Netflix TechBlog | Medium Note

Netflix TechBlog | Medium

Netflix Tech Blog offers insights into how Netflix handles technology. They provide research on data science, engineering, design, and technology innovations. They showcase their innovations, like their proprietary content delivery network and provide insights into their service reliability efforts.

Thread Of Notes

The company faces challenges in understanding its massive, complex infrastructure, especially during live events like the Jake Paul and Mike Tyson fight which drew 65 million streams. Debugging issues, such as a slow-rendering home screen, can take hours because information is siloed across different systems. These systems collect data through metrics, events, logs, and traces (MELT), but correlating this data effectively is difficult. The core problem is the lack of a shared, machine-readable understanding of operational entities.To address this, they developed an "Observability Ontology," a formal specification of types, properties, and relationships within their operational world. This ontology uses standards like RDF, OWL, SHACL, and SPARQL, storing data as a knowledge graph. A key design decision was to avoid a generic "Service" type, instead using specific, validated types like ops:Application. They also chose to model the reasoning and context from incident discussions, transforming unstructured chat into structured triples.The ontology creates determinism from inherently stochastic processes like LLMs and fuzzy matching through a pipelined approach. This pipeline uses "enrichers" that reduce entropy by converting noisy input into typed triples, following strict contracts. These enrichers ensure every entity has a type, URIs follow a naming scheme, and applications are validated against a catalog. The pipeline runs sequentially to avoid race conditions, with external calls being best-effort to prevent blocking.A "Correlation Engine" then assimilates signals from various sources, identifying causal or correlatory chains of events. It analyzes thirteen signal types, proposing hypotheses with evidence and confidence scores, storing supporting graph records. Each cycle of observation, enrichment, correlation, and storage forms a "Knowledge Flywheel," continuously enriching the knowledge graph and improving system context. This flywheel aims to reduce debugging time by providing a unified and interconnected view of system operations.
CdXz5zHNQW_iZ7761FCA3.png
Netflix developed a Foundation Model for personalization to centralize member preference learning. This powerful model, trained on extensive user interaction and content data, distributes its learnings to other models. Integrating this large model into production systems presented a challenge, leading Netflix to experiment with three distinct approaches: embeddings, subgraph, and fine-tuning. Each method caters to different application needs regarding latency, tech stack, and model utilization.The embeddings approach leverages pre-computed user profile and item representations from the Foundation Model, stored in an Embedding Store. While straightforward and cost-effective, it can lead to stale recommendations due to the time gap between computation and inference. Netflix enhances this with daily fine-tuning and an embedding stabilization technique. A near-real-time framework is being developed to address staleness and improve adaptiveness.The subgraph integration treats the Foundation Model decoder as a component within an application's larger model graph. This allows for deeper integration, uses up-to-date learnings, and unlocks application-specific value by accessing specific Foundation Model layers. However, it introduces complexity in feature generation and increases model size and inference time. This approach is reserved for high-impact use cases where metric improvements justify the costs.The fine-tuning approach adapts the Foundation Model for specific applications by further training it on product-specific data and objectives. This offers optimized performance and serves as a baseline for new applications. While requiring careful optimization for latency and SLAs, it can lead to a proliferation of models and pipelines. Netflix provides a fine-tuning framework to simplify this process.Ongoing innovations include near-real-time embedding inference and smaller, distilled Foundation Model versions to reduce latency. Standardized APIs and a robust fine-tuning framework aim to make leveraging the Foundation Model easier for application teams. These three integration patterns provide a comprehensive strategy for Netflix applications to benefit from the Foundation Model.
CdXz5zHNQW_hmBwk8f7S1.png
CdXz5zHNQW_l7K4dKBoxE.png
Personalization is a key feature of online platforms like Netflix, influencing user discovery and engagement. However, measuring the true value of personalization presents a significant challenge, as recommendations are targeted based on predicted user preferences, making it difficult to disentangle recommendation effects from user appeal. A naive approach of counting recommended views is insufficient because it doesn't establish causality. Running experiments to turn off personalization entirely would negatively impact user experience and is therefore not a viable measurement strategy.Instead, researchers developed a hybrid approach combining a behavioral model with small-scale A/B tests. This model estimates how recommendations influence both viewing decisions and title selection by separating underlying user preferences from the incremental impact of a recommendation. The model represents member preferences dynamically, capturing how past viewing history shapes current tastes. It explicitly models the "bonus" effect of recommendations on title selection, reflecting increased awareness and information.To validate the model's accuracy in predicting substitution patterns, it was compared against results from randomized experiments. These experiments introduced exogenous variation in title visibility, mimicking how recommendation algorithms change. The model demonstrated strong predictive power, with its simulated diversion ratios showing high correlation with experimental estimates.Using the validated model, researchers conducted counterfactual analyses to compare the current Netflix recommender system against baselines like random, popularity-based, and basic matrix factorization recommendations. The current system significantly outperformed these baselines in terms of aggregate engagement, reducing it by 16% for random recommendations and 12% for popularity-based ones. Even compared to matrix factorization, the current system showed a 4% gain in engagement.Beyond just increasing viewing, the model also assessed consumption diversity. The current system maintained a broader distribution of viewership across titles, unlike popularity-based and matrix factorization recommendations which led to increased viewership concentration. Random recommendations offered more diversity but at a considerable cost to engagement. Therefore, personalization not only drives more viewing but also matches users to a more diverse set of titles, reflecting varied tastes.
