Source-linked AI summary
An Army of Me: Sockpuppets in Online Discussion Communities
Srijan Kumar, Justin Cheng, Jure Leskovec, V. S. Subrahmanian
TL;DR
Sockpuppet accounts can deceive others and manipulate discussions, raising questions about their behavior and detectability across communities. This study identifies, characterizes, and models sockpuppetry across nine communities, finding differences in writing and interaction and robustly distinguishing sockpuppet pairs from ordinary-user pairs (ROC AUC=0.90).
Problem
The paper examines how sockpuppets behave in online discussion communities and whether accounts can be identified as sockpuppets, which matters because such accounts can deceive users and manipulate discussions.
Source: §1 · p. 1, §5.2 · p. 8Method
Results
Takeaways & Limitations
The methodology identifies sockpuppets even when accounts differ in creation time, usernames or email addresses, writing, or the discussions they join.
Source: §7 · p. 9The heuristics cannot identify sockpuppet throwaway accounts used once and then abandoned.
Source: §7 · p. 9
Abstract
from arXiv · showhide
In online discussion communities, users can interact and share information and opinions on a wide variety of topics. However, some users may create multiple identities, or sockpuppets, and engage in undesired behavior by deceiving others or manipulating discussions. In this work, we study sockpuppetry across nine discussion communities, and show that sockpuppets differ from ordinary users in terms of their posting behavior, linguistic traits, as well as social network structure. Sockpuppets tend to start fewer discussions, write shorter posts, use more personal pronouns such as "I", and have more clustered ego-networks. Further, pairs of sockpuppets controlled by the same individual are more likely to interact on the same discussion at the same time than pairs of ordinary users. Our analysis suggests a taxonomy of deceptive behavior in discussion communities. Pairs of sockpuppets can vary in their deceptiveness, i.e., whether they pretend to be different users, or their supportiveness, i.e., if they support arguments of other sockpuppets controlled by the same user. We apply these findings to a series of prediction tasks, notably, to identify whether a pair of accounts belongs to the same underlying user or not. Altogether, this work presents a data-driven view of deception in online discussion communities and paves the way towards the automatic detection of sockpuppets.
1. INTRODUCTION
The paper identifies and characterizes sockpuppetry across nine online discussion communities, then uses observed behavior and interactions to predict sockpuppetry.
Scope and identification
- Using IP addresses and user-session data, the study automatically identified 3,656 sockpuppets in 1,623 groups across nine discussion communities.Each group comprises sockpuppets controlled by a single puppetmaster.Source: §1 · pp. 1–2
Behavior and language
- Sockpuppets use more singular first-person pronouns but fewer negations, verbs, and conjunctions, start fewer discussions, and receive more downvotes, reports, and moderator deletions.Source: §1 · p. 2
Interactions and network structure
- Same-master pairs more often post simultaneously in the same discussion than random ordinary-user pairs, while sockpuppets show higher pagerank and local clustering and write more similarly to one another.Source: §1 · p. 2
Deceptiveness
- Sockpuppet groups range from pretenders, who masquerade as separate users, to overt non-pretenders; pretenders share discussions and face more negative moderation, while non-pretenders discuss separately and write longer, more readable posts.Source: §1 · p. 2
Supportiveness
- Pairs mostly remain neutral, but one account supports the other 30% of the time and attacks it 10% of the time; supporters tend to be pretenders, whereas dissenters are not more likely to be pretenders.Source: §1 · p. 2
Prediction
- ROC AUC=0.90 for distinguishing sockpuppet pairs from ordinary-user pairs and ROC AUC=0.68 for predicting whether an individual account is a sockpuppet.The strongest predictors relate to interactions between the paired accounts and between a sockpuppet and the community.Source: §1 · p. 2
2. DATA AND DEFINITIONS
The study analyzes Disqus activity across nine discussion communities and identifies sockpuppets using repeated, temporally close posting from the same IP address in the same discussion. Its broader definition treats each account controlled by a person with multiple accounts as a sockpuppet.
