BLOC: Behavioral Languages for Online Characterization

• BLOC is a symbolic framework that encodes online behavior into interpretable sequences of actions, content, and pauses.
• It shifts effort from task-specific feature engineering to a flexible representation that supports methods like classification, similarity search, and clustering.
• Empirical evaluations demonstrate competitive F1 scores in bot and coordinated inauthentic behavior detection using a compact set of features.

Behavioral Languages for Online Characterization (BLOC) designate a symbolic framework for representing online account behavior as sequences of interpretable symbols over action, content, and pause alphabets. In its initial formulation, BLOC was introduced as a general language for modeling social media account behavior in response to the brittleness of task-specific abuse-detection features, which often degrade as adversaries adapt their tactics (Nwala et al., 2022). The framework treats an account’s behavior as a language: what an account does over time is encoded as strings or “words,” which can then be analyzed with sequence-model or vector-space methods. In later work, the same acronym is used explicitly as “Behavioral Languages for Online Characterization,” emphasizing BLOC as a general substrate for online behavioral representation and temporal change analysis (Ariyarathne et al., 3 Mar 2026).

1. Origins and problem setting

BLOC emerged from a specific limitation in social media abuse detection: many existing systems rely on features engineered for previously observed suspicious behaviors, such as spam bots, retweet farms, or synchronized campaigns, but those features tend to lose effectiveness as malicious behavior evolves (Nwala et al., 2022). This creates an “arms race,” because attackers can modify profiles, timing, content mix, and interaction strategy to evade current detectors. Feature sets tuned to one threat model also generalize poorly across others: methods effective for individual bot detection may miss coordinated inauthentic behavior, while methods specialized for coordination may fail on newer forms of automation (Nwala et al., 2022).

The central response of BLOC is representational rather than purely classificatory. Instead of hand-designing many task-specific variables, it encodes behavior itself as a symbolic sequence over interpretable alphabets. This allows the same encoded trace to support multiple downstream analyses, including Markov models, n-grams, TF-IDF, cosine similarity, supervised classifiers, similarity search, and clustering (Nwala et al., 2022). A plausible implication is that BLOC shifts effort from exhaustive feature engineering to the design of a compact, semantically legible behavioral representation.

The 2022 formulation is platform-agnostic in principle, but instantiated for Twitter (Nwala et al., 2022). Later work preserved this representational role and used BLOC as the front end for measuring behavioral change over time, rather than only static behavioral regularities (Ariyarathne et al., 3 Mar 2026).

2. Symbolic structure of the language

BLOC is built from two main alphabets: an action alphabet and a content alphabet (Nwala et al., 2022). For Twitter actions, each post is mapped to exactly one action symbol according to activity type and relationship context: $T$ for post message, $P$ for reply to friend, $p$ for reply to non-friend, $\pi$ for reply to own post, $R$ for reshare friend’s post, $r$ for reshare non-friend’s post, and $\rho$ for reshare own post. A sequence such as $Tp\pi R$ therefore denotes an original post, then a reply to a non-friend, then a self-reply, then a reshare of a friend’s post (Nwala et al., 2022).

A major distinction of BLOC is the explicit encoding of pauses between consecutive actions. Let $\Delta$ be the time between two consecutive actions. With session delimiter threshold $p_1$, the coarse pause function is

$P$0

where the dot marks a session break (Nwala et al., 2022). A session is defined as “a maximal sequence of consecutive actions separated by pauses shorter than $P$1,” and the authors recommend $P$2 of one minute or less. If actions $P$3 are separated by a 2.5-minute pause after $P$4, a 50-second pause after $P$5, and a 3-day pause after $P$6, then with $P$7 minute the encoded action string is $P$8, indicating three sessions (Nwala et al., 2022).

BLOC also supports finer-grained logarithmic pause symbols through

$P$9

Under $p$0, the same example becomes $p$1, preserving distinctions between hour-scale and week-scale delays (Nwala et al., 2022).