CdXz5zHNQW_s7Y4CacbU5.png
Netflix's TimeSeries Abstraction platform, crucial for petabyte-scale temporal data, faces significant storage cost challenges. To address this, two solutions have been implemented to move older, less accessed data to cheaper object storage while maintaining low-latency access. The first solution uses Apache Kafka and Flink to stream data to S3, followed by a daily compaction job that merges and optimizes Parquet files. This compaction process involves creating small row groups, sorting events by time, and using Bloom filters for efficient reads. The compacted files are then registered in the control plane, allowing hot storage truncation. Reads are fanned out across hot and cold tiers, with the cold tier leveraging compaction metadata to minimize S3 reads.Despite success, the streaming infrastructure introduced complexity and cost. This led to the development of a second, more integrated solution leveraging Cassandra backups. This approach aims to read data directly from S3 backups without separate data transfer. It introduced a new Cassandra compaction strategy called ReadOnlyCompactionStrategy (ROCS) for immutable time slices. ROCS aligns SSTables with token ranges, reducing read fan-out and improving latency across all tiers.Cassandra backs up its data to S3, creating manifests that list SSTable paths. The second solution customizes Cassandra to read directly from these S3 backups for immutable time slices. It uses pluggable Memtables, specifically a "backupmemtable," to redirect reads. This backup Memtable downloads necessary index and metadata files from S3 to the node. Robust resilience mechanisms ensure reliable component downloads and initialization. Once local components are ready, Cassandra serves reads from these backups, parallelizing S3 reads and utilizing caching for further optimization. This strategy significantly reduces operational overhead and infrastructure costs by eliminating separate streaming infrastructure.
CdXz5zHNQW_qmkDWPsHdU.png
Netflix rebuilt its Ads Event Publisher to handle increased scale and complexity, particularly for live streaming advertisements. The previous system relied on a Key-Value store for ad metadata enrichment. This approach, while functional, presented scaling bottlenecks and critical path dependencies that were unsuitable for live events. Live streams generate massive, spiky traffic requiring a more robust and elastic solution.The new architecture utilizes Apache Flink, a stateful stream processing framework, for near real-time enrichment. Ad server response logs are sent to Kafka instead of a database. Flink then performs a real-time streaming join between these responses and client-generated ad events. This eliminates direct database writes on the critical serving path, preventing outages and improving scalability.The Flink job normalizes events, routes them to the correct processing region, and importantly, performs a stateful join. It holds recent ad serving responses in memory and matches incoming client events against them within configurable windows, typically 60 minutes. This approach allows for on-the-spot enrichment when both events are available. If an event arrives first, it's held until its corresponding response appears.To address cross-region enrichment, the system routes client events to the region that served the ad, rather than replicating all serving responses globally, which is more cost-effective. The ad token now includes the serving region information. Although the 60-minute window covers most events, a separate path exists to recover late-arriving events, ensuring data completeness for billing and reporting. This stateful stream processing architecture provides the necessary scalability and resilience for Netflix's evolving advertising needs.
CdXz5zHNQW_vv6mcOQtqA.png
CdXz5zHNQW_fpGlfFLsWS.png
Netflix's member-sessionizer, a critical data pipeline, processes billions of events to create user viewing sessions. Standard debugging approaches failed at Netflix's production scale, as issues like Out-Of-Memory errors only appeared with large, unsampled datasets due to data skew. The author's breakthrough was shifting focus from speeding up single runs to enabling multiple concurrent experiments. This was achieved by leveraging Dataflow's branch-driven development to isolate each test variant.By parameterizing the scheduler and assigning each experiment its own branch and output table, multiple tests could run simultaneously. This drastically reduced total execution time from hours per test to the duration of the longest single job. An AI agent was employed to manage the operational complexity of running many parallel experiments, automating configuration updates, job triggering, and metric polling. This freed the author from tedious manual checks, allowing for immediate comparison of results.Persistent tmux sessions on Netflix's cloud development environment proved crucial for preventing multi-hour Spark jobs from being interrupted by network drops or laptop closures. The core performance bottlenecks were identified as the collect_list operator buffering entire event bags in memory and inefficient data structures. Specifically, changing session IDs to UUID strings and using Scala Options for fields significantly increased memory usage. Additionally, bloated string attributes added unnecessary weight to each event.The fixes involved unboxing primitive fields from Options and slimming down event bags by removing unused attributes. Session-invariant metadata was hoisted to the session header. Two counterintuitive findings highlighted the complexities of Spark memory management: narrowing rows could trigger faster OOMs by forcing broadcast joins, and Adaptive Query Execution silently accumulated large amounts of data in memory through broadcast hash joins. Tuning AQE's broadcast threshold resolved this.A disciplined logging system tracked each experiment, its configuration, and key metrics, creating a single source of truth and forcing isolated variable changes. A mistake was made by testing a session capping fix before the Spark Window stage, which buffered memory before truncation. The final corrected fix moved the truncation upstream to prevent memory bloat. While these tuning efforts solved immediate problems, the fundamental data shape of aggregating entire sessions into single rows poses a future scaling challenge.
