# Spam Detection System Low-Level Design: Velocity Checks, Graph-Based Detection, and Classifier Ensemble

Source: https://www.techinterview.org/post/3233469710/lld-spam-detection/
Updated: 2026-06-30 · techinterview.org

## Spam Detection System Overview

Spam detection combines fast rule-based velocity checks, text classification, and graph-based account analysis. No single signal is sufficient — spammers adapt to any single detector. The system scores submissions using an ensemble of signals and enforces in real time at the point of posting or messaging.

## Spam Signal Categories

- **Velocity signals:** Too many posts or direct messages within a short time window.

- **Content signals:** Repeated identical messages, known spam URLs, promotional patterns.

- **Behavioral signals:** Account created recently, no profile photo, mass follow/unfollow cycles.

- **Graph signals:** Connected to known spam accounts in the follow or messaging graph.

## Rule-Based Velocity Checks

Velocity rules execute in under 1ms using Redis counters with sliding windows:

- Posts in the last hour per account.

- DMs sent today per account.

- New follows in the last 10 minutes.

When a counter exceeds a threshold, the action is immediately rejected or rate-limited. Redis INCR with TTL-based expiry implements sliding window counters efficiently. These rules catch the most obvious bot behavior before any ML inference runs.

## Text Classifier

A BERT-based classifier fine-tuned on labeled spam vs legitimate content identifies non-obvious spam:

- Detects spam URLs not yet in blocklists.

- Identifies obfuscated spam text (character substitution, spacing tricks).

- Trained on historical labeled data augmented with user reports.

The model outputs a spam probability score. Inference runs in ~10ms on GPU, or ~50ms on CPU with quantized model.

## Graph-Based Detection

Spam accounts do not operate in isolation — they follow each other, message each other, and are created by the same operators. The account graph exposes this:

- Build a graph: nodes are accounts, edges are follow/message relationships.

- Apply community detection (Louvain algorithm) to identify tightly connected clusters.

- If any node in a cluster is a confirmed spam account, flag the entire cluster for review.

- Graph analysis runs as an offline batch job (hourly or daily), feeding a risk score into the serving feature store.

## Ensemble Scoring

Signals are combined into a single spam probability score:


```
spam_score = w1 * velocity_score
           + w2 * text_classifier_score
           + w3 * graph_risk_score
           + w4 * account_age_signal
```

Weights are calibrated on labeled data. The combined score is compared against enforcement thresholds: auto-reject, queue for review, or allow.

## Real-Time Enforcement

The spam score is computed synchronously at post/message submission time:

- Velocity check (Redis, <1ms).

- Text classifier inference (~10-50ms).

- Graph risk score lookup from feature store (Redis, <2ms).

- Ensemble score computed.

- Action: reject with error, silently drop (shadow ban variant), or allow.

## Feedback Loop from User Reports

User reports are the primary source of new labeled training data:

- Reported content is reviewed and labeled as spam or not spam.

- Labels feed into weekly or monthly classifier retraining.

- Rapid-response pipeline: new spam URL domains can be added to blocklist within minutes of first report without model retrain.

## IP and Device Fingerprint Signals

Multiple accounts originating from the same IP or device fingerprint are a strong spam signal:

- IP-to-account mapping stored in Redis: if one account on an IP is confirmed spam, other accounts from the same IP receive elevated risk scores.

- Device fingerprint (browser, OS, screen resolution, timezone) used similarly for web-based spam.

## Hash-Based Deduplication

Identical or near-identical spam messages are detected before classifier inference:

- **Exact match:** SHA-256 hash of message content, checked against a bloom filter of known spam hashes.

- **Near-duplicate:** SimHash (locality-sensitive hashing) detects messages that differ only in minor character substitutions, whitespace, or URLs.

## False Positive Mitigation

Legitimate users must not be incorrectly blocked. Risk-adjustment factors:

- Verified accounts (phone-verified, payment method on file) receive a lower base spam score.

- Accounts with long positive history get more benefit of the doubt before enforcement.

- Appeals process available for incorrectly actioned accounts, with rapid human review SLA.

See also: [Netflix Interview Guide 2026: Streaming Architecture, Recommendation Systems, and Engineering Excellence](https://www.techinterview.org/post/3233460274/netflix-interview-guide-2026-streaming-architecture-recommendation-systems-and-engineering-excellence/)

See also: [Meta Interview Guide 2026: Facebook, Instagram, WhatsApp Engineering](https://www.techinterview.org/post/3233460272/meta-interview-guide-2026-facebook-instagram-whatsapp-engineering/)

See also: [Twitter/X Interview Guide 2026: Timeline Algorithms, Real-Time Search, and Content at Scale](https://www.techinterview.org/post/3233460305/twitter-x-interview-guide-2026-timeline-algorithms-real-time-search-and-content-at-scale/)

See also: [Scale AI Interview Guide 2026: Data Infrastructure, RLHF Pipelines, and ML Engineering](https://www.techinterview.org/post/3233460275/scale-ai-interview-guide-2026-data-infrastructure-rlhf-pipelines-and-ml-engineering/)