# Design a social network spam detection system: system design interview question

> Account risk and coordinated spam: fast post checks, delayed evidence, new attacks, and harm to legitimate users.

Source: https://sysround.com/questions/design-social-network-spam-detection-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a system that identifies spam accounts and coordinated spam on a social platform. The system must detect new abuse patterns and limit harm to legitimate users."

## What to clarify first

- Spam definition
- Scale
- Read and write mix
- Event data and retention
- Latency and location
- Availability and consistency
- Error costs
- Existing services
- Feedback delay
- Scope boundaries

## Scope of a strong answer

Core requirements:

- Assess spam risk for accounts and post attempts
- Detect groups of accounts that coordinate spam
- Apply proportionate actions through an existing enforcement service
- Record decision evidence and accept review outcomes

Usually out of scope:

- Detect every type of harmful content
- Analyze images, videos, or private messages
- Build the social feed or account service
- Build analyst tools or the user appeal interface

## What interviewers probe

### Coordinated account behavior

Attackers can keep each account below a local threshold. Legitimate events can also cause many accounts to share content at the same time.

### New abuse patterns

Labels arrive late and cover a selected set of accounts. Attackers can change their behavior or corrupt reports that influence future decisions.

### Effects on legitimate users

Spam has a low base rate. A small error rate can affect many legitimate users, while appeals reveal only some mistakes.

### Post checks and late evidence

Fast post checks use incomplete evidence. Late events and retries must not restore an old restriction after an appeal.

## Common mistakes

- Treats the problem as text classification and ignores account coordination.
- Uses shared links or networks as sufficient evidence for suspension.
- Uses accuracy instead of action-specific precision and recall.
- Treats reports and past detector decisions as confirmed labels.
- Performs unlimited group analysis in the post path.
- Ignores stale actions, appeal overrides, or the harm from challenges.

## The bar by level

- **Senior:** Bounds group analysis and meets the post latency target. Handles duplicate events, stale features, and action retries. Designs mature-label evaluation and proportionate actions.
- **Staff+:** Defines evidence standards for the suspension target. Addresses selective feedback, report attacks, and harm measurement. Establishes action authority, review overrides, and resource budgets under attack.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=social-spam-detection


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.