CdXz5zHNQW_imDTAsvHQS.png
Large-scale text generation with LLMs necessitates automated evaluation due to manual review limitations. The LLM-as-a-Judge approach uses a second LLM to score a primary LLM's output, but raises concerns about the evaluator's trustworthiness. This problem is addressed by building, aligning, and continuously monitoring LLM judges, ensuring they remain anchored in human judgment at every stage. Humans define quality standards, create labeled datasets, monitor judge behavior, and approve updates.A reliable LLM judge is not static; it has a lifecycle involving human ownership in its creation, alignment, operation, and maintenance. This process is illustrated through the task of generating recommendation explanations, which are short messages explaining item recommendations. Quality is crucial as misleading explanations erode user trust.The LLM judge lifecycle comprises four phases: Birth, Training, Deployment, and HITL Alignment & Drift Monitoring. Birth involves human experts crafting benchmark data, including adversarial and boundary examples, which are then labeled by human raters. Training refines the LLM judge to align with human labels and rationales, using self-reflection and rubric updates. Deployment integrates the judge as a gate and critic within the explanation generation system.HITL Alignment & Drift Monitoring ensures continued trustworthiness by periodically benchmarking the judge against human raters and requiring human approval for any system changes. This phase uses a Meta-Judge to compare the LLM judge's rationale with human rationales, catching cases where the judge arrives at the correct answer for the wrong reason. This continuous feedback loop, incorporating new human-labeled data and signals, feeds back into the benchmark and development phases. The system components include a Generator, Judge, Reflector, Meta-Judge, and human experts and raters, all working together across the lifecycle phases to maintain judge integrity.
CdXz5zHNQW_pa8iRRxAOL.png
Stratum is Netflix's internal serverless media processing platform, crucial for handling diverse media workloads like encoding and packaging. Engineers define Stratum functions as OCI images, which are then scheduled as batch jobs on the Titus compute platform. Managing hundreds of thousands of containers, Stratum needs dynamic scaling for new content formats such as podcasts and live events. Resource requests, specified in YAML, are often over-provisioned due to evolving infrastructure and application changes, leading to inefficiencies and increased operational costs.To address this, Netflix developed the Stratum Resource Tuner (SRT), an automated system designed to right-size container resources in production. SRT aims to eliminate manual resource configuration, focusing initially on high-throughput workloads with relaxed latency requirements, which constitute 70-80% of resource usage. Function owners can opt-in to automatic right-sizing per resource type (CPU, memory, disk, network).The SRT workflow consists of five steps: collecting resource usage metrics, generating recommendations, verifying recommendations via experiments, applying or rejecting recommendations, and monitoring post-application metrics. Recommendations progress through states: CREATED, EVALUATING, APPLIED, REJECTED, and MONITORED. For example, the VideoEncoder.encodeV1 function's over-provisioned memory and CPU were successfully tuned.Metrics collection is robust, with execution-level summaries stored in Elasticsearch for short-term lookups and high-resolution raw usage metrics in Iceberg tables for long-term trend analysis. A Conductor workflow runs daily, using a month of Iceberg data to generate recommendations for all functions and resource types. This process involves filtering high-throughput workloads, aggressively tuning CPU and network (p99 usage), and conservatively tuning memory and disk (p99.9 usage with a safety buffer).Safeguards are in place, such as discarding recommendations if the reduction is too small, and clamping maximum reductions for memory and disk to 15% per cycle. Recommendations are created in the CREATED state and become immutable once they advance past this stage. The example shows CPU recommendations reducing from 8 to 4, and memory from 18000MB to 15300MB in a single step, illustrating SRT's practical application in cost optimization.
CdXz5zHNQW_2pPMwVXJcD.png
Netflix relies heavily on GPUs for its personalized content recommendations and other machine learning applications. These GPUs are crucial for training and serving content, making their reliability a business imperative for both availability and cost efficiency. Basic cloud provider health checks are insufficient because they do not detect subtle GPU or network fabric failures that can cripple long-running training jobs. Such failures can manifest as slow performance or complete job stoppage, impacting user experience and wasting resources.Netflix employs a layered approach to ensure GPU infrastructure health. The first layer focuses on detecting and remediating failing hardware like GPUs and network adapters. The second layer involves the scheduler and platform, which retry tasks and validate machines before they are used. The third layer enables long-running jobs to survive machine loss through checkpointing and elastic workers. The fourth layer is observability, which monitors the effectiveness of the other three.Health checks operate in two tiers: device-level checks for individual GPUs and node-level checks performed by an agent. These checks report results as Kubernetes node conditions. When a problem is detected, the machine's condition is updated, and controllers take action. Initial issues are tolerated, but persistent failures escalate to machine evacuation, draining, and replacement.Remediation is graded, with actions matched to the fault severity, ranging from restarting a single GPU to terminating and replacing the entire machine. For persistently failing hardware, immutable identifiers are recorded to prevent them from rejoining the pool. Machines are validated before being released for work, ensuring they pass all diagnostics. Finally, long-running jobs are made resilient through checkpointing, allowing them to resume from the last stable state if a machine is lost.