The content alphabet describes what a post contains, and unlike actions a single post can contain multiple content symbols. For Twitter, the symbols are $p$2 for text, $p$3 for hashtag, $p$4 for mention of friend, $p$5 for mention of non-friend, $p$6 for quote of other’s post, $p$7 for quote of own post, $p$8 for media object, and $p$9 for link (Nwala et al., 2022). If four posts contain only text; then a reply with two images and one hashtag; then a self-reply with one link and one friend mention; then a retweet of a post mentioning a non-friend, the content encoding without sessions is

$\pi$0

where each parenthesized unit corresponds to one post. If the second and third posts are in the same session, the encoding becomes

$\pi$1

The order of symbols within a content word is implementation-defined, and optionally sortable (Nwala et al., 2022).

BLOC is explicitly parameterized. The main parameters are $\pi$2 session delimiter threshold, $\pi$3 time granularity ($\pi$4 or $\pi$5), $\pi$6 whether to use sessions for content words, $\pi$7 tokenization method (n-gram or pause), $\pi$8 whether to sort symbols within a word, and $\pi$9 truncation length for long repeated-symbol words (Nwala et al., 2022). The framework is therefore not one fixed encoding, but a family of behavior languages induced by parameter choice.

3. Encoding pipeline and modeling machinery

At the raw-data level, BLOC requires account activity records over time. For Twitter, the necessary metadata determine whether each tweet is an original post, reply, or retweet; whether the target account is a friend, non-friend, or self; timestamps; and content attributes such as text, hashtags, URLs, mentions, quotes, and media (Nwala et al., 2022). From these records, each tweet becomes one action symbol and zero or more content symbols, while consecutive tweets induce pause symbols from timestamp differences. The account timeline is thereby transformed into one action string plus one content string (Nwala et al., 2022).

One modeling option is a LLM such as a Markov chain. In that formulation, each BLOC symbol is a state and the transition probability from $R$0 to $R$1 is

$R$2

enabling next-symbol prediction via

$R$3

and sequence likelihood estimation via

$R$4

The paper also notes that more general sequence models, including deep learning LLMs, could be trained on BLOC strings (Nwala et al., 2022).

The main practical instantiation in the original work is vector-space modeling. BLOC offers two tokenization methods. In n-gram tokenization, a fixed-length sliding window of size $R$5 is moved over the string. For $R$6, given action string $R$7 and content string $R$8, the resulting set of words is

$R$9

In pause tokenization, pause symbols define variable-length action words corresponding to bursts or sessions, while each content post or session defines a content word boundary. With the same example and no sorting, pause tokenization yields

$r$0

Pause tokenization is particularly suited to bursty behavior, because long uninterrupted sequences become distinctive words (Nwala et al., 2022).

To prevent vocabulary explosion from long repetitive strings, BLOC uses truncation with parameter $r$1. If $r$2, then $r$3, $r$4, and $r$5 all map to

$r$6

This preserves the distinction between isolated reshares and retweet bursts while avoiding proliferation of nearly equivalent features (Nwala et al., 2022).

After tokenization, each account is represented as a weighted bag of BLOC words. If the vocabulary has $r$7 words, an account is a point

$r$8

in a $r$9-dimensional vector space. The weight of word $\rho$0 for account $\rho$1 is

$\rho$2

where $\rho$3 is the term frequency of word $\rho$4 in account $\rho$5, $\rho$6 is the number of accounts containing word $\rho$7, and $\rho$8 is the total number of accounts. Similarity is measured by cosine similarity between these TF-IDF vectors (Nwala et al., 2022). This vectorization supports supervised classifiers for bot detection and unsupervised or similarity-based methods for coordination detection.

4. Empirical uses in account characterization

The initial empirical evaluation applied BLOC to Twitter bot detection and coordinated inauthentic behavior detection (Nwala et al., 2022). For bot detection, the methodology used supervised classification on annotated Twitter accounts with $\rho$9 minute, $Tp\pi R$0, and $Tp\pi R$1. Action and content bi-grams yielded 197 features total, and these TF-IDF vectors were used to train a random forest classifier (Nwala et al., 2022). Evaluation used a balanced dataset of 32,056 bot accounts and 32,056 human accounts sampled from a larger pool of 42,773 humans, with 5-fold cross-validation and precision, recall, and $Tp\pi R$2 as metrics (Nwala et al., 2022).