Terminology
- A sockpuppet is any account controlled by an individual with at least one other account; the individual is the puppetmaster, and accounts in a group are primary or secondary according to comment volume.An ordinary user is any account that is not a sockpuppet.Source: §2 · p. 2
- A root post is not a reply; a discussion comprises all posts following a news article, while a sub-discussion comprises a root post and its replies.Users can also vote on posts or report them for abuse, and moderators can delete posts that violate community standards.Source: §2 · p. 2
Data
- 2,897,847 users, 2,129,355 discussions, and 62,744,175 posts make up the Disqus trace spanning nine communities and varied topics.Email domains were stripped before analysis, and posts were associated with anonymized IP addresses.Source: §2 · p. 2
Identifying sockpuppets
- The method excludes each community’s top 5% most-used IP addresses and top 5% of accounts with the most IP addresses to limit spurious matches.The excluded IPs may be shared through country-wide proxies or intranets, while accounts using many IPs are more likely to share addresses with other users.Source: §2 · p. 3
- Sockpuppet pairs posted from the same IP address in the same discussion within 15 minutes across at least three discussions; their posting times and post lengths were more similar than random pairs, with both differences minimized at Kmin = 3.The authors selected Kmin = 3 as the most reliable setting; larger time windows produced empirically similar findings.Source: §2 · p. 3, Figure 2 · p. 3
Data and identification
- 1,623 sockpuppet groups comprising 3,656 accounts were identified across nine communities; because most groups contain two accounts, the analyses focus on sockpuppet pairs.Groups are defined as maximal sets in which each account meets the sockpuppet criteria with at least one other account.Source: §2 · p. 3, Figure 3 · p. 3
3. CHARACTERIZING SOCKPUPPETRY
Across the nine communities, sockpuppets differ from ordinary users in when and how they post, their linguistic traits, and their interactions and local network structure. Accounts in a pair also tend to behave similarly to each other, while secondary accounts are often used alongside primary ones.
3. CHARACTERIZING SOCKPUPPETRY
- The second sockpuppet account tends to appear early, after a median of 18% of the first account’s posts.The second account tends to be created during the first 10% of posts, which the authors suggest may indicate premeditated creation. Because sockpuppets average 699 posts and 141 discussions versus 19 and 7 for ordinary users, subsequent analyses match users on activity and discussion participation.Source: §3 · p. 3
3.1 Do puppetmasters lead double lives?
- Sockpuppet pairs are more linguistically similar to each other than either is to a matched ordinary user (p < 0.001), weighing against the double-life hypothesis.The differences between sockpuppets are also smaller for readability, average word length, function words, personal pronouns, and assent words; the authors conclude that same-master sockpuppets tend to write similarly to each other and differently from ordinary users.Source: Figure 5 · p. 4, §3.1 · p. 4
3.2 Linguistic Traits of Sockpuppets
- Sockpuppets use more first- and second-person pronouns, write shorter sentences, and differ from ordinary users in several other linguistic traits.They use “I” at 0.076 vs 0.074 (p<0.001) and “you” at 0.017 vs 0.015 (p<0.01), and write 12.4 vs. 12.9 words per sentence (p < 0.001); syllables per word are similar (1.29 vs 1.28, p = 0.35). They swear more (0.003 vs 0.002, p < 0.05), use more punctuation (0.057 vs 0.055, p < 0.05), fewer alphabetic characters (0.769 vs 0.771, p < 0.05), and fewer articles (0.062 vs 0.064, p < 0.001); readability is similar (ARI = 11.24 vs 11.41, p=0.09).Source: §3.2 · p. 4
3.3 Activity and Interactions