CdXz5zHNQW_gLdQGMuM0X.png
Organizations often maintain two parallel identity systems: one from cloud providers like AWS and another for internal services. This post details how Apache Spark workloads on Amazon EMR bridge this gap, enabling them to gain a first-class internal identity from an initial cloud identity. Netflix utilizes a private PKI called Metatron for service-to-service authentication via mutual TLS, requiring an attestation process to verify workload identities. They also employ a "Data Project" concept, which owns data and has its own identity, ensuring consistency in access control and auditing.The core challenge is translating a cloud-based AWS execution role into the necessary internal identity for Spark jobs on managed compute. This solution establishes a direct, one-to-one mapping between each Data Project identity and a dedicated IAM role, with the Data Project service serving as the authority for this mapping. This mapping is crucial for translating statements from the cloud provider's vocabulary to the organization's internal one. To address the scalability issue of managing numerous IAM roles, these roles are deterministically sharded across a small pool of dedicated AWS accounts.Five components are involved: the control plane (launches jobs and signs metadata), the Data Project service (manages the identity-to-role mapping), the Identity service (verifies attestations and issues certificates), a Spark plugin (hooks into process bootstrapping), and AWS STS (acts as a notary). The process begins with the control plane signing a metadata payload containing workload details. Subsequently, the Spark driver plugin uses AWS credentials to create a pre-signed URL from AWS STS, proving possession of the cloud identity.The Identity service then corroborates these two independent claims: the role identified by AWS from the pre-signed URL and the signed metadata from the control plane. If they align, certificates are issued for the workload. This corroboration is vital as neither statement alone is sufficient; the provider's statement is unforgeable but underspecified, while the control plane's statement is well-specified but potentially replayable. The system addresses the fan-out problem for executors by having the driver attest once and distribute credentials securely. Certificates are short-lived and renewed through a repeatable attestation process within the driver JVM. The trust model ensures no single participant can issue an identity independently, and the workload itself is never required to vouch for its own legitimacy.
CdXz5zHNQW_E3OfGUk31B.png
Netflix aims to connect members with content they'll love through personalized visual assets like artwork and video previews. A significant challenge arises with new titles, where insufficient interaction data prevents effective personalization, a problem known as the cold-start issue. Traditionally, models treated assets as opaque IDs, relying on popularity heuristics until enough data accumulated. This meant personalization for new content was delayed, impacting the discovery experience.Netflix's solution involves using multimodal embeddings to allow models to "see" and "hear" the assets. By encoding artwork with CLIP, a pre-trained image-text model, assets gain visual understanding. This CLIP embedding is concatenated with the asset's ID embedding, creating a richer representation that captures visual themes and talent. This enables personalization based on member preferences for visual styles, even before the asset has any interaction history, facilitating knowledge transfer across titles.This approach also enables model consolidation, merging separate models for different artwork canvases into a single unified model. Because CLIP embeddings are largely invariant to cropping and resizing, near-identical renderings of artwork map to similar vectors. This pooling of interaction signals across canvases, especially benefiting low-data canvases, allows a single model to personalize all artwork placements. To address data imbalance across canvases, reward-based weighting is used, prioritizing interactions based on their long-term value rather than impression volume.The effectiveness of this approach was validated through offline evaluations using inverse propensity scoring and large-scale A/B tests. Combining image embeddings with a unified model (V3) significantly outperformed models with only one of these improvements. This combined approach proved crucial during a major Netflix home-screen redesign, where a dominant canvas with minimal historical data was introduced. The unified model with CLIP embeddings successfully personalized content for this new layout, showing statistically significant gains in discovery metrics and streaming hours, highlighting the power of multimodal embeddings for overcoming the cold-start problem.
CdXz5zHNQW_HJCpS7bDND.png
Netflix built a Real-Time Distributed Graph to power real-time insights for their internal partners, and the third part of this blog series focuses on querying the graph efficiently. The graph is a complex network of billions of nodes and edges, and querying it requires a fast and flexible serving layer. The authors discuss the challenges of querying the graph, including handling a wide range of access patterns and supporting both shallow-wide and deep-narrow queries. They explain how they designed a serving layer to efficiently query the graph, using a breadth-first approach and asynchronous composition to minimize latency. The authors also discuss the importance of caching, opt-in enrichments, and eventual consistency in the design of the query layer. The query layer is composed of three layers: the Graph Query Service, the Storage Abstraction Layer, and the Enrichment Layer, which work together to execute queries efficiently. The authors walk through an example query to demonstrate how the query layer works in practice, highlighting the importance of reading and interpreting the request, reading from storage efficiently, executing traversal with breadth-first levels, running many operations in parallel, filtering smartly, and making repeat queries faster with caching. The goal of the query layer is to complete queries in under 100ms, and the authors demonstrate how their design achieves this goal. The query layer is designed to handle tens of thousands of queries per second, each potentially different, and the authors discuss the trade-offs they made in designing the query layer to achieve this level of performance. Overall, the authors provide a detailed overview of the design and implementation of the query layer, highlighting the challenges and trade-offs involved in building a high-performance query layer for a large-scale distributed graph. The query layer is a critical component of the Real-Time Distributed Graph, and the authors' design and implementation have enabled Netflix to power real-time insights for their internal partners.
