the join: (upstream → LB) + (LB → downstream) = (upstream → downstream). After resolution, re-hash resolved edges by a different key (e.g., source+destination pair hash) and forward to Stage 3. Two distribution points in one stage isolates the join locality requirement to Stage 2 alone.
  • Stage 3 — enrichment and persistence: receives compressed, resolved aggregators; queries external stores for metadata; writes to graph DB with throttled, back-pressured writes. By this point no single intermediary's traffic is concentrated.
  • Why three stages, not two: a two-stage design forces the resolving stage to also do enrichment I/O, so the hottest node (most popular intermediary) is also doing the most I/O. Separating stages isolates compute-heavy resolution from I/O-heavy enrichment.
  • Inter-stage protocol: SSE over HTTP wins for unidirectional high-volume streaming because serialization overhead is minimal and backpressure integrates naturally with reactive stream demand signals. gRPC wins for request-response RPC or bidirectional streaming with strong schema contracts; at this throughput, gRPC's connection pool and serialization overhead consumed more CPU than business logic.
  • Auto-scaling and consistent hashing: each instance reads current healthy-instance list from the service registry at hash time; the sorted list is the hash ring. On scale-out, a fraction of keys remap to the new instance automatically; no coordinator needed. Trade-off: aggregators in-flight during a membership change may be re-routed, losing partial window state — acceptable if windows are short and aggregation is idempotent (additive counters).
  • Mutable hot-path structures: immutable aggregators create O(records) object allocations; at millions/sec this overwhelms GC. Switch aggregator objects on the hot path to mutable; retain immutability for all other data. Requires explicit code review discipline. Reduces heap allocation >50% and cuts GC pause time from hundreds of ms to tens of ms.
  • Common wrong turns: (1) trying to resolve intermediaries at query time — too slow and requires full scan; (2) a single consistent-hash stage that groups by destination — collapses popular services onto one node; (3) adding a message queue between stages — adds infrastructure complexity without the backpressure integration that SSE + reactive streams provide natively.

The underlying concept

This design is an instance of the map-reduce shuffle pattern applied to streaming: Stage 1 maps (local aggregation), Stage 2 shuffles by the join key (intermediary), reduces (resolves hops), and then shuffles again by a different key to break residual hot spots. The core insight is that data partitioning strategy determines processing architecture — when your join requires co-location on a skewed key, the only safe design concentrates that co-location into exactly one stage and redistributes before and after it. Consistent hashing gives stable partitioning under membership change: only keys that map to the added or removed node need to move, limiting disruption. Backpressure in reactive streams is the mechanism that converts 'downstream is slow' into a signal that propagates upstream through the pipeline, causing producers to slow rather than buffer unboundedly or drop; it is the difference between graceful degradation and cascading failure under load spikes.

Source

Derived from Building Service Topology at Scale: Architecture, Challenges, and Lessons Learned

Netflix · DS ·

The product team ships a "Skip Recap" button for series episodes. Design the decision framework and the experiment that determines whether it stays.

Product case · experimentation · ab-testing§
Practice against the follow-up probes
  • What is success for a convenience feature — surely not clicks on the button?
  • What could this feature quietly harm?
  • Shared profiles and repeat viewing: how do they complicate randomization and interpretation?
  • How do you handle novelty effects for a highly visible UI change?
  • When would personalization (showing it only sometimes) be justified?
Show answer guide
Also: recommendation

What the interviewer is probing

Whether the candidate can evaluate a small UX feature with rigor proportionate to its subtlety: the naive metric (button usage) measures availability, not value; the real questions are friction reduction (time-to-content), downstream viewing quality (completion, session satisfaction), and non-harm (does skipping recaps reduce comprehension and thus retention of serialized dramas?). Also probing unit-of- randomization judgment when profiles are shared.

Strong answer outline

  • Success definition: reduced friction (time from episode start to engaged viewing), unchanged-or-better episode completion and next-episode continuation, and neutral-to-positive series completion and satisfaction proxies. Button CTR is a usage descriptor, not a success metric.
  • Harm hypotheses: skipping recaps could reduce story comprehension → lower series completion for plot-heavy titles; more UI chrome could distract; measure per content-type (serialized vs. episodic).
  • Randomization: by profile (feature is a profile-level experience), aware that households share profiles (dilution — effects attenuate; note it, don't pretend it away); stratify by viewing tenure and device.
  • Novelty handling: expect early spike in usage and engagement; run weeks past stabilization; evaluate on the post-novelty window and cohort curves rather than cumulative averages.
  • Repeat viewing and eligibility: recaps only exist on some episodes — define exposure correctly (analyze eligible impressions), avoid diluting effects with ineligible plays.
  • Decision framework: ship if friction drops with completion/retention guardrails flat — convenience features are justified by non-harm plus measurable friction wins; consider personalization only if heterogeneity is strong (e.g., harmful for new viewers of serialized shows, helpful for bingers) and the added complexity pays.

The underlying concept

Convenience features invert the usual experiment logic: the treatment's direct metric (usage) is nearly meaningless because offering an option people take proves availability, not value. Evaluation must reach for the outcomes the feature is hypothesized to serve (friction, continuation) and the outcomes it might silently tax (comprehension, long-term engagement). Add the standard streaming-experimentation disciplines — novelty windows, exposure-correct analysis, shared- account dilution — and the general lesson emerges: match the metric to the mechanism, not to what's easiest to count.

Source

Distilled Prep canon — curated from Netflix's public work on product experimentation.

Source: Netflix engineering blog

Netflix · SWE · DS ·

Design the playback quality-of-experience telemetry platform: clients worldwide emit playback events; engineers need real-time incident dashboards, and data scientists need the same data, exactly, for experiment analysis.

Systems design · observability · stream-processing§
Practice against the follow-up probes
  • Client telemetry arrives late, duplicated, and sometimes never. How does the design absorb that?
  • Engineers want seconds-fresh dashboards; scientists want correctness. One dataset or two?
  • Rebuffer ratio by device × ISP × region × title × experiment cell — what does that cardinality do to your system, and what do you do?
  • How does anomaly detection distinguish "an ISP is degrading" from "a telemetry pipeline is degrading"?
  • A privacy review asks what you collect and retain. What's your answer?
Show answer guide
Also: data-pipelines

What the interviewer is probing

Whether the candidate can fuse three hard requirements — unreliable client data, dual freshness/correctness consumers, and high-cardinality slicing — into one coherent design: event-time processing with watermarks, a speed/batch reconciliation, pre-aggregation with cardinality budgets, and meta-monitoring that watches the telemetry itself. The DS-consumer angle tests whether experiment analysis gets first-class treatment (cells as a dimension, correctness guarantees).

Strong answer outline

  • Client contract: events carry device-generated IDs, session IDs, event-time timestamps, and sequence numbers; clients buffer and retry through connectivity gaps (hours), so the platform must accept very late data; server assigns arrival time for lateness accounting.
  • Ingest: regional collectors → durable log; dedupe on event IDs (idempotent processing); sessionization by session ID with event-time ordering repaired via sequence numbers.
  • Dual path, one truth: streaming path computes windowed QoE aggregates (time-to-first-frame, rebuffer ratio, bitrate, errors) with watermarks tuned for dashboard freshness — labeled provisional; batch path recomputes from the log after late data settles — labeled final, overwriting provisional; experiment analysis reads final only.
  • Cardinality: raw dimensions explode (device × ISP × region × title × cell); pre-aggregate along curated dimension sets with budgets; keep raw events for bounded retention so ad-hoc slices are computed on demand rather than pre-materialized; experiment cell is a first-class dimension in the curated sets.
  • Anomaly detection with self-suspicion: baseline models per slice flag deviations; pipeline health metrics (arrival rates by client version, dedupe rates, watermark lag) are monitored alongside — a drop in events from one app version is a telemetry incident, not a playback one; synthetic canary sessions ground-truth the whole path.
  • Privacy/retention: minimize identifiers, aggregate early, tier retention (raw short, aggregates long), and document collection — QoE needs sessions and network context, not identities.

The underlying concept

Client telemetry inverts server observability: the emitters are unreliable, mobile, and adversarially heterogeneous, so correctness is recovered in the platform — event time over arrival time, idempotency over exactly-once transport, watermarks as the formal treatment of lateness. The freshness/correctness tension resolves the same way it does in metrics platforms: two computation paths, one immutable log, explicit provisional/final labeling. And any system that measures quality must measure itself — otherwise every pipeline defect masquerades as a product incident.

Source

Distilled Prep canon — curated from Netflix's public work on playback telemetry and streaming data infrastructure.

Source: Netflix engineering blog

Netflix · DS ·

Leadership wants to know whether a product feature causes higher long-term retention — but the feature launched everywhere months ago, so a randomized experiment is off the table. You'll have to estimate the effect from observational data.

Walk me through your analysis — and more importantly, walk me through how you would convince a skeptical scientist that your number deserves to be trusted.

Product case · causal-inference · experimentation · Jun 2026§
Practice against the follow-up probes
  • Users who adopted the feature obviously differ from those who didn't. What exactly are you assuming when you "control for" that, and can the assumption be tested?
  • Your propensity model gives some users scores near 0 or 1. What does that mean, what do you do about it — and what does your fix change about what your estimate even means?
  • What is a placebo test in this setting, and what does passing or failing one tell you?
  • Your confidence interval is tight. Why is that not, by itself, evidence the estimate is good?
  • Your org wants to automate studies like this with LLM agents so every team can run them. What breaks first, and what guardrails would you insist on?
Show answer guide
Also: ml-platform

What the interviewer is probing

Whether the candidate treats observational causal inference as a credibility protocol rather than a regression recipe: the unconfoundedness assumption is unverifiable, so trust is built from a battery of diagnostics — balance, overlap, placebo outcomes, sensitivity analysis — each of which the candidate should reach for unprompted. The trimming probe tests whether they notice that fixing overlap changes the estimand. The final probe tests systems judgment about automating analytical discipline.

Strong answer outline

  • Frame the target first: define treatment (what counts as "adopted"), outcome window, and the population — then name the identifying assumption out loud: after conditioning on observed covariates, adoption is as-good-as-random (unconfoundedness). State plainly that this is an assumption, not a fact.
  • Design before estimation: choose covariates measured before treatment (post-treatment variables can be mediators — controlling for them destroys the effect you're measuring); think "what would the randomized trial have looked like" and emulate it.
  • Diagnostics as the credibility spine:
  • Balance: after weighting/matching on propensity scores, covariate distributions should match across groups (standardized mean differences near zero). Imbalance = the adjustment failed.
  • Overlap: propensity scores near 0 or 1 mean some users are near-certain adopters/non-adopters — no comparable counterparts exist. Trim them (with the honest consequence below) rather than extrapolate.
  • Placebo tests: estimate the "effect" on outcomes the feature cannot have caused (pre-period outcomes, unrelated metrics). A nonzero placebo effect reveals residual confounding.
  • Sensitivity analysis: quantify how strong a hidden confounder would need to be to erase the effect; report it alongside the estimate.
  • The trimming trap: dropping extreme-propensity users changes the estimand — the result now applies only to the overlap population, and the writeup must say so in plain language ("this estimate applies to members for whom adoption was genuinely uncertain").
  • Estimation: doubly robust methods (combining outcome model and propensity weighting) so one model's misspecification doesn't sink the estimate; but emphasize that estimator sophistication never substitutes for the diagnostics — a confounded model can produce a tight, wrong confidence interval.
  • Communicating trust: publish the full chain — assumptions, diagnostic results, estimand statement, sensitivity bounds — not just the point estimate; invite the skeptic to attack the assumption, not the arithmetic.
  • The automation probe: what breaks first is the discipline, not the math — an unscaffolded agent runs regression-with-controls and skips the diagnostics. Guardrails: a fixed protocol the agent must execute (diagnostics as mandatory gates), validation of the diagnostic suite on synthetic benchmarks with known truth, immutable auditable artifacts, and human sign-off on estimand and confounder judgments — the calls that require domain knowledge.

The underlying concept

Observational causal inference rests on an unverifiable assumption — that observed covariates capture everything driving both treatment and outcome — so its practice is really an evidence-building protocol: balance shows the adjustment worked mechanically, overlap shows comparisons exist rather than being extrapolated, placebo tests hunt for residual confounding, and sensitivity analysis prices the assumption's fragility. Two traps define seniority here: fixing overlap by trimming silently changes whose effect you measured, and interval width measures sampling noise, not bias — precision is not validity. The automation lesson generalizes: analytical rigor lives in the protocol, so automating the analysis means encoding the protocol as mandatory scaffolding, keeping judgment calls human.

Source

Derived from A Human-Augmenting Agentic Workflow for Causal Inference

Netflix · MLE · DS ·

Design the personalized homepage: the system that selects not just which titles to show a member, but how to organize them into rows — a full slate, not a ranked list.

ML system design · recommendation · ml-platform§
Practice against the follow-up probes
  • What objectives compete on a homepage, and how do you combine them?
  • Why is slate construction different from ranking a single list?
  • Where do candidate generation, ranking, and page assembly divide?
  • Feedback loops: the homepage causes the plays it trains on. What do you do about it?
  • How do you evaluate a whole-page change offline before any experiment?
Show answer guide
Also: experimentation

What the interviewer is probing

Slate-level thinking: a homepage's value isn't the sum of independent item scores — diversity across rows, redundancy penalties, position effects, and the member's mission variety (continue watching vs. discover) make it a set-optimization problem. Also probing feedback- loop hygiene (logged propensities, exploration) and off-policy evaluation literacy, which Netflix's experimentation culture treats as table stakes.

Strong answer outline

  • Objectives: immediate play probability, expected viewing satisfaction (completion-weighted), discovery/novelty (catalog breadth), and long-term retention — combined via a tunable scalarized objective or constrained optimization (e.g., maximize play prob subject to diversity floors).
  • Why slates differ: items interact — two similar rows cannibalize; position and row-order carry strong attention priors; the page should cover the member's plausible missions (resume, comfort, explore) as a portfolio, not a top-k.
  • Architecture: candidate generation per row-type (continue-watching logic, genre affinities, trending, because-you-watched graphs) → item ranking within candidates → page assembly as constrained slate optimization (row selection + ordering + intra-row ordering with diversity/redundancy terms) → artwork selection per title (contextual bandit over thumbnails).
  • Feedback loops: log propensities for every impression; reserve exploration traffic (randomized slots) to keep training data off-policy-correctable; without it, the model concentrates on its own past choices and discovery decays.
  • Cold start: new members → onboarding signals + popularity-by-cohort; new titles → content features and forced exploration budgets with spend caps.
  • Evaluation: offline — off-policy estimators (IPS/doubly-robust) on logged data with propensities, replay metrics for slate changes; online — member-level A/B on engagement and retention proxies with long windows; monitor diversity and catalog-coverage as health metrics, not just clicks.

The underlying concept

Slate recommendation is set optimization under attention constraints: the unit of value is the page, whose whole differs from its parts through substitution, diversity, and position effects — so assembly deserves its own optimization layer above item ranking. The second pillar is causal hygiene in a closed loop: a recommender trains on outcomes it caused, and only logged propensities plus deliberate exploration keep learning and evaluation from collapsing into self-confirmation. Off-policy evaluation is the bridge that lets a team iterate on page policies faster than online experiments alone allow.

Source

Distilled Prep canon — curated from Netflix's public work on personalization and page construction.

Source: Netflix engineering blog

Netflix · MLE · DS ·

You run a large-scale notification system — push, email, and in-app — sending hundreds of millions of messages per week across a diverse member base. A single ranking model currently handles all decisions: at each send opportunity it scores candidate messages and applies a relevance threshold that implicitly controls send frequency.

Product raises two complaints: (1) some members are clearly over-messaged and churning from the channel, but frequency is a side-effect of ranking rather than a controlled variable; (2) the model optimizes for immediate engagement, so it ignores cumulative fatigue and long-term retention effects that take weeks to surface.

Design a system that gives you explicit, personalized control over each member's messaging frequency at a strategic level, while still maximizing message relevance at the moment of send. Walk through the modeling choices, the data flow, and how the two layers communicate in production.

ML system design · recommendation · ml-platform · Jun 2026§
Practice against the follow-up probes
  • You've decoupled frequency planning from message selection — how do you actually define and optimize the frequency plan? What does the action space look like, and what objective does the planner optimize?
  • Negative signals like opt-outs are extremely rare events. How does that sparsity affect your reward model, and what do you do about it?
  • The two layers need to communicate without adding latency to the real-time send path. Walk me through the exact data flow from the planner writing its decision to the executor reading it at send time.
  • You want to A/B test a new pacing strategy without touching the message-ranking model, and vice versa. How does your architecture support that, and what are the interference risks between the two experiments?
  • How do you measure whether the strategic planner is actually improving long-term member health versus just redistributing the same messages differently?
Show answer guide
Also: experimentation

What the interviewer is probing

This question probes whether the candidate can decompose a coupled ML decision problem into well-scoped sub-problems with clean interfaces — the core architecture skill at senior/staff level. It also tests reward-design judgment under sparse feedback, because the naive utility function degenerates to 'always send' without deliberate correction. The follow-ups stress operational maturity: feature-store latency contracts, independent experimentation across hierarchical layers, and the measurement challenge of attributing long-horizon outcomes to strategic decisions made a week earlier.

Strong answer outline

  • Problem decomposition first: Name the two coupled decisions that need splitting — how often to message (a strategic, slow-moving, person-level decision) and which message to send right now (a tactical, real-time decision). Coupling them in one model means tuning one contaminates the other.
  • Slow/strategic layer — planner:
  • Runs on a longer cadence (e.g., weekly), consuming each member's longitudinal engagement history.
  • Action space: discretized cross-channel frequency buckets (e.g., push × email combinations), keeping the space tractable (~O(100) actions) while still expressive.
  • Objective: a utility function that sums weighted positive engagement signals minus a cost term for messaging. Key design challenge — opt-out and fatigue signals are extremely sparse, so the learned cost is near-zero and the model degenerates to 'always send maximum'. Fix: introduce a universal per-message cost floor (tuned offline/online) that keeps the utility function concave and prevents the degenerate policy.
  • Output: a pacing plan (target frequency + temporal distribution, e.g., uniform-random or structured by day-of-week) written to a feature store.
  • Fast/tactical layer — executor:
  • Triggers on each real-time send opportunity.
  • Reads the stored pacing plan as a feature; uses it as a constraint (budget gate) rather than a recommendation.
  • Within budget, ranks candidate messages by immediate relevance using a short-horizon model (CTR, play probability, etc.).
  • Decision is: does this opportunity fall within today's remaining pacing budget? If yes, send the top-ranked message.
  • Communication via feature store: Planner writes asynchronously; executor reads at low latency. This decouples compute cycles — planner can be expensive; executor must be fast. Stickiness is a side-effect: the plan persists until the next planning cycle, giving members a consistent experience.
  • Pacing strategy: Start with uniform-random (translate weekly frequency to per-opportunity send probability, flip a weighted coin). Flag the extension to non-uniform profiles (activity-triggered, launch-aligned bursts) as a clean upgrade path within the same architecture.
  • Experimentation design:
  • The two layers can be A/B tested independently because they touch different features and run at different cadences — a key architectural win.
  • Interference risk: a pacing experiment changes message volume, which changes the signal distribution the ranking model was trained on. Call this out and discuss potential need for holdout groups or joint analysis.
  • Long-horizon metrics (opt-out rate, sustained viewing, channel health) need weeks of exposure; flag that standard two-week experiment windows may be underpowered for the strategic layer.
  • Common wrong turns: Treating frequency as a ranking hyperparameter rather than a first-class modeled decision. Ignoring reward sparsity and shipping a utility function that collapses to always-send. Designing synchronous communication between layers, adding latency to the real-time path. Using short-horizon metrics to evaluate a system designed to optimize long-horizon outcomes.

The underlying concept

Hierarchical policy decomposition is a general answer to the problem of decisions that operate at different timescales with different information sets. The slow layer can afford expensive computation and long-horizon optimization because it runs infrequently; the fast layer must be cheap and latency-sensitive but can treat the slow layer's output as a trusted constraint rather than re-deriving it. The communication contract — slow layer writes intent to a durable store, fast layer reads it as a feature — is the key interface: it keeps the layers independently evolvable and independently testable without adding synchronous coupling to the hot path. The reward design problem (sparse negatives → degenerate always-send policy) is a specific instance of reward hacking: when the signal you care about (member fatigue, opt-out) is rare, a learned cost term alone cannot represent it faithfully, so you must regularize with a structural prior — here, a tuned per-message cost floor — to keep the optimizer in a reasonable region of the action space.

Source

Derived from Thinking Fast & Slow for a Personalized Notification System

Netflix · SWE ·

Design the video pipeline from a studio's master file to a phone screen: ingest, processing, global delivery, and playback — for hundreds of millions of members.

Systems design · infrastructure · caching§
Practice against the follow-up probes
  • What happens between "file uploaded" and "playable everywhere"?
  • Why does a streaming service build its own CDN presence inside ISPs?
  • Walk through the first two seconds after a member presses play.
  • What are your core playback SLIs, and what degrades first under stress?
  • New season of a hit show drops globally at midnight. What did you do yesterday?
Show answer guide
Also: reliability, scalability

What the interviewer is probing

End-to-end pipeline thinking with a delivery-economics core: video bytes dominate cost and quality, so the design centers on encoding ladders, edge placement inside ISP networks, and adaptive bitrate as the client-side control loop. The midnight-launch probe tests proactive-vs-reactive instincts: predictable demand means pre- positioning, not autoscaling heroics.

