Beyond Content: Behavioral Policies Reveal Actors in Information Operations

TL;DR

This paper addresses the brittleness of content- and network-based detection for online information operations by introducing a platform-agnostic framework that treats user activity as sequential decisions and infers individual behavioral policies. Using Reddit data (12,064 users, including 99 accounts linked to the Russian Internet Research Agency) and over 38 million activity steps, the authors compare empirical, GAIL, and maximum-entropy IRL policy representations against text embeddings, finding that behavior-based signals achieve higher accuracy, with strong early-detection capabilities from minimal traces. The key findings show that trolls exhibit distinctive temporal rhythms and structured action patterns, policy-based detectors reach a median macro-F1 of up to 94.9%, and the learned policies demonstrate robustness to noise and hijacking, while revealing heterogeneity with three troll clusters and some evaders. The work argues for integrating behavioral policies into detection pipelines to enhance resilience against evolving IO tactics and limited data access, and discusses practical considerations for cross-platform transfer, privacy-preserving evaluation, and hybrid systems.

Abstract

The detection of online influence operations -- coordinated campaigns by malicious actors to spread narratives -- has traditionally depended on content analysis or network features. These approaches are increasingly brittle as generative models produce convincing text, platforms restrict access to behavioral data, and actors migrate to less-regulated spaces. We introduce a platform-agnostic framework that identifies malicious actors from their behavioral policies by modeling user activity as sequential decision processes. We apply this approach to 12,064 Reddit users, including 99 accounts linked to the Russian Internet Research Agency in Reddit's 2017 transparency report, analyzing over 38 million activity steps from 2015-2018. Activity-based representations, which model how users act rather than what they post, consistently outperform content models in detecting malicious accounts. When distinguishing trolls -- users engaged in coordinated manipulation -- from ordinary users, policy-based classifiers achieve a median macro-$F_1$ of 94.9%, compared to 91.2% for text embeddings. Policy features also enable earlier detection from short traces and degrade more gracefully under evasion strategies or data corruption. These findings show that behavioral dynamics encode stable, discriminative signals of manipulation and point to resilient, cross-platform detection strategies in the era of synthetic content and limited data access.

Figures (14)

• Figure 1: Activity patterns.
• Figure 2: Policy-based vs content-based troll detection.
• Figure 3: Analysis of troll behavior and adversarial robustness.
• Figure 4: Action and state frequencies across user groups.
• Figure 5: t-SNE projection using Euclidean distance between user policies.