CoChat
Sign Up
Cited by 31Spam and Phishing DetectionMisinformation and Its ImpactsHate Speech and Cyberbullying Detection

The DOI matches its Crossref record; 53 of the 53 references it cites were found in a registry or an index; 10 of the 16 sources its claims cite were checked for support.

A language framework for modeling social media account behavior

Open access
Nwala, Alexander C., Flammini, Alessandro, Menczer, Filippo·2023·EPJ Data Science
DOI 10.1140/epjds/s13688-023-00410-9
Open this paper in CoChat — free accountOpen PDF

Abstract

Malicious actors exploit social media to inflate stock prices, sway elections, spread misinformation, and sow discord. To these ends, they employ tactics that include the use of inauthentic accounts and campaigns. Methods to detect these abuses currently rely on features specifically designed to target suspicious behaviors. However, the effectiveness of these methods decays as malicious behaviors evolve. To address this challenge, we propose a language framework for modeling social media account behaviors. Words in this framework, called BLOC, consist of symbols drawn from distinct alphabets representing user actions and content. Languages from the framework are highly flexible and can be applied to model a broad spectrum of legitimate and suspicious online behaviors without extensive fine-tuning. Using BLOC to represent the behaviors of Twitter accounts, we achieve performance comparable to or better than state-of-the-art methods in the detection of social bots and coordinated inauthentic behavior.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

The paper introduces BLOC, a platform-agnostic language framework that represents social media account behavior as strings over action and content alphabets and converts them into TF-IDF vectors for classification. Evaluated on Twitter, BLOC achieves bot-detection performance comparable to Botometer with far fewer features and outperforms coordination-detection baselines in most information operations.

Key findings

  • In bot detection, BLOC achieved precision 0.899, recall 0.884, and F1 0.892 using 197 features; Botometer-V4 achieved precision 0.929, recall 0.914, and F1 0.921 using 1160 features. DNA-influenced achieved precision 0.499, recall 1.000, and F1 0.666, while Digital DNA variants had lower F1 scores (0.636, 0.303, 0.308).
  • In coordination detection, BLOC classifiers had mean F1 = 0.659 with 108 features, while the combined method had mean F1 = 0.658 with 5869 features. BLOC outperformed baselines in most campaigns; China-origin operations were easiest to detect (F1 above 0.9 for all methods except Hash), and UAE drivers were hardest.
  • A hybrid test using BLOC’s vector representation and machine-learning model with DDNA language showed BLOC slightly outperformed the hybrid (precision 0.879, recall 0.851, F1 0.865), suggesting much of the improvement comes from the vector-based classifier’s higher recall over signature-based approaches.
  • Unsupervised clustering of the 1000 most active monthly accounts from the CoVaxxy dataset produced 163 behavioral clusters; clusters separated along an automation axis and included vaccine appointment bots, news posting accounts, spam bots, coordinated bots, and low-automation accounts with varied vaccine stances.

Methods

  • BLOC defines action and content alphabets: action symbols include T, P, p, π, R, r, ρ, and pause symbols; content symbols include t, H, M, m, q, φ, E, U. Parameters p1–p6 control session delimiter threshold, pause granularity, session use for content words, tokenization (n-gram or pause), symbol sorting, and word truncation.
  • Bot detection used 32,056 bot-labeled and 42,773 human-labeled Twitter accounts from the bot repository, with a random sample of 32,056 humans to balance classes. BLOC action and content bi-grams yielded 197 features; TF-IDF vectors were classified with a random forest under 5-fold cross-validation, compared against Botometer-V4, Digital DNA, and DNA-influenced.
  • Coordination detection used 36 information operations across 18 countries, totaling 5,219 drivers and 114,595 control accounts. BLOC TF-IDF vectors were compared via cosine similarity using leave-one-out KNN (k = 1–10), against hashtag sequences, activity, and co-retweet baselines, with incremental two-week evaluation intervals.