CdXz5zHNQW_1lL53FS8TQ.png
Netflix offers a wide range of features and content types across various devices, but hardware limitations can restrict certain features on specific devices. To address this, the company has developed a comprehensive device capability data model to understand device capabilities and ensure the best user experience. The data model integrates feature flags from internal systems, enabling smarter feature management across the global device landscape. A cumulative table is used to store information about device capabilities, such as screen resolutions, video profiles, and RAM size, making it ideal for analytics and reporting. The table is structured to capture the latest state of each device and its associated capabilities, allowing for efficient processing of information. For aggregate analytics, a histogram table is used to capture active device counts over the past 28 days, broken down by device model and software version. This table also records the number of devices supporting specific capabilities, enabling detailed distribution analysis. The histogram data can be used to analyze the distribution of external display capabilities, such as the percentage of devices supporting HD or UHD profiles. By leveraging these datasets, Netflix has built analytical products to provide a comprehensive view of feature reach, including 4K Ultra HD, Netflix Spatial Audio, and Cloud Gaming. The company uses data-driven insights to make informed decisions about which features to enable on specific devices, ensuring both performance and reliability.
Recommendations are a crucial part of the Netflix experience, and the company has been using complex production models that rely on thousands of hand-crafted features and specialized architectures. However, these models are costly to maintain and update, and the company is looking for more efficient and effective solutions. Large language models have shown promise in this area, but they are not yet production-ready and often have limitations such as over-recommending popular content and ignoring business constraints. To address this, Netflix built GenRec, an LLM-backed recommendation ranker that post-trains an internal foundation LLM on Netflix-specific data and objectives. GenRec verbalizes user histories, item metadata, and context as text and uses a catalog-aware scoring head to rank items. The model is trained with a multi-objective loss that combines ranking, language, and reward signals to align with business goals and long-term member satisfaction. GenRec has shown statistically significant improvements in both short-term and long-term online metrics compared to a well-tuned production ranker, while using only a small fraction of the labeled data and input signals. The model is served on Netflix's internal LLM stack using vLLM, and the company has implemented strategies to control serving cost, such as using smaller models, aggressive context compaction, and prefill-only inference. Overall, GenRec represents a significant step towards a more LLM-centric future for recommendation at Netflix, and its success has the potential to transform the way the company approaches recommendation and personalization. The model's ability to learn from natural language inputs and generate personalized rankings has the potential to improve the user experience and increase engagement. By leveraging the power of large language models, Netflix can create more effective and efficient recommendation systems that drive business success.
CdXz5zHNQW_VHtw7eOaqU.png
Netflix runs its entire large language model stack internally, managing deployment and inference directly. They integrated this into their existing production environment instead of a separate machine learning silo. This approach involved carefully selecting an inference engine, deciding how models would be packaged, designing the API surface, defining deployment strategies, and enforcing output constraints.The chosen inference engine is vLLM, selected for its operational fit, ability to load custom architectures, extensibility, debuggability, and familiarity among practitioners. Models are packaged using the vLLM backend in Triton to allow dynamic I/O tensor specification, promoting independent evolution of models and frontends. An OpenAI-compatible HTTP frontend was added alongside their existing gRPC interface for broader ecosystem compatibility.For deployment, Netflix uses a Versioned strategy to handle potential schema changes between model versions, allowing consumers to update independently. When model interfaces are stable, the less costly Red-Black deployment strategy is employed. One key operational challenge was slow model startup times, which they addressed by materializing large models on Amazon FSx for faster access.Observability was improved by creating a unified /metrics endpoint that aggregates data from both vLLM and Triton. A significant feature is constrained decoding at scale, implemented via vLLM's custom logits processor. This allows models to generate compliant outputs directly, avoiding post-inference correction.An initial pure-Python implementation of constrained decoding struggled with scaling due to the Global Interpreter Lock (GIL) and sequential processing on the CPU. This only became apparent under high concurrency, leading to significant tail latencies. The system relies on a Java control plane for managing deployment, versioning, and autoscaling. Both real-time and cached batch inference paths are supported by their serving system. This unified system handles the complete downstream consumer flow, including routing, candidate generation, and logging.
CdXz5zHNQW_CmjJjU7Bih.png
Netflix developed a real-time service dependency map to aid engineers in troubleshooting and understanding their distributed architecture. The system combines eBPF network flows, IPC metrics, and distributed tracing into independent graph layers. While the initial version worked locally, production revealed significant scaling challenges, including Kafka consumer lag and memory issues.The core architectural decision was a streaming-first approach, providing near real-time topology updates instead of hourly batch processing. This was crucial for incident response and live event monitoring. To handle millions of flow records per second without data loss, the system employs reactive streams with backpressure, signaling upstream components to slow down when downstream systems are overwhelmed. This ensures graceful degradation rather than crashes or data loss.The architecture uses a multi-layer design with physical storage isolation for network, IPC, and tracing layers, allowing independent optimization. The network layer's ingestion relies on a three-stage distributed aggregation pipeline. Stage 1 performs initial aggregation from Kafka, Stage 2 resolves network intermediaries (like load balancers) into direct application-level dependencies, and Stage 3 handles final aggregation, enrichment with external data, and persistence to the graph database.The three-stage pipeline was a critical evolution from an initial two-stage design, which suffered from "hot nodes" due to data concentration during intermediary resolution and enrichment. Splitting these responsibilities across three stages distributes the workload, preventing bottlenecks. Server-Sent Events (SSE) replaced gRPC for inter-stage communication due to gRPC's performance overhead, which consumed excessive CPU and memory at scale.
