Source-linked AI summary
A null model to detect coordinated online behavior integrating evidence from multiple indicators
Filipi Nascimento Silva, Manita Pote, Lake Yin, Luca Luceri, Filippo Menczer, Alessandro Flammini
TL;DR
Detecting coordinated accounts is difficult because shared behavior may reflect account activity or item popularity rather than coordination. This paper compares behavioral similarity with activity- and popularity-conditioned null models and combines evidence across indicators and partners. Multiplicative aggregation yields modestly higher mean detection performance, though results vary substantially across datasets.
Problem
Shared content can appear coordinated because of item popularity or account activity, while no general statistical framework exists for combining arbitrary coordination indicators.
Source: §1 · p. 1Method
The method compares account-pair behavior with activity- and popularity-conditioned null-model expectations and combines evidence across indicators and partner accounts.
Source: §1 · p. 1, §2.2.2 · p. 2, §2.2.6 · p. 5Results
Multiplying p-values across retweet, hashtag, and URL indicators and partner accounts yields modestly higher mean AUC, AP, and P@100, but results vary substantially across datasets.
Source: §4 · p. 8Takeaways & Limitations
The activity- and popularity-conditioned null model can assign different evidence to account pairs with comparable behavioral similarity, identifying overlap statistically unlikely under those conditions.
Source: §4 · p. 7Indicators and partner values are not independent, and neither the combined edge nor account scores are calibrated p-values.
Source: §2.3 · p. 6
Abstract
from arXiv · showhide
Coordinated online accounts can amplify messages and manipulate attention, but detecting such behavior is challenging due to confounding factors like account activity and item popularity. We propose a statistical null-model framework that assesses behavioral similarity between accounts by comparing observed coordination indicators against activity- and popularity-conditioned reference distributions. By combining evidence across multiple indicators and partners, our method can identify suspicious coordination links more accurately. Evaluations on nine labeled information-operation datasets involving over 152 thousand accounts show that aggregating p-values multiplicatively across indicators and partners yields improved detection performance. While results vary across information operations, this approach offers a generalizable and statistically principled tool for uncovering coordinated online behavior.
1 Introduction
Coordinated online behavior can be hard to distinguish from ordinary activity because account activity and item popularity explain some shared behavior. The paper proposes a null-model framework to assess suspicious links and combine evidence across indicators and partners.
1 Introduction
- Network-based methods detect relationships through shared behavioral traces, including amplification networks, synchronized actions, and information operations.Accounts may share links, amplify posts, act in synchrony, or use similar language without unusual individual profiles.Source: §1 · p. 1
- Account activity and item popularity can explain apparent behavioral overlap, so observed similarity alone may not distinguish coordination from ordinary sharing.Two accounts may reshare similar content simply because it is popular.Source: §1 · p. 1
- Existing approaches combine multiple signals in varied ways, but the paper identifies a lack of a general statistical framework for combining arbitrary coordination indicators.Moderate similarities across indicators such as hashtag use and resharing may be more informative in combination than individually.Source: §1 · p. 1
- The authors introduce a statistical null-model methodology to identify and combine suspicious links in a general online coordination framework.The approach evaluates observed patterns against reference patterns expected under a model.Source: §1 · pp. 1–2
- The evaluation compares eight pipeline variants on labeled information-operation datasets, using platform labels to assess account rankings.The variants differ in how indicators are aggregated for account pairs and how pairs are combined into an account score.Source: §1 · p. 2
2 Methods
The pipeline has six steps; indicator-specific steps are followed by steps that combine their outputs and are evaluated comparatively.
2.1 Data
The study uses nine labeled information-operation datasets pairing operation-attributed accounts with controls selected by related topics and dates.
2.1 Data
- Nine datasets met the inclusion rule of at least 50 labeled operation accounts and 50 controls after filtering.The collection spans six state actors.Source: §2.1 · p. 2
- The datasets contain about 19 million posts and 152 thousand accounts, including about 10,000 operation accounts before filtering.Source: §2.1 · p. 2
- Control accounts were selected through related topics and dates, and the operation accounts were attributed by a platform.Source: §2.1 · p. 2
2.2 Null method
The method builds sharing-based account networks for separate indicators, then evaluates similarities against activity- and popularity-conditioned null distributions. It combines indicator evidence into account-pair scores and aggregates those scores to rank accounts.
