Unsupervised Anomaly Detection of Information Operations Users via Behavioral and Language Patterns

2026-07-07 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Data Science & Analytics, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

TENSOR is a novel unsupervised approach designed to detect Information Operations (IO) users on social media, addressing the significant threat IOs pose to democracy. It overcomes limitations of existing methods, which either fail to capture dynamic IO behavior or rely on oversimplified coordination assumptions. TENSOR formulates IO user detection as an anomaly detection problem, leveraging multimodal data including temporal online user behavior, such as message posting activities, and the textual content of messages. The system trains a Temporal Point Process (TPP) to identify abnormal temporal behavioral patterns, assuming IO users behave in a coordinated manner. Additionally, it incorporates a novel evidence function that converts LLM responses, generated from user post timelines, into quantitative scores to refine TPP outputs. Experimental results demonstrate TENSOR's superior performance against baselines across five real-world IO datasets, with its code publicly available.

Key takeaway

For AI Security Engineers tasked with detecting sophisticated information operations on social media, TENSOR offers a robust unsupervised framework. You should consider integrating multimodal behavioral and language pattern analysis, particularly leveraging Temporal Point Processes and LLM-derived evidence functions, to identify evolving IO user tactics that evade traditional supervised methods. This approach provides a scalable solution for proactive threat detection, enhancing platform integrity against coordinated disinformation campaigns.

Key insights

TENSOR uses multimodal data and LLM-adjusted Temporal Point Processes for unsupervised IO user anomaly detection.

Principles

• IO detection can be framed as anomaly detection.
• Multimodal data improves IO user identification.
• Coordinated behavior is a key IO user signal.

Method

TENSOR trains a Temporal Point Process (TPP) on user behavior, then adjusts TPP outputs using an LLM-derived evidence function from user post timelines for IO user detection.

In practice

• Apply TPPs to model abnormal temporal patterns.
• Integrate LLM outputs for quantitative scoring.
• Combine behavioral and language signals.

Topics

• Information Operations
• Anomaly Detection
• Temporal Point Process
• Large Language Models
• Social Media Analysis
• Multimodal Data

Code references

• xiuzhenzhang/TENSOR

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• CRAFTIIF: Cross-Resolution Analytic Four-Type Interpretable Isolation Forest for Multivariate Time Series Anomaly Detection — CRAFTIIF addresses four distinct anomaly types in multivariate time series using specialized wavelet features and Isolation Forests for direct attribution.
• Unsupervised Graph Modeling for Anomaly Detection in Accounting Subject Relationships — Graph neural networks can effectively detect unsupervised anomalies in accounting subject relationships by modeling structural deviations.
• Data Machina #261 — Generative AI and LLMs are being adapted to achieve state-of-the-art performance in diverse time-series tasks.
• Out of Context: Reliability in Multimodal Anomaly Detection Requires Contextual Inference — Context-dependent anomalies require conditional inference in multimodal anomaly detection, separating context from observations.
• DAST: A VLM-LLM Framework for Cross-Interface Anomaly Detection in O-RAN — Multi-agent VLM-LLM reasoning, grounded in O-RAN domain knowledge, effectively detects complex cross-interface anomalies in disaggregated networks.
• LLM-based Detection of Manipulative Political Narratives — LLM-driven pipelines can effectively identify and cluster manipulative political narratives in raw social media data.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.