CdXz5zHNQW_FXxC4JJL7E.png
The Netflix homepage is a highly personalized and structured interface for content discovery. Traditionally, its generation involved a complex multi-stage pipeline. GenPage, a novel approach, utilizes a single generative transformer model to autoregressively construct the entire homepage. This end-to-end model takes user context as a prompt and generates rows, entities, and layout simultaneously. Key goals include simplifying the recommendation stack, enabling whole-page optimization via reinforcement learning, and improving scalability and flexibility. Production challenges involved real-time serving latency, entity cold start, and maintaining model freshness. GenPage has demonstrated significant improvements in user engagement and reduced serving latency in A/B tests. The data is tokenized into context tokens representing user information and page tokens for the homepage structure. Domain-specific tokenization enhances computational efficiency and product control compared to generic text tokenization. User history, profile, and request context form the prompt, while entities and rows are represented as tokens in the generated page. The system uses a reward system based on user feedback to quantify recommendation value and guide training. GenPage employs a standard decoder-only transformer architecture and follows an LLM-like training recipe of pretraining and post-training. Pretraining uses next-token prediction to teach the model the homepage language, followed by post-training with weighted binary classification or reinforcement learning. This generative approach offers a more integrated and direct path to optimizing the entire Netflix homepage experience.
CdXz5zHNQW_XlipK7GYZj.gif
CdXz5zHNQW_YZ3adN1Eip.gif
Netflix is transitioning its compute infrastructure to a Kubernetes-native model, integrating components like Kueue into its Titus platform. Kueue, a cloud-native job queueing system, has largely replaced the custom logic of their homegrown batch solution, Compute Managed Batch (CMB). Motivations for this migration included CMB's age, the evolution of Kubernetes, and the growing difficulty of adding features like preemption to the existing system. Kueue was chosen over alternatives due to its compatibility with existing Titus scheduling profiles, its adoption momentum, and its native support for features like preemption.The migration, known as Netflix Batch, aimed for zero user impact and no reduction in throughput. The process involved rerouting job submissions to Kueue-enabled Titus cells, with Titus federation handling job distribution. Operator adjustments were minimal, primarily involving a simple UI toggle to enroll tenants into Kueue. This enrollment translates CMB's existing tenant hierarchy and capacity configurations into Kueue's concepts of Cohorts, ClusterQueues, and LocalQueues.Key lessons learned include maintaining API parity with the old system to ensure a smooth user experience and migrating complex use cases early to build confidence. It was also crucial to load test Kueue to ensure it could handle Netflix's high throughput requirements, necessitating adjustments to default configurations. Kueue is now fully operational, managing millions of batch workloads, and has enabled enhanced fair sharing and preemption features. These improvements allow for better utilization of reserved capacity, reduced job starvation, and faster turnaround for critical workloads, significantly increasing average resource utilization.
CdXz5zHNQW_CNU9jjDeMi.png
CdXz5zHNQW_QIKFLIgBao.jpeg
Netflix faced challenges managing millions of data assets with an individual asset-based access control system. Organizational changes caused permission updates to be burdensome and inconsistent, leading to either flooded support teams or overly broad access grants. Workloads were tied to human identities, causing failures when engineers changed roles or left the company, resulting in a "permissions whack-a-mole" issue. To address these problems, Netflix introduced Data Projects, which act as containers for related assets and provide durable, project-specific identities for workloads. This shifts management granularity from individual assets to logical project groupings. Each Data Project has grants and roles, allowing users, groups, or applications to be assigned specific access levels. The project’s Netflix application identity executes workloads, independent of human lifecycles, and can be cryptographically exchanged for AWS IAM roles. A key feature called "gravity" automatically adds newly created assets to their project, ensuring organizational consistency. Data Projects have proven successful in stabilizing critical pipelines and simplifying access management for complex analytics domains. Onboarding involves creating a project, granting roles, and configuring workflows to use the project's identity, with new assets automatically associated via gravity. Future plans include expanding projects beyond data to software and studio assets, integrating rightsizing for permissions, and adding features like cost attribution and auditing. Ultimately, Data Projects provide a scalable and stable solution for identity and access management at Netflix, aligning with how teams organize their work.
CdXz5zHNQW_K0v8hwjFH4.png
Netflix's Analytics Summit showcases how analytics informs business decisions, including content launch risk. Content goes through development, production, post-production, and launch preparation, with launch preparation relying on finalized media assets. Teams face a trade-off between waiting for the final IMF, risking delays, or starting early with a less final Locked Cut, risking rework. Manually provided production schedules for these assets often lack accuracy and coverage, especially far from delivery. This inaccuracy is strongly correlated with content launch misses. To address this, Netflix developed predictive models to estimate media asset delivery dates. These boosted tree regression models use production-level signals, metadata, and seasonal data, updated daily. The models aim to fill schedule gaps and improve existing date accuracy. Evaluating these models involves metrics like mean absolute error, bias, and error distribution. Backtests show significant improvements in predictive accuracy compared to manual schedules, reducing forecast errors. These improved predictions lead to lower Accumulated Error Days, a metric tied to launch misses. The predictive dates integrate into existing workflows, offering earlier accuracy than scheduled dates. Serving logic defaults to scheduled dates where the model underperforms, while other teams can view both and use their judgment. This initiative streamlines launch workflows and mitigates launch risks by providing more reliable delivery estimates.
