Beyond Content: Behavioral Policies Reveal Actors in Information Operations

2026-02-02

AI Summary

Amid the proliferation of generative models and increasing platform restrictions on behavioral data access, traditional detection methods for malicious information manipulation—relying on content or network features—are becoming increasingly ineffective. This work proposes a platform-agnostic detection framework that, for the first time, models user activity as a sequential decision-making process and identifies manipulative accounts by learning behavioral policies rather than depending on content features. By leveraging behavioral policy as a stable discriminative signal, the approach enables cross-platform, evasion-resistant detection even in environments where content is easily forged and data access is limited. Evaluated on a dataset of 12,064 Reddit users including 99 known Russian IRA accounts, the proposed policy classifier achieves a macro F1-score of 94.9%, substantially outperforming text embedding–based methods while enabling earlier detection and greater robustness.

Technology Category

• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Machine Learning: Adversarial Learning & Robustness
• Humans and AI: Human-Aware Planning and Behavior Prediction

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Mitigating misinformation and disinformation
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

The detection of online influence operations -- coordinated campaigns by malicious actors to spread narratives -- has traditionally depended on content analysis or network features. These approaches are increasingly brittle as generative models produce convincing text, platforms restrict access to behavioral data, and actors migrate to less-regulated spaces. We introduce a platform-agnostic framework that identifies malicious actors from their behavioral policies by modeling user activity as sequential decision processes. We apply this approach to 12,064 Reddit users, including 99 accounts linked to the Russian Internet Research Agency in Reddit's 2017 transparency report, analyzing over 38 million activity steps from 2015-2018. Activity-based representations, which model how users act rather than what they post, consistently outperform content models in detecting malicious accounts. When distinguishing trolls -- users engaged in coordinated manipulation -- from ordinary users, policy-based classifiers achieve a median macro-$F_1$ of 94.9%, compared to 91.2% for text embeddings. Policy features also enable earlier detection from short traces and degrade more gracefully under evasion strategies or data corruption. These findings show that behavioral dynamics encode stable, discriminative signals of manipulation and point to resilient, cross-platform detection strategies in the era of synthetic content and limited data access.

Problem

• information operations
• malicious actors
• behavioral policies
• online influence detection
• coordinated manipulation

Innovation

• behavioral policies
• sequential decision processes
• platform-agnostic detection
• information operations
• synthetic content resilience