Strong answer outline

  • Ingest/processing: master file → validation → parallelized transcoding into an encoding ladder (multiple resolutions/bitrates, multiple codecs per device family), per-title/shot optimized encoding; packaging into segmented formats; DRM licensing; subtitle/ audio tracks; all as an idempotent, resumable workflow (a title is thousands of jobs).
  • Storage topology: origin in cloud object storage; popular content pushed to edge appliances inside ISP networks — rationale: video is ~all the bytes, and serving from inside the ISP removes transit cost and peering bottlenecks while cutting latency; fill happens during off-peak windows.
  • Play button (first 2s): client asks control plane for playback authorization + manifest (steering to healthy nearby edges), fetches initial segments at a conservative bitrate, ramps via adaptive bitrate (client-side controller reacting to measured throughput and buffer level).
  • SLIs: time-to-first-frame, rebuffer ratio, average delivered bitrate, playback error rate — sliced by device/ISP/region; degrade gracefully under stress by capping bitrate tiers before failing plays.
  • Failure handling: multi-CDN/edge steering with health signals; manifest-level failover; regional control-plane redundancy; the data plane (edges) keeps serving cached content through control-plane incidents.
  • Launch night: demand is predictable — pre-warm caches everywhere during prior-day fill windows, pre-scale control plane, rehearse steering fallbacks; the win condition is that midnight looks boring.

The underlying concept

Streaming architecture is shaped by one asymmetry: a tiny control plane decides, a colossal data plane delivers — so you optimize the byte path structurally (edge placement where the users are, cache-fill when the network sleeps) and keep the decision path redundant and out of the way. Adaptive bitrate reframes quality as a client-side control loop over an encoding ladder, converting network variance into quality variance instead of failure. And for predictable events, capacity is a scheduling problem, not a scaling problem: the best incident response is the cache you filled yesterday.

Source

Distilled Prep canon — curated from Netflix's public work on encoding and Open Connect delivery.

Source: Netflix engineering blog

Netflix · MLE ·

You run a large streaming service with a two-dimensional homepage: rows of content, and entities within each row. Today it's built as a multi-stage pipeline — separate models for row selection, entity ranking within each row, and layout assembly — each optimized with its own objective.

Your team wants to replace this with a single autoregressive generative model that produces the entire homepage as a token sequence, treating the user context as a prompt and the page as the response.

Design this system end-to-end. Cover how you represent inputs and outputs, how you train and align the model, and how you handle the production realities that a research prototype would ignore.

ML system design · recommendation · llm-applications · Jun 2026§
Practice against the follow-up probes
  • Your custom tokenizer maps each entity and row to a single token. What breaks when a new show launches today and has no learned embedding yet?
  • You want to optimize the homepage as a whole — not just rank entities independently. Walk me through how RL post-training enables that, and what new failure modes it introduces.
  • The model generates rows and entities autoregressively, one token at a time. A homepage might have hundreds of entities. What does serving latency look like, and how do you bring it down without sacrificing quality where it matters most?
  • You retrain daily to stay fresh, but full retraining of a large transformer every day is prohibitively expensive. How do you design a training cadence that balances freshness against compute cost and catastrophic forgetting?
  • Business rules say certain rows must always appear at fixed positions, entities in a Comedy row must actually be comedies, and no entity should appear twice. How do you enforce hard constraints on an autoregressive model without retraining it for every new rule?
Show answer guide
Also: ml-platform

What the interviewer is probing

This question probes whether the candidate can reason about the architectural trade-offs of collapsing a multi-stage pipeline into a single generative model — not just the appeal of the unified objective, but the concrete problems it creates: representation of structured outputs, credit assignment across a sequence, cold start, serving latency, and constraint enforcement. Strong candidates will surface the tension between whole-page optimization and tractable training, and between autoregressive flexibility and inference cost. They will treat constrained decoding, incremental training, and cold-start embedding fusion as first-class engineering problems rather than footnotes.

Strong answer outline

Framing and motivation - Multi-stage pipelines suffer from misaligned objectives across stages and cascading errors; a single model can optimize the full page jointly. - The core bet: a generative transformer over a domain-specific token vocabulary can represent a structured 2-D layout as a flat sequence, enabling autoregressive generation of rows and entities together.

Tokenization - Domain-specific tokenizer: each entity, row, and action maps to a small number of discrete tokens (entity ID, action type, time bucket, duration bucket) — far more compact than a text tokenizer. - Page serialized in layout order (row by row, left to right within each row); special delimiter tokens mark segment boundaries. - Continuous signals (timestamps, durations) bucketized to keep the vocabulary finite. - Common wrong turn: using a general-purpose text tokenizer — it balloons sequence length, increases latency, and loses the direct token-to-product-concept mapping needed for constrained decoding.

Training recipe - Pretraining via next-token prediction on historically successful homepage impressions — teaches the model the "language" of the page structure and the user-content relationship. Analogous to SFT on (prompt, response) pairs, not raw unsupervised text. - Post-training option 1 — Weighted Binary Classification (WBC): for each impressed token, derive a binary label from reward sign and a weight from reward magnitude; optimize weighted binary cross-entropy per token. Credit assignment is clean because each token is a single entity. Simpler to optimize; aligns with entity-level production metrics. - Post-training option 2 — RL: treat page generation as a sequential decision process; train a separate reward model to predict page-level reward for arbitrary candidate pages; use a KL penalty against the pretrained checkpoint to prevent reward hacking and keep the policy within the reward model's training distribution. Enables whole-page optimization, capturing cross-row interactions like diversity and stopping power. - Trade-off: WBC is stable and interpretable; RL is harder to tune but is the path to page-level optimization and supports multi-token entities naturally.

Cold start - New entities have no interaction data → no learned ID embedding. - Two mitigations: (1) inject content metadata (synopsis, cast, genre) directly as context tokens; (2) represent each entity as a fusion of its ID embedding and a content-based embedding; during training, randomly drop ID embeddings so the model learns to rely on content embeddings alone — new entities are representable at launch. - Common wrong turn: ignoring cold start entirely, or assuming a popularity fallback is sufficient for a personalized homepage.

Serving latency and hybrid decoding - Fully autoregressive generation over hundreds of entity tokens is expensive; latency is a hard constraint for a real-time homepage. - Key insight: early entities in each row receive the most user attention and most shape perceived row quality — those benefit most from full autoregressive conditioning. - Hybrid decoding: autoregressively generate the first few entities per row; then, conditioned on that prefix, score all remaining eligible entities in a single forward pass and select top-k. Cuts latency substantially while preserving quality where it matters. - Discuss batching, model parallelism, and caching user context embeddings as additional levers.

Freshness and incremental training - Full retraining daily is too expensive; but staleness degrades quality as trends and catalog shift. - Multi-cadence schedule: periodic large-scale pretraining + post-training on a broad historical window; daily incremental post-training from the previous checkpoint on recent data mixed with a replay sample of historical data. - Replay prevents catastrophic forgetting; the periodic full pass resets accumulated drift. - New tokens (new entities, rows) initialized to a typed fallback embedding; the model is trained with random fallback substitution so it handles unknowns gracefully at serving time.

Enforcing business rules - Rules: no duplicates, row pinning, category consistency (entities in a Comedy row must be comedies), content filters. - Constrained decoding: at each generation step, compute a token-eligibility mask from applicable rules and zero out ineligible logits before sampling. Single-token-per-entity design makes this tractable — mask computation is O(vocabulary) per step, with no multi-token bookkeeping. - Training signals encourage rule adherence but cannot guarantee it; hard enforcement must live at inference time. - Common wrong turn: relying on post-processing to filter rule violations — this wastes generation budget and can leave a page with too few valid entities.

Evaluation - Offline: entity AUC, next-token prediction loss, page-level reward on held-out impressions. - Online: A/B test against the production multi-stage system; primary metric is the core engagement metric used for launch decisions; guardrails on latency and diversity. - Watch for: offline gains that don't transfer (distribution shift between logged data and policy's generated pages); novelty effects in A/B tests.

The underlying concept

A multi-stage recommendation pipeline breaks a joint optimization problem into sequential subproblems, each with its own objective. This is tractable but introduces cascading errors and misaligned objectives — the row ranker doesn't know what the entity ranker will do with its output. A single autoregressive generative model sidesteps this by treating the entire page as a sequence to be generated, so each token is conditioned on all preceding decisions. The trade-off is that a sequence model's credit assignment problem (which token caused the good or bad outcome?) must be solved explicitly, either by decomposing rewards to the token level (WBC) or by learning a reward model and using RL. Constrained decoding extends this paradigm to hard business rules by masking ineligible tokens at inference time — a technique that works cleanly when the vocabulary is domain-specific and each concept maps to exactly one token. The broader pattern — pretrain on imitation data, post-train to align with a reward signal, enforce hard constraints at inference time — is the same recipe used to build instruction-following LLMs, transplanted into structured recommendation.

Source

Derived from GenPage: Towards End-to-End Generative Homepage Construction at Netflix

Netflix · DS ·

Viewing hours rise after a homepage redesign, but title completion and next-month retention fall. What would you conclude, and what would you investigate before recommending launch or rollback?

Product case · experimentation · recommendation§
Practice against the follow-up probes
  • Which of these three metrics should carry the decision, and why?
  • What mechanisms could push hours up while pushing completion down?
  • How would you tell "more low-intent viewing" apart from "worse recommendations"?
  • What segments would you cut first, and what would each cut tell you?
  • Retention is slow and noisy. How do you make a launch decision on a reasonable timeline anyway?
Show answer guide
Also: ml-monitoring

What the interviewer is probing

Metric hierarchy judgment: does the candidate recognize that engagement volume is a proxy that has come apart from the outcomes it proxies for (satisfaction, retention), and that when proxies and true outcomes disagree, the true outcome wins? Also probing mechanistic thinking — a strong candidate generates concrete hypotheses (autoplay inflation, accidental starts, discovery of shallow content) and maps each to an observable signature, rather than proposing generic "dig into the data."

Strong answer outline

  • State the metric hierarchy immediately: retention is closest to the business outcome; completion is a satisfaction proxy; raw hours is the weakest of the three and the easiest to inflate mechanically. A design that trades retention for hours is a regression, full stop.
  • Generate mechanisms with signatures: (a) autoplay/preview inflation — hours up via many short sessions, starts-per-session up, completion down; (b) accidental or low-intent starts — high abandon rate in first 5 minutes; (c) discovery shifted toward bingeable-but-shallow content — title mix shift, diversity down; (d) the redesign buried search or My List — navigation funnel changes for returning users with intent.
  • Check measurement artifacts before behavior: did the redesign change what counts as a "view start" or how hours are logged? Instrumentation changes masquerade as behavior changes constantly.
  • Segment cuts, each tied to a hypothesis: device (autoplay behavior differs), profile maturity (novelty effects hit tenured users differently), household sharing, content type, market.
  • Handle the retention timeline honestly: use leading indicators validated against retention historically (completion, successful- session rate, days-active), run the experiment longer for a novelty washout, and pre-register the decision rule: launch only if retention is flat-or-up once leading indicators stabilize.
  • Recommendation shape: likely rollback or iterate — but a strong answer specifies what evidence would change that call.

The underlying concept

This is Goodhart's law meeting proxy metrics: when a measure becomes the target, it stops being a good measure. Engagement volume correlates with satisfaction until you optimize for it directly, at which point systems find ways to generate engagement that satisfaction doesn't back — autoplay, clickbait thumbnails, low-intent sessions. Mature experiment programs therefore maintain a metric hierarchy (true north outcomes, validated proxies, diagnostics) and treat proxy-outcome divergence as an alarm, not a mixed result. The practical skill is mapping each candidate mechanism to a signature you can actually observe in the data.

Source

Distilled Prep canon — curated from Netflix's public work on experimentation and personalization measurement.

Source: Netflix engineering blog

Netflix · SWE · DS ·

You run a high-velocity data pipeline that transforms catalog metadata from multiple upstream sources and publishes a new version every 10 minutes. A past incident showed that corrupted data — not a bad code deploy — took down playback for millions of users before anyone noticed. Your existing code canary tooling requires 30–60 minutes to reach statistical confidence and only catches code changes, not data changes.

Design a system that validates each new data version before it reaches production, detects corruption in under 10 minutes, and does so using real production traffic — without exposing the majority of users to the bad data if corruption is present.

Systems design · data-pipelines · reliability · Jun 2026§
Practice against the follow-up probes
  • Why is shadow or synthetic traffic insufficient here? What does real production traffic give you that replay traffic cannot?
  • You've chosen to abort experiments early the moment you see regression rather than wait for full statistical confidence. What are the failure modes of that decision, and when would it burn you?
  • Your primary signal is actual playback starts per second rather than latency or error rates. Walk me through why a data corruption event might not surface as an application error at the service layer.
  • The orchestrator itself is a stateful coordinator that restarts sometimes. Walk me through every race condition or dropped-state scenario and how you'd harden against each.
  • Your detection window is 10 minutes; your data pipeline runs every 10 minutes. What happens to the system's correctness guarantees if the pipeline ever accelerates to 5-minute cadence or if two versions publish in overlapping windows?
Show answer guide
Also: data-quality

What the interviewer is probing

The question tests whether the candidate can extend the mental model of code canary deployments to data deployments — recognizing that data is a deployable artifact with its own blast radius. The interviewer is probing architecture (baseline/canary cluster separation, orchestrator coordination), metric judgment (behavioral vs. technical signals), causal reasoning (emergent corruption in transformed outputs vs. validated inputs), and degraded-mode thinking (what happens when the validator itself is in-flight or restarts). Strong candidates will also raise the tension between statistical confidence and time-to-decision without being prompted.

Strong answer outline

  • Frame the core insight first: data publications are deployments. Each new catalog version needs a gating mechanism analogous to what code canaries provide — a staged exposure with an automated go/no-go decision before the version reaches the full fleet.
  • Cluster topology: maintain three persistent clusters in a canary region — a baseline cluster pinned to the last known-good version and a canary cluster receiving the new version under test. A dedicated orchestrator instance coordinates the experiment; it must not self-validate (i.e., not consume its own catalog output as the test signal).
  • Why production traffic: shadow traffic can replay requests to the metadata service but cannot simulate the full downstream playback lifecycle — manifest generation, DRM handshakes, device-side behavior. Corruption in the final transformed output may only manifest as a failure several hops downstream. Production traffic propagates through real paths and generates real behavioral signal.
  • Blast radius control: route only a small slice (~0.2%) of global traffic to the canary cluster via session affinity (sticky routing). Session affinity is critical: once a user is assigned to baseline or canary, all their requests stay there for the experiment window, preventing cross-contamination and making the comparison clean.
  • Metric selection: prefer a behavioral metric — actual playback starts per second (SPS) — over technical metrics like latency or HTTP error rates. Catalog corruption may cause downstream services to fail silently or return empty results that are syntactically valid; application-layer errors may not surface. SPS directly measures whether users are successfully reaching playback, the true north star.
  • Decision policy: stream metrics in real time and abort immediately upon detecting regression against a tight threshold rather than collecting data for post-hoc analysis. This sacrifices some statistical confidence but is necessary given the 10-minute window. Threshold tuning is domain-specific and should be calibrated against controlled failure injection experiments, not intuition.
  • Orchestrator hardening: three specific failure modes to address: (1) in-flight experiments on restart — the orchestrator must persist experiment state durably and resume polling rather than abandon mid-flight; (2) leader election during rolling deploys — multiple orchestrator instances could trigger duplicate experiments for the same version; use a distributed lock or version-keyed idempotency check; (3) version synchronization — in multi-tenant services where different clients consume at different cadences, gate experiment start on confirming both baseline and canary clusters have fully loaded the correct versions.
  • Multi-tenant signal: different client types (mobile, TV, web) have different traffic volumes and downstream dependencies. Run separate experiments per major client type; the highest-traffic or most playback-critical tenant will detect failures fastest and should be the primary gate.
  • Validate the validator: conduct controlled failure injection — deliberately corrupt data in staging, route a small traffic slice through the canary flow, and confirm detection and blocking fire correctly. This is a prerequisite before trusting the system in production.
  • Common wrong turns: (1) relying solely on input-level validation from upstream sources — this misses emergent corruption in the transformation layer; (2) treating this as purely a monitoring problem rather than a gating/blocking problem — detection without blocking doesn't reduce blast radius; (3) using aggregate error rate as the primary metric, which masks silent data failures; (4) not accounting for orchestrator statefulness, leading to abandoned experiments or duplicate triggers.

The underlying concept

Code canaries work by routing a fraction of traffic to a new binary version and comparing behavioral outcomes between the new and old version before full rollout — the key insight being that traffic itself is the test. The same principle applies to any artifact that can corrupt production state, including data. A data canary treats each published data version as a deployable and gates promotion on a behavioral comparison under live traffic. The critical design constraint is that behavioral metrics — what users actually accomplish — are more reliable signals of data quality than technical metrics like error rates, because a semantically corrupted but syntactically valid payload propagates silently through application layers and only fails at the point of real use. Session affinity (sticky routing) is the mechanism that makes a clean A/B comparison possible within a single short experiment window: without it, a user's requests could be split across baseline and canary, contaminating both measurement arms.

Source

Derived from The Data Canary: How Netflix Validates Catalog Metadata

Netflix · DS · MLE ·

You run a content studio that delivers hundreds of titles per year to a streaming platform. Each title goes through a multi-month production pipeline, and a late asset delivery — even by a few days — can cascade into a missed launch date that costs millions in marketing spend and subscriber goodwill.

Your operational teams currently rely on manually estimated delivery dates from production partners. These estimates are often missing entirely for early-stage titles and grow increasingly inaccurate as productions encounter the typical chaos of filmmaking.

Design an end-to-end ML system that predicts, on a daily basis, when each in-flight production will deliver its final media assets. Your system should fill gaps where no estimate exists, improve on existing estimates where they do exist, and give operators enough lead time to meaningfully intervene before a launch miss becomes inevitable.

ML system design · forecasting · data-quality · Jun 2026§
Practice against the follow-up probes
  • Your model predicts "days until delivery." How do you define the training target, and what's the right loss function — and why might mean absolute error mislead you here?
  • Production signals are noisy and arrive at different cadences. How do you structure your training data so the model generalizes across all stages of production without leaking future information?
  • You now have two delivery estimates for every title: the partner-supplied scheduled date and your model's prediction. How do you decide which one to surface to an operator, and what happens when they disagree?
  • Six months before delivery your model beats manual schedules on 76% of titles. On the other 24%, it's worse. How do you characterize and handle that 24%?
  • The model's predictions feed back into partner behavior — if teams act on predicted slips, production partners may update their own schedules. How does that feedback loop affect your model over time?
Show answer guide
Also: ml-monitoring

What the interviewer is probing

This question probes end-to-end ML system design across problem framing, feature engineering with temporal data, evaluation metric judgment, and deployment under distributional complexity. It tests whether the candidate understands that a daily-snapshot regression model must be trained on snapshotted data to avoid future leakage — a subtle but critical architecture decision. It also probes decision quality: knowing when not to trust your own model and building serving logic that degrades gracefully to manual schedules is where production systems diverge from research prototypes. The feedback-loop probe reveals whether the candidate thinks at the level of a system embedded in human workflows, not just an isolated predictor.

Strong answer outline

  • Problem framing: The target is a continuous value — days until asset delivery — observed daily per title per asset type (Locked Cut and final master separately, since they have different decision implications). The key constraint is that predictions must be freshly computed each day and reflect the latest production state; this rules out static models trained once at intake.
  • Training data structure (the critical design choice): Create a daily snapshot table: one row per (title, asset_type, calendar_date), with all features reflecting their value as of that date and the label being actual_delivery_date − calendar_date. This point-in-time materialization prevents future leakage and lets the model learn how signals evolve over a production's life. A common wrong turn is training on final-state features and then applying the model to mid-production inputs.
  • Features: Production-phase indicators, days since key upstream milestones (e.g., principal photography wrap), scheduled delivery date (the manual estimate, treated as a feature not the target), deviation between scheduled date and today's implied progress, historical slip rates by content type / studio / buying org, seasonal signals (holiday clustering, release-calendar density), and lag features of the prediction itself (how much has the model's estimate drifted over the last N days — high drift is itself a risk signal).
  • Model choice and loss: Gradient-boosted trees are a natural fit for tabular production data with mixed types and missing values. MAE is interpretable but hides asymmetric cost: a prediction that's 2 weeks early is operationally different from one that's 2 weeks late (early = unnecessary rework cost, late = compressed timeline risk). Consider a quantile loss at the 70th–80th percentile as a conservative bias, or report both the median prediction and a "risk bound" at the 85th percentile. Avoid optimizing purely for mean — the tail behavior (percentage of predictions off by more than X days) matters more for launch-miss prevention.
  • Evaluation beyond accuracy: Track (1) mean and median absolute error by horizon-to-delivery (model should be most accurate in the final 8 weeks), (2) directional bias (consistently early or late by segment), (3) coverage — the model should produce a prediction for 100% of titles, filling the gaps manual schedules leave, (4) a cumulative error metric like Accumulated Error Days that captures how wrong predictions were over the full pre-delivery window, not just at one snapshot, and (5) calibration of risk bounds — does the 85th-percentile estimate actually contain the true delivery date 85% of the time?
  • Serving logic: Do not blindly replace manual schedules. Build an ensemble-of-confidence approach: if the model has strong historical accuracy for a given buying org / content type, default to the model prediction; if not, default to the scheduled date. Surface both estimates side-by-side in dashboards so operators can apply judgment. Critically, flag titles where manual schedule and model diverge by more than a threshold — that divergence is itself a risk signal worth surfacing as an alert. Maintain incentive for partners to keep updating their manual estimates, since those estimates are input features; communicate this dependency explicitly.
  • Feedback loop risk: If operators act on predicted slips (e.g., allocating extra resources), production partners may update their schedules in response, changing the distribution the model was trained on. Monitor model residuals over time and retrain frequently. In the limit, treat the intervention as a confounder and consider separating evaluation cohorts of acted-upon vs. unacted-upon predictions.
  • Common wrong turns: (1) Training a single static model at intake ignores that the model's job is to update in real time as production evolves. (2) Using final-state features in training — leakage. (3) Treating missing scheduled dates as an edge case rather than a core use case. (4) Evaluating only on average accuracy rather than on the tail and on bias by segment.

