DoorDash Machine Learning Engineer (Staff Level) Interview Preparation Guide

Requirements & constraints:

• Functional: stateless classification, 1,000,000 RPS peak, p95 latency ≤ 10 ms globally.
• Non-functional: high availability, cost-effective, regional traffic patterns, model updates with low churn.

High-level architecture:

1. Global CDN (content delivery network) + Edge Cache for responses and lightweight models
2. Regional serving clusters (multiple zones per region) with provisioned pools + autoscaling
3. Load balancer + regional gateway that routes to warm inference nodes
4. Optional serverless endpoints for spiky, low-throughput regions
5. Central model registry and CI/CD + canary rollout

Key components & responsibilities:

• CDN/Edge (CloudFront/Cloudflare Workers, Fastly): cache identical requests/responses for TTL; host tiny quantized model variants (e.g., 8-bit) for ultra-low-latency on edge where feasible.
• Regional Gateways (anycast DNS + regional LB): terminate TLS, do auth, rate-limit, and VPC-proxy to regional pools.
• Regional Serving Pools: provisioned instances (k8s or VM scale sets) with warmed containers running optimized inference runtimes (TorchScript/TF-TRT, ONNX Runtime). Use CPU for small models, GPU/TPU or inference accelerators for heavy models.
• Sharding/Partitioning: shard by model version + request type; for extremely large models use model-parallel inference (Tensor Parallel) or offload to specialized accelerators.
• Autoscaling: maintain a baseline of provisioned warm capacity to meet p95 SLA; scale horizontally with predictive scaling using traffic forecasting and scale-in cooldown to avoid cold starts.
• Serverless: use for <5% of unpredictable bursts; accept higher cold-start latency and cost.

Data flow:
Client -> Anycast DNS -> Edge CDN (cache hit? return) -> Regional LB -> Inference pool -> Response
If model update: Atomic swap from model registry + health checks + slow rollout to prevent tail-risk.

Performance & meeting p95=10ms:

• Minimize network hops: use anycast + regional endpoints so RTT is <5ms in most regions.
• Keep inference time ≤ 5ms target: quantize, prune, use batch=1 optimized kernels, use pinned threads and CPU vectorization or small GPUs with low queuing.
• Warm pools sized via capacity planning: e.g., if single optimized instance can handle 500 rps at p95, need 2000 instances globally; distribute regionally by traffic.

Cost-performance tradeoffs:

• Provisioned instances increase cost but ensure strict latency; serverless reduces ops but higher per-inference cost and cold starts.
• Edge-hosted tiny model reduces network + latency and CDN egress cost, but increases complexity and model fragmentation.
• GPU/accelerator instances increase throughput per node (fewer machines) but higher fixed cost; use mixed fleet: CPU for predictable baseline, GPUs for peak and heavy models.

Reliability, monitoring & operations:

• Observability: per-region SLO (service-level objective) telemetry, p95/p99 latency, queue depth, CPU/GPU utilization, error rates.
• Circuit breakers, retry with jitter, backpressure, and graceful degradation (fall back to lightweight model or cached response).
• Security and compliance: TLS, model signing, audit logs.

Trade-offs & rationale:

• Prioritize provisioned warm capacity to hit strict p95 SLA; add edge caching & tiny models to reduce load/cost.
• Use autoscaling + predictive forecasting to avoid overprovisioning.
• Favor simpler sharding (by region/version) unless model size forces model-parallel setups.

This design balances latency, throughput, and cost by combining CDN edge caching, regional warm pools for strict SLAs, and selective use of serverless/GPU where cost-effective.

Direct answer

Build one boolean mask per condition, amount > 100, status.isin([...]), created_at.between(...), and combine them with & for AND / | for OR, wrapping every individual comparison in parentheses. Parentheses are required because Python's & and | bind tighter than comparison operators like > and ==, so without them the expression groups incorrectly and pandas raises rather than silently misevaluating.