Limitations

  • The paper states that BLOC representations do not capture specific content or contextual information and may not apply to tasks requiring semantic understanding, such as user stance detection and ideology prediction; for example, @HuffPost and @FoxNews could share similar BLOC words because BLOC strips away semantics.
  • The paper states that new detection techniques such as BLOC could trigger changes in tactics by malicious actors to evade detection, though it argues BLOC may raise the bar for appearing authentic.
  • Evident from the results: Botometer-V4 slightly outperformed BLOC on F1 in bot detection, and the activity method slightly outperformed BLOC at the end of campaigns (mean F1 = 0.855 vs. 0.824) while using 1680 vs. 116 features; coordination performance varied across campaigns, and adding more data sometimes hindered detection.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1140/epjds/s13688-023-00410-9

Cites

53 of 53 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

10 of 16 cited sources checked · 6 supported · 0 flagged · accuracy not yet measured

  • Premisecitation

    Existing detection methods rely on features crafted specifically to target previously observed malicious behaviors.

    “An important limitation of these methods is that they rely on features crafted specifically to target previously observed malicious behaviors [18].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [18] Sayyadiharikandeh M, Varol O, Yang K-C, Flammini A, Menczer F (2020) Detection of novel social bots by ensembles of specialized classifiers. In: Proc. of ACM intl. Conf. on information & knowledge management (CIKM), pp 2725–2732. https://doi.org/10.1145/3340531.3412698 source

      The Related Work section (p. 6) says supervised bot detectors use account features and annotated datasets, and the paper’s introduction (p. 1) says bots with unseen characteristics are easily missed. This supports the limitation involving previously observed behavior, but the copy does not say the features were crafted specifically to target that behavior. (LLM, conf=0.84)

      Experimental — accuracy not yet measured
  • Premisecitation

    A group of inauthentic accounts can be coordinated by a single entity, whether human-controlled or automated.

    “A group of inauthentic accounts can be coordinated by a single entity, whether their behavior are human-controlled or automated.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [16] Cresci S (2020) A decade of social bot detection. Commun ACM 63(10):72–83 source
  • Premisecitation

    These kinds of sophisticated deception can only be detected through observations at the group level.

    “These kinds of sophisticated deception can only be detected through observations at the group level [16].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [16] Cresci S (2020) A decade of social bot detection. Commun ACM 63(10):72–83 source

      The Rise of Group Approaches (p. 7) says analyzing coordinated groups is likely to detect sophisticated bots better than analyzing individual accounts. Figure 3’s caption (p. 4) likewise says large coordinated groups are more likely to be detected than sophisticated individual bots. Neither passage says group-level observation is the only way to detect such deception, so the claim’s exclusivity is unsupported. (LLM, conf=0.87)

      Experimental — accuracy not yet measured
  • Findingnone given

    Using BLOC to represent the behaviors of Twitter accounts achieves performance comparable to or better than state-of-the-art methods in the detection of social bots and coordinated inauthentic behavior.

    “Using BLOC to represent the behaviors of Twitter accounts, we achieve performance comparable to or better than state-of-the-art methods in the detection of social bots and coordinated inauthentic behavior.”
    Quote in the paperNot a substantial claim
  • Findingnone given

    Meaningful behavioral patterns emerge from BLOC representations, facilitating tasks related to the classification of social media accounts.

    “In this paper we show that meaningful behavioral patterns emerge from such representations, facilitating tasks related to the classification of social media accounts.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one. 39
  • Probably not a substantial claim. 28
  • The quote only partly states this claim. 1

  • It may state two separate claims as one.

    Premisecitation

    Methods designed to detect sophisticated social bots tend to overlook coordinated behaviors, and vice versa.

    “For example, methods designed to detect sophisticated social bots tend to overlook coordinated behaviors, and vice versa [19].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [19] Yang K-C, Varol O, Davis CA, Ferrara E, Flammini A, Menczer F (2019) Arming the public with artificial intelligence to counter social bots. Hum Behav Emerg Technol 1(1):48–61 source

      Section 2.3 (p. 6) says supervised methods often fail to detect coordinated bots because their individual accounts do not look suspicious. Section 6.2 (p. 19) says coordination-focused unsupervised methods capture only narrow groups of bots, but it does not establish the reverse claim that they tend to overlook sophisticated bots specifically. (LLM, conf=0.82)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    DDNA was designed for characterizing behaviors, especially automated ones.

    “Conceptually, DDNA was designed for characterizing behaviors, especially automated ones.”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [27] Cresci S, Di Pietro R, Petrocchi M, Spognardi A, Tesconi M (2017) Social fingerprinting: detection of spambot groups through dna-inspired behavioral modeling. IEEE Trans Dependable Secure Comput 15(4):561–576 source
    • cites [28] Cresci S, Di Pietro R, Petrocchi M, Spognardi A, Tesconi M (2017) Exploiting digital DNA for the analysis of similarities in Twitter behaviours. In: IEEE intl. Conf. on data science and advanced analytics (DSAA). IEEE, pp 686–695 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Coordination detection involves clustering suspiciously similar accounts into groups.