CdXz5zHNQW_D56kTwX7j8.png
Netflix uses Data Bridge as a unified management plane for batch data movement. Historically, custom connectors were developed for specific needs, but efforts are underway to centralize these offerings. The Cassandra to Iceberg connector, Casspactor, was an in-house solution for critical applications like Member and Billing. Casspactor handled significant data volumes but faced challenges with fragile metadata dependencies and inherited limitations across data abstractions. These issues included skewed partition failures, lack of data model awareness, intermediate table bloat, and an inability to time travel. A new layered architecture was developed to address these shortcomings.This new engine, built on Apache Cassandra Analytics and the Move Data framework, features a core S3 reading capability and a Connector Factory model. It processes data directly into Spark DataFrames, eliminating intermediate tables. The new stack efficiently handles skewed partitions and offers autosizing capabilities for jobs. It also significantly reduces dependencies by relying solely on S3 for metadata, enhancing reliability and enabling time travel. Rigorous validation, visibility, and safety measures were crucial for migrating from Casspactor. A like-for-like migration strategy ensured minimal disruption and no changes for downstream users. Shadow testing was employed to guarantee data consistency between the old and new systems. This involved verifying that the output of the new system was an exact replica of the legacy system's output.
CdXz5zHNQW_YhOHn7KUOE.png
Daniel Kahneman's dual-process theory describes two cognitive systems: System 1 for automatic, quick thinking and System 2 for deliberate, focused effort. This concept applies to designing intelligent systems that balance immediate responsiveness with foresight. Netflix's personalized notification platform faces a similar challenge, optimizing hundreds of millions of daily messages. A core tension exists between maximizing short-term engagement and ensuring a positive long-term member experience. Over-messaging can lead to fatigue and opt-outs, while under-messaging risks missing valuable content discoveries.To address this, Netflix implemented a hierarchical framework with a "slow" policy for strategic, weekly messaging plans and a "fast" policy for tactical, real-time message selection. Previously, single-message outcome models optimized for short-term gains but overlooked cumulative effects and coupled ranking with pacing decisions. The new "slow" policy defines a personalized message pacing over a defined horizon, considering long-term engagement. This is achieved by maximizing a utility function that balances positive engagement signals against the long-term cost of messaging.A universal message cost term is introduced to prevent models from always opting for maximum frequency. The "slow" policy's decisions are stored in a feature store, enabling asynchronous communication with the "fast" policy. The "fast" policy then executes tactical send decisions within the strategic guardrails set by the "slow" policy. This decoupling allows for independent evolution of both strategies and ensures a consistent member experience. The hierarchical architecture led to significant metric lifts, particularly benefiting casual viewers by improving content awareness. Ultimately, separating frequency planning from message selection proved transformative, allowing for independent iteration on both aspects.
CdXz5zHNQW_5a5N2KsO0X.png
Data analysis is increasingly delegated to software agents, necessitating oversight for valid results, especially in Observational Causal Inference (OCI). This work introduces an agentic workflow for OCI that adheres to rigorous templates while augmenting human inspection. The workflow aims to reduce repetitive tasks for OCI practitioners, allowing them to focus on nuanced aspects like question framing and assumption evaluation. An open-sourced version of their oci-agent is available for improvement, and evaluations show it outperforms one-shot iterations and rivals hand-tuned benchmarks. The philosophy relies on target trial emulation, outlining ideal A/B tests to inform necessary assumptions for causal inference. This involves design diagnostics like covariate balance, overlap, placebo outcomes, and sensitivity analysis. The agent orchestrates an actor-critic loop with three personas: Principal (human user), Actor (analysis executor), and Critic (results synthesizer). Principals define the plan and context, Actors refine and execute the analysis with diagnostics, and Critics identify gaps and assess credibility. To empower human evaluation, the workflow makes each analytic step transparent through published artifacts like plans, specifications, and notebooks. A case study at Netflix estimated the impact of a new entertainment type, revealing significant early adopter bias. Standard regression gave a large effect, but the agentic workflow, using diagnostics, identified poor overlap and placebo test failures. Addressing these, the agent implemented trimming, significantly reducing the estimated effect to a more credible range for the overlapping population. Follow-up analyses, such as sensitivity tests and time-series generation, are facilitated by the agent's ability to manage complex, multi-version executions.
CdXz5zHNQW_diDkFz7Rdh.png
CdXz5zHNQW_FChDJm0cOO.png
Netflix's TimeSeries Abstraction ingests and queries petabytes of temporal event data with millisecond latency, using Apache Cassandra as its storage. Wide partitions, where a single partition accumulates a large volume of events over time, pose a significant challenge for TimeSeries workloads. This leads to high read latencies, timeouts, increased CPU utilization, and garbage collection pauses in Cassandra clusters. To address this, TimeSeries data is partitioned into discrete time chunks, creating manageable segments.The initial provisioning strategy relied on user-specified workload characteristics and Monte Carlo simulations to determine optimal infrastructure and partition configurations. However, this approach proved insufficient when workloads were unknown, inaccurately estimated, evolved over time, or contained data outliers. To automate adjustments, a background worker was introduced to monitor partition histograms and dynamically re-partition future time slices based on observed data density. This Time Slice Re-Partitioning strategy effectively reduces read latencies and timeouts when most data exhibits similar wide partition behavior.However, this strategy doesn't address scenarios where only a small percentage of IDs within a table are wide. For such cases, and when callers require all data even with elevated latencies, Dynamic Partitioning per ID was developed. This asynchronous pipeline detects wide partitions during read operations and transparently splits them into optimal sizes. The process involves detection, planning and splitting, and serving reads by re-routing queries to the split partitions.Detection occurs when a read operation exceeds a configured byte threshold, emitting an event to Kafka. The system initially focuses on immutable partitions for simplicity. The planning stage reads the entire partition to create a split plan, using checkpointing to handle failures. Splitting involves delegating the data division to specific strategies, like assigning more event buckets to a time bucket. Validating splits is crucial, with checksums ensuring data integrity before marking a split as complete. Finally, the TimeSeries servers use in-memory Bloom filters to efficiently divert read queries to the split partitions, making the diversion practically invisible to callers.