Approach

import pandas as pd

orders = pd.DataFrame({
    'order_id': [1, 2, 3, 4],
    'user_id': [10, 11, 12, 13],
    'amount': [50, 150, 200, 90],
    'status': ['complete', 'shipped', 'pending', 'complete'],
    'created_at': ['2024-01-15', '2024-02-20', '2024-02-25', '2024-04-01'],
})
orders['created_at'] = pd.to_datetime(orders['created_at'])

mask_amount = orders['amount'] > 100
mask_status = orders['status'].isin(['complete', 'shipped'])
mask_date = orders['created_at'].between('2024-01-01', '2024-03-31')

result = orders[mask_amount & mask_status & mask_date]

# Equivalent with .query()
result_q = orders.query(
    "amount > 100 and status in ['complete', 'shipped'] "
    "and created_at >= '2024-01-01' and created_at <= '2024-03-31'"
)
# result.equals(result_q) -> True

Output (only order_id 2 satisfies all three conditions: amount 150 > 100, status "shipped", created_at 2024-02-20 in range):

   order_id  user_id  amount   status created_at
1         2       11     150  shipped 2024-02-20

Key points

• Use & / | for elementwise boolean-Series logic, never the Python keywords and / or, which only work on single scalar truth values and raise on a Series.
• Wrap each comparison, (orders['amount'] > 100), in parentheses before combining with &/|; the operator-precedence trap is the single most common bug in hand-written boolean masks.
• .query() reads more like SQL and lets you write and/or/in directly as keywords inside the string, since the expression is parsed and evaluated separately from normal Python operator precedence.

Complexity

Each comparison, isin, or between call is a single vectorized O(n) pass over the column. Combining k masks with & is O(k*n) total. .query() compiles the expression once and evaluates it in a comparable O(n) pass (and can use numexpr under the hood for large frames to reduce the number of intermediate boolean arrays materialized). Memory: each intermediate boolean mask is O(n) at 1 byte per element, and the final result is O(m) for the m matching rows.

Edge cases

• NaN in a compared column: any comparison against NaN (not-a-number) evaluates to False, so rows with missing amount are silently excluded, never raised, which matches how NaN comparisons work generally.
• Missing parentheses: orders['amount'] > 100 & orders['status'] == 'complete' raises a TypeError at the &, because & binds to 100 and orders['status'] before the comparisons resolve; it fails loudly rather than returning a wrong-but-silent mask.
• Timezone-aware vs timezone-naive values mixed in created_at: comparing them raises a TypeError, so normalize timezone handling before filtering.
• Duplicate index labels in orders: boolean masking is positional in effect (aligned by index, but each row is independently True/False), so duplicates don't break the filter itself, though a later .loc lookup by label on the result could return more rows than expected.

Trade-offs and pitfalls

For very large frames, .query() can be more memory-efficient because it can avoid materializing every intermediate boolean mask (numexpr evaluates the whole expression in a more fused fashion), which matters if you are chaining many conditions. For readability with column names that are valid Python identifiers, .query() also tends to be easier to review at a glance than a long &-chained boolean expression. Prefer .loc[mask] over df[mask] when you also need to select specific columns in the same step, since df[mask][cols] = ... reintroduces exactly the chained-indexing risk that plain boolean filtering for reading avoids.

Situation: At my previous company I was on a team building a recommendation model for personalized email campaigns. A junior ML engineer had implemented a PyTorch ranking model and asked for a code review before we put it in our staging pipeline.

Task: I needed to give constructive technical feedback to improve model generalization and production readiness while preserving the engineer’s confidence and ownership.

Action:

• I started with positive reinforcement: highlighted clean modularization, good unit tests, and clear training scripts.
• Then I walked through concerns one-by-one with evidence: the training loop used a single validation split (risking overfit), the data pipeline did on-the-fly shuffling that caused nondeterministic runs, and the model saved only state_dict without versioned metadata.
• For each issue I suggested concrete fixes and paired with them: I proposed k-fold or time-based cross-validation, deterministic data loaders with fixed seeds for reproducibility, and a model registry entry including hyperparameters, dataset hash, and training metrics.
• We scheduled a 90-minute pairing session where I helped implement deterministic DataLoader seeding, added a validation scheme, and integrated MLflow for metadata tracking.
• I framed feedback as experiments to run (“let’s test whether k-fold reduces variance”) and asked for their ideas so it stayed collaborative.