    “While individual bot detection aims to separate individual human and bot-like accounts, coordination detection involves clustering suspiciously similar accounts into groups [6].”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [6] Pacheco D, Hui P-M, Torres-Lugo C, Truong BT, Flammini A, Menczer F (2021) Uncovering coordinated networks on social media: methods and case studies. In: Proc. Intl. AAAI conf. on web and social media (ICWSM), vol 15, pp 455–466 source

  • Probably not a substantial claim.

    Premisecitation

    Coordination detection methods typically extract account features designed to target specific suspicious behavioral patterns.

    “These methods typically extract account features designed to target specific suspicious behavioral patterns [6].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [6] Pacheco D, Hui P-M, Torres-Lugo C, Truong BT, Flammini A, Menczer F (2021) Uncovering coordinated networks on social media: methods and case studies. In: Proc. Intl. AAAI conf. on web and social media (ICWSM), vol 15, pp 455–466 source

  • Probably not a substantial claim.

    Premisecitation

    The BLOC model was compared to three baseline methods that make different assumptions about the behavioral traits shared among coordinated accounts: hashtag sequences (Hash), activity (Activity), and co-retweet (CoRT).

    “We compared the BLOC model to three baseline methods, which make different assumptions about the behavioral traits that may be shared among coordinated accounts [6]: hashtag sequences (Hash), activity (Activity), and co-retweet (CoRT).”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [6] Pacheco D, Hui P-M, Torres-Lugo C, Truong BT, Flammini A, Menczer F (2021) Uncovering coordinated networks on social media: methods and case studies. In: Proc. Intl. AAAI conf. on web and social media (ICWSM), vol 15, pp 455–466 source

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    The accounts were collected and labeled by multiple researchers between 2017-2019.

    “These accounts were collected and labeled by multiple researchers between 2017-2019 [19].”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [19] Yang K-C, Varol O, Davis CA, Ferrara E, Flammini A, Menczer F (2019) Arming the public with artificial intelligence to counter social bots. Hum Behav Emerg Technol 1(1):48–61 source

      The Acknowledgements (p. 20) name several people who collected datasets, and the training-data table (p. 15) identifies some accounts as manually labeled. Neither passage establishes that the accounts were collected and labeled by multiple researchers between 2017 and 2019; the dates in Table 2 describe Botometer model activity periods, not account collection or labeling dates. (LLM, conf=0.83)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Interpretationcitation

    These findings are consistent with prior analysis based on ad-hoc features.

    “These findings are consistent with prior analysis based on ad-hoc features [18].”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [18] Sayyadiharikandeh M, Varol O, Yang K-C, Flammini A, Menczer F (2020) Detection of novel social bots by ensembles of specialized classifiers. In: Proc. of ACM intl. Conf. on information & knowledge management (CIKM), pp 2725–2732. https://doi.org/10.1145/3340531.3412698 source

  • It may state two separate claims as one.

    Findingown data

    Methods based on BLOC use significantly fewer features than state-of-the-art methods, making them much more efficient, yet yield better or comparable performance.

    “Although methods based on BLOC use significantly fewer features than state-of-the-art methods -making them much more efficient-they yield better or comparable performance.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    In Figs. 3D and F, bot accounts are more likely to amplify content (rrr) and link to external websites (Ut), respectively, while their corresponding human accounts are more likely to engage in conversations (p).

    “The bot accounts are more likely to amplify content (rrr) and link to external websites (Ut) in Figs.3D and F, respectively, while their corresponding human accounts are more likely to engage in conversations (p).”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    DNA-influenced outperformed Digital DNA, even though it labeled all accounts as bots.

    “DNA-influenced outperformed Digital DNA, even though it labeled all accounts as bots.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    In Fig. 3C, bots amplify content with bursts of retweets (rrr, rrr+) unlike humans who create original content (T).

    “In Fig. 3C, bots amplify content with burst of retweets (rrr, rrr+) unlike humans who create original content (T).”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingown data

    In Fig. 3A, while both bot and human accounts tweet text-only (t) content, the bot accounts more often include hashtags (Ht).

