Model Card
Model version v7, serving since June 30, 2026 · Last Updated: September 6, 2026
1. What the models do
Two retrieval models ("two-tower") map a person's taste in one domain to recommendations in the other:
- Film to music: films a visitor watched or picked, to songs.
- Music to film: songs or artists a visitor picked or imported, to films.
The user tower turns the visitor's input (catalogue identifiers of films or songs, plus aggregate taste statistics derived from them) into a vector at request time. The item tower is a fixed table of film and song vectors. A recommendation is the set of items nearest to the visitor's vector, followed by diversity post-processing (language cap, artist cap, franchise cap, re-ranking for variety).
2. What the models contain
- No user records. The served artifacts hold film and song metadata (title, year, genres, artist, album, public popularity counts) and item vectors only. There is no user identifier, no username, no hash of one, no mapping table.
- No per-user parameters. The user tower has no user-ID embedding table. It is a function of the input history and cannot store or look up a person. Visitor vectors exist in memory for the duration of a request and are discarded.
- No sensitive inference. The models output ranked films and songs. They do not infer or output religion, sexuality, health, politics or any other special category, and the product displays no such attribute.
3. Training data
- Source: publicly posted film diaries and ratings on Letterboxd and publicly posted playlists on Spotify, collected between August 2025 and February 2026 from 10,717 profiles that used the same public handle on both platforms. This "bridge" is a handle match, not a verified identity link.
- What was taken: which films were logged, the star rating and like flag, and which songs appeared in public playlists with the time they were added. Film and song metadata (genres, themes, language, country, popularity, audio descriptors) describes titles, not people, and was assembled from public sources.
- What was not taken: names, email addresses, locations, profile text, reviews, comments, followers, private or unlisted content.
- Splits: user-disjoint training, validation and test sets. Catalogue: 2.26 million tracks and 124,565 films.
- Where it is: offline, on an encrypted disk, not on our servers, not shared with or sold to anyone. It still carries the public handles, used for nothing except locating rows for objection requests. Copies existed on rented GPU machines only for the duration of training runs (the last in June 2026); those machines were destroyed afterwards.
- Future training: this corpus, minus any rows removed on request, together with first-party data from visitors who buy, save, sign in or rate with model improvement switched on (Privacy Policy, section 2.1). No further collection from public profiles is planned.
4. Evaluation, honest numbers
Full-catalogue recall on held-out, user-disjoint test users. A "popularity" baseline (recommend the most popular items to everyone) is shown for scale.
| Model | Recall@10 | Recall@100 | Popularity baseline, Recall@100 |
|---|---|---|---|
| Music to film (124,565 films) | 2.9% | 20.6% | 15.9% |
| Film to music (2.26M tracks) | 2.2% | 13.2% | 8.6% |
Read as: the models beat the popularity baseline by roughly five points at Recall@100 and only marginally at Recall@10. The advantage sits in the long tail, which is what the product is for. Batch-level numbers reported by the training loop are five to seven times higher than these and are not used anywhere.
5. Privacy test: membership inference
Question: can the model be used to tell whether a person was among the 10,717 training profiles? Method (6 September 2026, design reviewed by an independent second model): training users against held-out users, exactly the same number of known films or songs per user in both groups, the shipped model and the served embeddings. AUC 0.50 means the two groups cannot be told apart, 1.00 means perfect separation.
| Model | Live input path (what a visitor can supply) | Full training-time features (white-box) | Cohort check, model-free |
|---|---|---|---|
| Music to film (1,023 users per group) | 0.60 (0.57 to 0.63) | 0.64 (0.62 to 0.67) | 0.51 |
| Film to music (94 users per group) | 0.60 (0.50 to 0.69) | 0.65 (0.56 to 0.73) | 0.42 |
Reading: a weak but real separation exists. It is not explained by differences between the two groups of people (the model-free cohort checks sit near 0.50) and not by rare items (results restricted to frequently seen items stay above 0.50). To run this test someone must already hold several of the person's exact items; the outcome is a noisy ranking statistic, not a confirmation. Not covered by this test, and therefore not claimed either way: reconstructing a person's list from the weights, inferring attributes, or extracting content. The full report is available on request.
6. Known limitations
- Popularity bias in music-to-film: recommended films are more popular than the catalogue median. Artist and franchise concentration in raw outputs is corrected by post-processing.
- Language and national-genre caps are heuristics; some regional catalogues are under-represented.
- The handle-match bridge can pair two different people who share a handle; such pairs add noise.
- The membership-inference test in section 5 shows a weak association. Reducing it (stronger regularisation, differential privacy) is on the list for the next model version.
7. Your rights regarding the training corpus
If you believe your public Letterboxd or Spotify lists were part of the corpus and you object, email [email protected] with the public handle. We check whether the profile is in the corpus, remove the corresponding rows, exclude them from all future training and confirm to you, within 30 days. The model currently in use cannot be edited person by person; it holds no stored profile or record of you, only the statistical traces measured in section 5. Because these lists were not collected from you directly, this page and Privacy Policy section 2.5 are how we inform you, instead of contacting each person individually.
8. Third-party platforms
Lumitone is not affiliated with, endorsed by or sponsored by Letterboxd or Spotify. The Service never signs in to or reads from any user's account; results link out to the platforms.