Result:

• After changes, validation variance across folds dropped 18% and offline AUC improved 0.9 points. Reproducibility bugs in staging decreased to zero for that model. The junior engineer adopted the registry pattern and later led similar improvements on another model. The team added these points to our review checklist, reducing post-deploy rollbacks by 30% in the next quarter.

This approach balanced technical rigor with empathy by starting positive, giving evidence-backed suggestions, pairing to implement fixes, and measuring impact so the feedback felt developmental rather than punitive.

Direct answer

Before trusting a company-wide experimentation platform, an analyst should insist on: a fixed, shared standard for event instrumentation (not "however each team happened to log it"), a single place experiment metadata lives that every team can query, an explicit and validated join path from exposures to the business metrics that actually matter, and enforced guardrails against the three classic self-inflicted wounds: peeking, underpowered tests, and cross-experiment interference.

Structured elaboration

• Instrumentation standards: a shared event taxonomy and a required exposure event, so metrics defined once can be reused across teams instead of every team building slightly incompatible versions of "conversion."
• Metadata location: a queryable registry (not a spreadsheet, not tribal knowledge) so an analyst investigating a weird number in March can find every experiment that touched the same surface, in the same window, without asking around.
• Joining exposures to business metrics: this is where a naive implementation goes wrong first, typically through an attribution-window mismatch or double-counting a user exposed via two different entry points; before trusting a number, an analyst should be able to see the actual join logic, not just the output.
• Guardrails against peeking: enforce a pre-registered analysis plan and either disable early "peek" views for a non-technical audience or make any interim look explicitly caveated as such, since repeated informal checking inflates the false-positive rate far above the nominal 5%.
• Guardrails against underpowered tests: block or clearly flag any launch whose planned sample size wouldn't detect the minimum effect the team says they care about.
• Guardrails against cross-experiment interference: either enforce mutually exclusive traffic layers on shared surfaces or run an automated interference check that flags overlapping populations.
• What "enforced" should mean concretely: a Sample Ratio Test on every launch (not just an offered option), an explicit experiment-versioning field so a mid-run configuration change is visible rather than silently overwriting history, and a conflict check that throttles or flags a NEW launch the moment its targeting overlaps a currently-running experiment on the same surface, rather than only detecting the collision after the fact.

Worked example

An analyst is asked to explain why revenue moved in March. Without a metadata registry, answering that question means emailing every team that might have touched checkout that month; with one, it's a single query against the experiment registry filtered by date range and affected surface. That difference is the entire argument for insisting on centralized metadata before trusting a platform's output at all.

Trade-offs and pitfalls

Insisting on all of this before trusting any result can feel like blocking legitimate, fast-moving experimentation. The resolution isn't to lower the bar, it's to make the standard itself cheap to comply with: a shared instrumentation library that makes "do it the standard way" the path of least resistance, rather than a policy document nobody reads until an audit goes wrong.

Month 0 — Preparation (2 weeks)

• Activities: baseline measurements (training time, GPU-hours, accuracy, latency), pick representative workloads, set success targets.
• Infra: logging/experimentation stack (Weights & Biases), quota tracking, small validation cluster (1–2 GPUs).
• Metrics: baseline GPU-hours per update, val metrics, iteration time.

Priority 1 — Adopt Parameter-Efficient Tuning (Adapters / LoRA) (Months 0.5–3)

• Plan: pilot LoRA + adapters on 1–2 common model families (e.g., BERT/transformer decoder) for fine-tuning tasks.
• Infra changes: enable mixed checkpointing for partial weights, extend model repo to store sparse/adapter params, update training pipelines to load adapters and apply merge/unmerge. Add versioning for adapter artifacts.
• Estimated savings: 5–20× reduction in fine-tuning GPU memory & storage for checkpoints; per-update GPU-hours reduced ~3–5× (smaller batch per GPU possible).
• Expected impact on quality: minimal to small degradation (≈0–2% absolute depending on task); sometimes matches full fine-tune.
• Metrics: GPU-hours per fine-tune, adapter size (MB), end-task metric delta vs full-finetune, convergence epochs, parameter-efficiency (performance per MB).
• Rollout: 2–4 weeks pilot, then expand to 60% of update workflows by month 3.