    “For example, while both bot and human accounts in Fig. 3A tweet text-only (t) content, the bot accounts more often include hashtags (Ht).”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Cluster 3-Sep includes accounts with low automation scores and high variety of behaviors, likely legitimate users who mostly retweet and occasionally post tweets with normal pauses.

    “Cluster 3-Sep includes accounts with low automation scores and high variety of behaviors.These are likely legitimate users who mostly retweet and occasionally post tweets, with normal pauses.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The vast majority of Twitter native apps are operated manually.
    • The authors state this as an assumption: Non-native apps indicate the use of the Twitter API and thus likely automation.

  • It may state two separate claims as one.

    Findingcitation

    Cluster 24-Feb includes @USSANews owned by ussanews.com, a misinformation website according to factcheck.org.

    “Cluster 24-Feb includes @USSANews owned by ussanews.com,a misinformation website according to factcheck.org.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites factcheck.org

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Findingown data

    Some information operations lasted a few months (e.g., China_3), others over five years (e.g., Iran_7).

    “Some information operations lasted a few months (e.g., China_3 in Table 4), others over five years (e.g., Iran_7 in Table 4).”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingown data

    In Fig. 3E, bots share more external links (U) while humans tend to engage in conversations and commentary (p, q).

    “In Fig. 3E, bots share more external links (U) while humans tend to engage in conversations and commentary (p, q).”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingnone given

    Cluster 4-May includes a pair of accounts that create no content; they retweet mostly the same tweets repeatedly.

    “Cluster 4-May includes a pair of accounts that create no content; they retweet mostly the same tweets repeatedly.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Cluster 13-Jul includes @CovidvaxDEL, a vaccine appointment status bot for New Delhi, India; and @ncovtrack, a bot that posted vaccine statistics for various countries.

    “Cluster 13-Jul includes @CovidvaxDEL, a vaccine appointment status bot for New Delhi, India; and @ncovtrack, a bot that posted vaccine statistics for various countries.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    The clusters in Fig. 4 are well separated along the automation axis, suggesting a robust distinction between human and bot accounts.

    “The clusters in Fig. 4 are well separated along the automation axis, suggesting a robust distinction between human and bot accounts.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The vast majority of Twitter native apps are operated manually.
    • The authors state this as an assumption: Non-native apps indicate the use of the Twitter API and thus likely automation.

  • It may state two separate claims as one.

    Findingown data

    Cluster 19-May includes self-identified bots created by the same self-identified developer, @EdinburghWatch and Glasgow_Watch, which retweet random content from Glasgow and Edinburgh, respectively.

    “Cluster 19-May includes self-identified bots created by the same self-identified developer.These bots, @EdinburghWatch and Glasgow_Watch, retweet random content from Glasgow and Edinburgh, respectively.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    Cluster 12-Apr includes 12 self-identified bot accounts that track vaccine availability and appointments in various US cities, and these accounts created long bursts of tweets consisting mostly of URLs and text.

    “Cluster 12-Apr includes 12 self-identified bot accounts that track the availability of vaccines and appointments in various US cities, such as @DCVaxAlerts and @FindAVac_Austin.”
    • Also stated in: § 4.2 Behavioral clusters · plain
      “They created long bursts of tweets consisting mostly of URLs and text.”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingnone given

    The BLOC model used significantly fewer features than Botometer-V4.

    “However, the BLOC model used significantly fewer features.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingnone given

    In Fig. 3B, bots and humans express similar behavioral traits: both classes have the same five top words.

    “In Fig. 3B, bots and humans express similar behavioral traits: both classes have the same five top words.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Findingown data

    The BLOC model used 197 bi-grams as features.

    “This resulted in a set of 197 bi-grams.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Findingown data

    The drivers from information operations originating from China (e.g., China_4 and China_5) were the easiest to detect; the F 1 scores for all coordination detection methods except Hash were above 0.9.

    “The drivers from information operations originating from China (e.g., China_4 and China_5) were the easiest to detect; the F 1 scores for all coordination detection methods except Hash were above 0.9.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingreasoning

    In several campaigns there is no clear temporal trend, and in a few cases (e.g., Iran_4 and Iran_3) adding more data hinders detection.

    “In several campaigns there is no clear temporal trend, and in a few cases (e.g., Iran_4 and Iran_3) adding more data hinders detection.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingown data

    The activity method failed to identify the drivers of the Egypt_UAE information operation based on early data (F 1 = 0), but succeeded at the end (F 1 = 1).