2.2 Null method
- The authors state that the approach applies beyond Twitter wherever account activity indicators can be extracted from available social-media data.The evaluation datasets themselves are from Twitter (now X).Source: §2.2 · p. 2
2.2.1 Step 1: indicators and filters
- The pipeline uses retweeted posts, hashtags, and URLs as indicators, applying sequential filters before building each indicator’s network.Accounts qualify for analysis if they pass at least one indicator-specific filter.Source: §2.2.1 · p. 2
2.2.2 Step 2: account–item bipartite network
- For each indicator, account–item occurrence counts form a weighted bipartite network, with account activity measured by total occurrences.Item popularity is its total number of occurrences across accounts.Source: §2.2.2 · p. 2
2.2.3 Step 3: TF-IDF and cosine similarity
- The method weights item-use counts by inverse document frequency, then uses cosine similarity between account TF-IDF vectors as account-link weights.The resulting weighted account network has no link between pairs that share no items.Source: §2.2.3 · pp. 2–3
2.2.4 Step 4: null model and p-values
- For each account pair, the null model compares observed similarity with similarities expected under randomized associations while conditioning on both accounts’ activity and item popularity.The reference shuffling preserves account activity and item popularity; implementation uses pooled sampling to approximate it.Source: §2.2.4 · pp. 3–4
- Pairs with similar hashtag similarity can have sharply different evidence: the less-active pair has p < 0.01, while the more-active pair has p > 0.9.Across roughly 800,000 linked pairs, fewer than 1% have p < 0.01; null median similarity rises from about 0.2 at ten occurrences to above 0.9 at 500 occurrences.Source: §2.2.4 · p. 4
2.2.5 Step 5: aggregation to edges
- Across indicators, the min rule retains the smallest indicator p-value, whereas the product rule multiplies p-values to accumulate evidence.Smaller combined edge values indicate stronger evidence under either rule.Source: §2.2.5 · p. 4
2.2.6 Step 6: aggregation to accounts
- Account scores aggregate neighboring edge weights using min or product, or use degree or eigenvector scores after pruning edges above a cutoff.Accounts without partners or retained links receive P = 1; smaller P values indicate greater suspiciousness.Source: §2.2.6 · pp. 4–5
2.3 Evaluation
The evaluation compares eight variants formed by combining two edge-level indicator aggregations with four account-scoring methods. It tests account rankings against information-operation labels using three ranking metrics, while noting that the resulting values are not calibrated p-values.
2.3 Evaluation
- Eight variants combine two edge-level aggregations with four account-scoring methods, including product-min and product-product.Product-min multiplies indicator p-values for each pair and ranks an account by its strongest partner; product-product multiplies edge values across partners.Source: §2.3 · pp. 5–6, Figure 5 · p. 6
- Neither edge value p_ab nor account score P_a is a calibrated p-value because indicators and partners are not independent and no multiple-testing correction is applied.Figure 5 depicts the aggregation and ranking variants.Source: §2.3 · p. 6, Figure 5 · p. 6
- Accounts passing at least one of three indicator filters are ranked by P, with lower values indicating greater suspicion.Evaluation uses account-level information-operation labels, which do not identify directly coordinated accounts.Source: §2.3 · p. 6
- Performance is assessed with ROC AUC, average precision, and precision among the top 100 accounts.Mean values are averaged equally across nine eligible datasets; ties are handled explicitly for average precision and P@100.Source: §2.3 · p. 6
3 Results
Across nine datasets, product-product has the highest mean performance on all three measures, while results vary across information operations. Stricter edge thresholds have weak, scoring-method-dependent effects on AUC.
3 Results
- AUC distributions vary across datasets; product and degree account methods have similar distributions, while min and eigenvector show different patterns.AUC ranges broadly overlap among most variants, while min-min has a more restricted range.Source: §3 · p. 6
- About 0.75 mean AUC is achieved by product-product, which has the highest mean ROC AUC, average precision, and P@100 across the eight variants.Product aggregation has its clearest effect with min account scoring; degree variants have closely similar results under min and product edge aggregation.Source: §3 · p. 6, Figure 6 · p. 7
(a) ROC AUC
- Cuba and Venezuela 1 have high AUC across all eight variants, whereas six variants yield AUC below 0.5 for Iran 6.The highest-AUC variant differs across datasets.Source: §3 · p. 6, Figure 7 · p. 7, (a) ROC AUC · p. 7
- Stricter edge-value thresholds have weak, account-method-dependent effects: degree AUC distributions remain similar, while eigenvector is more sensitive, especially with min edge aggregation.The threshold comparison covers α = 0.05, 0.01, and 0.001 across nine datasets.Source: Figure 8 · p. 7, (a) ROC AUC · p. 7
4 Conclusion
An activity- and popularity-conditioned null model identifies account pairs whose behavioral similarity is statistically unlikely. Multiplying p-values across indicators and partner accounts modestly improves mean detection metrics, though results vary substantially across datasets.
4 Conclusion
- An activity- and popularity-conditioned null model identifies account pairs whose behavioral similarity is statistically unlikely under the reference model.Comparable sharing behaviors can receive very different evidence when account activity and item popularity are considered.Source: §4 · p. 7
- Multiplying p-values across retweet, hashtag, and URL indicators and partner accounts yields modestly higher mean AUC, AP, and P@100 for detecting coordinated accounts.Substantial variation across datasets precludes strong conclusions about a single preferred method variant.Source: §4 · p. 8
- The null-model evidence is limited by omitted temporal windows, possible contamination of popularity estimates, URL handling, and approximations in sampling and IDF weights.It also omits topics, communities, and temporal dynamics, so shared interests may sometimes account for observed overlap.Source: §4 · p. 8
- Future work could test sensitivity to these limitations and compare the methods with other approaches, but limited platform transparency makes empirical information-operation data difficult to obtain.The paper says greater platform transparency would facilitate research on strategies to mitigate online manipulation.Source: §4 · p. 8