Priority 2 — Mixed-Precision Training (FP16 / BF16) (Months 1–4, overlaps)

• Plan: enable AMP in training scripts, validate numeric stability on all target models.
• Infra changes: ensure GPUs support FP16/BF16 (A100/T4/V100); upgrade CUDA/cuDNN; add automated loss-scaling and checks; CI tests for NaNs.
• Estimated savings: ~1.5–2× speedup and 1.5–2× memory reduction; lower cloud cost proportional to runtime.
• Expected impact on quality: negligible if properly tuned; possible rare instabilities.
• Metrics: throughput (samples/sec), training time, memory usage, number of instability incidents, final model metric delta.
• Rollout: 2–3 weeks for safe models, 6–8 weeks for edge cases with tweaks.

Priority 3 — Dataset Distillation / Coresets (Months 3–6)

• Plan: construct distilled datasets or task-specific coresets to reduce training data and accelerate updates. Start with expensive re-training tasks (large pretraining is out; focus on fine-tune/continual learning).
• Infra changes: add distillation pipelines (distillation training worker), storage for distilled sets, validation harness to ensure coverage.
• Estimated savings: 5–10× reduction in data-processed per update → proportional GPU-hour reduction; also faster experiments.
• Expected impact on quality: if distilled carefully, small quality drop (0–3%) but faster iteration allows more frequent tuning; guardrails required.
• Metrics: dataset size, training time per epoch, epochs to converge, validation performance vs full data, generalization gap, robustness on held-out cases.
• Rollout: proof-of-concept 4–6 weeks, then gradual integration.

Cross-cutting policies and guardrails

• CI checks: automatic comparison to baseline on quality/regression tests before deployment.
• Cost tracking: per-run GPU-hours, cost per update; target 50% cumulative GPU-hour reduction by month 6.
• Human processes: docs, templates, and rollback for adapter merges; decision gates for quality vs cost trade-offs.

Expected 6-month outcomes

• Combined effect: ~3–6× faster update cycle, 50%+ reduction in GPU budget for update workflows, maintain production-quality models within a 0–3% task-specific metric window.
• Key success metrics: cumulative GPU-hours/month, mean update latency (days), percentage of updates using adapters/LoRA, model metric regression rate, cost savings ($).

Direct answer

Because the real question is causal, would this user have converted without the promotion, ordinary classification metrics can't answer it. You need randomized treatment/control data to estimate incremental lift, evaluate offline with uplift-ranking metrics rather than accuracy, and after launch keep a persistent randomized holdout running so you can always measure the live model's true incremental return on investment (ROI), not just the treated group's raw conversion rate.

Structured elaboration

1. Data requirement. You need randomized treatment assignment (promotion given or withheld) with recorded outcomes. Without it, you can't separate "targeted users converted more" from "the model happened to target users who would have converted anyway," which is exactly the confound the question is pointing at.

2. Offline evaluation. Use uplift modeling (approaches that predict the incremental effect of treatment rather than the outcome itself, such as a two-model approach or other meta-learner methods) and evaluate with an uplift or Qini curve, a cumulative-gain-style curve that ranks users by predicted incremental uplift and plots the actual observed incremental conversions captured as more of the ranked population is targeted, rather than plain accuracy or area under the curve (AUC). A model can score well on predicting who will convert while being worthless for uplift ranking, for example a model that mostly just predicts "will convert regardless of treatment" looks accurate but recommends targeting people who didn't need the promotion.

3. Post-launch validation. Hold out a persistent, randomized slice of users the model would have selected for treatment from ever being treated, a true holdout, so the live model's incremental value can always be measured, not just its offline training-time uplift. Ideally run a full 2x2 design: model-selected-and-treated, model-selected-but-control, not-selected-but-treated, not-selected-and-control, which isolates both the model's targeting value and the promotion's baseline effect separately.