    “For example, the activity method failed to identify the drivers of the Egypt_UAE information operation based on early data (F 1 = 0), but succeeded at the end (F 1 = 1).”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingown data

    In the bot detection task, BLOC achieved precision 0.899, recall 0.884, F1 0.892 with 197 features.

    “BLOC | 0.899 | 0.884 | 0.892 | 197”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Findingnone given

    The combined classifiers had a similar mean F 1 = 0.658, but employed the largest number of features (5869).

    “The combined classifiers had a similar mean F 1 = 0.658, but employed the largest number of features (5869).”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingown data

    BLOC is a platform-agnostic framework, and its flexibility was demonstrated through two real-world applications on Twitter.

    “Although BLOC is a platform-agnostic framework, we demonstrated its flexibility through two real-world applications on Twitter.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The effectiveness of some prior methods that mostly depend on hand-crafted features is temporary because malicious actors evolve their tactics to evade detection.

  • It may state two separate claims as one.

    Findingown data

    The activity method slightly outperformed the BLOC model when the evaluation was run during the last weeks of a campaign, with mean F 1 = 0.855 vs. 0.824, albeit using 1680 vs. 116 features.

    “The activity method slightly outperformed the BLOC model when the evaluation was run during the last weeks of a campaign, with mean F 1 = 0.855 vs. 0.824, albeit using 1680 vs. 116 features.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingown data

    The BLOC model achieved F 1 = 0.444 based on early data and F 1 = 0.978 at the end for the Egypt_UAE information operation.

    “By contrast, the BLOC model achieved F 1 = 0.444 based on early data and F 1 = 0.978 at the end.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Findingnone given

    In the bot detection task, a BLOC model performed better than similar methods (Digital DNA and DNA-influenced) and comparably to a state-of-the-art method (Botometer-V4), with a much lower number of features.

    “In the bot detection task, a BLOC model performed better than similar methods (Digital DNA and DNA-influenced) and comparably to a state-of-the-art method (Botometer-V4), with a much lower number of features.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.

    Interpretationnone given

    BLOC languages are platform agnostic; similar alphabets can be easily adapted to other platforms such as Instagram, Facebook, and TikTok.

    “The BLOC framework is in fact platform agnostic; similar alphabets can be easily adapted to, say, Instagram, Facebook, and TikTok.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.

    Interpretationnone given

    BLOC differs significantly from DDNA conceptually and technically.

    “While BLOC languages similarly use sequences of symbols to encode actions and types of content, they differ significantly from DDNA conceptually and technically.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Interpretationnone given

    BLOC is the only representation framework that has been applied to both social bot and coordinated behavior detection tasks.

    “To the best of our knowledge, BLOC is the only representation framework that has been applied to both tasks.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    Accounts are represented as word vectors, allowing for similarity measures beyond string matching.

    “Accounts are thus represented as word vectors, allowing for similarity measures beyond string matching.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Interpretationnone given

    The distinction between, for example, rrrr and rrrrr is often not important.

    “The distinction between, for example, rrrr and rrrrr is often not important, so instead of representing both as separate words in our vocabulary, we could truncate long words after a limit.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    Pause tokenization often results in long words, which occur when pauses between multiple consecutive actions are shorter than p1, meaning actions are performed in bursts, which often indicates automation.

    “Pause tokenization often results in long words, for example, the 13-symbol word ππππππTTπππππ from the cyborg account in Fig. 2. Long words occur when the pauses between multiple consecutive actions are shorter than p 1 , meaning that actions are performed in bursts, which often indicates automation.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Premisenone given

    BLOC words express behavioral traits.

    “BLOC words express behavioral traits.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Interpretationnone given

    BLOC languages represent behaviors with words that may capture distinct behavioral patterns.

    “BLOC languages represent behaviors with words that may capture distinct behavioral patterns.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim.

    Interpretationreasoning

    Pauses enable studying a variety of behaviors (e.g., repetitive, dynamic, and bursty).

    “Pauses enable studying a variety of behaviors (e.g., repetitive, dynamic, and bursty).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Study design and conductown data

    The recommended values for BLOC language parameters are based on extensive experiments.

    “Below we discuss these parameters in detail, noting recommended values based on extensive experiments.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Actions taken with very short or highly regular pauses could indicate automation.

