How the interviewer opens it
“Design a system that identifies spam accounts and coordinated spam on a social platform. The system must detect new abuse patterns and limit harm to legitimate users.”
The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.
What to clarify first
- Spam definition
- Scale
- Read and write mix
- Event data and retention
- Latency and location
- Availability and consistency
- Error costs
- Existing services
- Feedback delay
- Scope boundaries
The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.
Scope of a strong answer
Core requirements
- Assess spam risk for accounts and post attempts
- Detect groups of accounts that coordinate spam
- Apply proportionate actions through an existing enforcement service
- Record decision evidence and accept review outcomes
Usually out of scope
- Detect every type of harmful content
- Analyze images, videos, or private messages
- Build the social feed or account service
- Build analyst tools or the user appeal interface
What interviewers ask about
- Coordinated account behavior
- Attackers can keep each account below a local threshold. Legitimate events can also cause many accounts to share content at the same time.
- New abuse patterns
- Labels arrive late and cover a selected set of accounts. Attackers can change their behavior or corrupt reports that influence future decisions.
- Effects on legitimate users
- Spam has a low base rate. A small error rate can affect many legitimate users, while appeals reveal only some mistakes.
- Post checks and late evidence
- Fast post checks use incomplete evidence. Late events and retries must not restore an old restriction after an appeal.
Common mistakes
- Treats the problem as text classification and ignores account coordination.
- Uses shared links or networks as sufficient evidence for suspension.
- Uses accuracy instead of action-specific precision and recall.
- Treats reports and past detector decisions as confirmed labels.
- Performs unlimited group analysis in the post path.
- Ignores stale actions, appeal overrides, or the harm from challenges.
The bar by level
- Senior (L5/E5)
- Bounds group analysis and meets the post latency target. Handles duplicate events, stale features, and action retries. Designs mature-label evaluation and proportionate actions.
- Staff (L6+/E6+)
- Defines evidence standards for the suspension target. Addresses selective feedback, report attacks, and harm measurement. Establishes action authority, review overrides, and resource budgets under attack.