The underlying concept

Predicting time-to-event from an evolving set of features — sometimes called "survival analysis" or "dynamic hazard modeling" — is structurally different from static regression: the same entity is observed repeatedly over time, features change each day, and the model must generalize across different stages of the lifecycle simultaneously. The key discipline is point-in-time correctness: every training row must contain only information that would have been available on that calendar date, because any leakage from the future produces optimistic offline metrics and degraded live performance. Evaluation must also respect the time dimension — accuracy at 6 months out and accuracy at 2 weeks out serve different operational decisions and should be measured separately. Finally, a model that feeds human decision-making creates a reflexive system: predictions change behavior, behavior changes outcomes, and outcomes change future training data, which is why monitoring residuals over time and preserving a held-out non-intervened cohort for evaluation are engineering requirements, not afterthoughts.

Source

Derived from Predicting Risk in Content Launches: How Data-Driven Insights can Transform Launch Planning

Meta · SWE ·

You run a large-scale, latency-sensitive request-serving fleet — think ads retrieval, search ranking, or similar — where each incoming request fans out to many threads that must complete within a tight deadline. The fleet runs standard Linux with a general-purpose CPU scheduler that has no knowledge of your workload structure.

A kernel upgrade introduces a scheduling regression: p99 latency climbs, timeout errors rise, and business metrics worsen. Rolling back the kernel is an option but creates long-term technical debt. How do you design a workload-aware scheduling policy for this fleet, and how do you build the surrounding infrastructure so that scheduling improvements can be iterated on continuously rather than being one-off fixes tied to kernel release cycles?

Systems design · infrastructure · performance · Jul 2026§
Practice against the follow-up probes
  • Before you write a single line of scheduler code, how do you diagnose where the scheduling regression is actually coming from — what instrumentation do you reach for?
  • You decide to soft-partition CPUs into a latency-critical pool and a background pool. How do you determine the right pool sizes, and what happens when the split is wrong under a traffic spike?
  • Cache locality is a key win in your design. How do you measure whether a scheduling change actually improved L3 hit rates, and how do you distinguish that effect from other concurrent changes on the fleet?
  • Your policy ships as a user-space binary that can be reloaded without a kernel upgrade. What does your experiment framework look like — how do you safely A/B test two scheduling policies on a live production fleet without corrupting in-flight requests?
  • A future team wants to let the application itself signal thread priority to the scheduler — for example, flagging a thread as working on a high-value request. What are the risks of exposing that interface, and how do you prevent it from being abused or destabilizing the scheduler?
Show answer guide
Also: distributed-systems

What the interviewer is probing

This question probes architecture thinking across the kernel-userspace boundary: does the candidate understand why a general-purpose scheduler is a poor fit for latency-sensitive fan-out workloads, and can they design a partitioning policy with explicit trade-offs around pool sizing, cache affinity, and failure modes? The deployment model — policy as a reloadable user-space artifact rather than a kernel patch — tests whether the candidate sees iteration speed as an architectural constraint worth designing around. The follow-up on application-scheduler interfaces probes systems thinking around trust boundaries and interface design: who gets to signal priority, and what prevents that interface from becoming a source of instability.

Strong answer outline

  • Diagnose first, design second. Before designing a custom policy, characterize the regression: use scheduler tracing (e.g., perf sched, BPF tracepoints on context switches, runqueue wait times) to identify whether the regression is excess preemption, poor cache affinity, priority inversion, or NUMA thrashing. The fix is different for each.
  • Model the workload structure. A request-serving fan-out has a clear thread taxonomy: request-handling threads on the critical path (latency-sensitive, short-burst), background threads (compaction, logging, async I/O — throughput-oriented). A general-purpose scheduler cannot distinguish these; a custom policy can encode this knowledge directly.
  • CPU pool partitioning. Soft-partition CPUs into a latency pool and a background pool. 'Soft' is important — hard partitioning wastes capacity during imbalance; soft partitioning allows the pools to borrow from each other under load, with a priority bias rather than a hard boundary. Pool sizing starts from observed utilization ratios and is adjusted dynamically via load-based heuristics.
  • Cache locality as a first-class design goal. Scheduling related threads to the same physical cores over time improves L3 hit rates and reduces DRAM accesses — critical when the fan-out brings together many threads working on shared data structures. NUMA-aware placement (keep threads and their memory on the same socket) is a follow-on optimization.
  • Deployment model determines iteration speed. Encoding the policy as a reloadable user-space program (BPF program loaded by a user-space daemon) decouples the scheduling improvement cycle from the kernel release cycle. Rolling out a change is a daemon restart, not a kernel patch with months of validation. This is an architectural choice, not an implementation detail — it is what makes continuous optimization tractable.
  • Experiment framework for live scheduling changes. A/B testing two scheduling policies on a live fleet requires: (a) host-level assignment (not request-level, to avoid mixing policies on the same host), (b) a grace period on policy switchover to let in-flight requests drain, (c) a rollback trigger based on p99 latency and timeout error rate guardrails, (d) metrics stratified by traffic mix to catch load-dependent effects.
  • Common wrong turns: designing for average latency rather than tail latency (the business impact lives at p99+); using hard CPU partitioning and starving one pool; building the policy into the kernel binary rather than user space (kills iteration speed); skipping the diagnosis step and tuning a policy against the wrong bottleneck.
  • Application-scheduler interface (the hardest part). Allowing the application to signal thread importance (e.g., 'this thread is serving a high-value request') is powerful but risky. Trust model must be explicit: the scheduler must treat these signals as hints, not hard constraints, with a cap on the boost any thread can claim. Abuse vectors — all threads claiming high priority — must be rate-limited or quota-bounded. The interface should be instrumented so gaming is detectable.

The underlying concept

General-purpose CPU schedulers like CFS and EEVDF optimize for fairness and throughput across arbitrary workloads — they are deliberately ignorant of application semantics. For most workloads this is fine, but for latency-sensitive request-serving systems the cost of that ignorance is measurable: threads on the critical path compete on equal footing with background work, cache affinity is not preserved across scheduling decisions, and small changes in the scheduler's virtual-time accounting can shift tail latency by tens of milliseconds. The key insight behind workload-aware scheduling is that the application already has the information the scheduler lacks — which threads are on the critical path, which are background, which requests are high-value — and a custom scheduler can use that information to make better decisions than any general-purpose heuristic. The deeper architectural point is that where the policy lives determines how fast you can improve it: a policy encoded in a kernel module requires a full kernel release cycle to ship; a policy encoded in a reloadable BPF program ships in days. At the scale where a single percentage point of latency improvement translates to megawatts of power savings and measurable revenue lift, that iteration speed difference is itself a strategic asset.

Source

Derived from Modernizing the Meta Ads Service With an Open-Source Kernel Scheduler

Meta · SWE · MLE ·

A research team trains models in a region where GPUs are available, but their curated datasets live in a central object store in a different region. Today, before starting any training job, they must manually kick off a data-ingestion job that copies a full snapshot of the dataset to the target region — a process that can take hours for large datasets. They then wait for it to finish before submitting their training job.

For large production training runs spanning weeks, this one-time cost is acceptable. But most jobs are small exploratory experiments where researchers iterate rapidly: tweak the dataset, re-run, analyze outputs, repeat. Here, the hours-long ingestion step is the bottleneck on research velocity, not GPU compute.

Design a storage system that eliminates the manual ingestion step for these iterative workloads. A researcher should be able to submit a job without pre-copying data and begin training within minutes, even if the data hasn't been replicated to the target region yet. Be explicit about the latency, consistency, and cost trade-offs your design introduces.

Systems design · caching · ml-platform · Jul 2026§
Practice against the follow-up probes
  • Your system is doing on-demand hydration across regions. How does the first-access latency compare to local storage, and how does that affect the first few training steps?
  • You support multiple epochs — the model iterates over the same dataset several times. How does your caching strategy change across epochs, and what is the eviction policy?
  • A researcher modifies their dataset mid-experiment and re-submits. What consistency guarantees does your cache provide, and how does stale data get invalidated?
  • How do you handle the case where the remote region is temporarily unreachable — does training stall, degrade, or fail, and what's the right answer?
  • You described this as a trade-off between performance and iteration speed. How would you instrument the system so the team can tell when a job has crossed the threshold where pre-copying would actually have been faster?
Show answer guide
Also: infrastructure

What the interviewer is probing

This question tests whether the candidate can translate an OS-level abstraction — hierarchical memory with demand paging and prefetching — into a distributed systems design, and whether they can reason about the real optimization target (researcher iteration speed) rather than the obvious one (data-loading throughput). Strong candidates will recognize that the write-once, read-many pattern of training datasets makes aggressive caching safe, will design a prefetch API that hides cross-region latency behind compute work, and will explicitly frame the trade-off between performance predictability (full pre-copy) and iteration speed (on-demand hydration) rather than claiming the new design is strictly better.

Strong answer outline

  • Frame the actual problem: For large training runs, pre-copy is fine — it amortizes over weeks. The problem is small iterative experiments where researchers spend more time waiting on ingestion than on the model. The goal is to cut the setup time from hours to minutes for this workload, accepting occasional I/O stalls that wouldn't occur with a full pre-copy.
  • Core insight — treat storage as a tiered cache:
  • L1: GPU-host memory (fastest, smallest — the current training batch)
  • L2: Local flash on the GPU host (warm data across a few batches)
  • L3: Regional disaggregated flash storage, co-located with GPUs (data for the current job's duration)
  • Source of truth: global HDD-backed object store (remote, durable, cheap)
  • This mirrors OS demand paging: data is pulled toward compute on first access and cached for reuse.
  • Demand hydration: On a cache miss at L3, the client transparently fetches from the remote source of truth. First-access latency will be higher (cross-region), so the design must hide this.
  • Prefetching to hide latency:
  • Dataloader prefetch: the dataloader pre-loads the next batch into memory while processing the current one — standard overlap of I/O and compute.
  • Explicit deep prefetch API: the dataloader triggers background hydration of the next several minutes of data into L3 before it's needed, prewarms metadata cache. This is what allows the first real training step to start before all data is local.
  • Multi-epoch reuse: Training iterates over the same data multiple times. The L3 cache should hold data for the duration of the training cycle (TTL tied to job lifetime or a configured window), not evict after first use. LRU within that window handles capacity pressure when multiple jobs share the cache.
  • Consistency: Training datasets are write-once — once a researcher publishes a dataset version, it doesn't change during the training run. Cache invalidation is therefore not a hot path; it happens on explicit dataset version update. Version identifiers in the cache key prevent stale reads across experiments.
  • Failure mode: If the remote source of truth is unreachable and L3 has a miss, the training step stalls. For iterative small jobs this is acceptable; for production runs you'd want the full pre-copy. The system should expose a metric for cross-region fetch rate so researchers can identify when they've crossed the threshold where pre-copying would have been cheaper.
  • Trade-offs to name explicitly: First-epoch performance will be lower than pre-copy (cold L3). Subsequent epochs are fast (warm L3). Power and flash capacity are consumed in the GPU region. The design is strictly worse than pre-copy on throughput predictability, and strictly better on time-to-first-step.
  • Common wrong turns: Candidates who propose caching without a prefetch strategy will have a cold-start problem on the first epoch that stalls GPUs. Candidates who don't discuss eviction policies will overrun flash capacity. Candidates who claim this design is better in all cases have not thought carefully about the large-run use case.

The underlying concept

Operating systems have solved the problem of 'data is far away but compute needs it now' through hierarchical caching with demand paging and prefetching: bring data close to compute on first use, keep it there for reuse, and hide the fetch latency behind ongoing computation. Distributed training storage can borrow this model directly — the key enabling property is that training datasets are write-once and read-many, which makes aggressive caching safe (no cache coherence problem during a run) and makes prefetching tractable (access patterns are sequential and predictable). The architectural insight is that 'ingestion' and 'training' don't have to be sequential phases; demand hydration with deep prefetching collapses them into a single overlapped operation, converting an hours-long blocking step into a background process invisible to the researcher.

Source

Derived from Meta’s AI Storage Blueprint at Scale

Meta · SWE ·

Design a globally distributed social feed system — write path and read path — for users ranging from ordinary accounts to celebrities with hundreds of millions of followers.

Systems design · distributed-systems · caching§
Practice against the follow-up probes
  • Fan-out-on-write vs. fan-out-on-read: what forces you into a hybrid?
  • A celebrity posts and 200 million timelines are stale. What actually happens in your design in the next 500 ms?
  • How do deletions and privacy changes propagate — and how fast must they?
  • What are your hot keys, and what specifically absorbs them?
  • What degrades first in a regional outage, and what do users see?
Show answer guide
Also: scalability

What the interviewer is probing

Whether the candidate recognizes that the celebrity case breaks any uniform design: pure fan-out-on-write melts on a 100M-follower post, pure fan-out-on-read makes every ordinary feed load expensive. The hybrid answer is table stakes; differentiation comes from the details — hot-key mitigation, cache strategy, pagination stability, and treating deletion propagation as a correctness requirement, not an afterthought.

Strong answer outline

  • Hybrid fan-out by author class: normal users fan out on write (precomputed timeline lists per follower, cheap because follower counts are small); high-follower accounts fan out on read (their recent posts merged into follower feeds at request time from a heavily cached per-author store).
  • Read path: timeline = precomputed list + merge of followed celebrities' recent posts + ranking layer; cache aggressively at the edge with short TTLs for celebrity content since one entry serves millions of readers — that cache is the hot-key absorber.
  • Write path: async fan-out via queues with backpressure; idempotent timeline inserts (retries are constant); celebrity posts skip fan-out and instead invalidate/warm the per-author cache.
  • Deletions and privacy: tombstones filtered at read time give fast effective deletion even before async cleanup of fanned-out copies completes; privacy changes flip a read-time ACL check rather than rewriting timelines.
  • Pagination and dedup: cursor-based pagination over stable IDs (offsets break as items insert), dedup at merge since an item can arrive via multiple paths.
  • Multi-region: writes home-regioned with async replication; feeds tolerate seconds of staleness (availability over freshness), but deletions get priority replication; degraded mode serves cached/stale timelines and queues writes.
  • Targets stated: p99 read latency, fan-out completion SLO for normal posts, deletion propagation SLO, and cache hit-rate as the capacity lever.

The underlying concept

Fan-out placement is the classic read-amplification vs. write-amplification trade, and skewed follower distributions mean no single placement works — power-law workloads force hybrid designs where the strategy is chosen per key by its skew. The companion principle is that popularity concentrates load onto single keys, and the only real defenses are replication of that key's data (caching) and coalescing of its requests. Feeds also illustrate consistency budgeting: staleness is tolerable for inserts but not for removals, so the design spends its consistency effort asymmetrically.

Source

Distilled Prep canon — curated from Meta's public work on feed and caching infrastructure.

Source: Meta engineering blog

Meta · MLE · DS ·

Your team owns retrieval for a content feed. The system has a hard 100-millisecond end-to-end latency budget before results must be handed to downstream ranking. Your retrieval pipeline currently does: (1) compute a user embedding, (2) run ANN search over 80M items, (3) filter for eligibility, (4) score and rerank survivors. You're proposing to add a neural reranking layer that applies richer user-item interaction modeling to the candidate pool — early offline experiments show a meaningful improvement in NDCG.

How do you decide whether to ship the neural reranking layer? Walk through how you'd measure its real impact, what guardrails you'd put in place, and how you'd manage the latency trade-off — including what happens when the new layer pushes p99 latency over budget on a bad traffic day.

Product case · recommendation · performance · May 2026§
Practice against the follow-up probes
  • Your offline NDCG improvement doesn't translate to the online A/B test — engagement is flat. What are the most likely explanations, and how do you diagnose each?
  • The neural reranking layer adds 20ms at median but 55ms at p99. The ranking team's latency SLA is measured at p95. How do you decide whether 20ms median gain is worth the p99 risk?
  • You want to measure the retrieval layer's contribution to final recommendation quality, but the ranking model downstream can partially compensate for worse retrieval inputs. How do you isolate retrieval's causal contribution?
  • Retrieval operates over a shared item pool. Adding neural reranking means certain items get systematically deprioritized before ranking ever sees them. What fairness or diversity risks does this introduce, and how do you monitor for them?
  • The reranking layer improves engagement metrics but you notice same-day content — posts from the last few hours — is surfacing less often. How do you think about the tension between engagement optimization and content recency?
Show answer guide
Also: ml-platform

What the interviewer is probing

This question tests metric judgment and causal reasoning in a multi-stage ML system: candidates must reason about offline-online gaps, latency distributions (not just means), the difficulty of attributing quality to a stage when downstream components compensate, and second-order effects like content fairness and recency that engagement metrics don't directly capture. Strong candidates treat latency as a budget with a distribution, not a single number, and raise the isolation problem unprompted.

Strong answer outline

  • Decision framing: The question isn't just "does NDCG go up" — it's whether the improvement is real (not an artifact of offline evaluation), large enough to justify latency cost, and durable enough to survive production conditions. Frame the decision across three dimensions: quality impact, latency risk, and second-order effects.
  • Offline-online gap diagnosis: NDCG on a held-out set measures whether the reranker correctly orders items that were eventually shown and interacted with — but it doesn't capture exploration (items never retrieved under the old system that would have been great), position bias in the training labels, or distribution shift between the offline eval set and live traffic. Common causes of a flat online experiment: training labels reflect the old retrieval distribution, so the reranker learned to score items the old system already selected well; or the downstream ranking model compensates for changes in retrieval order, absorbing the signal.
  • Latency as a distribution, not a point: p50 improvement is not the right gate. Measure p95 and p99 under peak traffic, not just average load — social media traffic has sharp intraday spikes. Budget the 100ms across stages explicitly (e.g., 15ms user tower, 40ms ANN, 15ms filter, 20ms reranking, 10ms margin) and test whether the new layer fits in the reranking slot under the worst observed traffic conditions, not just median. Consider adaptive degradation: if the reranking layer times out, fall back to dot-product scoring rather than failing the request.
  • Causal isolation of retrieval quality: The challenge is that ranking partially compensates for worse inputs — if retrieval degrades, the ranking model rescores from a worse pool but still finds the best available items. Measure retrieval quality directly: recall@K (what fraction of items the ranking model would have chosen are in the retrieved set), and use a forced-exposure experiment where you hold the ranking model fixed and vary only retrieval, rather than measuring end-to-end engagement which conflates the two.
  • Guardrails for the experiment: Engagement lift (primary); latency p50/p95/p99 per stage (hard guardrail — automatic rollback if p99 exceeds budget under production traffic); same-day content rate (recency guardrail — a reranker trained on historical engagement may penalize fresh items with sparse signals); creator/content diversity metrics (a learned reranker may amplify popularity bias if not explicitly penalized).
  • Recency tension: Engagement-trained models learn that items with engagement history are safer bets — new items have sparse or zero training signal and may get systematically downscored. Monitor same-day content share separately. Mitigate by: adding a freshness feature into the reranker, adding an exploration budget (hold back N% of retrieval slots for recency-boosted items), or using a separate retrieval path for fresh content that bypasses the reranker.
  • Common wrong turns: Treating NDCG improvement as sufficient evidence to ship; ignoring latency distributions; not naming the isolation problem; missing that the reranker could systematically harm new content.

The underlying concept

Multi-stage recommendation systems create an attribution problem: the observable outcome (did the user engage?) is produced by a chain of stages, each partially compensating for the previous. Improving retrieval may not show up in engagement if ranking absorbs the change, and degrading retrieval may not hurt engagement if ranking compensates from a smaller pool. Isolating a stage's causal contribution requires either holding all downstream stages constant (forced-exposure design) or measuring a stage-specific metric (recall@K for retrieval) that doesn't depend on downstream behavior. Latency in these systems is also a distribution problem, not an average problem: the tail of the latency distribution during traffic peaks is what determines whether a feature ships, and optimizing for median latency while ignoring p99 is a common failure mode that surfaces only in production.

Source

Derived from SilverTorch: Index as Model — A New Retrieval Paradigm for Recommendation Systems

Meta · SWE ·

You operate a large data center region housing millions of containers managed by a control plane made up of several interdependent services — a scheduler, an allocator, a broker, a coordinator, and so on. The entire region loses power instantaneously with zero warning. When power is restored, every service attempts to start simultaneously and must rediscover each other autonomously.

Two specific failure modes emerge: 1. Circular dependencies: The control plane services that must start first themselves depend on each other, creating a chicken-and-egg deadlock at boot time. 2. The boomerang problem: The mechanism you use to orchestrate shutdown and recovery (broadcast unavailability signals) ends up shutting down the very control plane services that are supposed to send those signals, orphaning dependent services that never receive the signal.

Design an architecture that handles both failure modes reliably. Then walk through the tradeoffs you made — what you chose to tolerate versus what you deemed unacceptable — and how you would validate your design before exercising it against a live production region.

Systems design · infrastructure · reliability · Jun 2026§
Practice against the follow-up probes
  • Before any clever bootstrapping logic, how do you prevent circular dependencies from being introduced in the first place — and how do you make that guarantee continuous as the system evolves rapidly?
  • Your 'jumpstart' kit that breaks circular dependencies at recovery time is itself a dependency. What are its failure modes, and who owns keeping it operational?
  • For the boomerang problem, you chose to have control plane services ignore shutdown signals from power-related events. What are the risks of that choice — could it mask a real failure you'd want to respond to?
  • You validated readiness incrementally: pre-production regions → shadow regions → smallest production region → large production regions. At each stage, what specific properties were you trying to confirm before moving to the next? What would have caused you to stop?
  • At 50-60x the scale of a single fault domain, what new failure modes emerge that simply don't appear at smaller scale, and how does your design account for them?
Show answer guide
Also: distributed-systems

What the interviewer is probing

This question probes whether candidates understand that bootstrapping is a fundamentally different operational mode than steady-state — the failure modes are distinct and the standard tooling may not apply. It surfaces architecture instincts around dependency management (detecting statically vs. breaking dynamically), the hazard of a system being its own signal consumer (the boomerang pattern), and the maturity to reason about tolerable vs. intolerable failure modes rather than seeking a zero-risk design. The validation-staging section probes risk management and blast-radius thinking.

