[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84017-en":3,"doc-seo-84017-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},84017,13056703019404,"Miles","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Unsupervised Anomaly Detection of Information Operations Users via Behavioral and Language Patterns","Information Operations (IOs) on social networks pose a significant threat to democracy, yet reliable detection remains difficult and costly for humans. Prior supervised methods struggle with the evolving, dynamic nature of IO user behavior, while existing unsupervised approaches depend on unrealistic coordination assumptions. The work formulates IO user detection as anomaly detection and proposes TENSOR, an unsupervised multimodal method using temporal behavioral signals and message language patterns, enhanced with a Temporal Point Process and an LLM-derived evidence function.","arXiv :2607 .05855v 1 [ cs .LG] 7 Jul 2026  \nUnsupervised Anomaly Detection of Information Operations Users via Behavioral and Language  \nPatterns  \nSishun Liu 1 , Sajal Halder 1 , Ke Deng 1 , Yan Wang2 , and Xiuzhen Zhang 1 (􀀀)  \n1 RMIT University, Melbourne, Victoria 3000, Australia  \n[sishun.liu@student.rmit.edu.au](sishun.liu@student.rmit.edu.au) ,{sajal.halder,ke.deng,[xiuzhen.zhang}@rmit.edu.au](xiuzhen.zhang}@rmit.edu.au)  \n2 Macquarie University, Sydney, New South Wales 2000, Australia  \n[yan.wang@mq.edu.au](yan.wang@mq.edu.au)  \nAbstract. Information Operations (IOs) on Social Networks (SNs) have been identified as a significant threat to democracy and modern society, but they are challenging and expensive to detect by humans. Existing supervised IO detection methods fail to capture the dynamic nature of evolving IO user behavior, while existing unsupervised approaches rely on oversimplified assumptions of coordination among IO users that may not exist in practice. To overcome the limitations of existing methods, we formulate IO user detection as an anomaly detection problem and propose a novel unsupervised IO user detection approach called Temporal-bEhavior-laNguage Signals for information Operation Recognition (TENSOR), which leverages multimodal data, including temporal online user behavior, such as message posting activities, and the textual content of the messages. The motivation is that IO users are typically a very small fraction of all online users and have unique temporal behavioral and language patterns. Specifically, we train a Temporal Point Process (TPP) to capture abnormal temporal behavioral patterns of IO users because they are known to behave in a coordinated manner for IO campaigns. We further introduce a novel evidence function that converts LLM responses, which are generated from user post timelines, into quantitative scores to adjust the TPP outputs for better IO user detection.  \nExperimental results show that TENSOR outperforms the baselines on five real-world IO datasets3 .  \nKeywords: Information Operation User Detection · Temporal Point Process · Large Language Model  \n1 Introduction  \nThe development of Social Networks (SNs) enables fast dissemination of critical information, large-scale discussions, and joint actions about political and social issues because SNs connect people [6] . However, the capabilities of SNs can  \n3 Code is available at [https://github.com/xiuzhenzhang/TENSOR](https://github.com/xiuzhenzhang/TENSOR).  \n2 S. Liu et al.  \nbe misused by Information Operations (IOs), especially state-sponsored ones. IOs are organized attempts to tamper with the regular flow of information and influence public opinion through disinformation, hate speech, and other harmful content. IOs are hard to detect because they are always initiated by a small group of users [28, 37] . With targets including narrative manipulation and the fostering of division in online and real-world communities, IOs have been identified as a significant threat to democracy, and the need for robust methods to detect these operations is urgent [7] .  \nResearchers have proposed IO detection approaches to identify whether individual posts or specific users are related to an IO. The following discussion focuses on the detection of IO users, which is the primary interest of this study. IO users are motivated or incentivized to promote IOs, while legitimate organic users are called control users. IO user detection approaches use patterns within user post timelines on SNs. These patterns can be categorized as behavioral patterns (specifically, temporal behavioral patterns because they describe the user activities on SNs over time) and language patterns, including speaking style and areas of interest.  \nIO user detection is challenging. The biggest challenge is the generalization capability of IO user detection algorithms, i.e., their ability to detect unseen IOs. In the wild, IOs evolve quickly, so existing labeled IO datas","cbCaicjXyCLRGxpe","https://ap.wps.com/l/cbCaicjXyCLRGxpe","pdf",909246,4,1,18,"English","en",105,"# Introduction\n# Related Work","[{\"question\":\"What problem does the paper address in social network information operations?\",\"answer\":\"The paper targets detecting IO users on social networks, where IO activity is difficult to identify because it is initiated by a small group and evolves quickly.\"},{\"question\":\"How does TENSOR detect IO users without labeled data?\",\"answer\":\"TENSOR treats IO user detection as an anomaly detection task, training a Temporal Point Process to capture abnormal temporal behavioral patterns and using message language content as additional multimodal evidence.\"},{\"question\":\"What role do LLM responses play in the proposed method?\",\"answer\":\"The method introduces an evidence function that converts LLM responses generated from user post timelines into quantitative scores, which adjust Temporal Point Process outputs to improve IO user detection.\"}]",1784192033,45,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"unsupervised-anomaly-detection-of-information-operations-users-via-behavioral-and-language-patterns","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":20},"https://docshare.wps.com/document/unsupervised-anomaly-detection-of-information-operations-users-via-behavioral-and-language-patterns/84017/",{"url":52,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-27","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper address in social network information operations?","Question",{"text":75,"@type":76},"The paper targets detecting IO users on social networks, where IO activity is difficult to identify because it is initiated by a small group and evolves quickly.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does TENSOR detect IO users without labeled data?",{"text":80,"@type":76},"TENSOR treats IO user detection as an anomaly detection task, training a Temporal Point Process to capture abnormal temporal behavioral patterns and using message language content as additional multimodal evidence.",{"name":82,"@type":73,"acceptedAnswer":83},"What role do LLM responses play in the proposed method?",{"text":84,"@type":76},"The method introduces an evidence function that converts LLM responses generated from user post timelines into quantitative scores, which adjust Temporal Point Process outputs to improve IO user detection.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]