4. The metric that should gate the campaign. Incremental conversions or incremental revenue per treated user, weighed against the promotion's cost, giving an incremental ROI. This is the number that should decide whether the campaign continues, not the raw conversion rate of the treated group in isolation.

Worked example

A concrete 2x2 holdout illustrates why the raw treated-group conversion rate is misleading. Pinned assumptions: model-selected-and-treated group, 10,000 users, 1,800 conversions (18%); model-selected-but-control group (held back from treatment), 10,000 users, 1,200 conversions (12%).

If average order value is $50/conversion and the promotion costs $5 per treated user (pinned assumptions):

Promotion cost is paid for every treated user, since you don't know in advance which of them would have converted anyway:

A 40% loss relative to spend, even though the raw treated-group conversion rate (18%) looks healthy in isolation. Twelve of those eighteen percentage points would have converted without the promotion at all; only 6 points, 600 conversions, are actually attributable to it, and against a $50,000 spend that isn't enough revenue to break even. This is exactly why evaluating on treated-group conversion rate alone, ignoring the control group, would have reached the opposite, wrong conclusion.

Trade-offs & pitfalls

A persistent true holdout has a real, ongoing opportunity cost, revenue given up by deliberately not treating a control group indefinitely, that has to be weighed against the value of always being able to measure incremental impact. Uplift models are typically noisier than plain outcome models, since they're effectively modeling a difference between two noisy estimates, so they need larger sample sizes to reach the same statistical confidence as an outcome model would. Aggregate ROI can look positive while a specific segment's ROI is negative, a Simpson's-paradox-style masking, so slice the holdout by key segments before declaring the campaign a success. Deliberately withholding a beneficial offer from a portion of eligible users, even for measurement purposes, is sometimes as much a business and ethics conversation as a technical one, and is worth raising explicitly rather than assuming it's automatically fine.

A strong answer here names a persuasion attempt that genuinely failed, not a near-miss that secretly worked out, and shows real self-awareness about which specific part of the approach was wrong. The most useful version separates whether the argument itself was flawed from whether the delivery, timing, or audience was wrong, and ends with a concrete change in habit, not a vague lesson like 'communicate better.'

What makes this answer land

• Pick something real. Interviewers can usually tell when a "failure" is a disguised success story, and it undercuts exactly the self-awareness signal this question is testing for.
• Diagnose the layer that actually failed: was the underlying analysis incomplete, or was the argument sound but delivered to the wrong audience, at the wrong time, or without the stakeholder who actually needed to be in the room?
• Separate content failure from relationship failure. Sometimes the analysis holds up fine but the way it was delivered damaged the relationship; sometimes the analysis itself was missing something the audience cared about.
• Show the specific, durable change: a new step you now take before making this kind of case, not a general resolution.

Worked example

A proposal to delay a planned platform investment, based on a sensitivity analysis (testing how much the projected return changes if you vary each key assumption one at a time, to see how dependent the conclusion is on any single guess) showing the near-term return was marginal and dependent on assumptions that hadn't been stress-tested, is presented to the finance and marketing leads. They prefer to proceed as planned, because a related campaign is already scheduled and partially committed.

What failed: the presentation covered the numbers thoroughly but never addressed the operational cost of delay (the campaign disruption, the vendor commitments already in motion) that actually mattered most to the people in the room. It was treated as a numbers argument when, for this audience, it was really a timing and operational-risk argument.

After the decision goes ahead as originally planned, the presenter requests short one-on-ones with both decision-makers, acknowledges directly that the proposal hadn't accounted for the operational costs they cared about, and asks what evidence would have actually been persuasive. Both say, essentially, "show me the two paths side by side, including what breaks if we shift the timeline," not just a return estimate.

The concrete change: the presenter builds a revised model that explicitly includes rollout timing and a phased option, and adopts a standing habit of mapping each audience's specific operational constraints before making a numbers-only case in the future. On a later, related decision, the phased framing is adopted from the start.

