# Coordinated Reply Attacks in Influence Operations: Characterization and Detection

arXiv: https://arxiv.org/abs/2410.19272 · HTML: https://mlsanity.com/paper/2410.19272/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 65 references that are in the map.
- First posted on arXiv 25 Oct 2024.

## Builds on (most cited first, 15 of 15)

- [Language-agnostic BERT Sentence Embedding](https://mlsanity.com/paper/2007.01852/) (2020)
- [The spread of low-credibility content by social bots](https://mlsanity.com/paper/1707.07592/) (2017)
- [Uncovering Coordinated Networks on Social Media: Methods and Case Studies](https://mlsanity.com/paper/2001.05658/) (2020)
- [Identifying Coordinated Accounts on Social Media through Hidden Influence and Group Behaviours](https://mlsanity.com/paper/2008.11308/) (2020)
- [Anatomy of an AI-powered malicious social botnet](https://mlsanity.com/paper/2307.16336/) (2023)
- [Generalized Word Shift Graphs: A Method for Visualizing and Explaining Pairwise Comparisons Between Texts](https://mlsanity.com/paper/2008.02250/) (2020)
- [Interval-censored Transformer Hawkes: Detecting Information Operations using the Reaction of Social Systems](https://mlsanity.com/paper/2211.14114/) (2022)
- [Still out there: Modeling and Identifying Russian Troll Accounts on Twitter](https://mlsanity.com/paper/1901.11162/) (2019)
- [Exposing Influence Campaigns in the Age of LLMs: A Behavioral-Based AI Approach to Detecting State-Sponsored Trolls](https://mlsanity.com/paper/2210.08786/) (2022)
- [Characterizing Retweet Bots: The Case of Black Market Accounts](https://mlsanity.com/paper/2112.02366/) (2021)
- [Analyzing Activity and Suspension Patterns of Twitter Bots Attacking Turkish Twitter Trends by a Longitudinal Dataset](https://mlsanity.com/paper/2304.07907/) (2023)
- [Unsupervised detection of coordinated information operations in the wild](https://mlsanity.com/paper/2401.06205/) (2024)
- ['Senator, We Sell Ads': Analysis of the 2016 Russian Facebook Ads Campaign](https://mlsanity.com/paper/1809.10158/) (2018)
- [Information Operations in Turkey: Manufacturing Resilience with Free Twitter Accounts](https://mlsanity.com/paper/2110.08976/) (2021)
- [Coordinated through aWeb of Images: Analysis of Image-based Influence Operations from China, Iran, Russia, and Venezuela](https://mlsanity.com/paper/2206.03576/) (2022)

## Built on by (most cited first, 3 of 3)

- [Emergent Coordinated Behaviors in Networked LLM Agents: Modeling the Strategic Dynamics of Information Operations](https://mlsanity.com/paper/2510.25003/) (2025)
- [Density-aware Walks for Coordinated Campaign Detection](https://mlsanity.com/paper/2506.13912/) (2025)
- [Beyond Content: Behavioral Policies Reveal Actors in Information Operations](https://mlsanity.com/paper/2602.02838/) (2026)

## Abstract (arXiv)

Coordinated reply attacks are a tactic observed in online influence operations and other coordinated campaigns to support or harass targeted individuals, or influence them or their followers. Despite its potential to influence the public, past studies have yet to analyze or provide a methodology to detect this tactic. In this study, we characterize coordinated reply attacks in the context of influence operations on Twitter. Our analysis reveals that the primary targets of these attacks are influential people such as journalists, news media, state officials, and politicians. We propose two supervised machine-learning models, one to classify tweets to determine whether they are targeted by a reply attack, and one to classify accounts that reply to a targeted tweet to determine whether they are part of a coordinated attack. The classifiers achieve AUC scores of 0.88 and 0.97, respectively. These results indicate that accounts involved in reply attacks can be detected, and the targeted accounts themselves can serve as sensors for influence operation detection.