Strong answer outline

Problem framing - Distinguish two failure modes clearly: deadlock-at-boot from circular deps vs. the boomerang where the signal system takes down its own dispatcher. - Recognize that scale changes the problem: at 50-60x a single fault domain, replica placement means dependencies that 'usually resolve' can all block simultaneously.

Circular dependency design - Static detection first: encode the dependency graph of control plane services and enforce it in CI/CD (analogous to Belljar tests) — fail the build when a new dependency would introduce a cycle. This catches the problem cheaply and early. - But static detection can't catch everything in a fast-moving codebase, so you also need a dynamic break: a minimal 'jumpstart' toolkit — ideally a stripped-down, dependency-free binary or set of primitives — that can bring up the most foundational services without relying on the control plane itself. Think of it as a BIOS: it has no runtime dependencies. - The jumpstart kit must itself be tested in isolation, kept minimal, and owned with high discipline — it is the last resort and cannot fail. - Wrong turn: trying to enumerate a 'safe startup order' manually and encoding it as a config. This is fragile at scale and requires constant maintenance.

Boomerang problem design - Root cause: power-related unavailability events are broadcast globally and consumed by the orchestrator to initiate shutdown — but the orchestrator is also in the blast radius of its own broadcast. - Solution: control plane services exempt themselves from power-related shutdown signals (they treat them as informational, not actionable). They remain up to shepherd the recovery of other services. - Tradeoff: this means control plane services won't self-terminate if there's a real power-related reason they should (e.g., their own rack is unsafe). Mitigate by having a separate, narrower signal for 'this specific node must stop' that the control plane does respect. - Wrong turn: maintaining a static exclusion list of services to skip in the broadcast — operationally fragile, prone to staleness.

Defining tolerable vs. intolerable impact - Intolerable: data loss in storage/DB systems, DC hardware damage, failures that span beyond a single region, or failures that cannot be remediated within a defined MTTR. - Tolerable: transient service errors during boot convergence, bounded staleness in routing tables while the control plane reconverges, a small number of rack failures within a predefined threshold. - The principle: only accept impacts that post-incident remediation can fully reverse within a reasonable time window.

Validation strategy - Incremental blast radius: validate sub-problems (dependency graphs) on new/pre-production regions; then shadow (production-replica) regions; then smallest live production regions; then large production regions. - At each stage, confirm the specific invariant for that stage before proceeding: pre-prod confirms bootstrapping logic; shadow confirms production-fidelity behavior; small prod confirms blast-radius is bounded; large prod confirms storage/DB recovery. - Avoid preemptive actions before the test — draining traffic or pre-warming caches artificially — to represent a true zero-notice event. MTTR in the test mirrors real incident MTTR. - Continuous validation: don't treat this as a one-time milestone. Re-run as the system evolves; embed dependency checks in CI/CD so each deploy re-validates the invariant.

The underlying concept

Bootstrapping a distributed system after a total restart is categorically harder than operating it in steady state because the mechanisms that handle failures during normal operation — service discovery, health signals, orchestration broadcasts — are themselves services that must boot, yet may depend on each other to do so. This creates the circular dependency or 'ouroboros' problem: a true deadlock where no service can start because the one it needs hasn't started yet. The classical solution is a two-tier design: a minimal, dependency-free bootstrap layer (analogous to a computer's BIOS or bootloader) that brings up just enough foundation for the full control plane to self-assemble, combined with static dependency enforcement to prevent cycles from forming in the first place. The 'boomerang' failure mode is a subtler variant of the same class: a system that is both the producer and consumer of a critical signal must explicitly exempt itself from that signal's effects, or it will disable itself at the moment it is most needed. Both problems are examples of a general principle in resilience engineering — the recovery mechanism must be more primitive and more robust than the system it recovers.

Source

Derived from Lights Out, Systems On: Validating Instant Power Loss Readiness

Meta · DS · MLE ·

A new feed-ranking model improves short-term engagement metrics but increases inference infrastructure cost by 35%. Decide whether and how to launch it.

Product case · experimentation · ml-platform§
Practice against the follow-up probes
  • How do you translate the engagement gain into a value that can be compared against a dollar cost?
  • What beyond average engagement should the launch experiment measure?
  • The cost hits latency and capacity, not just budget. How do those feed back into user experience — and into your experiment?
  • What options exist between "launch as-is" and "don't launch"?
  • How would your answer change at 10x smaller company scale?
Show answer guide
Also: performance

What the interviewer is probing

Whether the candidate can put product gains and infrastructure costs in one decision framework instead of treating "engagement up" as self-justifying. Strong candidates convert both sides to comparable units (incremental revenue or retention value vs. serving cost), recognize that latency regressions can silently eat the engagement gain, and generate the middle-path options — distillation, cascades, selective inference — that experienced ML engineers reach for before accepting a 35% cost increase.

Strong answer outline

  • Frame the decision as ROI with uncertainty: value of the engagement lift (via revenue-per-engagement estimates or long-term holdouts) vs. annualized serving cost delta, including capacity displacement — what else can't run if this model takes the compute.
  • Audit the experiment for hidden costs: per-request latency and tail latency by device/region (slow feeds depress engagement — the model's gain may be net of a latency penalty already, or the penalty may bind only at peak), power/memory on constrained devices, and whether short-term engagement predicts long-term retention here at all.
  • Insist on a long-term readout: novelty effects and engagement-quality concerns (is the lift from more low-value impressions?) argue for a weeks-long holdout and guardrails on quality proxies.
  • Generate the middle paths: distill the model into a cheaper student; cascade (cheap model for most traffic, expensive one where it changes the decision); selective inference by user value or uncertainty; quantization/hardware placement; ship to segments where ROI clears.
  • State a decision rule and its sensitivity: launch fully only if value exceeds cost with margin; otherwise ship a cascade and re-measure.
  • Scale-awareness: at extreme scale, 35% inference cost is enormous in absolute dollars — engineering effort to shrink it almost always pays; at small scale, engineer time is the scarcer resource and shipping as-is may be right.

The underlying concept

At scale, ML models are products with unit economics: every ranking request has a marginal cost, and a model change shifts both the revenue and the cost curve. The discipline is marginal analysis — value of the lift minus cost to serve it — plus the recognition that serving budgets couple models to each other through shared capacity. Cascading and distillation exist precisely because prediction value is unevenly distributed across requests: most traffic doesn't need the expensive model, so spending compute only where it changes decisions dominates uniform spending almost everywhere.

Source

Distilled Prep canon — curated from Meta's public work on ranking systems and ML efficiency.

Source: Meta engineering blog

Meta · SWE · DS ·

Design a petabyte-scale metrics platform that powers both near-real-time dashboards and reproducible experiment analysis for thousands of concurrent experiments.

Systems design · data-pipelines · stream-processing§
Practice against the follow-up probes
  • Real-time dashboards and reproducible analysis want different things. Where do the paths split, and where do they reconcile?
  • Events arrive late, duplicated, and out of order. What semantics do you actually promise, and how?
  • Two teams compute "daily active users" differently. Whose number is right, and how does the platform prevent the argument?
  • An experiment analysis from three months ago needs to be reproduced exactly. What must have been true all along for that to work?
  • Schemas evolve weekly. How do you keep old data readable and old metrics computable?
Show answer guide
Also: experimentation, data-warehouse

What the interviewer is probing

Whether the candidate sees this as two systems with one source of truth — a fast approximate path and a slow correct path — and understands the reconciliation contract between them. Also probing governance instincts: at thousands of experiments, the hard problems shift from throughput to semantics — metric definitions, lineage, and reproducibility — and strong candidates treat those as architecture, not process.

Strong answer outline

  • Ingestion: durable event log as the spine; producers write with event IDs and event-time timestamps; schema registry with compatibility-checked evolution so old readers never break.
  • Two paths, one truth: streaming path computes windowed aggregates with watermarks for late data and effectively-once semantics via idempotent, keyed upserts — labeled provisional; batch path recomputes from the log with full dedup and late-data inclusion — labeled final and overwriting provisional numbers on a fixed lag (e.g., T+1). Dashboards show provisional; decisions and experiment readouts use final.
  • Honest semantics: exactly-once end-to-end is a contract you engineer per sink via idempotency, not a property you inherit; state it that way.
  • Metric governance as code: a central metric-definition layer (versioned, code-reviewed) from which both paths compile their computations — one definition of DAU, by construction; lineage tracked from metric to source events.
  • Reproducibility: immutable raw events with retention policy, versioned metric definitions, versioned experiment assignment logs, and snapshotted dimension tables — reproducing an analysis means re-running pinned versions against immutable data.
  • Experiment scale: precompute per-experiment-arm aggregates rather than per-query scans; cardinality control on dimensions; access controls and query cost budgets so one team's exploration can't starve the platform.

The underlying concept

This is the lambda-architecture idea matured: speed and correctness have different physics (streaming must decide with incomplete information; batch can wait for completeness), so mature platforms run both and define which one owns the truth and when. Watermarks formalize "how long we wait for stragglers," turning late data from a bug into a parameter. And reproducibility is an immutability discipline — recomputing f(data) requires that both f and the data be versioned and frozen — which is why metric governance belongs in the architecture, not in a wiki.

Source

Distilled Prep canon — curated from Meta's public work on data infrastructure and experimentation platforms.

Source: Meta engineering blog

Meta · DS ·

A core event-logging pipeline is discovered to drop an unknown fraction of mobile events during traffic peaks. Build a strategy to quantify the impact and restore trustworthy metrics.

Product case · data-quality · observability§
Practice against the follow-up probes
  • How do you estimate how much is missing when the missing data is, by definition, not there?
  • How do you determine whether the loss is random or systematically correlated with something that matters?
  • Which downstream metrics and experiments do you triage first?
  • What do you tell stakeholders while the investigation is running?
  • What permanent instrumentation prevents a silent recurrence?
Show answer guide
Also: experimentation

What the interviewer is probing

Comfort with missing-data reasoning under operational pressure: can the candidate construct estimates of the unobservable using redundancy (client vs. server logs, sequence numbers, invariant checks), and do they immediately grasp that correlated loss is the dangerous case — peak-time drops disproportionately delete data from the most active users and busiest markets, biasing every metric that matters. Also probing decision hygiene: which conclusions drawn from this data must now be revisited.

Strong answer outline

  • Quantify via redundancy: join client-side counters against server-received events; exploit per-session sequence numbers to count gaps; compare against independent systems that observe the same behavior (billing, server-side actions); inject synthetic heartbeat events at known rates as a canary.
  • Characterize the bias, not just the rate: loss concentrated at peaks means it correlates with heavy users, dense regions, evening hours, possibly device types with slower upload paths — quantify loss rate by segment and by event type (are purchases dropped as often as scrolls?).
  • Triage downstream: rank metrics and recent experiment decisions by exposure — anything comparing across time-of-day, geography, or engagement intensity is suspect; flat-rate loss mostly cancels in ratio metrics but correlated loss does not.
  • Communicate with error bars: publish a known-issues banner on affected dashboards, an estimated-impact range per metric, and a list of decisions under re-review — trust survives acknowledged uncertainty better than discovered silence.
  • Remediate in two tracks: fix the pipeline (backpressure, client-side buffering and retry, sampling that is explicit rather than accidental) and backfill where client buffers allow.
  • Prevent: data-quality SLIs (delivery rate vs. client counters), loss-rate alerts by segment, and end-to-end synthetic event monitoring as a permanent canary.

The underlying concept

Data missing "at random" merely adds noise; data missing in a way correlated with the outcome or the segment (missing-not-at-random) adds bias that no amount of volume fixes. Peak-load loss is almost guaranteed to be the second kind. The estimation strategy is always the same: find a second observation channel with different failure modes and use the disagreement to measure the first channel's loss. And the organizational lesson mirrors the statistical one — metrics infrastructure needs its own observability, because the failure mode of measurement systems is silence, not alarms.

Source

Distilled Prep canon — curated from Meta's public work on data infrastructure and measurement integrity.

Source: Meta engineering blog

Meta · MLE · SWE ·

Design a multi-stage recommendation system serving billions of users with a strict end-to-end latency budget of a few hundred milliseconds.

ML system design · recommendation · ml-platform§
Practice against the follow-up probes
  • Why multi-stage at all — what breaks if you rank everything with one model?
  • Where does each stage's latency budget go, and what do you do when feature hydration blows it?
  • How do you keep embeddings and features fresh without retraining or re-indexing constantly?
  • How do you handle cold-start users and brand-new items?
  • A new model wins offline but you can't trust that. Walk me through getting it safely to 100% of traffic.
Show answer guide
Also: feature-store, scalability

What the interviewer is probing

Whether the candidate understands the funnel economics that force the retrieval → ranking → re-ranking architecture: compute per candidate rises steeply while candidate count falls, and the design skill is allocating latency and compute across stages. Also probing operational ML maturity — feature freshness, offline/online parity, and safe rollout are where these systems actually fail, and strong candidates raise them unprompted.

Strong answer outline

  • Funnel structure with budgets: candidate retrieval (millions → thousands; ANN over embeddings, plus heuristic and graph sources) in tens of ms; ranking (thousands → hundreds; mid-size model, hydrated features) taking the largest share; re-ranking/policy (hundreds → the slate; diversity, integrity filters, business rules) in single-digit ms.
  • Feature infrastructure as the real bottleneck: a feature store with an online serving tier, batched hydration, caching of user features per session, and strict timeout-plus-default behavior so one slow feature never breaks the page. Offline/online parity — same feature definitions in training and serving — prevents the classic silent quality bug.
  • Freshness tiers: user long-term embeddings refresh daily; item embeddings on ingest; short-term interest via a real-time session feature stream rather than model retraining.
  • Cold start: fall back to popularity-by-cohort and content-based retrieval; explicitly widen exploration for new items to gather signal (and accept the small engagement tax it costs).
  • Feedback loops and integrity: the system trains on data it created — log propensities, hold out random exploration traffic, and put content integrity gates in the re-rank layer, not post-hoc.
  • Rollout: offline metrics gate → shadow scoring for parity checking → small-percentage online experiment with engagement and latency guardrails → staged ramp with automatic rollback triggers.

The underlying concept

Multi-stage ranking is the standard answer to a scaling identity: you cannot afford heavy computation on every candidate, so you spend cheap computation to decide where to spend expensive computation. Each stage trades recall for precision at rising cost per item — the architecture is a compute-allocation curve, and latency budgets are how it's enforced. The second load-bearing idea is that at this scale the model is a minority of the system: feature pipelines, freshness, parity, and rollout safety determine realized quality more than architecture choices, which is why interviewers push hardest there.

Source

Distilled Prep canon — curated from Meta's public work on recommendation infrastructure.

Source: Meta engineering blog

Meta · SWE · MLE ·

You run an object-storage service originally designed for web and social-media workloads — think billions of small reads at relaxed latency budgets. You're now asked to repurpose it for large-scale AI training: hundreds of thousands of GPUs, each needing the next data batch within a tight deadline, or the entire training cluster stalls waiting on the slowest node.

Your current architecture resolves every getObject(path) through several sequential metadata lookups across independently sharded services before the data transfer even begins; total metadata latency can reach hundreds of milliseconds. Your data is also proxied through a central tier rather than sent directly to the client.

Design the storage architecture changes that would let this system meet AI training's latency and throughput requirements without stalling GPUs. Be explicit about the trade-offs you're making against the goals of the original design.

Systems design · storage-systems · distributed-systems · Jul 2026§
Practice against the follow-up probes
  • Walk me through what actually happens when one storage node runs slowly — how does that affect the training cluster, and what does your architecture do about it?
  • You've eliminated the proxy tier. What did you gain, and what responsibilities has the client now taken on that it didn't have before?
  • Your metadata store is now a hot shard target: hundreds of thousands of GPUs simultaneously resolving the same popular model-checkpoint path. How do you handle that?
  • You chose a flat, unified metadata schema backed by a fast KV store. What did you give up by collapsing the layered metadata hierarchy, and are there workloads where the old design was actually better?
  • A researcher restarts a failed training run and thousands of GPUs suddenly re-request the same checkpoint simultaneously. Trace the request through your new architecture and show where the spike is absorbed.
Show answer guide
Also: performance

What the interviewer is probing

This question tests whether the candidate can reason from first principles about why a system built for one latency regime fails in another — not just enumerate solutions, but articulate why each architectural layer (proxy, multi-hop metadata, global replication by default) was originally rational and what changed. Strong candidates will surface the tail-latency problem explicitly — that pMax latency, not average latency, is the binding constraint when a slow tail stalls a synchronized cluster — and will reason about trade-offs (fat client vs. proxy, flat schema vs. layered metadata, regional vs. global deployment) rather than treating redesign as obviously correct.

Strong answer outline

  • Frame the constraint precisely: The binding constraint is p-max latency, not p50. A single slow metadata hop or a single slow storage node stalls the entire synchronized GPU cluster. This changes the optimization target fundamentally from the original system.
  • Diagnose the legacy bottlenecks in order:
  • Multi-hop sequential metadata lookups (namelayer → volumeslayer → containerlayer) add latency that compounds; any single slow hop dominates.
  • A central data proxy adds a hop on the critical data path and consumes power/compute that competes with GPUs.
  • Global-by-default replication means cross-region metadata fetches are on the hot path.
  • Metadata redesign: Collapse the layered metadata into a single flat schema in a fast KV store, turning path resolution into O(1) per chunk. Trade-off acknowledged: the layered design offered richer indirection and cross-layer consistency guarantees — losing that requires tighter schema discipline and more careful migration paths.
  • Eliminate the proxy / fat client: The API server returns a read plan (chunk → block address mapping) to the client SDK; the SDK streams directly from storage nodes. Gains: lower latency, lower power footprint, higher throughput ceiling. Costs: the client SDK is now complex and must be versioned carefully; failure handling that the proxy absorbed is now client responsibility.
  • Regional deployment: Deploy a BLOB-storage stack colocated with GPUs in each AI region so metadata lookups and data reads are intra-region. Trade-off: you give up global-by-default durability and must be explicit about when cross-region replication is needed.
  • Hot-spot and spike absorption:
  • Cache read plans (path → block address) in a distributed memory tier — cheap to store, dramatically reduces metadata load during concurrent access.
  • Use spare GPU-host memory as a distributed data cache for hot data (model weights, frequently reused checkpoints). With an 80%+ hit rate this absorbs most spike I/O before it reaches storage.
  • Hedged reads: if a storage node is slow, fire a speculative second request to a replica after a short timeout; use whichever responds first. This directly attacks the tail-latency / single-slow-node problem.
  • Dynamic concurrency control on the client SDK: auto-tune parallelism based on application-level congestion signals to prevent egress spikes from cascading into timeouts and retries.
  • Common wrong turns: Candidates who treat average latency as the optimization target miss the point entirely. Candidates who add caching without addressing the metadata multi-hop problem fix the hot path but not the cold path. Candidates who eliminate the proxy without acknowledging the fat-client complexity trade-off are hand-waving.

The underlying concept

When a distributed system gates computation on storage, the relevant latency metric shifts from average to maximum — specifically the maximum across all parallel waiters, because a synchronized barrier (like a GPU all-reduce step) moves at the speed of the slowest participant. This means a storage system that is 'fast on average' can still stall every GPU in a large cluster on every training step. The architectural response is to attack tail latency at every layer: flatten multi-hop metadata into a single lookup, eliminate proxies from the data path, absorb hot-spot spikes in in-memory caches before they reach durable storage, and use hedged reads to neutralize slow nodes. Each of these interventions involves a real trade-off — simplicity of schema, client complexity, regional vs. global durability — and the design is only correct if those trade-offs are made consciously against the specific workload's requirements, not inherited from a system built for different physics.

Source

Derived from Meta’s AI Storage Blueprint at Scale

Google · DS ·

At a product with a billion daily users, nearly every experiment is statistically significant — a 0.02% change reaches p < 0.001. Design the decision framework that determines which changes actually launch, and how you would run hundreds of experiments on the same surface concurrently.

Product case · experimentation · ab-testing§
Practice against the follow-up probes
  • If everything is significant, what replaces significance as the launch bar?
  • How do you compare a +0.02% revenue change against a -0.01% latency guardrail move?
  • Hundreds of concurrent experiments on one surface: how do you avoid collisions, and when do interactions actually matter?
  • How do you control the false-launch rate across thousands of experiments a year?
  • A tiny effect is significant in aggregate but you suspect it's driven by one country. How do you investigate without p-hacking?
Show answer guide

What the interviewer is probing

Whether the candidate understands that at extreme power the binary significance question dissolves and the real questions become effect size, practical value, and portfolio-level error control. Also probing knowledge of overlapping-experiment infrastructure — layered traffic allocation — which Google pioneered and which any candidate claiming experimentation depth should be able to reconstruct from first principles.

