Design a Real-time Recommendation System — System Design Interview Practice

Interview prompt

Design a real-time personalized recommendation service that ingests behavior events, combines fresh features with offline models, and returns diverse candidates within a tight latency budget.

• Define event collection, online feature freshness, candidate retrieval, ranking, filtering, exploration, diversity, and explanation contracts.
• Combine collaborative, content-based, popular, and contextual candidates while preventing stale, unsafe, duplicate, or already-consumed items.
• Keep the serving path bounded and cacheable; update features asynchronously and make event ingestion and model rollout idempotent.
• Explain cold start, feedback loops, experimentation, privacy, fallback recommendations, observability, and model/index recovery.

Requirements and scale assumptions

• Ingest impressions, clicks, views, purchases, skips, and dislikes with deduplication and consent-aware retention.
• Retrieve and rank personalized candidates with configurable filters, diversity, explanations, model/version metadata, and freshness.
• Support anonymous and new-user recommendations, experimentation, user deletion/export, model rollback, and graceful fallback when features are missing.
• Meet p95 recommendation latency under 50ms for warm users and keep online-feature freshness under one minute.
• Scale to millions of requests per minute without a single hot key or unbounded synchronous candidate work.
• Do not lose committed state; make retries and duplicate events safe.
• Degrade safely when downstream workers, caches, or external dependencies fail.
• Millions of recommendation requests per minute and billions of catalog items/events
• Partition online features and user caches by user; shard ANN/item indexes and precompute broad candidate pools.
• Keep serving state bounded; retain raw events or durable records for replay and auditing.

• Peak scale: 1M requests/minute; 10B catalog items/events — Capacity assumption that drives partitioning and backpressure.
• Latency target: p95 serving < 50ms; features < 1 minute old — User-facing budget for the primary request or read path.
• Durable boundary: Committed before async — Interaction events and versioned model artifacts are authoritative; online features and indexes are rebuildable.
• Async boundary: At-least-once workers — Keep Use two-tower models for candidate retrieval, Implement ANN indexes for fast similarity search, Use feature stores for real-time user features off the synchronous path.

Key entities

• DatasetVersiondatasetId, version, schemaHash, qualityStatus, lineage, createdAt

  Immutable real time recommendation system input version used for reproducible training, evaluation, or replay.

• FeatureSnapshotentityId, featureSetVersion, eventTime, values, sourceWatermarks

  Point-in-time real time recommendation system features with source watermarks so online and offline values can be compared.

• TrainingRunrunId, datasetVersion, codeVersion, metrics, artifactUri, status

  Audited real time recommendation system run that records data, code, dependency, and evaluation lineage.

• ModelVersionmodelId, version, stage, schema, qualityGates, endpoint

  A promotable real time recommendation system model version with rollout state, contract, and rollback metadata.

Data flow

1. 1. Register and validate training dataThe real time recommendation system gateway records an immutable dataset version, schema, lineage, quality status, and privacy disposition.
2. 2. Build point-in-time featuresFeature workers join real time recommendation system inputs using event-time watermarks, prevent leakage, and publish the same feature contract for training and serving.
3. 3. Train and evaluate asynchronouslyThe orchestrator schedules real time recommendation system runs with checkpointed artifacts, reproducible environments, and metrics tied to the exact input versions.
4. 4. Gate and serve a model versionA registry compares real time recommendation system quality, bias, safety, and compatibility gates before canary or production rollout with an immediate rollback pointer.
5. 5. Monitor drift and learn from feedbackOnline inference records latency, errors, drift, and delayed labels so real time recommendation system retraining is evidence-driven rather than triggered by guesswork.

Deep dives and trade-offs

• Reproducibility and leakage preventionPin real time recommendation system data, feature, code, dependency, and model versions for every run. Use point-in-time joins and quarantine failed quality or privacy checks before training. Keep raw inputs and artifacts immutable so a result can be replayed after a dependency changes.
• Safe promotion and serving contractsSeparate real time recommendation system model registration from deployment and require signed artifacts plus schema compatibility. Use shadow traffic, canaries, rollback pointers, and per-version latency/error budgets. Return model version and feature freshness so clients can explain or reproduce a prediction.
• Drift, feedback, and costMeasure feature drift, prediction drift, label delay, and segment-level quality for real time recommendation system rather than only aggregate accuracy. Sample expensive inference and cap retraining concurrency with an explicit GPU or compute budget. Keep human corrections and delayed labels linked to the original prediction and model version.
• Batch versus online featuresPrefer a shared feature contract with batch backfills and a low-latency online serving path for decisions that need freshness. Two independently defined transformations create training-serving skew and hard-to-debug regressions.
• Synchronous versus asynchronous inferenceKeep interactive real time recommendation system inference synchronous within a strict budget and queue large or expensive jobs. A request path that waits for model loading, enrichment, or retraining turns downstream slowness into an outage.
• Global model versus segment modelsStart with one versioned model and add segment-specific models only when quality or policy evidence justifies the operational cost. Many simultaneously active versions multiply monitoring, rollback, and data-lineage burden.