Training Data for ML Systems: Sampling, Splits, Imbalance and Leakage

Building ML training data: data sources, sampling strategies, time-based splits, class imbalance, negative sampling, data leakage and dataset versioning.

Intermediate 4 min read · Updated

In production ML, the training data usually matters more than the model. This guide covers how training examples are built from logs, how to sample them, how to split them without peeking into the future, how to handle class imbalance, and the forms of data leakage that make a model look excellent offline and fail on day one.

Where training examples come from

Most ML systems build examples by joining what the system showed or decided with what happened next. A recommender logs every impression, then joins clicks and purchases onto it. A fraud model logs every scored transaction, then joins chargebacks weeks later.

Impression logwhat was shownOutcome logclicks · ordersLabel joinwithin windowFeature snapshotsas of time tPoint-in-time joinVersioned datasettrain / val / test
Building a training set: impressions are the rows, outcomes become labels, and features are looked up as they were at the moment of the impression (point-in-time).
  • Label window: how long to wait for an outcome. A click within 30 minutes, a purchase within 7 days, a chargeback within 90 days. Too short loses positives; too long delays training.
  • Point-in-time correctness: features must be read as of the impression time, not today. A feature store does this join for you.
  • Logging the decision context: position on screen, model version, and the score the model gave. You need them later for debiasing and debugging.

Sampling strategies

StrategyHow it worksWhen to use
RandomEvery example has the same chanceDefault when data is plentiful and balanced
StratifiedSample within each class or segmentKeep rare classes and small countries represented
Negative downsamplingKeep all positives, a fraction of negativesClick and fraud data with very few positives
ReservoirKeep a fixed-size uniform sample of a streamSampling from an unbounded event stream
ImportanceWeight examples by how likely they were to be sampledCorrecting for a biased logging policy
Hard negative miningPick negatives the model currently confusesTraining retrievers and embedding models

Downsampling negatives changes the base rate the model sees, so its raw probabilities are too high. If anything downstream needs real probabilities (ad auctions, thresholds), recalibrate: with negatives kept at rate w, the corrected probability is p / (p + (1 − p) / w).

Splitting: train, validation, test

Random splits leak information whenever the data has time or identity structure. In production systems the default is a time-based split: train on the past, validate and test on what came after.

trainvalidatetestweek 1week 2week 3week 4week 5week 6week 7week 8gap
A time-based split. The model never trains on anything later than what it is evaluated on, which mirrors how it will be used. A gap stops label windows from overlapping the test period.
  • Group splits: if one user contributes many rows, keep all of a user's rows in the same split, or the model memorises the user.
  • Rolling (backtest) evaluation: retrain and test across several windows to see how stable the gain is.
  • Slices: report metrics for new users, small markets, and each device type, not only the average.

Class imbalance

Fraud might be 0.1% of payments and ad clicks 1% of impressions. A model that always predicts the majority class looks accurate and is useless. Options, roughly in the order to try them:

  1. Use the right metric: precision, recall and PR-AUC instead of accuracy. See ML evaluation.
  2. Choose the threshold from the cost of each error, not 0.5.
  3. Reweight the loss so minority errors cost more (class weights, focal loss).
  4. Resample: downsample the majority or oversample the minority (synthetic oversampling is rarely needed with large data).
  5. Collect more positives: route uncertain cases to reviewers, which also feeds labelling.

Data leakage

Leakage is when a feature contains information that won't be available at prediction time, or that encodes the label. Offline metrics become unbelievably good; production metrics collapse.

LeakExampleFix
Future data in features"Orders in the last 7 days" computed at training time includes orders after the impressionPoint-in-time feature joins
Label proxy as featureA refund_issued flag used to predict fraudAudit features against the label's causal path
Random split on time dataTraining on Friday, testing on ThursdayTime-based splits
Duplicates across splitsThe same image or user in train and testDeduplicate; split by group
Preprocessing on all dataNormalising with the mean of the full datasetFit transforms on train only

Dataset versioning and lineage

Every trained model should point to the exact dataset snapshot, feature definitions and code it came from, so you can reproduce it, compare it and roll back. Store datasets as immutable, versioned tables (for example with an open table format) and record the version in the model registry.

Where it’s used

Recommendations and ads

Impression logs joined to clicks and conversions, with heavy negative downsampling and calibration afterwards.

Fraud and risk

Labels arrive weeks later, so training uses data old enough to be labelled and features rebuilt point-in-time.

Forecasting and ETA

Strictly time-based splits and rolling backtests, since the future always looks different from the past.

In an interview

  • Describe exactly how a training row is built: the unit, the label window and the feature timestamp.
  • Use a time-based split and explain why a random split would leak.
  • If you downsample negatives, say how you recalibrate.
  • Name one leakage risk specific to the problem and how you'd prevent it.

Frequently asked questions

What is data leakage in machine learning?

Data leakage is when a training feature contains information that will not be available at prediction time or that encodes the label, such as aggregates computed with future events. It makes offline metrics look excellent while the model fails in production.

Why use a time-based split instead of a random split?

Because production models predict the future from the past. A random split lets the model train on events that happened after the ones it is tested on, which inflates offline metrics.

How do you handle class imbalance?

Use metrics such as precision, recall and PR-AUC instead of accuracy, choose thresholds from the cost of each error, reweight the loss, downsample the majority class (and recalibrate probabilities), and collect more positive examples.

Further reading