Strong answer outline

  • Replace "significant?" with "big enough to matter?": pre-registered practical-significance thresholds per metric (minimum launch-worthy effect), confidence intervals reported against those thresholds rather than zero.
  • Value framework: convert core metrics to a common currency (long-term value per user) with explicit exchange rates set by leadership — e.g., how much revenue a millisecond of latency is worth — so mixed-sign results are decidable rather than debated ad hoc.
  • Long-term validity: tiny short-term gains can be novelty or cannibalization; use long-running holdbacks to measure cumulative and lagged effects, and validate proxy metrics against them.
  • Concurrency: layered/orthogonal experiment infrastructure — divide the system into layers (e.g., UI, ranking, ads) where experiments within a layer split traffic exclusively but layers overlap freely via independent hashing; run explicit interaction tests only for suspected-conflicting pairs.
  • Portfolio error control: with thousands of tests, control the expected number of false launches (higher evidence bars for launch-gating metrics, replication runs for surprising wins, holdback verification post-launch).
  • Segmentation discipline: pre-registered segment analyses or hierarchical shrinkage estimates; exploratory segment findings get confirmed in a fresh experiment, never launched from the discovery data.

The underlying concept

Statistical significance answers "is the effect exactly zero?" — a question nobody asked. With enormous samples, standard errors collapse and every real-but-trivial effect clears p-thresholds, so decision theory must take over: minimum effects of interest, explicit trade-off prices between metrics, and error control at the portfolio level (false launches, not false positives). Overlapping-layer designs solve the concurrency problem by making experiment assignments statistically independent across layers, spending scarce exclusive traffic only where interference is real.

Source

Distilled Prep canon — built on Google's published experimentation methodology (overlapping experiments, long-term holdbacks).

Source: Google engineering blog

Google · MLE · DS ·

Your team needs a semantic segmentation model that distinguishes fine-grained land features — hedgerows, stone walls, isolated tree patches — in high-resolution satellite imagery. You have annotations covering only a few hundred square kilometers, but the target region is over 130,000 km². You have access to a vision-transformer backbone pre-trained on several hundred million satellite images from a broad global distribution.

How do you approach training and evaluation, how do you decide whether the pre-trained backbone is actually helping — and what are the ways this model will most likely fail silently when deployed across the full region?

ML system design · geospatial · ml-platform · Jun 2026§
Practice against the follow-up probes
  • How do you construct a validation set that gives you honest signal about generalization, given that your labeled data is geographically small and possibly clustered?
  • Pre-training was done on global imagery; your target is one country with a specific landscape character. What would make you distrust the feature representations the backbone learned?
  • After fine-tuning, you discover the model performs well on hedgerows near roads but poorly on field-interior hedgerows. What does that tell you about your annotation set, and how do you fix it?
  • How do you decide how much of the backbone to freeze vs. fine-tune, and what experiment tells you you've made the right call?
  • The model will be used to measure carbon stocks, so false negatives (missed hedgerows) have a real financial cost. How does that asymmetric cost change your modeling and evaluation choices?
Show answer guide
Also: data-quality

What the interviewer is probing

The question tests whether the candidate can reason about transfer learning not as a recipe but as a set of assumptions — about distribution shift, label density, and feature alignment — that must each be checked empirically. Metric judgment is probed through the carbon-accounting use case, which makes false-negative costs concrete. Causal reasoning about geographic clustering in the label set is the hardest dimension; strong candidates will recognize that spatially autocorrelated data requires spatial cross-validation, not random splits.

Strong answer outline

  • Why a pre-trained backbone helps: satellite imagery shares low-level texture features (vegetation spectral signatures, edge patterns, shadow geometry) across geographies; a backbone trained on hundreds of millions of global images will have learned these representations far better than a model trained from scratch on a few hundred km² of annotations. The fine-tuning hypothesis: the head and upper layers need to specialize to local landscape character; the lower layers may transfer almost directly.
  • Validation set design — the critical issue: spatial autocorrelation means that if you randomly split pixels or even patches, train and validation sets will be geographically adjacent and share context. Use spatial cross-validation: hold out geographically contiguous blocks (e.g., entire counties), not random patches. This gives honest generalization signal.
  • Checking that pre-training actually helps: ablation — train the same head from random init vs. from the pre-trained backbone, on the same labeled data, evaluated on the spatial hold-out. If the backbone doesn't improve sample efficiency (fewer labeled km² needed for the same performance), the distribution shift is too large and the representations don't transfer.
  • How much to freeze: start with the backbone frozen, establish a baseline, then progressively unfreeze upper layers and measure validation performance. The inflection point where unfreezing hurts (overfitting to the small labeled set) tells you where to stop. Monitor training vs. validation loss gap carefully.
  • Distribution shift failure modes in deployment:
  • Geographic bias in labels: if annotators covered accessible or visually distinct areas, the model learns those contexts. Field-interior hedgerows, less-managed boundaries, or features in remote uplands may be systematically missed.
  • Seasonal/illumination shift: fine-tuning imagery may be from one season; deployment imagery from another — vegetation appearance changes significantly.
  • Resolution or sensor shift: if inference imagery comes from a different satellite or processing pipeline, spectral statistics shift.
  • Rare but high-value features: stone walls may be underrepresented in training; the model's recall on them may be near zero without explicit oversampling or a weighted loss.
  • Asymmetric cost — false negatives: use a recall-weighted loss (e.g., focal loss or class-weighted cross-entropy biased toward the positive class), tune the classification threshold explicitly on the spatial validation set against a precision-recall curve, and report recall and false-negative rate per feature class as primary metrics, not aggregate pixel accuracy.
  • Wrong turns: using random pixel splits for validation (falsely optimistic generalization); treating aggregate IoU as the primary metric when the use case is carbon accounting (hides per-class recall differences); freezing the entire backbone without testing whether fine-tuning upper layers helps on this specific landscape character.

The underlying concept

Transfer learning from large foundation models works when two conditions hold: the source pre-training distribution shares low-level structure with the target task (so early-layer features transfer), and the target dataset, while small, is representative enough of the deployment distribution that fine-tuning the upper layers doesn't overfit to annotation artifacts. Geographic data violates the standard i.i.d. sampling assumption — nearby locations are correlated — so a random train/val split produces optimistically biased validation metrics. Spatial cross-validation, which holds out contiguous geographic blocks, is the correct analog to time-series cross-validation in temporal data: it simulates the actual generalization challenge, predicting on regions the model has never seen. Asymmetric misclassification costs should be encoded in both the loss function and the evaluation protocol from the start, not corrected post-hoc.

Source

Derived from From pixels to planning: Earth AI for nature restoration

Google · MLE · SWE ·

You work on a navigation platform and want to test whether rerouting a small fraction of vehicles away from congested segments improves city-wide driving speeds. The catch: the intervention isn't applied to individual users at random — it reshapes traffic conditions for everyone on the network, including drivers not using your app at all.

How do you design a valid experiment to measure the causal effect of this routing intervention? Walk through your choice of randomization unit, how you handle interference between treatment and control, and how you'd analyze the results.

Product case · experimentation · causal-inference · Jul 2026§
Practice against the follow-up probes
  • Why can't you use a standard A/B test that randomly assigns individual trips to treatment vs. control?
  • You chose a switchback design alternating treatment and control by day. What are the main threats to validity with that choice, and how would you mitigate them?
  • How do you choose which road segments to target, and how does that selection affect what causal claim you can make?
  • You observe a 2% speed improvement on targeted segments but only 0.35% network-wide. What explains the gap, and which number should drive the business decision?
  • A critic argues that day-of-week confounding (e.g., treatment days happened to be less rainy) explains the result. How do you rule that out?
Show answer guide
Also: networking

What the interviewer is probing

This question tests whether the candidate immediately recognizes the network interference problem — the defining reason standard A/B testing fails here — and whether they can reason about the trade-offs of the available alternatives (geographic clustering, switchback/crossover, synthetic control). It also probes metric judgment: the distinction between local segment effects and network-wide effects is not cosmetic, and a strong candidate will articulate why only one of them represents the policy-relevant estimand. Finally, the follow-ups reveal causal discipline — can they enumerate the confounders a switchback design is exposed to and propose concrete countermeasures?

Strong answer outline

  • Why standard A/B fails: routing changes are not independent across users — diverting user A changes congestion for user B, so individual-level randomization produces SUTVA violations everywhere. Treatment and control units interfere, making estimated effects meaningless.
  • Randomization unit options and their costs:
  • Geographic clustering (randomize by city or district): eliminates within-city interference but requires many cities for power; spillover at cluster boundaries remains.
  • Switchback / crossover design (alternate treatment and control over time across the whole city): removes geographic spillover by giving the entire network the same treatment state at any moment. Cost: assumes the city reaches a new equilibrium quickly, and that consecutive-day effects don't bleed over (carryover bias).
  • Synthetic control (match treated cities to untreated ones): useful for city-level rollouts but requires rich pre-treatment data and assumes no network ties between cities.
  • Segment selection is a design choice, not a tuning knob: selecting ~100 historically congested segments creates a well-defined estimand (effect on those bottlenecks) but limits external validity to similar bottleneck types. Pre-registration matters here to prevent post-hoc fishing.
  • Carryover bias in switchback: traffic patterns have memory (rush hours, weekly seasonality). Mitigation: enforce washout periods between arms, balance arm assignment by day-of-week, and model residual autocorrelation explicitly in the analysis.
  • Analysis with hierarchical Bayesian model: pools information across cities and hours while allowing city-level heterogeneity; appropriate when per-city power is limited. Key output is a posterior distribution over the effect, not just a point estimate — which forces honest uncertainty communication.
  • Interpreting the two effect sizes: the ~2% targeted-segment effect measures local decongestion; the ~0.35% network-wide effect is the policy-relevant number because it captures both the gains on cleared segments and the costs imposed on absorbing segments. Reporting only the larger local number would overstate societal benefit.
  • Common wrong turns: claiming individual-level causal effects from a city-level design; ignoring that non-app users benefit (which is actually an argument for the intervention, not against measurement); conflating statistical significance with practical significance at 0.35%.

The underlying concept

Standard A/B testing rests on the Stable Unit Treatment Value Assumption (SUTVA): one unit's treatment does not affect another's outcome. Traffic networks violate this structurally — a rerouted vehicle changes travel times for every other vehicle on its new and old path, a phenomenon called interference or spillover. When interference is global (the whole network is one connected system), the only valid randomization units are ones that contain the interference: entire cities, or time periods in a switchback design. Switchback designs trade spatial isolation for temporal isolation, measuring the city's response to switching the entire system between states, but they introduce carryover risk whenever the system's equilibrium lag exceeds the switching interval. The causal estimand must be defined at the level of the randomization unit — network-wide average speed, not individual trip time — or the estimate is not causally identified.

Source

Derived from The power of collaboration: How we can reduce traffic congestion

Google · MLE ·

Design the production ML pipeline for a model that retrains continuously on fresh data — covering validation, training, deployment, and the guarantee that a bad data day never silently degrades the serving model.

ML system design · ml-platform · ml-monitoring§
Practice against the follow-up probes
  • What specifically can go wrong with the data between yesterday and today, and how does each failure manifest?
  • What does automated data validation check, and against what reference?
  • Training/serving skew: where does it creep in and how is it prevented structurally?
  • What gates stand between a freshly trained model and production traffic?
  • When the model degrades in production anyway, how do you localize cause quickly?
Show answer guide
Also: data-quality

What the interviewer is probing

Production-ML maturity: the understanding that most real-world model failures are data failures — schema drift, distribution shift, broken upstream joins, feature pipeline bugs — and that reliability comes from treating data like code: schemas, validation, versioning, and gated promotion. The TFX worldview, reconstructable from first principles.

Strong answer outline

  • Failure taxonomy: schema changes (renamed/dropped fields, type changes), distribution shift (gradual drift vs. sudden breakage), missing partitions, upstream logic changes silently redefining a feature, and label problems (delay, leakage).
  • Data validation stage: maintain a versioned schema + expected statistics per feature (ranges, missingness, distributions); validate each training batch against it — hard-fail on schema violations, alert on statistical anomalies (drift scores vs. a reference window); quarantine bad batches rather than train on them.
  • Skew prevention structurally: single feature-definition source compiled to both training and serving (shared transforms / feature store); continuously compare serving-time feature distributions against training distributions — skew alarms are among the highest value monitors.
  • Training pipeline: versioned data snapshots + versioned code + config = reproducible artifacts; evaluate on holdout and on sliced metrics (segments where regressions hide) against the current production model as baseline.
  • Promotion gates: offline eval thresholds → canary serving on small traffic with online guardrails → gradual ramp with automatic rollback; the previous model stays warm for instant reversion.
  • Diagnosis loop: when production quality dips, the versioned lineage (which data, which code, which model) plus feature-distribution monitors localize whether it's data, model, or world; without lineage, every incident is archaeology.

The underlying concept

Continuous training turns ML into a data-processing system whose correctness depends on inputs no one reviews — so the engineering answer is to give data the same discipline code has: declared schemas, automated validation, version control, and staged rollout. The two structural insights: skew is prevented by construction (one definition, two consumers), not by vigilance; and models should be promoted like binaries — evaluated against the incumbent, canaried, and reversible — because "newer" is not "better" when the data decides.

Source

Distilled Prep canon — built on the themes of Google's TFX and ML production-systems publications.

Source: Google engineering blog

Google · SWE ·

Design a globally replicated database for advertiser account budgets: a campaign must never spend past its budget, updates can arrive on any continent, and ad-serving decisions read budgets millions of times per second worldwide.

Systems design · distributed-systems · databases§
Practice against the follow-up probes
  • Strong consistency across continents costs round trips. Where exactly do you pay it, and where do you refuse to?
  • How can ad servers make spend decisions at local latency without letting global spend exceed budget?
  • What does a consensus protocol buy you here, and per what unit would you run it?
  • Clocks: why do global transactions care about time, and what breaks with ordinary NTP?
  • An entire region is partitioned away mid-campaign. What happens to spending?
Show answer guide

What the interviewer is probing

Whether the candidate can localize the strong-consistency requirement (budget commitment) and engineer around paying cross-continent latency on the hot path — the budget-reservation/quota-lease pattern. Also probing real distributed-systems literacy: consensus per shard, read-path options (leases, bounded staleness), and why globally ordered transactions need bounded clock uncertainty.

Strong answer outline

  • Split the problem: the invariant (total spend ≤ budget) needs serialized commitment; the decisions (serve this ad?) need microsecond reads. Never put the second on the first's path.
  • Budget ledger: shard by account/campaign; each shard is a consensus-replicated state machine (Paxos/Raft) across regions — writes commit with cross-region quorum (pay the ~100 ms once per budget mutation, which is rare traffic).
  • Local spending at global safety: regions lease budget slices from the ledger (e.g., region takes a 5% tranche); ad servers decrement local tranches at memory speed and renew leases asynchronously. Overspend is bounded by outstanding tranche size — pick tranche sizes to trade slight budget under-utilization against overspend risk.
  • Reads: serving reads hit local replicas/leases (bounded staleness by construction); reporting reads can request linearizable reads through the leader when exactness matters.
  • Time: to give external consistency (transactions ordered as observed globally) you need bounded clock uncertainty — the TrueTime idea: expose uncertainty intervals and wait them out on commit; with plain NTP you either wait too long or violate ordering under skew.
  • Partition behavior: a cut-off region can spend only its already-leased tranches, then fails closed (stops spending) — bounded damage, no global invariant violation; leases expire and return to the ledger.
  • State the CAP position explicitly: choose consistency for the ledger; engineered availability comes from leases, not from weakening the invariant.

The underlying concept

Global strong consistency is affordable when you stop buying it wholesale: identify the single invariant that needs serialization, run consensus for exactly that, and convert the hot path into locally served, pre-authorized capacity — the quota-lease/escrow pattern that turns a global constraint into bounded local ones. The Spanner lesson completes it: global transaction ordering is fundamentally a clock problem, solved not by perfect clocks but by known-bounded uncertainty plus commit waits.

Source

Distilled Prep canon — built on the themes of Google's Spanner and planet-scale infrastructure work.

Source: Google engineering blog

Google · SWE · MLE ·

You run a globally distributed, Spanner-like database serving billions of requests per second — replicas on several continents, and a cache miss can mean an expensive cross-shard or cross-region read. Memory is billed by the gigabyte-hour, making it a metered utility rather than a sunk cost. Your current cache is statically sized to handle peak load, which means you're paying for idle memory most of the day.

Design a cache management system that treats memory as a variable cost and dynamically adjusts what it holds — and how long it holds it — to minimize total cost of ownership without unacceptably degrading I/O performance.

Start by explaining how you'd frame the eviction decision, then walk through the architecture from prediction to eviction, and finally tell me how you'd validate that the system is actually saving money and not silently destroying tail latency.

Systems design · caching · performance · Jun 2026§
Practice against the follow-up probes
  • You framed this as an optimization problem — what's the objective function, exactly, and what are its inputs? Walk me through the math.
  • You're assigning time-to-live values per cached page. How do you learn good TTLs, and what features do you train on?
  • Your TTL model runs on every cache hit at billions of requests per second. What happens if the model is even slightly too slow?
  • TTL eviction and capacity-based eviction (e.g., LRU) are now both active. How do you reason about their interaction, and which one takes precedence under what conditions?
  • Memory pricing shifts, or a new workload type appears with very different miss costs. How does the system adapt without a manual re-deployment?
Show answer guide
Also: ml-platform

What the interviewer is probing

This question probes whether the candidate can translate an economic constraint (pay-per-byte-hour) into an algorithmic design, rather than treating resource allocation as a static engineering parameter. It tests architecture judgment — separating the TTL assignment problem from the capacity management problem — and forces the candidate to reason about the feedback loops between a prediction model and the system it controls. The validation portion surfaces metric judgment: distinguishing between cost savings and latency degradation, and knowing which cache miss increases are acceptable.

Strong answer outline

  • Frame the cost model first. Total cost = (memory cost × bytes cached × time held) + (miss penalty × miss rate). The insight is that holding a page whose next access is far away costs more in memory rental than the miss penalty you'd pay to re-fetch it. This reframes eviction as: "when should I stop renting this page's slot?"
  • The ski-rental analogy. Each cached page faces the same rent-vs-buy decision under uncertainty about future access. The break-even rule: keep the page as long as its accrued memory cost is below the miss penalty; evict when it crosses. A randomized variant reduces expected cost versus the adversarial worst case.
  • TTL assignment via a lightweight model. Features: data size (miss penalty scales with it), operation type (read vs. scan), historical inter-arrival time for this page, relative miss cost vs. memory cost ratio. Candidate should reach for a shallow decision tree or small lookup table — not a neural net — because inference runs on every cache hit in a hot path. Wrong turn: proposing a complex model without noting the latency budget.
  • Capacity eviction as a backstop. When the cache fills, fall back to a generalized LRU (or GDSF to handle variable-size pages). TTL-based eviction shrinks the working set first; LRU handles physical overflow. These are complementary, not competing.
  • Validation strategy. Offline: replay cache traces with the new policy vs. fixed-size baseline; measure integrated memory-time cost and miss rate. Distinguish miss rate by miss cost — a high miss rate on cheap-to-fetch rows is acceptable; misses on expensive cross-shard reads are not. Online: shadow the new policy against production traffic before cutover; track p99 latency, actual I/O cost per request, and memory footprint over time. Alert on tail-latency degradation, not just aggregate miss rate. The critical wrong turn: using miss rate alone as the health signal — a cost-aware system deliberately increases misses on cheap data.
  • Adaptation. TTL model should be retrained on rolling windows of production access logs. Feature drift (e.g., a new query pattern) shows up as systematic TTL misprediction; detect this by monitoring model-predicted TTL vs. actual next-access gap for sampled pages.

The underlying concept

Static cache sizing is a peak-provisioning problem: you allocate for the worst hour and pay for all the idle hours in between. When memory is metered, this becomes a literal dollar cost rather than an amortized hardware cost, which makes the economics of dynamic sizing much more attractive. The ski rental problem is the canonical model for this class of decision: you must commit to a recurring cost (renting memory) or a one-time cost (paying the miss penalty) without knowing how long you'll need the resource. The break-even algorithm — rent until your total rental equals the buy price, then buy — is worst-case optimal within a factor of 2. In practice, access patterns are predictable enough that a learned model can beat the adversarial bound significantly. The deeper structural insight is that TTL-based eviction and capacity-based eviction solve different subproblems — TTL controls the holding duration under normal load, and LRU/GDSF controls behavior when the cache fills — and keeping them cleanly separated makes both easier to reason about and tune.

Source

Derived from Optimizing cloud economics with linear elastic caching

Google · DS ·

A search ranking change increases result click-through rate, but query reformulations and back-button returns to the results page also rise. Interpret the experiment and recommend a decision.

Product case · search-ranking · experimentation§
Practice against the follow-up probes
  • What story reconciles more clicking with more re-searching?
  • Which metrics distinguish "attractive results" from "useful results"?
  • How would you measure whether users actually found what they needed?
  • What role do time-based signals (dwell time, time-to-success) play, and what are their pitfalls?
  • If the effect differs by query type, how does that change the launch decision?
Show answer guide
Also: ml-monitoring

What the interviewer is probing

Metric literacy in search: CTR measures the promise of a result (title/snippet attractiveness), not its delivery. Rising reformulations and pogo-sticking are classic signals that clicks are failing to satisfy. Strong candidates assemble a success-oriented metric story (abandonment done right, long clicks, session-level success) and slice by query intent before deciding.

Strong answer outline

  • The reconciling story: the change likely surfaces clickable results — compelling titles/snippets — that under-deliver; users click, bounce back (pogo-stick), and re-query. CTR up + reformulation up = attractiveness up, relevance flat or down.
  • Better metric set: long clicks (dwell above threshold) vs. short clicks; pogo-stick rate; session-level success (did the session end in a satisfied state?); time-to-result; and good abandonment (query answered on the results page itself) separated from bad abandonment.
  • Diagnose by intent: navigational queries (one right answer), informational, transactional — a change can help one class and harm another; the aggregate hides it. Also slice by position: is added CTR coming from top positions or deep exploration?
  • Careful with dwell: long dwell can mean satisfaction or struggle; calibrate time signals per query class against explicit-feedback panels or human relevance ratings.
  • Recommendation shape: as described, the evidence pattern points against launch despite CTR; either iterate (snippet honesty, relevance) or launch only for the query classes where session success genuinely improved.
  • Prevention: make session-success and pogo-stick guardrail metrics so attractiveness-only wins can't clear the launch bar again.

