# Beyond Content: Behavioral Policies Reveal Actors in Information Operations

arXiv: https://arxiv.org/abs/2602.02838 · HTML: https://mlsanity.com/paper/2602.02838/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 38 of its 82 references that are in the map.
- First posted on arXiv 2 Feb 2026.

## Builds on (most cited first, 30 of 38)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Generative Adversarial Imitation Learning](https://mlsanity.com/paper/1606.03476/) (2016)
- [Smarter, Better, Faster, Longer: A Modern Bidirectional Encoder for Fast, Memory Efficient, and Long Context Finetuning and Inference](https://mlsanity.com/paper/2412.13663/) (2024)
- [A Survey of Inverse Reinforcement Learning: Challenges, Methods and Progress](https://mlsanity.com/paper/1806.06877/) (2018)
- [The Pushshift Reddit Dataset](https://mlsanity.com/paper/2001.08435/) (2020)
- [Maximum Entropy Deep Inverse Reinforcement Learning](https://mlsanity.com/paper/1507.04888/) (2015)
- [The science of fake news](https://mlsanity.com/paper/2307.07903/) (2023)
- [The Rise of Social Bots](https://mlsanity.com/paper/1407.5225/) (2014)
- [AI model GPT-3 (dis)informs us better than humans](https://mlsanity.com/paper/2301.11924/) (2023)
- [The spread of low-credibility content by social bots](https://mlsanity.com/paper/1707.07592/) (2017)
- [Online Human-Bot Interactions: Detection, Estimation, and Characterization](https://mlsanity.com/paper/1703.03107/) (2017)
- [The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race](https://mlsanity.com/paper/1701.03017/) (2017)
- [Uncovering Coordinated Networks on Social Media: Methods and Case Studies](https://mlsanity.com/paper/2001.05658/) (2020)
- [A Decade of Social Bot Detection](https://mlsanity.com/paper/2007.03604/) (2020)
- [Identifying Coordinated Accounts on Social Media through Hidden Influence and Group Behaviours](https://mlsanity.com/paper/2008.11308/) (2020)
- [BotOrNot: A System to Evaluate Social Bots](https://mlsanity.com/paper/1602.00975/) (2016)
- [Detection of Novel Social Bots by Ensembles of Specialized Classifiers](https://mlsanity.com/paper/2006.06867/) (2020)
- [Expecting to be HIP: Hawkes Intensity Processes for Social Media Popularity](https://mlsanity.com/paper/1602.06033/) (2016)
- [Bots increase exposure to negative and inflammatory content in online social systems](https://mlsanity.com/paper/1802.07292/) (2018)
- [Disinformation Warfare: Understanding State-Sponsored Trolls on Twitter and Their Influence on the Web](https://mlsanity.com/paper/1801.09288/) (2018)
- [Interval-censored Transformer Hawkes: Detecting Information Operations using the Reaction of Social Systems](https://mlsanity.com/paper/2211.14114/) (2022)
- [Coordinated Behavior on Social Media in 2019 UK General Election](https://mlsanity.com/paper/2008.08370/) (2020)
- [Unmasking the Web of Deceit: Uncovering Coordinated Activity to Expose Information Operations on Twitter](https://mlsanity.com/paper/2310.09884/) (2023)
- [Leveraging Large Language Models to Detect Influence Campaigns in Social Media](https://mlsanity.com/paper/2311.07816/) (2023)
- [Characterizing the 2016 Russian IRA Influence Campaign](https://mlsanity.com/paper/1812.01997/) (2018)
- [Unveiling Coordinated Groups Behind White Helmets Disinformation](https://mlsanity.com/paper/2003.01313/) (2020)
- [TROLLMAGNIFIER: Detecting State-Sponsored Troll Accounts on Reddit](https://mlsanity.com/paper/2112.00443/) (2021)
- [Predicting the Role of Political Trolls in Social Media](https://mlsanity.com/paper/1910.02001/) (2019)
- [Exposing Influence Campaigns in the Age of LLMs: A Behavioral-Based AI Approach to Detecting State-Sponsored Trolls](https://mlsanity.com/paper/2210.08786/) (2022)
- [Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election](https://mlsanity.com/paper/2410.22716/) (2024)

## Abstract (arXiv)

The detection of online influence operations -- coordinated campaigns by malicious actors to spread narratives -- has traditionally depended on content analysis or network features. These approaches are increasingly brittle as generative models produce convincing text, platforms restrict access to behavioral data, and actors migrate to less-regulated spaces. We introduce a platform-agnostic framework that identifies malicious actors from their behavioral policies by modeling user activity as sequential decision processes. We apply this approach to 12,064 Reddit users, including 99 accounts linked to the Russian Internet Research Agency in Reddit's 2017 transparency report, analyzing over 38 million activity steps from 2015-2018. Activity-based representations, which model how users act rather than what they post, consistently outperform content models in detecting malicious accounts. When distinguishing trolls -- users engaged in coordinated manipulation -- from ordinary users, policy-based classifiers achieve a median macro-F1 of 94.9%, compared to 91.2% for text embeddings. Policy features also enable earlier detection from short traces and degrade more gracefully under evasion strategies or data corruption. These findings show that behavioral dynamics encode stable, discriminative signals of manipulation on Reddit's IRA-linked campaign, and point to resilient detection strategies in the era of synthetic content and limited data access.