CdXz5zHNQW_JhVMWuRvRR.png
Netflix utilizes machine learning across various business domains like personalization, studio production, payments, and advertising. As ML adoption grew, a challenge emerged: a fragmented landscape where models and data were siloed, hindering collaboration and discovery. ML practitioners struggled to understand model lineage, feature sources, and impact across different systems. This fragmentation prevented easy answers to questions about existing features, data sources, pipeline dependencies, and the effects of changes.The core difficulty lay in connecting disparate ML infrastructure components that generated metadata. Dozens of systems, from pipeline orchestrators to experimentation platforms and feature stores, produced data in various formats. Solving this required collecting heterogeneous metadata, transforming it into a unified model, and building a connected graph for exploration.The solution is the Metadata Service (MDS), which constructs a Model Lifecycle Graph to interconnect ML entities at Netflix. MDS ingests ML metadata in real-time, enabling cross-domain queries like identifying experiments using a specific model or models sharing certain features. The vision is to make all ML assets discoverable, understandable, and reusable across the company.MDS operates on core abstractions: Components, each with a unique AIP URI; Entities, which are ML-specific assets with properties; Entity Types, defining data shapes; Domains, which group related entity types; and Providers, concrete implementations of domains from source systems. This URI-based addressing allows any service to reference any ML asset universally. The process of building the graph involves several stages.First, MDS integrates with source systems via Kafka and AWS SNS/SQS to consume thin events indicating changes. Dedicated event handlers process events from systems like the Pipeline Orchestration, Model Registry, Feature Store, Experimentation Platform, and Identity Platform. Second, MDS implements a hydration contract, validating events and calling source system APIs to fetch complete state, which is then transformed into a normalized entity. This "notification of change" pattern ensures robustness against event order issues but places read load on source systems.Third, raw events are transformed into a unified entity model with standardized fields, creating a consistent interface for downstream consumers. Normalized entities standardize field names, formats, and convert platform-specific IDs into global AIP URIs. Finally, normalized entities are persisted to Datomic for caching and relationship storage, and simultaneously indexed in Elasticsearch. Datomic, with its immutable fact model, supports complex graph traversals and entity relationships, enabling queries across multiple domains without inefficient N+1 query patterns.
CdXz5zHNQW_EXeyjNVmx8.png
The blog post discusses the technical insights into how Netflix's ML model serving infrastructure powers personalized experiences at scale across various domains. The central ML model serving platform exposes a domain-independent API abstraction and traffic routing capabilities to several domain-specific microservices for model inference. This singular API has increased the speed of innovation for iterating on newer versions of existing ML experiences and enabling new product experiences with ML. The success of the ML model serving infrastructure depends on enabling researchers to rapidly experiment with new hypotheses and safely release their models into production. The platform serves hundreds of model types and versions, netting 1 million requests per second, and operates at the level of workflows, not just individual scoring functions.The model definition contains a list of facts that it needs to compute features, and it relies on the model serving platform to supply these facts at serving time by calling several other microservices. The calling services only need to provide standard request context, and the relevant domain context, and the model can itself compute features and perform inference as part of the execution flow. The platform acts as an enabler of rapid ML innovation and limits the exposure of ML model iterations to the client apps. The key principles of the platform include model innovation independent of client apps, decoupling clients from model sharding, and flexible traffic routing rules.The platform uses a custom service called Switchboard, which serves as a flexible proxy layer for all traffic, handling over 1 million requests per second while maintaining high availability and reliability. Switchboard provides a single point of contact for all clients' model needs and can route a request based on a rich set of contextual features. The platform also introduces the concept of an "Objective", which is an enumeration defined by the serving platform that every request into the system must provide. The Objective decouples clients from concrete models and guides the platform's routing and model selection decisions.Switchboard Rules is a JavaScript configuration that allows researchers to attach model variants, experiments, and traffic splits to Objectives without changing client code. The rules dictate the default model to use for a given Objective, A/B experiments to configure for a set of Objectives, and customizations to gradually shift traffic to a new model. The rules are consumed by both Switchboard and the Model Serving clusters, and the serving platform components can take various actions based on these rules. Overall, the platform provides a scalable and flexible solution for serving ML models at Netflix, enabling rapid innovation and experimentation while minimizing the impact on client apps.
CdXz5zHNQW_XdCPf6klQA.png
CdXz5zHNQW_kK6Y54I9YV.jpeg
CdXz5zHNQW_ZIJYgW0wPc.png
CdXz5zHNQW_HceAyprWfz.png