The underlying concept

Every proxy metric encodes an assumption about what it proxies for; CTR assumes clicking predicts satisfaction, and ranking changes can break exactly that link by optimizing the promise rather than the payoff. Search measurement matured by moving from action counts to session-level success models — the unit of value is the user's task, not the click. The generalizable habit: when two proxies disagree (clicks up, re-queries up), the disagreement itself is the finding, and the tiebreaker is the metric closest to the user's true goal.

Source

Distilled Prep canon — built on Google's published work on search quality measurement.

Source: Google engineering blog

Google · SWE ·

Design a cluster scheduler that places both latency-critical services and batch jobs across hundreds of thousands of machines, maximizing utilization without harming the critical services.

Systems design · infrastructure · distributed-systems§
Practice against the follow-up probes
  • Why does mixing service and batch work on the same machines matter economically, and what makes it dangerous?
  • What does a job specification need to contain for the scheduler to do its job?
  • Placement is a constrained optimization. What are the constraints and the objective, and how do you keep scheduling latency low at this scale?
  • A top-tier service suddenly needs capacity in a full cluster. What happens, step by step?
  • How do you handle machine failures, maintenance, and the scheduler itself failing?
Show answer guide
Also: scalability

What the interviewer is probing

Understanding of the core datacenter economics — services reserve for peak and idle most capacity, so reclaiming that idle capacity for preemptible batch work is worth billions — plus the mechanisms that make sharing safe: priorities/tiers, preemption, resource isolation, and overcommit informed by actual usage vs. reservations. This is Borg territory; Kubernetes-only intuition covers maybe half of it.

Strong answer outline

  • Why mix: dedicated pools idle at 20-40% utilization because services size for peak; co-locating preemptible batch in the trough reclaims it. The danger is interference — batch stealing CPU cache, memory bandwidth, or IO from latency-critical work.
  • Job spec: resource requests (CPU, RAM, disk, accelerators), priority tier (production vs. best-effort), constraints (region, hardware, anti-affinity), and disruption tolerance. Quota is enforced at admission, priority at runtime.
  • Scheduling loop: feasibility filtering (which machines can host it) then scoring (bin-packing for utilization, spreading for failure domains, data locality); at this scale use equivalence classes / cached scores and randomized sampling of candidate machines rather than scoring the whole fleet; shard or replicate schedulers with optimistic concurrency on placement commits.
  • Priority mechanics: the top-tier service preempts best-effort tasks — scheduler evicts enough batch (respecting disruption budgets), reclaims resources, places the service; batch tasks are checkpointed or simply rescheduled — their contract is "will finish eventually."
  • Overcommit safely: schedule against predicted actual usage rather than reservations for lower tiers, with node-level isolation (cgroups-style) and a killer that reclaims from best-effort first when a node runs hot.
  • Reliability: scheduler state rebuilt from node agents (nodes are the truth); running workloads unaffected by scheduler outages; masters consensus-replicated per cell; failure domains and maintenance handled via eviction with notice.

The underlying concept

Cluster scheduling is economically a statistical multiplexing problem: peak-reserved capacity is mostly air, and tiered priorities plus preemption convert that air into throughput while preserving the latency tier's guarantees. Technically it's constrained optimization under a latency budget — solved not by optimality but by good-enough placement found fast (sampling, caching, sharding). The deepest design rule: keep the data plane independent of the control plane, so the scheduler's own failures never take down what it scheduled.

Source

Distilled Prep canon — built on the themes of Google's Borg and cluster-management publications.

Source: Google engineering blog

DoorDash · MLE · DS ·

Your marketplace's search and recommendations run on behavioral embeddings — learned from clicks and orders — which work well for established merchants and fail for exactly the items you most need to surface: new merchants, new catalog verticals, and long-tail items with no interaction history. You have access to a capable LLM. Design how you'd use it to give every item a useful representation from day one — and how you'd prove the new representations actually improve retrieval rather than just demoing well.

ML system design · llm-applications · search-ranking · Apr 2026§
Practice against the follow-up probes
  • Raw item metadata is messy and thin. What does the LLM add over embedding the metadata directly?
  • LLM calls per item are expensive and the catalog has millions of items that keep changing. Where do you spend, cache, and refresh?
  • The LLM occasionally invents attributes ("vegan-friendly") that aren't true. Where does that hurt, and what's the containment?
  • Behavioral and semantic embeddings now coexist. Do you replace, concatenate, or gate between them — and by what rule?
  • Your offline retrieval metrics improved but the online A/B is flat. What are the three most likely explanations?
Show answer guide
Also: recommendation

What the interviewer is probing

Whether the candidate can position LLMs as a data-enrichment layer inside a classical retrieval architecture rather than as a replacement for it: generate normalized, descriptive item profiles once (offline, cacheable), embed those into the existing vector machinery, and blend with behavioral signals as they accumulate. Also probing evaluation maturity — cold-start improvements hide in slices that aggregate metrics wash out — and clear-eyed handling of hallucinated attributes in a system that makes claims to users.

Strong answer outline

  • The core move: use the LLM offline to transform sparse, inconsistent metadata into a normalized rich profile per merchant/item (cuisine, attributes, occasions, descriptive summary) — enrichment plus standardization, which is what makes downstream embeddings comparable across a heterogeneous catalog. Then encode profiles with an embedding model into the same vector infrastructure retrieval already uses.
  • Why not embed raw metadata: thin and inconsistent fields embed inconsistently; the LLM's contribution is inference (a taqueria's menu implies attributes no field states) and canonical vocabulary.
  • Cost architecture: generation is one-time per item + refresh on meaningful catalog change (menu updates), not per query; batch it, version prompts, cache aggressively; per-query path touches only vector similarity — LLM latency never enters serving.
  • Hallucination containment: constrain generation to grounded fields where truth matters (dietary claims validated against source data or suppressed), use profiles for retrieval and ranking features rather than user-facing claims, and audit a sample per generation batch; measure downstream harm via complaint/refund proxies on affected surfaces.
  • Blending with behavior: cold items ride semantic embeddings; as interactions accumulate, blend (weighted or learned gate on interaction volume) toward behavioral signals, which encode what descriptions can't (quality, conversion propensity). Replacing behavioral embeddings outright throws away your best signal for the head of the catalog.
  • Evaluation designed for cold start: offline — retrieval recall and ranking metrics sliced by item tenure and interaction count, since aggregate metrics are dominated by the head; online — experiment with cold-start-focused readouts (new-merchant first-week conversion, long-tail impression share) plus overall guardrails. Flat-overall/ better-in-slice is the expected success shape.
  • The flat-A/B probe: (1) cold items are a small traffic share, so the win is real but diluted — check the slice; (2) retrieval improved but the ranker, trained on behavioral features, buries the new candidates — retrain or add semantic features to ranking; (3) offline gains were popularity-bias artifacts of the eval set.

The underlying concept

Cold start is a missing-signal problem: collaborative/behavioral representations are functions of interaction history, so new entities sit at the origin. Content-based representation is the classical answer, and LLMs upgrade it by converting messy, heterogeneous metadata into normalized, inference-enriched text — effectively transferring world knowledge into items that lack local data. The architectural principle is separation of timescales: expensive generation lives offline where it amortizes; serving stays vector-fast. And the evaluation principle is that improvements targeted at a minority slice must be measured in that slice — aggregate metrics are head-of- distribution metrics, and cold start is by definition the tail.

Source

Derived from Using LLMs to Build Content Embeddings for Search and Recommendations

DoorDash · DS ·

Your demand forecast drives Dasher supply planning. Every week, city operators override your model's numbers — sometimes because they know a local festival is coming, sometimes on gut feel. Leadership asks you to "stop the overrides." You suspect that's wrong. Design the system and process that gets the best of both the model and the operators.

Product case · forecasting · data-quality · Feb 2021§
Practice against the follow-up probes
  • How do you determine whether the overrides have historically helped or hurt — what's the comparison, exactly?
  • What's the difference between letting operators edit the forecast and letting them feed the model structured inputs? Why does it matter?
  • An operator's "festival next weekend" knowledge — how does that enter a model as data rather than as an override?
  • How do you keep accountability clean when the published forecast is part model, part human?
  • Over time, which human adjustments should the system make obsolete, and how do you retire them gracefully?
Show answer guide
Also: ml-monitoring

What the interviewer is probing

Judgment about human-in-the-loop forecasting: the naive positions ("trust the model" / "trust the operators") are both wrong, and the mature answer is structural — convert judgment into measurable, attributable inputs. Strong candidates propose backtesting the adjustment layer separately from the base model, designing structured channels for operator knowledge (event calendars, capacity flags), and preserving an audit trail so every published number decomposes into model + adjustment with separate accuracy accounting.

Strong answer outline

  • Diagnose before deciding: backtest overrides against the counterfactual — for every adjusted forecast, compare realized demand against both the model's original number and the adjusted number, sliced by operator, adjustment size, and stated reason. Typical finding: event-driven adjustments help; sentiment-driven ones add noise.
  • Reframe the architecture: overrides replace the model's output and destroy attribution; structured inputs inform it. Build channels for the knowledge operators actually have — an event calendar (festivals, closures, weather ops), promo schedules, capacity constraints — that enter the model as features with learned effects.
  • Keep a principled adjustment layer for what can't be featurized: adjustments logged with reason codes, bounded in magnitude, applied as explicit deltas on top of the model output — never silent edits.
  • Accountability by decomposition: publish forecast = model + named adjustments; score each component's error separately and report it back — operators see their own adjustment accuracy, which self-corrects behavior better than mandates.
  • Evaluation discipline: the base model is evaluated pre-adjustment; the system (model + adjustments) is what supply planning consumes and is evaluated end to end; both tracked over time so the adjustment layer's shrinking value is visible.
  • Retirement path: when a class of adjustment (e.g., holiday effects) becomes learnable — enough labeled instances — promote it into the model, then watch that adjustment category's frequency fall; the goal is migrating knowledge from heads into features, not banning judgment.

The underlying concept

Judgmental forecast adjustment is one of the oldest findings in forecasting research: domain experts add real information about discrete, foreseeable events and subtract value everywhere else — so the design goal is to channel judgment, not to choose between human and machine. Treating human input as data — structured, logged, attributable, and separately scored — turns an untestable override culture into a measurable model component. The organizational insight mirrors the statistical one: accountability requires decomposition, because a single blended number lets both the model and the human disown its errors.

Source

Derived from Why Good Forecasts Treat Human Input as Part of the Model

DoorDash · DS · MLE ·

Your daily demand forecast is accurate 350 days a year and badly wrong on holidays — which are exactly the days when staffing mistakes cost the most. Each specific holiday gives you only a handful of historical observations, holidays shift dates and interact with weekdays, and new markets have never seen some holidays at all. Improve holiday forecasting without degrading the everyday model.

Product case · forecasting · data-quality · Aug 2023§
Practice against the follow-up probes
  • Why does simply adding an "is_holiday" feature to the main model underperform?
  • Walk me through a cascade/decomposition design: what does each layer learn, and from what data?
  • Thanksgiving has ~5 usable observations. How do you estimate its effect without overfitting — and how do markets share strength?
  • How do you evaluate holiday accuracy when holidays are, by construction, rare in any test window?
  • Christmas falls on a Monday for the first time in your data. What does your system do?
Show answer guide

What the interviewer is probing

Rare-event forecasting judgment: the candidate should recognize this as a small-data problem embedded inside a big-data one, where a monolithic model drowns a handful of holiday examples in hundreds of thousands of ordinary days. The expected shape of the answer is decomposition — model the baseline, then model event effects separately with pooling — plus honest evaluation design for rare slices and graceful handling of never-observed combinations.

Strong answer outline

  • Why the flag feature fails: gradient descent on the full dataset allocates capacity proportional to data; a few dozen holiday rows can't move a model dominated by ordinary days, and each holiday's effect differs (Valentine's ≠ Thanksgiving), interacts with weekday, and varies by market — one coefficient can't carry that.
  • Cascade design: layer 1 forecasts baseline demand trained on non-holiday data (or with holidays masked); layer 2 models the holiday effect — realized demand relative to the baseline prediction (a multiplier or residual) — trained only on event days across all holidays, markets, and years. Publishing forecast = baseline × predicted effect.
  • Making 5 observations work: pool across the hierarchy — holiday family (major feast vs. minor observance), market cluster, weekday interaction — with hierarchical/shrinkage estimation so Thanksgiving in a new market borrows from Thanksgiving elsewhere and from similar-holiday behavior, with uncertainty widened accordingly.
  • The quiet advantage of decomposition: the everyday model is untouched — no risk of degrading 350 good days to fix 15 bad ones — and holiday-effect estimates are inspectable numbers operators can sanity-check ("we predict +38% Mother's Day lunch"), preserving trust.
  • Evaluation for rare slices: leave-one-holiday-out backtests across years; report error on holiday days specifically and the cost- weighted version (staffing error cost), never blended MAPE where 350 easy days launder 15 hard ones; track baseline and effect layers separately so misses attribute cleanly.
  • Never-seen combinations: fall back up the hierarchy (holiday family × weekday-shift priors), widen intervals, and flag for the human adjustment channel — the cascade makes "what we don't know" explicit rather than silently interpolated.

The underlying concept

Rare structured events break the i.i.d. comfort of large-scale forecasting: the information about holidays lives in a tiny data slice with its own structure, and monolithic training dilutes it. The classical remedy is decomposition — separate the abundant-data problem (baseline) from the scarce-data problem (event effects) — paired with hierarchical pooling, which is the general answer to "many related small problems": share strength across the hierarchy, let data earn specificity, and express ignorance as widened uncertainty. Evaluation must mirror the decomposition, because aggregate metrics are majority-class metrics and the minority days are the ones that carry the operational cost.

Source

Derived from How DoorDash Improves Holiday Predictions via a Cascade ML Approach

DoorDash · DS ·

Your team ran a well-powered A/B test on a new consumer promotion. The average treatment effect is a precise zero. The PM wants to kill the feature; you suspect it helped some users and hurt others. How do you find out — and if you're right, how do you turn that into a targeting policy you'd trust in production?

Product case · causal-inference · experimentation · Sep 2020§
Practice against the follow-up probes
  • Why can't you just slice the experiment by segment and ship to the segments with positive effects?
  • Walk me through estimating a per-user treatment effect when each user was only ever in one arm. What are meta-learners actually doing?
  • How do you evaluate an uplift model when the true individual effect is never observable?
  • You deploy targeting based on the model. What experiment validates the policy, and why isn't the original A/B enough?
  • Two quarters later the targeted rollout's gains have faded. What are your leading hypotheses?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Whether the candidate understands that a zero average can mask offsetting heterogeneous effects, and that finding responders is a causal estimation problem, not a segmentation exercise — post-hoc subgroup mining is multiple-testing on noise. Strong candidates reach for heterogeneous-treatment-effect estimation on the randomized data, know why individual effects are fundamentally unobservable (one potential outcome per user), and insist on validating the resulting targeting policy with a fresh experiment.

Strong answer outline

  • Name the possibility space first: a flat average means (a) truly no effect for anyone, (b) small effects below detection, or (c) offsetting heterogeneity. Distinguishing them is the job.
  • Why naive slicing fails: dozens of segments × noisy subgroup estimates = guaranteed false discoveries; effects found by searching the same data that generated them won't replicate. Pre-registered segments or held-out validation are the minimum discipline.
  • HTE estimation: use the experiment's randomization as the engine — meta-learners (S/T/X-learners) or causal forests estimate conditional average treatment effects as a function of user covariates (pre-treatment only). The fundamental problem: each user reveals one potential outcome, so models estimate conditional averages, never individual truths.
  • Evaluation without ground truth: uplift curves / Qini coefficients on a held-out slice of the experiment — rank users by predicted uplift, verify realized treatment-control gaps concentrate in the top ranks; calibration of predicted vs. realized subgroup effects.
  • Policy validation: a new experiment where treatment = "model-targeted promotion" vs. control = status quo (and ideally an arm with the old untargeted policy). The original test validated the treatment; this validates the decision rule — different estimand.
  • Decay hypotheses: novelty effects in the original data, covariate drift, feedback loops (targeting changes the population's behavior), and cannibalization as competitors/other promos adapt. Monitoring: periodic holdouts to re-measure the policy's incremental value.

The underlying concept

An average treatment effect is exactly that — an average — and decision-relevant heterogeneity lives underneath it. The conditional average treatment effect (CATE) is estimable from randomized data because randomization holds within every covariate stratum, but the fundamental problem of causal inference (one potential outcome observed per unit) means uplift models predict group-conditional effects, and their evaluation must be rank- and calibration-based rather than per-user accuracy. The deeper discipline is separating estimand layers: an experiment validates a treatment; an uplift model proposes a policy; only a policy experiment validates the policy. Skipping that last step ships a multiple-testing artifact with a model wrapped around it.

Source

Derived from Leveraging Causal Modeling to Get More Value from Flat Experiment Results

DoorDash · DS ·

You're the DS reviewing three experiment proposals in a delivery marketplace: a new consumer checkout flow, a change to Dasher pay display that Dashers will adapt to over weeks, and a new dispatch algorithm. Each team proposes a standard user-level A/B test. For each, say whether that's the right randomization design — and where it isn't, what you'd use instead and what it costs you.

Product case · experimentation · ab-testing · Feb 2022§
Practice against the follow-up probes
  • What exactly goes wrong, mechanically, if the dispatch change is randomized at the Dasher level?
  • The pay-display change has learning effects. Why do those break short switchback windows, and what design respects them?
  • Rank the designs you've named by statistical power. What are you paying for interference protection?
  • How would you detect, after the fact, that a design you chose still leaked interference?
  • A team insists on user-level randomization for speed and offers to "adjust for interference in analysis." What's your response?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Whether the candidate has a decision framework rather than a favorite design: the choice among user-level, cluster/geo, switchback, and long-window designs is driven by two properties of the treatment — does it touch a shared resource (interference), and does its effect develop over time (learning/carryover) — traded against power. This is DoorDash's home turf; strong candidates match each scenario to its failure mode and can articulate the power price of every unit coarsening.

Strong answer outline

  • The framework first: ask two questions of any treatment. (1) Does it affect units beyond the treated one — via shared supply, shared queues, social exposure? If yes, the randomization unit must contain the interference. (2) Does the effect take time to develop or persist after removal — learning, habituation, carryover? If yes, the design needs long exposure windows and washouts.
  • Checkout flow: no shared resource, effect immediate → user-level A/B is correct; maximum power, no reason to pay for more.
  • Dasher pay display with learning: Dasher-level randomization is fine on interference (weak coupling through display alone) but the effect develops over weeks → long-running Dasher-level experiment with effect curves by exposure time; switchbacks are wrong here — alternating conditions faster than Dashers learn measures a blend of transient states.
  • Dispatch algorithm: treated and control assignments compete for the same Dashers → user- or Dasher-level randomization leaks treatment effects into control (typically flattering the treatment). Design: switchbacks over region × time windows, or geo-cluster randomization; washout/burn-in periods at boundaries for queue carryover.
  • The power ledger: effective sample size collapses from millions of users to hundreds of region-time units or dozens of geos — expect longer runs, variance-reduction (covariate adjustment, stratification), and cluster-robust inference; state this cost explicitly when recommending the design.
  • Post-hoc leak detection: compare boundary vs. interior switchback periods (carryover signature), test control-group metric shifts correlated with local treatment intensity, and monitor market-level invariants.
  • The pushback answer: interference is a design problem; analysis-time corrections require the very model of spillovers you don't have — randomize at the level the mechanism operates or accept a biased answer fast.

The underlying concept

Experimental design is the art of choosing a randomization unit whose boundaries contain the treatment's mechanism. Interference (one unit's treatment touching another's outcome, via shared resources) violates SUTVA and forces coarser units — clusters in space or blocks in time — while temporal dynamics (learning, carryover) force longer and buffered exposure. Every coarsening pays in power because inference runs on the number of independent randomization units, not raw observations. There is no universally correct design — only a mapping from treatment mechanism to unit, with power as the currency; the professional skill is naming the failure mode of the cheap design before the data does.

Source

Derived from Balancing Network Effects, Learning Effects, and Power in Experiments

DoorDash · DS ·

Marketing runs dozens of concurrent tests on promo copy and creative, each with 5-10 variants. Fixed-split A/B tests keep burning weeks of traffic on obviously losing variants. You're asked to replace them with an adaptive system that shifts traffic toward winners as evidence accumulates. Design the allocation policy — and then tell me what your key outcome metric arriving 2-7 days late does to it.

Product case · experimentation · ab-testing · Dec 2025§
Practice against the follow-up probes
  • Why not just "send 100% of traffic to whichever variant is currently winning"? What does deliberate randomness buy?
  • Walk me through Thompson sampling mechanically — what gets sampled, and why does that naturally balance explore vs. exploit?
  • With conversions arriving days late, the bandit allocates on stale evidence. What failure mode does that create, and how do you damp it?
  • When is a boring fixed A/B test still the right tool? Name the cases where you'd refuse the bandit.
  • The bandit shifted traffic while a variant's performance was measured — can you still report an unbiased effect size afterward?
Show answer guide

What the interviewer is probing

Whether the candidate understands adaptive experimentation as a trade — bandits minimize regret (cost of showing losers) at the price of clean inference and added machinery — rather than as a strict upgrade to A/B testing. The delayed-feedback probe is the discriminator: naive bandits over-exploit whatever converts fastest, and strong candidates reach for batched updates, pessimistic priors on immature cohorts, or delay-corrected reward estimates. Knowing when not to use a bandit is worth as much as knowing how.