- Sockpuppets make 65% of their posts as replies, versus 51% for ordinary users, and are concentrated in controversial CNN topics such as politics and justice.They also receive more downvotes (0.51 vs 0.43, p < 0.001), reports (0.05 vs 0.026, p < 0.001), deletions (0.11 vs 0.08, p < 0.001), and moderator blocks (0.09 vs 0.07, p < 0.001). Their prevalence in controversial topics suggests a motivation to build support for a position, corroborating prior work.Source: §3.3 · p. 5
- Sockpuppet pairs post together in 6.57 vs. 0.33 sub-discussions and within 15 minutes on the same discussion 7.8 vs 4.28 times (both p < 0.001).They vote on each other’s posts 9.35 vs 0.40 times (p < 0.001); secondary accounts vote more on primary posts than vice versa (14.2 vs 4.5, p < 0.01), and their mutual votes are more often positive (0.987 vs 0.952; p < 0.05), inflating one another’s popularity.Source: §3.3 · p. 5
- Secondary sockpuppets have higher posting-sequence entropy and are more often used alongside primary accounts, while primary accounts tend to be used more exclusively.Higher entropy indicates more intertwined use and frequent switching between accounts; the authors suggest secondary accounts may support the primary account, for example through supportive replies.Source: §3.3 · p. 5
3.4 Reply network structure
- Sockpuppet ego-networks have higher clustering (0.52 vs 0.49, p < 0.001), reciprocity (0.48 vs 0.45, p < 0.001), and interaction initiation (0.51 vs 0.46, p < 0.001).Their ego-networks have similar sizes (291.5 vs. 291.3 nodes, p = 0.97) and densities (0.24 vs. 0.22, p < 0.01); the authors interpret the results as greater activity in sockpuppets’ local networks and among their neighbors.Source: §3.4 · p. 5
4. TYPES OF SOCKPUPPETRY
Sockpuppet pairs vary in whether they masquerade as separate people and whether they support one another; the paper distinguishes these behaviors as deceptiveness and supportiveness.
4.1 Deceptiveness: Pretenders vs. non-pretenders
- Sockpuppet display-name distances are bimodal: pairs below 5 are non-pretenders, while pairs at least 5 are pretenders.The authors measure Levenshtein distances between display names and email addresses; sockpuppet pairs have more similar names and email addresses than random ordinary-user pairs, with email addresses 50% more similar and display names 25% more similar than expected at random.Source: §4.1 · p. 6, Figure 10 · p. 6
- Pretender pairs tended to participate in more common discussions, and shared-discussion likelihood increased as display-name distance grew.The study identifies 947 pretender and 403 non-pretender groups; pairs participating in few common discussions tend to be non-pretenders.Source: §4.1 · pp. 6–7, Figure 10 · p. 6
- Pretenders’ posts were more often reported or deleted and received fewer upvotes than non-pretenders.Reports were 0.06 vs 0.03, deletions 0.11 vs 0.08, and upvote fractions 0.45 vs 0.53 (all p < 0.001). Pretenders also used more uppercase (0.07 vs 0.05) and special characters (0.06 vs 0.05), while their posts had more positive sentiment (0.04 vs 0.013) and agreement words (0.006 vs 0.005); each difference had p < 0.001.Source: Figure 8 · p. 6, §4.1 · p. 7
4.2 Supporters vs. Dissenters
- Across communities, 60% of sockpuppets were non-supporters, 30% supporters, and 10% dissenters.Supporters agree with the initial sockpuppet, while dissenters argue against it; the study considers direct replies and replies to third users, adjusting agreement for the third user's stance. The authors suggest dissent may attract attention or discredit an opposing view.Source: §4.2 · p. 7
- 74% of supporters, 70% of non-supporters, and 58% of dissenters were pretenders.Pretending was more common among supporters than dissenters, which the authors suggest may reflect attempts to create an illusion of consensus.Source: Table 2 · p. 7, §4.2 · p. 7
5. DETECTING SOCKPUPPETS
The paper evaluates classifiers for distinguishing sockpuppets from ordinary users and for identifying sockpuppet pairs. Activity features are useful in both tasks, while interactions between sockpuppets strongly predict pairs.