Trade-offs and pitfalls

• Choosing a "failure" that's really a near-win undercuts the whole point of the question; interviewers are listening for a real cost, not a happy ending in disguise.
• Blaming the audience's receptiveness instead of naming what was actually missing from the case reads as a lack of self-awareness, which is the opposite of what this question is testing for.
• Being genuinely honest about what went wrong carries some risk in the room, but a story with no real cost to the narrator tends to read as evasive rather than reassuring.

Approach: Provide a concise technical note that documents masking policy, pipeline placement, pseudocode for deterministic/ stochastic masking, threat model, auditing requirements, and who reads each section (engineers, security, compliance, product). Focus on reproducibility, minimal risk of re-identification, and clear logs without leaking raw PII.

Outline:

1. Summary (audience: Product, Engineering, Compliance)

• Purpose, scope, regulation references (GDPR, CCPA)

2. Data Flow & Placement (audience: ML Engineers, SREs)

• Where masking occurs: ingestion -> feature store write
• Diagram: Raw data (ingest) -> Masking service -> Feature store -> Model

3. Masking Methods & Pseudocode (audience: ML Engineers, Privacy Engineers)

• Deterministic hash + keyed HMAC for joinable ID
• Tokenization with vault for reversible needs (strict access)
• Redaction/noise for free-form PII

Pseudocode:

# deterministic HMAC masking
import hmac, hashlib, base64

KEY = b'secure_key_from_kms'

def mask_hmac(value: str) -> str:
    if not value: return None
    mac = hmac.new(KEY, value.encode('utf-8'), hashlib.sha256).digest()
    return base64.urlsafe_b64encode(mac).decode('ascii')

4. Threat Model (audience: Security, Privacy, Engineers)

• Assets: raw PII, keys, feature store, logs
• Adversaries: malicious insider, compromised service, exfiltration attacker
• Risks: key leak -> re-identification, logs containing PII, incorrect masking enabling linkage
• Mitigations: KMS key rotation, least-privilege, token vault, schema enforcement, automated tests

5. Audit Logs & Metrics (audience: Compliance, Security, SRE)

• Expose: masking ops (timestamp, field, masking_method, hashed_id_present bool, actor/service), feature-store write events (no raw value), key usage events from KMS, token vault access logs
• Example log entry (no raw PII):

{
 "ts":"2025-01-01T12:00:00Z",
 "service":"masking-worker",
 "field":"email",
 "mask_method":"hmac256",
 "masked_sample":"q1w2...==",
 "record_id":"ingest-job-123",
 "status":"success"
}

6. Testing & Validation (audience: ML Engineers, QA)

• Unit tests, property tests ensuring consistency, fuzz tests to detect leaks, privacy-preserving differential testing

7. Operational Considerations (audience: SRE, Engineers)

• Latency budget, batching, retries, monitoring alerts on KMS errors

8. Compliance Appendix (audience: Legal, Compliance)

• Retention, data subject requests process, reversal policy for tokenized data

Key reasoning: use keyed deterministic masking for joinability without storing raw PII; reserve reversible tokenization only when justified and tightly controlled. Audit logs must prove masking occurred while never containing raw PII.

Direct answer

I'd separate the timeline question from the model-complexity question: propose a simple analytics baseline that can ship inside the deadline, while being explicit about what it will and won't deliver, and frame the more complex model as a follow-up investment once the baseline's results are in.

Structured elaboration

1. Quantify the time-versus-value trade-off concretely. How much longer would the complex model realistically take, and what specific additional value would it capture that the simpler approach can't? Vague statements like "the ML model would be better" aren't useful to a stakeholder making a timeline call.
2. Estimate resourcing for both paths honestly. The simpler analytics approach's true cost (including validation, not just a quick query) versus the ML path's true cost (data preparation, training, evaluation, and the ongoing maintenance it creates).
3. Propose a phased plan. Ship the simpler approach on the stakeholder's timeline, instrument it well enough to measure its actual impact, and use that measurement to make the case (or not) for investing in the complex model afterward.
4. Keep the stakeholder's actual goal in view. The tight timeline usually reflects a real business pressure (a launch date, a reporting deadline); the plan needs to respect that pressure rather than just arguing it away.