Strong answer outline

  • Frame the objective difference: A/B optimizes for learning (precise effect estimates at fixed allocation); bandits optimize for earning (minimize cumulative regret while learning). Many-variant, short- lived, low-stakes decisions like promo copy sit squarely in bandit territory.
  • Why greedy fails: always-play-the-leader locks onto early noise and never gathers the evidence to escape it. Exploration is the price of correctable beliefs.
  • Thompson sampling: maintain a posterior over each variant's conversion rate (Beta-Binomial for binary rewards); each allocation period, sample one draw per variant and route traffic proportionally to how often each variant wins the sampled comparison. Exploration emerges from posterior uncertainty and self-anneals as evidence concentrates — no tuning knob like epsilon.
  • Delayed/batched rewards, the real-world core: updating on immediate signals biases toward fast-converting variants, not best ones. Mitigations: update in batches aligned to the conversion window; score only matured cohorts (or model the delay distribution and correct immature counts); keep a minimum-allocation floor per variant so late bloomers keep collecting evidence; slow the allocation cadence relative to the feedback delay.
  • When to refuse the bandit: guardrail-heavy or high-blast-radius changes needing precise CIs, treatments with learning/novelty dynamics (early performance misleads by construction), interference- prone marketplace levers (allocation shifts change the market), and anything requiring a defensible effect size for a launch review.
  • Post-hoc inference honesty: adaptive allocation breaks the fixed- sample assumptions behind naive estimates — variants get traffic correlated with their own noisy history. Report via inverse- propensity weighting on logged allocation probabilities, or accept that the bandit's output is a decision, not an unbiased measurement, and say so.

The underlying concept

The explore-exploit trade-off is the recognition that every allocation decision spends traffic on two goods at once: immediate reward and information. Fixed experiments buy pure information; greedy policies buy pure (apparent) reward; Thompson sampling prices the two automatically by sampling from posterior beliefs — probability matching that explores exactly as much as uncertainty warrants. Delayed feedback breaks the loop's core assumption (act, observe, update) and re-opens the door to premature convergence, which is why production bandits are mostly engineering around feedback latency. And adaptivity taxes inference: data collected under a policy that reacts to outcomes is not a random sample, so measurement either corrects for the collection policy or downgrades its claims from "effect" to "choice."

Source

Derived from Accelerating Experimentation at DoorDash with a Multi-Armed Bandit Platform

DoorDash · MLE · DS ·

Design the system that predicts when a restaurant order will be ready for pickup, used by dispatch to time Dasher arrival.

ML system design · forecasting · ml-platform§
Practice against the follow-up probes
  • What is your label, given that true ready-times are mostly unobserved or noisy?
  • Which errors cost more — Dasher early or food early — and how does that enter the model?
  • What features exist without leakage, and which must be served in real time?
  • How do you handle brand-new merchants and menu items?
  • How do you connect model metrics to marketplace outcomes?
Show answer guide
Also: logistics-optimization

What the interviewer is probing

ML judgment under label noise and asymmetric costs: ready-time is rarely logged directly (proxies: pickup time minus wait, merchant confirmations when present), errors are asymmetric (early Dasher = paid waiting; late Dasher = cold food and lateness), and the model's value is realized only through dispatch decisions — so calibration and uncertainty matter more than point-accuracy bragging rights.

Strong answer outline

  • Label construction: where merchant "ready" signals exist, use them with de-noising; elsewhere infer from Dasher arrival/wait/pickup telemetry (ready ≈ pickup when Dasher waited; censored when food waited). Model the censoring rather than pretending labels are clean; keep a small ground-truth panel for calibration.
  • Loss design: asymmetric cost — under-prediction (Dasher early) costs Dasher time; over-prediction (food ready, no Dasher) costs quality and lateness. Use quantile regression or explicit asymmetric loss; dispatch consumes a distribution (e.g., P50 + P90), not a point.
  • Features without leakage: merchant historical prep by item/basket size/hour, current confirmed queue depth, kitchen throughput proxies, time/weather; real-time features (queue, recent confirmations) via online feature store; strictly exclude anything timestamped after the prediction moment in training joins.
  • Cold start: hierarchical backoff — item → menu-category → cuisine → market priors; shrink toward the merchant as their data accumulates; widen predicted uncertainty for new entities so dispatch pads conservatively.
  • Serving: prediction at order-confirmation and re-prediction on signal updates; latency budget small; feature freshness monitored; training/serving parity via shared feature definitions.
  • Evaluation tied to decisions: offline — calibration and quantile loss by segment; online — Dasher wait minutes, food-sit minutes, lateness, cost per delivery via experiment; monitor drift by merchant cohort (menus and staffing change constantly).

The underlying concept

This is decision-focused ML: the model's product is not a number but a calibrated distribution consumed by an optimizer whose costs are asymmetric — so loss functions, uncertainty, and calibration are the design surface, not afterthoughts. Label noise and censoring are the second theme: real operational labels are inferred from behavioral traces, and modeling their generation process beats wishing they were clean. Hierarchical priors solve cold start the same way they solve every sparse-entity problem: borrow strength, then let data earn independence.

Source

Distilled Prep canon — curated from DoorDash's public work on ETA and prep-time prediction.

Source: DoorDash engineering blog

DoorDash · DS ·

Late deliveries increased 8% week-over-week across several cities. Lead the investigation and propose both immediate mitigations and a durable fix.

Product case · forecasting · data-quality§
Practice against the follow-up probes
  • Decompose a delivery's timeline. Where can lateness enter?
  • Is this a forecasting problem or an operations problem — and how do you tell?
  • Which cuts do you make first and why?
  • Several cities at once: what does that pattern itself tell you?
  • What do you ship this week vs. what do you build this quarter?
Show answer guide
Also: logistics-optimization

What the interviewer is probing

Operational decomposition under time pressure: can the candidate break the promise-to-door timeline into stages (quote, prep, assignment, travel, wait-at-store, last mile), distinguish "we predicted badly" from "the system performed worse," and use the multi-city pattern to prioritize hypotheses (simultaneity suggests a common cause: model release, app version, incentive change, weather system)?

Strong answer outline

  • Definition first: late relative to quoted time — so lateness rises if quotes got tighter OR operations got slower. Check whether the ETA model/quote policy changed; a quote-side change explains multi-city simultaneity instantly.
  • Timeline decomposition: order → merchant confirmation → prep → Dasher assignment → travel to store → wait at store → pickup → travel to consumer. Attribute the extra minutes: which stage(s) grew?
  • Common-cause scan (because several cities moved together): model or app releases, dispatch/batching parameter changes, incentive/supply changes, weather systems, holidays/events; overlay release calendars on the trend.
  • Segment cuts in order of information: by stage (above), by city vs. control cities, merchant type (prep-time issues concentrate in specific cuisines/chains), batched vs. solo deliveries, Dasher tenure (new-Dasher influx slows pickup), hour-of-day.
  • Immediate mitigations: widen quote buffers where lateness concentrates (protects promises at slight conversion cost), cap batching aggressiveness, targeted supply incentives at peak.
  • Durable fix: whichever stage drove it — recalibrate ETA/prep models with recent data, add wait-at-store telemetry, dispatch parameter guardrails, and a lateness decomposition dashboard so the next spike self-localizes.

The underlying concept

"Late" is a relation between a promise and an outcome, so its investigation always forks immediately: did promises tighten or did performance slip? Treating the delivery as a sum of stage durations turns a vague metric move into an attribution problem — the same telemetry-decomposition instinct as latency debugging in distributed systems. And correlated onset across units is itself evidence: simultaneity points to shared infrastructure (models, releases, policies) rather than local operations, which is why release calendars are the first dataset a good investigator pulls.

Source

Distilled Prep canon — curated from DoorDash's public work on delivery operations and ETA prediction.

Source: DoorDash engineering blog

DoorDash · DS ·

DoorDash adds bicycle Dashers in a market that previously relied on cars. How would you determine whether the launch is successful?

Product case · experimentation · causal-inference§
Practice against the follow-up probes
  • Success for whom? Walk through consumers, Dashers, merchants, and the platform.
  • Bike deliveries will differ from car deliveries by construction. How do you avoid mistaking selection for causation?
  • What experiment design fits a market-level supply change?
  • How do you measure whether bikes added capacity versus cannibalizing car Dashers?
  • Weather and geography interact with mode. How does that shape rollout and analysis?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Three-sided metric thinking plus a specific trap: bikes get assigned short, dense, small-basket orders, so naive bike-vs-car comparisons measure the assignment policy, not the mode. Strong candidates design at the market level (geo or phased rollout), decompose incremental capacity vs. substitution, and treat existing car Dashers' earnings as a first-class guardrail.

Strong answer outline

  • Define success across sides: consumers — delivery time, lateness, food quality, cost; Dashers — earnings per active hour for both modes (cannibalization shows up as car-Dasher earnings decline); merchants — order volume, wait-at-store; platform — cost per delivery, fulfillment rate at peak.
  • Name the selection problem: dispatch will route bikes to short/dense orders — never compare bike orders to car orders directly; compare markets (or time periods) with and without the bike program.
  • Design: staged geo rollout with matched control markets or synthetic control; within-market switchbacks are polluted by supply persistence (Dashers don't appear/disappear hourly), so market-level inference is the honest unit.
  • Incrementality decomposition: total supply-hours before/after by mode; survey/behavioral evidence on whether bike Dashers are new workers or car Dashers switching; capacity value measured at peak (did fulfillment improve when it was binding?).
  • Interaction effects: weather (bike supply collapses in rain — check reliability under adverse conditions before calling success), geography (dense cores vs. suburbs), and time-of-day mix.
  • Decision framing: expand where bikes add peak capacity at lower cost per delivery without degrading car-Dasher earnings past a threshold; hold or adjust incentives where substitution dominates.

The underlying concept

When a new supply type enters a marketplace, the platform's own assignment algorithm immediately confounds any unit-level comparison — the treatment (mode) is entangled with the routing policy. The clean counterfactual lives at the market level, which is why geo experiments and synthetic controls dominate marketplace launch evaluation. The second discipline is decomposing gross additions into incremental capacity vs. substitution: marketplaces care about the net supply curve, and total-hours accounting plus peak-constraint analysis is how you see it.

Source

Distilled Prep canon — curated from DoorDash's public work on marketplace experimentation.

Source: DoorDash engineering blog

DoorDash · DS ·

Design the experiment for a new batching algorithm that assigns two orders to one Dasher. The team believes it cuts cost per delivery; you suspect it risks lateness and food quality.

Product case · experimentation · logistics-optimization§
Practice against the follow-up probes
  • What is the treatment unit — order, Dasher, zone, time window — and why?
  • Where does interference between treatment and control come from here?
  • Why might a switchback beat user-level randomization, and what new problems do switchbacks bring?
  • What guardrails and what decision rule — is this a superiority or a non-inferiority question?
  • The algorithm's benefit depends on order density. How does that shape analysis and rollout?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Interference-aware design: batching decisions consume shared Dasher supply, so treated and control orders in one market at one time contaminate each other. This is the canonical switchback scenario, and the interviewer wants the candidate to reason to it — plus the analytic maturity to frame cost savings against lateness as a non-inferiority test with pre-set margins.

Strong answer outline

  • Why order-level randomization fails: an order batched in treatment removes a Dasher from the shared pool that control orders draw on — control outcomes absorb spillover, biasing effects (typically making treatment look better than reality).
  • Design: switchbacks — randomize (zone × time-window) units between algorithms; windows long enough for the system to reach steady state (dispatch queues clear) but short enough for many units; buffer/burn periods at boundaries to limit carryover.
  • Analysis on switchbacks: cluster-robust inference at the window-zone level; expect far less power than order-level tests — plan duration accordingly; check residual carryover by comparing boundary vs. interior periods.
  • Metric frame: primary — cost per delivery (superiority); guardrails — lateness rate, food-temperature proxies/complaints, cancellations, Dasher earnings per hour, merchant wait congestion (non-inferiority with pre-registered margins, e.g., lateness within +0.5pp).
  • Heterogeneity: batching pays only above an order-density threshold; pre-plan analysis by density tier and hour; rollout policy is likely conditional (batch aggressively in dense zones at peak, minimally elsewhere), not global.
  • Decision rule stated upfront: ship the density-conditional policy if cost improves where guardrails hold; iterate the algorithm where quality margins fail.

The underlying concept

Marketplace experiments fail SUTVA whenever treatment consumes a shared resource; the fix is to randomize the level at which the resource is shared — space-time blocks rather than orders. Switchbacks buy validity at the price of power and carryover risk, which planning (steady-state windows, buffers, clustered inference) manages. The metric lesson: when an intervention trades cost against quality, the honest statistical frame is superiority on the target plus non-inferiority margins on guardrails, all pre-registered so the trade-off is decided before the data can argue.

Source

Distilled Prep canon — curated from DoorDash's public work on switchback experimentation and dispatch optimization.

Source: DoorDash engineering blog

DoorDash · SWE ·

A customer taps "Place order" and their app times out waiting for your response, so it retries. Meanwhile your first attempt actually succeeded — the order reached the kitchen. Walk me through how you design the order placement API so retries are safe, and then tell me what happens when the deduplication store itself is briefly unavailable.

Systems design · distributed-systems · api-design§
Show answer guide
Also: reliability

What the interviewer is probing

Whether the candidate reaches for idempotency keys as a design principle rather than a buzzword: where the key is generated, what gets stored, the atomicity requirement between "check" and "act", and TTL trade-offs. The second part tests degraded-mode reasoning — do they fail open (risk duplicates) or fail closed (risk lost orders), and can they connect that choice to the business cost of each failure?

Strong answer outline

  • Client generates the idempotency key (per logical order attempt, not per HTTP request) so all retries of one intent share a key.
  • Server: atomic check-and-set (e.g. unique constraint or conditional write), not read-then-write — the race between two concurrent retries is the classic bug.
  • Store the response with the key so retries return the original result, not just a "duplicate" error.
  • TTL discussion: too short re-enables duplicates, too long bloats storage; tie it to realistic client retry windows.
  • Degraded mode: articulate fail-open vs fail-closed and pick using domain cost — a duplicate food order costs a refund; a dropped one costs a customer. Reasonable answers differ; unreasoned answers don't.

The underlying concept

Exactly-once delivery doesn't exist between distributed parties; what systems actually implement is at-least-once delivery plus idempotent processing, which is indistinguishable from exactly-once from the caller's perspective. The idempotency key turns a side-effecting operation into something safely retryable by giving the server a durable memory of intents it has already honored. Every payment and ordering system you've used is built on this pattern.

Source

Hand-written seed example in the style of DoorDash's platform reliability posts.

Source: DoorDash engineering blog

Airbnb · MLE · DS ·

You run search ranking for a large travel marketplace. Your ranking model scores each listing independently and fills result positions top-to-bottom with the highest-scoring listings. Product intuition and business data both suggest the results are too homogeneous — guests with minority preferences (e.g., those who favor quality over price) are poorly served, and the overall mix of bookings skews heavily toward one segment.

Your task: redesign the ranking pipeline so that the full result page — not just the top listing — better serves the diversity of guest preferences, while protecting overall booking volume. Walk me through how you would train the diversity signal and how you would use it at serving time.

ML system design · search-ranking · recommendation · Jan 2023§
Practice against the follow-up probes
  • Before building anything, how do you confirm that the current results are actually too similar and that this similarity is causing worse outcomes — not just correlated with them?
  • Your training signal comes from guests who skipped the top result and booked something lower. What selection bias does that introduce, and how does it affect what the model learns?
  • At serving time, you discount each candidate's score by its similarity to already-placed results. What's the failure mode if that similarity discount is calibrated poorly — too high or too low?
  • How do you tune the trade-off between relevance and diversity without running a separate experiment for every possible weight?
  • Diversity gains might erode over time as the model's own outputs become training data. How do you detect and prevent that feedback loop?
Show answer guide

What the interviewer is probing

This question probes whether the candidate can separate the pointwise scoring problem from the set-selection problem and recognize that the two require different model architectures and different training regimes. Strong candidates must reason carefully about the selection bias baked into the training construction (skipped-then-booked implies dissimilarity, but only among a filtered population), the serving-time greedy sequential algorithm and its failure modes, and how to measure diversity outcomes without letting the diversity objective silently cannibalize relevance. The calibration and feedback-loop probes test decision quality and long-term system thinking.

Strong answer outline

  • Problem framing: Pointwise ranking maximizes expected booking probability per position independently; it implicitly assumes preferences are homogeneous and stationary. The real objective is maximizing utility of the set of results, which requires modeling inter-item relationships. This is a set-selection or submodular optimization problem.
  • Diversity signal — training data construction: Use logged sessions where a guest skipped the top result and booked from a lower position. The antecedent (top) listing represents what was passed over; the booked listing further down is the positive, and other skipped lower listings are negatives. The signal being taught: given that a guest rejected the antecedent, the booked listing was preferable in part because it was different. Selection bias to name: this population is not random — it excludes guests who booked the top result (majority), so the similarity model learns the preferences of the minority who wanted something different. That's actually desirable, but the candidate should state it explicitly.
  • Similarity model architecture: A pairwise neural network that takes (candidate listing, antecedent listing) and predicts a similarity score. Features: price bucket delta, listing type, location cluster, amenity overlap, bedroom count delta, photo style embeddings. Train by minimizing a ranking loss where the booked listing has (raw score − similarity to antecedent) > (not-booked score − similarity to antecedent).
  • Serving-time algorithm: Sequential greedy selection — position 1 gets highest raw relevance score; each subsequent position selects argmax over remaining candidates of (relevance score − λ × similarity to all already-placed listings). λ is a tunable hyperparameter controlling the diversity–relevance trade-off.
  • Calibration of λ: Don't tune per-experiment. Instead, treat λ as a business-level dial: fix it via offline simulation on held-out sessions, measuring distributional coverage of price tiers, listing types, and location clusters in results vs. in actual bookings. A/B test a small set of λ values; prefer the one that lifts booking value and quality metrics without degrading total bookings.
  • Metrics: Primary — uncancelled bookings (volume guardrail); secondary — booking value (proxy for quality mix shifting upward), 5-star review rate. Diversity diagnostic — distributional spread of booked price tier, listing type, location cluster across sessions in treatment vs. control. Don't let booking value become the optimization target directly.
  • Failure modes to name:
  • λ too high: high-relevance listings get suppressed; overall booking rate drops.
  • λ too low: no diversity effect; system degenerates to original pointwise ranker.
  • Feedback loop: if ranked outputs become training data, the model learns to reward diversity for its own sake, not because it reflects guest preference. Mitigate with a held-out logging policy (pure relevance ranker on a small traffic slice) to keep unbiased training data.
  • Greedy algorithm is not globally optimal for the set; for longer result pages, beam search or learned sequential policies are worth exploring at higher complexity.
  • Common wrong turns: Trying to inject diversity as a post-processing heuristic (e.g., rule-based price-tier quotas) rather than learning it from data; optimizing booking value as the primary metric rather than as a diagnostic.

The underlying concept

Standard pointwise and pairwise learning-to-rank models assign scores to items independently, which means the result set they produce is implicitly optimized for the modal guest preference — the majority principle. When the guest population is heterogeneous (a Pareto-distributed preference spread), the optimal set of results is one that covers the distribution, not one that packs the top preference into every slot. This is the core idea behind submodular set-selection and Maximal Marginal Relevance (MMR): each new item's marginal value is its relevance minus its redundancy with already-selected items. The key machine-learning insight is that the redundancy signal itself must be learned from behavior — specifically from sessions where guests reveal by their choices that they wanted something different from what was shown first — rather than engineered from feature overlap rules.

Source

Derived from Learning to rank diversely

Airbnb · DS ·

Your company runs hundreds of concurrent A/B experiments each week across dozens of product teams, each optimizing their own success metrics. A post-launch audit reveals that a team shipped a change that significantly degraded a key company-wide metric — one outside their purview — without anyone catching it before launch.

You've been asked to design a guardrail system that automatically flags experiments for review before they can ship, protecting the company's most important metrics without grinding experimentation to a halt.

How would you design this system? Focus on: what metrics you'd protect and how you'd decide when an experiment must escalate before launching.

Product case · experimentation · ab-testing · Jan 2021§
Practice against the follow-up probes
  • Walk me through how you'd choose which metrics belong in the guardrail set versus which stay as team-level success metrics.
  • A low-traffic experiment can't detect a 0.5% change with adequate power in a reasonable time. How does your system handle experiments that differ widely in traffic coverage?
  • There's a fundamental tension between catching real harm and generating noise that reviewers stop taking seriously. How do you operationalize that trade-off?
  • An experiment has a positive point estimate on the guardrail metric but hasn't run long enough to be well-powered. Should it be allowed to ship? Defend your answer.
  • Your escalation process is a bottleneck — reviewers are overwhelmed and teams are slowing down. What levers do you pull, and what are the risks of each?
Show answer guide
Also: ml-monitoring

What the interviewer is probing

This question probes metric judgment — can the candidate distinguish north-star guardrails from team-level OKRs and reason about false positive costs, not just false negatives? It also probes decision quality around the power-vs-sensitivity trade-off: a guardrail that's too tight stops everything; one that's too loose misses real harm. Strong candidates will surface the multiple-comparisons problem, the coverage-adjustment problem, and the organizational dynamics of escalation pipelines — not just describe a p-value threshold.