5. DETECTING SOCKPUPPETS
- The classifiers combine activity, community-feedback, and linguistic features, including network structure and shared discussions for pair detection.Activity features include post and reply rates, posting intervals, tenure, clustering, and reciprocity; pair detection also counts shared discussions. Community features include downvotes, reports, deletions, and blocks. Post features include text length, readability, LIWC categories, sentiment, emotional valence, and agreement.Source: §5 · pp. 7–8
5.2 Are two accounts sockpuppet pairs?
- AUC 0.91 identifies sockpuppet pairs, with activity features close behind at AUC 0.86; interactions between sockpuppets are especially predictive.The authors conclude that finding other sockpuppets in the same group is significantly easier once one sockpuppet has been identified.Source: Figure 11 · p. 8, §5.2 · p. 8
5.1 Is an account a sockpuppet?
- AUC 0.68 distinguishes sockpuppets from ordinary users using all features, while activity features alone reach AUC 0.59.Forward selection found that activity and post features come close to the final AUC, with little lift from community features.Source: Figure 11 · p. 8, §5.1 · p. 8
- For account classification, sockpuppets and ordinary users are matched by post count and discussions, then evaluated with 10-fold cross-validation and a random forest.The matched dataset is balanced, so random guessing yields 50% accuracy; performance is measured with ROC AUC.Source: §5.1 · p. 8
5.2 Are two accounts sockpuppet pairs?
- For pair classification, each sockpuppet pair is matched with an ordinary account, and a random forest uses differences between the paired accounts’ feature values.The balanced task is to identify which of the two pairs is the sockpuppet pair.Source: §5.2 · p. 8
6. RELATED WORK
The paper situates its findings within research on deception, sockpuppetry motivations, and account identification, emphasizing that sockpuppets can deceive, support one another, or use multiple accounts benignly.
Deception detection
- Sockpuppets extend deception research: pretenders use different display names and deceptive writing, amid known shifts in communication and linguistic style.Prior work reports reduced communication and changes in presentation, including increased use of particles and personal pronouns, shorter sentences, and nervousness.Source: §6 · p. 8
Motivations for sockpuppetry
- Prior work describes sockpuppetry for ban evasion, false consensus, support, vandalism, and benign or malicious gaming motives.The paper finds sockpuppets sometimes support one another, while some users may use different accounts to post in different topics.Source: §6 · p. 8
Sockpuppetry and author identification
- Earlier detectors assumed similar usernames, shared opinions, or mutual support, while this work finds non-pretenders and non-supporters through fewer assumptions.Wikipedia sockpuppet editors primarily edit articles rather than interacting with one another, unlike the discussion-community focus here.Source: §6 · p. 8
Author identification
- Author identification and cross-platform account linking do not assume deception, potentially limiting applicability when authors obfuscate writing.These lines of work identify document authors, malicious users, or accounts operated by the same user across platforms.Source: §6 · p. 8
7. DISCUSSION AND CONCLUSION
The study develops a robust way to identify sockpuppets and finds distinctive behavioral patterns that support prediction. It also emphasizes limits to the analysis and cautions that sockpuppetry is not always malicious.
DISCUSSION AND CONCLUSION
- The identification methodology detects sockpuppets despite substantially different creation times, usernames, email addresses, writing styles, or discussion participation.This enabled a comprehensive study of sockpuppet activity.Source: §7 · p. 9
- Sockpuppets used more singular first-person pronouns, wrote shorter sentences, swore more, joined controversial discussions, and interacted more with sockpuppets; these patterns supported robust pair- and account-level prediction.The models differentiated pairs of sockpuppets from ordinary users and identified individual sockpuppet accounts.Source: §7 · p. 9
- The analysis could not identify one-use throwaway accounts and focused mainly on pairs in pseudonymous discussion forums, limiting its scope.Future work could examine real-identity or fully anonymous settings, larger sockpuppet groups, and knowledge-sharing platforms where sockpuppets may seek additional upvotes. Other directions include personality traits, including trolling’s association with sadism, more robust identification methods, and cross-community sockpuppets; the study found 14 groups used in multiple communities.Source: §7 · p. 9
- Better detection could improve trust in online discussions, but sockpuppets should not all be presumed malicious: many do not impersonate others and may separate interests across discussions.The authors suggest some users value keeping activity in different spheres of interest separate.Source: §7 · p. 9