    “For example, actions taken with very short (e.g., less than a second) or highly regular pauses could indicate automation [44].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [44] Ghosh R, Surachawala T, Lerman K (2011) Entropy-based classification of retweeting activity on Twitter. In: Proc. of KDD workshop on social network analysis (SNA-KDD)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Interpretationnone given

    The threshold of cosine similarity at least 0.98 ensures a focus on accounts with a suspiciously high level of similarity.

    “This threshold ensures a focus on accounts with a suspiciously high level of similarity.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Twitter published over 141 information operation datasets.

    “Twitter published over 141 information operation datasets [56].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [56] Twitter: Information Operations. https://transparency.twitter.com/en/reports/information-operations.html. Accessed: 2022-06-15 (2022)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Interpretationnone given

    It is more difficult to detect drivers early, since sufficient tweets with coordination signals might be absent.

    “We believe it is more difficult to detect drivers early, since sufficient tweets with coordination signals might be absent.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • Probably not a substantial claim.

    Study design and conductown data

    The authors computed precision, recall, and F1 from 5-fold cross validation.

    “We computed precision, recall, and F 1 from 5-fold cross validation.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Interpretationreasoning

    Repetitions provide a means to weigh and identify important signals, which is crucial since not all aspects of behaviors are expressed equally.

    “Repetitions provide a means to weigh and identify important signals, which is crucial since not all aspects of behaviors are expressed equally.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Interpretationnone given

    The absence of long pauses could be revealing of automated behaviors.

    “For example, the absence of long pauses could be revealing of automated behaviors.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    Consequently, accounts in the left column have fewer words in common and are easier to separate.

    “Consequently, accounts in the left column have fewer words in common and are easier to separate.”
    Quote in the paperNot a substantial claim

  • It may state two separate claims as one.

    Interpretationreasoning

    DDNA truncates repeated content characters, whereas BLOC content words can capture repetitions to emphasize different behaviors.

    “Additionally, DDNA truncates repeated content characters, whereas BLOC content words can capture repetitions to emphasize different behaviors.”
    Quote in the paperSubstantial claim

  • It may state two separate claims as one.

    Interpretationown data

    The behaviors displayed by humans tend to be consistent across datasets, whereas bots have distinct behaviors based on the purpose for which they have been created.

    “In summary, the figure suggests that the behaviors displayed by the humans tend to be consistent across datasets, whereas the bots have distinct behaviors based on the purpose for which they have been created.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may state two separate claims as one.

    Study design and conductreasoning

    To eliminate a potential bias in the comparative analysis that might result from class imbalance, the authors took the union of all datasets but used a random sample of 32,056 accounts from the majority class (humans).

    “To eliminate a potential bias in the comparative analysis that might result from the class imbalance, we took the union of all datasets but used a random sample of 32,056 accounts from the majority class (humans).”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.

    Interpretationnone given

    These bi-grams can be used as features within any machine learning model.

    “These bi-grams can be used as features within any machine learning model.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim.

    Interpretationnone given

    BLOC is a language framework that represents the behavior of social media users irrespective of class (e.g., bot or human) or intent (e.g., benign or malicious).

    “In this paper, we proposed BLOC, a language framework that represents the behavior of social media users irrespective of class (e.g., bot or human) or intent (e.g., benign or malicious).”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The effectiveness of some prior methods that mostly depend on hand-crafted features is temporary because malicious actors evolve their tactics to evade detection.

  • It may state two separate claims as one.

    Interpretationown data

    BLOC models are versatile, effective, efficient, and applicable to multiple tasks.

    “Collectively, these results indicate that BLOC models are versatile, effective, efficient, and applicable to multiple tasks.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The effectiveness of some prior methods that mostly depend on hand-crafted features is temporary because malicious actors evolve their tactics to evade detection.
    • Rests on an assumption: Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • It may state two separate claims as one.

    Interpretationreasoning

    BLOC representations do not capture specific content or contextual information, so they may not be applicable to a variety of tasks that require a semantic understanding of the content, such as user stance detection and ideology prediction.

    “We must note, however, that since BLOC representations do not capture specific content or contextual information, they may not be applicable to a variety of tasks that require a semantic understanding of the content, such as user stance detection and ideology prediction.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.

    Interpretationreasoning

    The introduction of BLOC could raise the bar for malicious social media accounts to appear authentic, discounting the benefits of automated tactics such as flooding and coordination.