In that setting, BLOC achieved Precision .899, Recall .884, and $Tp\pi R$3 with 197 features, compared with Botometer at Precision .929, Recall .914, and $Tp\pi R$4 using 1,160 features, and substantially better than the DNA-influenced and Digital DNA variants, whose $Tp\pi R$5 ranged from .303 to .666 (Nwala et al., 2022). This suggests that a compact generic behavior language can approach state-of-the-art bot detection performance without the larger bespoke feature battery of Botometer.

For coordination detection, the paper treated the task as similarity-based detection of “drivers” of information operations against control accounts discussing the same topics at the same times (Nwala et al., 2022). BLOC TF-IDF vectors were compared using pairwise cosine similarity, against baselines based on hashtag 5-grams, synchronized activity in 30-minute windows, and co-retweet similarity. The benchmark covered 36 operations across 18 countries and 2008–2021, with 5,219 driver accounts and 114,595 control accounts (Nwala et al., 2022). Averaged over information operations using the first 10 weeks of campaign data, BLOC achieved mean $Tp\pi R$6 with 108 features, while the combined method had mean $Tp\pi R$7 but required 5,869 features (Nwala et al., 2022). Campaign-level scores were particularly high for China_3 (.995), China_4 (.996), China_5 (.981), Iran_6 (.961), and Catalonia (.957) (Nwala et al., 2022).

The same representation was also used in unsupervised clustering on the CoVaxxy vaccine-discourse dataset. The pipeline used pause-tokenized BLOC TF-IDF vectors with unsorted symbols and truncation $Tp\pi R$8, cosine similarity thresholded at .98, singleton removal, and Louvain community detection. The resulting clusters corresponded to legitimate users, vaccine appointment bots, news posting accounts, content amplifiers, spam bots, coordinated bots, misinformation sharers, and stance-based communities (Nwala et al., 2022). This application is significant because it demonstrates the same representational framework modeling both benign and suspicious behavior.

A later extension shifted attention from static traces to behavioral evolution. In “Behavior Change as a Signal for Identifying Social Media Manipulation,” BLOC strings were segmented by pauses, weeks, or sets-of-$Tp\pi R$9, consecutive or cumulative segments were compared with cosine distance or Normalized Compression Distance, and action/content change distributions were summarized as two 10-bin histograms, producing 20 features per account (Ariyarathne et al., 3 Mar 2026). In that study, the best automation-detection configuration achieved $\Delta$0, and the best information-operation configuration achieved mean $\Delta$1, substantially outperforming Co-RT, hashtag, and activity baselines on average across the 32 IO campaigns (Ariyarathne et al., 3 Mar 2026). This suggests that BLOC can function not only as a descriptive encoding of behavior, but also as a basis for temporal change analytics.

5. Interpretability, generality, and limits

A defining property of BLOC is interpretability. Because symbols are semantically legible, high-weight words can often be read behaviorally: $\Delta$2 indicates retweet bursts, $\Delta$3 repeated URL-sharing with text, and $\Delta$4 conversational replying (Nwala et al., 2022). The paper illustrates this with the official @NASA account. A sequence of reply, original tweet, and retweet becomes $\Delta$5, while the corresponding content string $\Delta$6 encodes media, mentions, URLs, and text in a way that remains interpretable even without the original tweets (Nwala et al., 2022).

The framework also exposes the continuum between human, bot, and cyborg accounts. A human account tends to have short pause-delimited words, often single symbols such as $\Delta$7, $\Delta$8, or $\Delta$9, reflecting rest between posts. A cyborg account mixes isolated human-like actions with bursty bot-like substrings. A bot account may produce long retweet bursts such as $p_1$0 (Nwala et al., 2022). This does not reduce characterization to profile metadata; it centers behavior as the primary object of analysis.

BLOC is also presented as general and adaptable for four reasons: it does not hard-code a single notion of abuse; it represents actions, content composition, and timing in a common symbolic language; it supports multiple views such as action-only, content-only, joint action/content, n-grams, pause-defined burst words, and coarse or fine pause granularity; and it feeds multiple downstream methods, including supervised classification, similarity search, clustering, and generative or Markov models (Nwala et al., 2022). This suggests a representational abstraction that is broader than any one detector.