Strong answer outline

  • Metric selection — less is more: Guardrail metrics should be company-wide, not team-local. Good candidates: top-line revenue or bookings, core user experience indicators (latency, error rates, bounce), and a small number of strategic priorities. Resist the temptation to add every team's favorite metric — with k independent metrics each tested at α = 0.05, the experiment-level false alert rate approaches 1 − (0.95)^k fast, making the escalation queue unworkable.
  • Three layers of protection: A strong answer identifies that no single threshold handles all cases:
  • Magnitude guardrail: escalate if the point estimate is worse than a preset threshold (e.g., −0.5%), regardless of significance. Catches large harms even in noisy experiments.
  • Power guardrail: require the experiment to have run long enough that the magnitude guardrail is well-powered — i.e., if a harm of that size existed, you'd plausibly detect it. Underpowered experiments that show no harm aren't actually clean.
  • Statistical significance guardrail (applied selectively): for the highest-stakes metrics (e.g., revenue), even a small but statistically significant negative move should trigger review, because the dollar value of a small percentage is large.
  • Coverage adjustment: Experiments targeting a narrow audience (say, 5% of traffic) can't detect a 0.5% global effect — the metric is barely touched. Rather than holding all experiments to the same absolute threshold, scale the escalation threshold by coverage: low-coverage experiments get a wider per-unit tolerance but a tighter global-impact tolerance. This normalizes runtime requirements across experiments without letting small experiments escape accountability.
  • Automatic approvals to reduce noise: Not every technical trigger warrants a human review. Two sensible exemptions: (a) metrics where small movements are analytically significant but commercially immaterial — suppress the stat-sig guardrail and use only magnitude; (b) experiments with positive point estimates that haven't yet met the power requirement — allow launch if the confidence interval lower bound clears the threshold (a non-inferiority framing).
  • Setting thresholds — the art part: T (the escalation parameter) should be set as the larger of "what magnitude is worth a human's time to review" and "what magnitude is feasible to detect in a reasonable runtime." Too tight → experiments run forever or escalate constantly; too loose → real harm slips through. Backtest against historical experiments: what fraction would have been flagged, and of those, how many were genuine problems?
  • Organizational design: The escalation process itself is a system with throughput limits. The right answer includes who reviews escalations (cross-functional stakeholders, not just the running team), what the SLA is, and what happens when the queue backs up. Escalation should be a conversation, not a veto — the goal is transparency, not a launch block.
  • Common wrong turns: Setting thresholds purely on statistical grounds without asking "is this magnitude commercially meaningful?" Ignoring the multiple-comparisons inflation across guardrail metrics. Treating underpowered clean results as safe. Applying identical thresholds to 1%-coverage and 100%-coverage experiments.

The underlying concept

Guardrail systems are a structured answer to the multiple-objectives problem in large-scale experimentation: teams optimize local metrics, but a launch decision should be conditioned on the absence of meaningful harm to shared company metrics. The core statistical challenge is that 'no detected harm' and 'no harm' are different claims — one requires adequate power to be meaningful. The coverage-adjustment insight is that a metric's standard error scales with the fraction of total traffic included, so a fixed absolute threshold creates unequal runtime burdens; normalizing by coverage makes the power requirement consistent. The multiple-comparisons problem means each additional guardrail metric adds false-positive escalation probability, so metric selection is as much an organizational design decision as a statistical one — too many guardrails and reviewers become desensitized, too few and real harms go undetected.

Source

Derived from Designing Experimentation Guardrails

Airbnb · DS · SWE ·

You're building the assignment layer for an A/B testing platform at a consumer marketplace. A colleague proposes a simple design: call get_treatment(user_id) to assign a user to a variant, then immediately log that assignment, and only afterward execute the variant-specific code path.

A senior engineer pushes back, saying this design will silently corrupt experiment results in production. What's the flaw they're pointing at, and how would you redesign the assignment and logging contract to prevent it?

Product case · experimentation · ab-testing · May 2014§
Practice against the follow-up probes
  • Walk me through a concrete scenario — not hypothetical — where the log fires but the user sees a different experience than what was logged.
  • Why is this class of bug particularly dangerous compared to, say, a metric being computed incorrectly?
  • How does your redesign prevent a well-meaning engineer who doesn't know about the experiment from introducing the same bias later?
  • Your redesign makes experiments more explicit in the code. What's the cost of that, and how do you mitigate it?
  • Suppose the variant-specific code path throws an exception after assignment is logged. What should happen to that log record?
Show answer guide

What the interviewer is probing

This question probes causal reasoning — specifically whether the candidate understands that logged assignment must be causally tied to actual exposure, not just to the assignment call. Strong candidates identify the check-then-act decoupling as the failure mode, articulate why silent mis-logging is worse than a crash (it produces biased estimates with no error signal), and reason about encapsulation as a correctness guarantee, not just an API taste. The follow-ups test whether they can think about error handling and the organizational dimension of keeping experiment integrity under ongoing code changes.

Strong answer outline

  • Name the flaw precisely: the bug is that logging and treatment delivery are decoupled. Any code between the log call and the rendered experience — a short-circuit conditional, a feature flag, a performance patch — can silently override the variant while the log records the original assignment. The user sees experience A; the log says B. This is exposure-logging contamination.
  • Why it's especially bad: unlike a computation error that produces noisy estimates, this produces systematically biased estimates — the contaminated segment (e.g., all Chinese users in the post's example) will show inflated or deflated treatment effects with no warning signal. The experiment appears to run cleanly.
  • Redesign principle — atomic deliver-and-log: the assignment, logging, and execution of the variant code path must be a single, indivisible call. The canonical pattern is a higher-order function (or callback/lambda): deliver_experiment(:name, control: -> { … }, treatment: -> { … }). The framework owns: (1) hashing the subject to a bucket, (2) recording the log, (3) immediately invoking only the correct lambda. No caller can interpose logic between steps 2 and 3 without touching the framework itself.
  • Encapsulation as a correctness guarantee: because the variant logic lives inside the lambda, any engineer who wants to change behavior for a subgroup (e.g., Chinese users) must either modify the lambda — which is visibly inside the experiment block — or modify the framework itself. Either action is auditable. The design makes bias hard to introduce accidentally.
  • Exception handling: if the variant lambda throws, the framework should catch, log the failure with the assignment record invalidated or flagged, fall back to a safe default, and not count that session in the analysis. Counting a failed delivery as a valid treatment observation is another form of the same contamination bug.
  • Common wrong turns: proposing logging at metric-collection time (too late; the user may not convert), proposing client-side deduplication (doesn't fix the causal gap), or treating this as purely a logging infrastructure problem rather than an API design problem.
  • Trade-off to name: the lambda/callback design is more verbose and requires experiment authors to reason about closures; the cost is worth it because the alternative trades ergonomics for silent correctness failures in production data.

The underlying concept

In controlled experiments, the unit of analysis is an exposure — a moment when a user actually experienced a specific variant. Logging must record exposures, not assignments, and those two things diverge whenever any logic can run between the assignment call and the rendered experience. The fix is encapsulation: binding the log emission and the variant execution into a single atomic operation so no external code can split them. This is a special case of the check-then-act race condition, except the damage is statistical rather than transactional — the experiment produces confidently wrong numbers rather than an obvious error. Because the bias is systematic (it affects a predictable subgroup, not random noise), it cannot be averaged away with more data.

Source

Derived from Experiment Reporting Framework

Airbnb · DS · MLE ·

You run a two-sided experiences marketplace — think cooking classes, surf lessons, guided tours. Your current search ranking model is a GBDT trained to maximize booking probability, and it's working well. A senior stakeholder argues that optimizing for bookings alone is shortsighted: guests who have a great experience are substantially more likely to rebook, so the model should be biased toward high-quality supply, even if that slightly depresses near-term bookings.

How would you decide whether to change the ranking objective, and if you do change it, how would you design and evaluate the experiment?

Product case · search-ranking · experimentation · Feb 2019§
Practice against the follow-up probes
  • Before touching the model, how do you define 'quality' in a way that's measurable and manipulation-resistant?
  • You plan to reweight training examples by quality tier. What are the failure modes of that approach compared to changing the loss function or adding a quality feature directly?
  • Your A/B test runs for two weeks and shows neutral bookings and a shift toward high-quality experiences. Is that enough to ship? What's missing from the readout?
  • The experiment is over. A host whose low-rated experience got demoted complains. How do you explain the ranking change to them, and does your answer change how you design the system?
  • A year later, your supply of high-quality experiences has grown because you promoted them — but your model's quality signal is now noisier because experiences have fewer reviews per slot of demand. What do you do?
Show answer guide

What the interviewer is probing

This question probes objective function design and the tension between a short-term proxy metric (bookings) and a long-term marketplace health metric (rebooking, quality). Strong candidates will define quality operationally, reason about label construction and leakage, design an experiment with a long enough horizon to capture rebooking effects, and articulate the supply-side feedback loop that makes this a sustained strategy decision rather than a one-time model tweak.

Strong answer outline

  • Define quality operationally before modeling it. Quality must be defined from data, not intuition. Candidates should propose a composite: review rating, review volume (to reduce noise on thin-review items), and structured post-experience feedback (e.g., 'better than expected'). Flag that rating alone is gameable and noisy at low count; volume thresholds matter.
  • Three implementation options, with trade-offs.
  • Add quality as a feature: cleanest; model learns the relationship from data; doesn't force a predetermined quality-booking trade-off. Risk: model may ignore it if bookings dominate the signal.
  • Reweight training examples by quality tier: directly shapes what the model optimizes; simpler to tune. Risk: arbitrary tier boundaries, potential cliff effects, model may learn to proxy quality via correlated features (price, category) rather than quality itself.
  • Change the label: replace binary booked/not-booked with a weighted outcome (e.g., booked × quality multiplier). Similar to reweighting but applied at label level; interacts with loss function. Risk: calibration breaks — model scores no longer approximate booking probability.
  • Label leakage is a real trap. Quality signals (post-trip reviews) are observed after the booking and stay. Training data construction must be careful: quality features used to reweight must come from the experience's historical reviews, not reviews generated by the training examples themselves.
  • Experiment design must include delayed outcomes. Near-term A/B readout: bookings (volume and quality distribution). But the core hypothesis — better experiences drive rebooking — has a 30-90 day delay. Design the experiment with a pre-registered secondary metric: rebooking rate of guests in treatment vs. control within 90 days. Without this, you can't actually validate the hypothesis.
  • Watch for supply-side effects. Demoting low-quality supply reduces their demand, potentially improving or worsening those experiences over time (fewer bookings means less revenue for the host to invest in improvement, or fewer reviews to escape cold start). Track quality distribution of the full supply, not just top-ranked items, to detect whether ranking is concentrating demand dangerously.
  • Decision rule. Ship if: (a) bookings are neutral or better, (b) quality distribution of bookings shifts toward high-quality tiers, (c) 90-day rebooking signal is directionally positive (even if underpowered). Hold if quality shift comes at a bookings cost that isn't recovered by rebooking gains within a defensible time window.
  • Common wrong turns. Treating AUC improvement in offline evaluation as sufficient validation. Running the experiment for too short a window to observe rebooking. Ignoring cold-start experiences that have no quality signal yet (they need a separate treatment, e.g., a quality-neutral score floor while accumulating reviews).

The underlying concept

Ranking objective design is fundamentally a question of which outcome you're willing to optimize as a proxy for long-term marketplace health. When you train on a short-term label (booking), you implicitly assume that all bookings are equally valuable — but in a marketplace where supplier quality drives repeat demand, that assumption is wrong. Reweighting training examples by outcome quality is the standard technique for introducing a richer objective without changing the model architecture: you're telling the optimizer that some positive examples matter more than others. The core risk is that quality labels are post-hoc (observed after the outcome you're trying to predict), so careful temporal discipline in training data construction is essential to avoid leakage. Finally, any supply-side ranking intervention creates feedback loops: demoting low-quality supply changes the demand those suppliers receive, which changes their future quality signals — a dynamic that offline experiments and short A/B tests cannot capture, making long-horizon monitoring a non-negotiable part of the launch decision.

Source

Derived from Machine Learning-Powered Search Ranking of Airbnb Experiences

Airbnb · DS ·

Design a policy and measurement plan for encouraging hosts to adopt Instant Book (guests book without host approval) without harming trust or marketplace quality.

Product case · causal-inference · experimentation§
Practice against the follow-up probes
  • Adoption is voluntary. Why does that break the obvious adopters-vs-non-adopters comparison, and what do you do instead?
  • What could go wrong for trust and quality, and which metrics catch it early?
  • Would you treat new hosts, professional hosts, and occasional hosts the same way?
  • What encouragement levers exist, and how do they differ analytically?
  • What would make you roll the program back?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Selection-bias instincts: hosts who opt into Instant Book differ systematically from those who don't (professionalism, availability discipline), so naive comparisons flatter the feature. Strong candidates reach for encouragement designs — randomize the nudge, not the adoption — and instrument the trust side (cancellations, incidents, reviews) as first-class outcomes, with policies differentiated by host segment.

Strong answer outline

  • Name the selection problem: adoption correlates with host quality; outcome gaps between adopters and non-adopters are not causal effects of the feature.
  • Encouragement design: randomize incentives/nudges (search boost, fee discount, education) at the host level; measure intent-to-treat effects, and use the randomized encouragement as an instrument for adoption if effect-on-adopters is needed. Cluster by market if ranking-boost nudges create within-market interference.
  • Outcome set: guest conversion and booking latency (the upside); host-cancellation rate, guest-reported incidents, review scores, support contacts, host churn (the trust guardrails). A host who accepts Instant Book but cancels often is worse than one who declines upfront.
  • Segment policies: professional hosts likely adopt with light nudges; occasional hosts may need protections (trip-type controls, guest-requirement filters) before adoption is healthy; brand-new hosts are the riskiest to auto-enroll — stage them.
  • Long-horizon monitoring: adoption changes the composition of bookings; track quality metrics per cohort over quarters, not weeks.
  • Rollback rule: pre-register thresholds on host-cancellation and incident rates by segment; the program pauses per-segment, not globally.

The underlying concept

When treatment is chosen rather than assigned, comparing the treated to the untreated measures who chooses, not what the treatment does. Encouragement designs recover causality by randomizing an upstream influence and analyzing intent-to-treat; instrumental-variable logic then scales that to the compliers. The marketplace twist is that adoption changes system composition — evaluation must include the counterparty's outcomes (guests, here) and run long enough for composition effects to surface.

Source

Distilled Prep canon — curated from Airbnb's public work on experimentation and policy evaluation.

Source: Airbnb engineering blog

Airbnb · SWE ·

Design a globally consistent availability and reservation system that makes double-booking a listing for overlapping dates impossible, while keeping search fast.

Systems design · distributed-systems · databases§
Practice against the follow-up probes
  • Two guests hit "book" for overlapping dates within 50 ms of each other. Walk me through exactly what happens.
  • How do you model availability for date ranges rather than single slots?
  • Payment authorization takes seconds and can fail. How does that interact with holding the dates?
  • Search reads availability millions of times per booking write. Do reads see the same truth as writes?
  • A region goes down mid-booking. What is the failure behavior?
Show answer guide
Also: reliability

What the interviewer is probing

Whether the candidate separates the one operation that needs strict serialization (committing a reservation) from the vast read traffic that doesn't, and can implement range-overlap exclusion correctly — naive check-then-insert is the classic race. Also probing the booking-payment interaction (holds with TTL, sagas) and honest consistency reasoning across regions.

Strong answer outline

  • Correctness core: per-listing serialization of reservation commits. Implementations: transactional insert with an exclusion constraint on (listing, date-range overlap) — e.g., per-day rows with unique (listing, date) keys inserted atomically, or a range-exclusion constraint; alternatively optimistic concurrency on a per-listing calendar version. The invariant lives in the database, not application logic.
  • The 50 ms race: both requests attempt the atomic commit; exactly one succeeds, the other receives a clean conflict and re-searches. Correctness does not depend on timing.
  • Payment interaction: two-phase flow — place a short-TTL hold on the dates (same exclusion mechanics), authorize payment, then confirm; expiry or payment failure releases the hold automatically. Idempotency keys on the whole flow make client retries safe.
  • Read path: search reads eventually consistent replicas/caches of availability (staleness measured in seconds is acceptable — the commit step re-verifies), so search scale never touches the serialized path. Final availability check happens inside the booking transaction.
  • Multi-region: home each listing's calendar to one region (ownership by geography) so commits are single-region strongly consistent; replicate asynchronously for reads. Cross-region failover promotes ownership with fencing to prevent split-brain double-commits.
  • Degraded modes: if the owning region is down, fail bookings for its listings (correctness over availability for money+inventory) while search continues on stale reads.

The underlying concept

Inventory systems are exclusion problems: the invariant "no two confirmed reservations overlap" must be enforced where atomicity actually exists — a transactional store with constraints — because any check-then-act sequence outside it races. The scalable pattern is asymmetric consistency: strong consistency on the narrow write path, eventual consistency on the wide read path, with the write path re-validating what stale reads promised. Holds-with-TTL are the standard bridge between instantaneous inventory locks and slow external side effects like payment.

Source

Distilled Prep canon — curated from Airbnb's public work on reservation and payments infrastructure.

Source: Airbnb engineering blog

Airbnb · DS ·

Search-to-book conversion fell 15% in one destination market, but traffic and listing supply are stable. Lead the diagnosis.

Product case · search-ranking · marketplace-dynamics§
Practice against the follow-up probes
  • Walk me through the funnel you'd construct before touching any data.
  • Which segment cuts do you make first, and what would each reveal?
  • How do you distinguish a demand mix-shift from a product or supply problem?
  • What supply-side changes could cause this with listing count unchanged?
  • When do you stop diagnosing and escalate or act?
Show answer guide
Also: data-quality

What the interviewer is probing

Structured funnel decomposition under a one-market anomaly: does the candidate localize the drop to a funnel stage before hypothesizing, do they generate supply-side explanations that hide behind stable listing counts (availability, minimum stays, pricing, host responsiveness), and do they check for measurement artifacts before believing the behavior change? Airbnb's version of this question rewards knowing that "supply is stable" by count can conceal massive effective-supply changes.

Strong answer outline

  • First: verify the metric — instrumentation changes, bot traffic, definition changes, and comparison-window artifacts (holiday shift, event last year) explain a large share of single-market anomalies.
  • Localize in the funnel: query → results viewed → listing detail → booking request/instant book → acceptance → payment. A drop at detail-view→request implicates pricing/content; at request→acceptance implicates hosts; at results→detail implicates ranking or inventory match.
  • Demand mix: lead time, trip length, party size, domestic vs. international, device — a shift toward lower-converting segments (e.g., longer lead times after an event announcement) can move the aggregate with no product problem.
  • Effective supply despite stable counts: calendar availability for searched dates, minimum-stay rules, price increases, cleaning fees, host response time — all shrink bookable supply invisibly.
  • Cross-checks: did competitors or events change locally (regulation, festivals moving)? Compare similar markets as a synthetic control to see if the drop is market-specific.
  • Prioritize by expected information gain; timebox the diagnosis, and present findings as: funnel stage, segment, magnitude, candidate cause, recommended action or experiment.

The underlying concept

Funnel decomposition is diagnosis by conditional probabilities: overall conversion is a product of stage-wise rates, so a drop must live in identifiable factors — and localizing it first prevents hypothesis-shopping. The Airbnb-specific lesson is effective supply: in calendar-based marketplaces, supply is inventory × availability × constraints × price acceptability, and only the first term shows up in a listing count. Measurement artifacts outrank behavioral explanations in prior probability; check them first.

Source

Distilled Prep canon — curated from Airbnb's public work on search and booking funnel analytics.

Source: Airbnb engineering blog

Airbnb · DS ·

Search ranking is changed to favor listings with a higher predicted probability of host acceptance. How would you evaluate whether this change should launch?

Product case · search-ranking · experimentation§
Practice against the follow-up probes
  • What defines success here — for guests, hosts, and the marketplace — beyond bookings?
  • How do you separate ranking relevance from host availability and acceptance behavior?
  • Position bias, delayed outcomes, cancellations: how does each contaminate your readout?
  • Boosting likely-accepting hosts changes which hosts get demand. What long-term effects does that create, and how would you detect them?
  • Would you randomize by guest, by search, or something else? Why?
Show answer guide
Also: marketplace-dynamics

What the interviewer is probing

Whether the candidate sees that this ranking change optimizes a transaction probability, not relevance — and that doing so redistributes demand among hosts, which can reshape the supply side over time. Strong candidates define a guest metric (successful, completed stays — not clicks), a host-side metric (demand concentration, new-host exposure), and a marketplace metric, and they handle the long feedback delays that make booking experiments slow.

Strong answer outline

  • Success definition: guest side — booking conversion and completed, well-reviewed stays (an accepted booking that cancels later is not success); host side — acceptance rate, distribution of bookings across hosts, new-listing exposure; marketplace — total completed nights and rebooking rates.
  • Decompose the mechanism: the change can win by (a) genuinely reducing guest effort wasted on requests that get declined, or (b) merely shifting exposure to instant-book/professional hosts. Same topline, very different long-term marketplace.
  • Experiment design: randomize by guest (searcher), stratify by market; measure through the full funnel — search → request → acceptance → booking → completed stay — with a window long enough for stays to complete; expect weeks, and pre-register leading indicators.
  • Confounds to name: position bias (boosted listings get clicks by position alone — consider counterfactual logging or position-adjusted metrics); seasonality by market; cancellation lag.
  • Long-term supply effects: run a host-side holdout or monitor demand concentration (e.g., share of bookings to top-decile hosts) and new-host cold-start success; a rich-get-richer loop is the main strategic risk.
  • Decision rule: launch if guest success improves without measurable harm to new-host exposure; if concentration worsens, pair the ranking change with an exploration floor for new listings.

The underlying concept

Ranking by predicted transaction success is optimizing a composite outcome: relevance times counterparty behavior. The moment counterparty behavior enters the objective, ranking becomes a market intervention — it allocates demand, and suppliers respond to the allocation. This is the two-sided version of Goodhart's law: boosting what converts today reshapes tomorrow's supply, so evaluations must include distributional metrics and exploration guarantees, not just average conversion.

Source

Distilled Prep canon — curated from Airbnb's public work on search ranking and marketplace experimentation.

Source: Airbnb engineering blog