    “We argue that even though this is possible, the introduction of BLOC could raise the bar for malicious social media accounts to appear authentic, discounting the benefits of automated tactics such as flooding and coordination.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The effectiveness of some prior methods that mostly depend on hand-crafted features is temporary because malicious actors evolve their tactics to evade detection.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    Drivers include humans, automated accounts, coordinating accounts, and so on.

    “This is consistent with Twitter's reports, which reveal that drivers include humans, automated accounts, coordinating accounts, and so on [57,58].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [57] Twitter Safety: Disclosing networks to our state-linked information operations archive. https://t.co/etMqAUGwo2. Accessed: 2022-10-01 (2020)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [58] Twitter Safety: Disclosing state-linked information operations we’ve removed. blog.twitter.com/en_us/topics/company/2021/disclosing-state-linked-information-operations-we-ve-removed. Accessed: 2022-06-15 (2021)

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Rests on an assumption: Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.

  • It may state two separate claims as one.

    Interpretationreasoning

    Drivers may change their behaviors and become harder to detect as a result.

    “This suggest that drivers may change their behaviors and become harder to detect as a result.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

  • Probably not a substantial claim. The paper may give no reason why it holds.

    Premisenone given

    BLOC words map to features derived in an unsupervised manner.

    “BLOC words map to features derived in an unsupervised manner.”
    Quote in the paperNot a substantial claim
62 of 62

  • The authors state this as an assumption.

    The vast majority of Twitter native apps are operated manually.

    “While software could in principle be written to control native apps, we assume the vast majority of these apps are operated manually.”

  • The authors state this as an assumption.

    Non-native apps indicate the use of the Twitter API and thus likely automation.

    “Similarly, we assume non-native apps indicate the use of the Twitter API and thus likely automation, even though some could be operated manually.”

  • The paper relies on this without support.

    The effectiveness of some prior methods that mostly depend on hand-crafted features is temporary because malicious actors evolve their tactics to evade detection.

    “The effectiveness of some of these -which mostly depend on hand-crafted features -is however temporary since malicious actors evolve their tactics to evade detection.”

  • The paper relies on this without support.

    Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.

    “Multiple nation states utilize social media for information operations that target their citizens, foreign nationals, organizations, etc.”

  • The paper relies on this without support.

    Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.

    “Twitter deletes the public tweets of accounts engaged in information operations, but publishes datasets containing these tweets.”
5 of 5

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Botometer feature count differs between text and table

    Minor

    The methods section says Botometer-V4 uses 1161 features, but Table 3 reports 1160 for Botometer.

1 of 1

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 4

  1. Schiffrin A (2017) Disinformation and democracy: the Internet transformed protest but did not improve democracy. J Int Aff 71(1):117–126
  2. Lee K, Eoff BD, Caverlee J (2011) Seven months with the devils: a long-term study of content polluters on Twitter. In: Proc. Intl. AAAI conf. on web and social, Media (ICWSM)
  3. Yang K-C, Varol O, Hui P-M, Menczer F (2020) Scalable and generalizable social bot detection through data selection. In: Proc. of AAAI conf. on artificial intelligence (AAAI), pp 1096–1103
  4. Ghosh R, Surachawala T, Lerman K (2011) Entropy-based classification of retweeting activity on Twitter. In: Proc. of KDD workshop on social network analysis (SNA-KDD)

Cited by

Sorted by citations

Related

Metadata

Authors
Nwala, A. C., Flammini, A., & Menczer, F.
Affiliations
Indiana University Bloomington (US)
Corresponding author
Nwala, Alexander C.
ORCID
Venue
EPJ Data Science
Publisher
Springer Science and Business Media LLC
Published
2023-08-23
Volume
12
Issue
1
ISSN
2193-1127 (ISSN-L)
DOI
10.1140/epjds/s13688-023-00410-9
OpenAlex
W4386098562
Cited by
31
References
34
Citations by year
2026: 8 · 2025: 12 · 2024: 8 · 2023: 3
FWCI
5.70
Type
journal article
Language
en
Open access
Licence
Locations
  • EPJ Data Science (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • W&M Publish (College of William & Mary) (submittedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • arXiv (Cornell University)
Funders
  • Defense Sciences Office, DARPA (W911NF-17-C-0094, HR001121C0169)
  • Knight Foundation
  • Craig Newmark Philanthropies
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
  • Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
Keywords
language modeling, blocs, social bot detection, coordinated inauthentic behavior, misinformation, election interference, Twitter

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Cited sources are checked with a language model’s help (gpt-6-sol).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review