Conceptually, BLOC is closely related to Digital DNA, an earlier string-based account-behavior representation in which online actions are encoded as symbolic sequences and analyzed with longest common substring methods (Cresci et al., 2016). The 2022 BLOC paper identifies two major differences from Digital DNA: BLOC captures pauses explicitly, enabling session and burst analysis, and it preserves repetitions instead of collapsing them. Digital DNA, for example, uses a single symbol $p_1$1 to represent one or more URLs, whereas BLOC distinguishes $p_1$2, $p_1$3, $p_1$4, and so forth (Nwala et al., 2022). This matters because repetitive behavior can itself be diagnostic.

The framework nonetheless has clear limits. Some interpretation choices depend on platform metadata, such as whether a reply or retweet target is a friend, non-friend, or self. The content alphabet is shallow and captures content types rather than semantics, sentiment, or topic. Timing assumptions can fail in edge cases, and some analyses use the fraction of posts made through non-native Twitter apps only as a proxy for automation, with the explicit caution that non-native apps can be used manually and native apps could in principle be scripted (Nwala et al., 2022). Coordination detection by similarity can be expensive at scale because pairwise comparison is quadratic; this is one reason some analyses were restricted to the 1,000 most active accounts (Nwala et al., 2022). BLOC may also weaken when adversaries deliberately diversify behavior, when data are too sparse to reveal stable patterns, or when behavioral drift changes the discriminative value of earlier segments (Nwala et al., 2022).

6. Extensions and relation to adjacent research

Subsequent work extends BLOC most directly by turning it into a substrate for temporal change detection. The 2026 behavior-change study uses BLOC to segment account histories and compare behavior across adjacent or cumulative segments, finding that authentic accounts tend to have relatively stable change distributions, bots often show either very low or very high change, and coordinated inauthentic accounts show highly similar change distributions within campaigns but diverse ones across campaigns (Ariyarathne et al., 3 Mar 2026). In this line of work, BLOC is not merely a symbolic trace format; it becomes the basis for quantifying behavioral evolution.

A broader adjacent literature points toward complementary directions rather than direct replacements. “User Behavior Simulation with LLM based Agents” decomposes online behavior into profile, memory, action, environment, and social influence, offering typed actions, memory triplets $p_1$5, and explicit event vocabularies that are highly relevant to BLOC, but realized mainly through prompt engineering and natural-language latent state rather than a formal symbolic language (Wang et al., 2023). “Behavior Gated LLMs” shows that inferred behavioral state can function as a latent conditioning signal for sequential prediction, modeling $p_1$6 with $p_1$7, but it uses only five predefined behavior labels and does not supply a broad behavioral lexicon (Shivakumar et al., 2019).

Recent work on generative social-media agents has also made explicit the distinction between who agents are and how they act. “From Who They Are to How They Act: Behavioral Traits in Generative Agent-Based Models of Social Media” introduces behavioral traits that regulate propensities across posting, re-sharing, commenting, reacting, and inactivity, but these are implemented as archetypal prompt instructions rather than as a platform-agnostic symbolic behavior language (Gatta et al., 21 Jan 2026). “LLMs Reading the Rhythms of Daily Life” aligns sequence embeddings of daily behavior to LLMs and generates interpretable behavioral summaries, yet its event schema $p_1$8 and free-text summaries remain an alignment framework rather than a BLOC-style explicit language (Meng et al., 26 Apr 2026).

For language-model characterization, related work has shifted from scalar benchmarking toward multi-axis behavioral profiles. “Behavioral Fingerprinting of LLMs” builds prompt suites, rubrics, and radar-plot profiles over dimensions such as abstract reasoning, sycophancy resistance, robustness, and metacognition (Pei et al., 2 Sep 2025), while “Evaluating LLM Character Traits” formalizes traits as measures $p_1$9 over behavioral traces and distinguishes stationary from reflective traits across interaction (Ward et al., 2024). These works are not BLOC in the social-media sense, but they converge on the same general principle: behavior can be represented as a structured, interpretable object rather than as an incidental by-product of task performance.

Taken together, the literature positions BLOC as a compact, interpretable, parameterized behavioral representation that sits between raw event logs and highly task-specific engineered features. Its distinctive contribution is to encode actions, timing, and content composition as symbolic sequences that remain readable to analysts, flexible across downstream tasks, and sufficiently generic to support both static account characterization and later analyses of behavioral change (Nwala et al., 2022).