Worked example

For an analysis that needs to inform a go or no-go decision in two weeks, a simple cohort-based analysis with clearly-stated assumptions and confidence bounds, delivered on time, is worth more to the business than a more rigorous model that arrives after the decision has already been made without it. Framing this honestly to the stakeholder (here's what the fast approach gives you, here's what it doesn't, here's what a slower approach would add) turns a potential conflict into a shared decision.

Trade-offs and pitfalls

The risk of always deferring to the tight timeline is under-delivering on decisions that genuinely need more rigor; the risk of insisting on the complex approach regardless of the deadline is missing the actual business window entirely, which can make even a perfect analysis worthless. The honest phased-plan framing avoids both traps by making the trade-off explicit rather than making the call unilaterally.

Problem formalization:

• Environment: M services i∈{1..M}, T decision rounds. Each round t we allocate a vector of discrete resources a_t = (a_{t,1},...,a_{t,M}) from a feasible budget set A (e.g., ∑i c_i a{t,i} ≤ C, per-host caps).
• Reward: stochastic QoS reward r_t = ∑i R_i(a{t,i}, s_{t,i}) where s_{t,i} are unknown service states (load, SLO attainment); we observe rewards (possibly delayed/noisy) after allocation. Objective: maximize cumulative expected reward E[∑_{t=1}^T r_t] (or minimize regret vs best fixed allocation/policy).
• Unknowns: response curves R_i(·) (monotone, possibly concave), cross-service interactions (contention).

Why this is a combinatorial bandit:

• Each action is a combinatorial object (vector allocation under constraints) drawn from an exponential-size set A. Reward decomposes (possibly approximately) over arms (services) but choice couples via budget constraints. Observations may be semi-bandit (per-service feedback) or bandit (only aggregate). This matches combinatorial multi-armed bandits (CMAB).

Algorithmic solutions:

1. Approximate Combinatorial UCB (CMUCB):

• Maintain per-service estimates μ̂_i(a) or parametric models (e.g., diminishing returns curve). Compute optimistic estimates μ̂_i + bonus_i(t) and solve an offline knapsack/ILP to pick allocation maximizing sum of optimistic rewards subject to constraints. Use approximation-aware regret bounds: if offline oracle is α-approx, regret scales O((poly)·T/α). Use structured models (GLM, parametric) to reduce sample complexity.

2. Greedy with submodular objectives:

• If ∑i R_i(a{i}) is monotone submodular in discrete resource units, use greedy hill-climbing per round: iteratively allocate marginal unit with largest estimated marginal gain. With (1-1/e) approximation and confidence bonuses, this gives provable approximate regret. Practical variant: Thompson Sampling + greedy sampling to handle uncertainty.

3. Contextual/parametric bandits:

• Use contextual CMAB: include features (current load, queues). Fit online Bayesian/linear models and use LinUCB/Thompson Sampling over allocations with efficient combinatorial optimization via knapsack solvers.

4. Handling interactions:

• If strong cross-coupling, treat joint arms for small groups or use low-rank factorization of interaction matrix and learn latent factors.

Practical monitoring and risk controls:

• Safety constraints: enforce hard SLO-preserving actions (never drop below reserve allocations), and clipping of exploratory allocations.
• Conservative bootstrapping: begin with off-line A/B tests or simulation to initialize priors; use decaying exploration rates.
• Canary & rollback: stage policy in canary cluster with traffic shadowing; automatic rollback on SLO degradation beyond thresholds.
• Observability: per-service QoS, latencies, error rates, resource usage, and reward attribution with high-cardinality logs; compute regret/expected reward delta vs baseline in real-time.
• Alarm & intervention: require human-in-loop for high-impact allocation changes, throttle exploratory updates when variance or delayed feedback increases.
• Explainability: surface marginal gains used for each allocation decision to operators.

Trade-offs:

• Exact CMAB algorithms give theoretical guarantees but need efficient oracles; greedy/submodular methods scale well and are robust if submodularity approx holds. Contextual models reduce samples but require reliable features.

This design balances provable algorithms with practical safety: start with parametric/contextual CMUCB + greedy allocation, strong monitoring and safety gates, then iterate as more data reduces uncertainty.