Coordinated Inauthentic Behavior (CIB)

• Coordinated Inauthentic Behavior (CIB) is a pattern of synchronized actions by multiple accounts designed to mask true identity and manipulate public discourse.
• Researchers operationalize CIB through methods like pairwise similarity, temporal synchronization, and network analysis to identify inauthentic coordinated campaigns.
• Studies underscore the challenge of distinguishing harmful inauthentic campaigns from benign collective actions, driving advances in detection and cross-platform strategies.

Coordinated Inauthentic Behavior (CIB) denotes concerted online activity in which multiple accounts work together in ways that mislead audiences about “who they are or what they are doing, with the end goal of manipulating public debate” (Overdorf et al., 2020). In empirical research, CIB is treated less as a property of any single post than as a pattern of behavioral traces—shared retweets, identical likes, synchronized posting, repeated URL sharing, multimedia reuse, or other forms of “exceptional similarity” across accounts (Hristakieva et al., 2021). The concept is therefore adjacent to, but not identical with, misinformation, propaganda, echo chambers, automation, or bot activity: a post may be false yet spread organically, and highly coordinated communities may be authentic activist groups rather than deceptive campaigns (de-Lima-Santos et al., 2023).

1. Definitional core and conceptual boundaries

The platform-origin definition most frequently cited in the literature is Facebook’s December 2018 formulation of CIB as “the use of multiple Facebook accounts—often fake—working in concert to mislead people about who they are or what they are doing, with the end goal of manipulating public debate” (Overdorf et al., 2020). In that framework, the two core elements are coordination and inauthenticity. Coordination requires that accounts operate as part of a concerted campaign rather than independently; inauthenticity requires concealment or falsification of origin, identity, or purpose (Overdorf et al., 2020).

Subsequent research has sharpened this definition in two ways. First, CIB is often operationalized behaviorally rather than semantically. One Facebook-group study explicitly states that CIB “is not defined by the truth value of a message but by the behavioral patterns through which that message is disseminated,” and distinguishes it from both generic misinformation and organic echo chambers generated by selective exposure or algorithmic filtering (de-Lima-Santos et al., 2023). Second, some work separates coordination from manipulative intent and treats CIB as their conjunction: “CIB ≈ (high coordination) + (high intent to manipulate),” where propaganda supplies the “intent to manipulate” signal and coordination supplies the “organized action” signal (Hristakieva et al., 2021).

The concept remains contested. A taxonomic critique argues that binary distinctions such as coordination vs. non-coordination, program vs. person, deception vs. forthrightness, and inauthenticity vs. authenticity are “philosophically and practically untenable” (Overdorf et al., 2020). That critique formalizes fake accounts as

$$\mathrm{Fake}=\{\,a\in A\mid \mathrm{Allonymy}(a)\lor \mathrm{Pseudonymy}(a)\},$$

and proposes analysis along continuous dimensions of scale, user(s), purpose(s) and technique(s), and audience impact(s) (Overdorf et al., 2020). This suggests that CIB is more precisely studied as a multi-dimensional profile than as a single binary status.

2. Operationalizations and detection paradigms

A large fraction of the literature operationalizes CIB through pairwise or groupwise similarity. In Twitter retweet data, one influential framework models users as TF–IDF vectors over retweeted tweet IDs and defines pairwise similarity by cosine similarity,

$$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$

followed by multiscale backbone filtering and Louvain community detection (Nizzoli et al., 2020). A related propaganda study uses the same co-retweet representation and then assigns each user a coordination score by iterative edge-weight thresholding, so that the score reflects how long the user remains connected as weaker edges are removed (Hristakieva et al., 2021).

A stricter operationalization appears in research on likes and retweets. One Danish-election study defines potential CIB as groups of accounts that perform “exactly the same sequence of liking or retweeting actions on the same set of tweets over a defined time window,” implemented by grouping identical binary like/retweet vectors into “bins” (Jahn et al., 2023). A proof-of-concept Twitter-like study represents interactions as a binary matrix

$$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$

and places two users in the same cluster only when their vectors are identical, equivalently when Hamming distance is zero, Jaccard similarity is one, or cosine similarity is one (Jahn et al., 2023). In a 30-day #dkpol collection, this yielded 25,806 nonempty bins; 50 bins had size at least 50; 13,018 accounts, or 27.3% of all likers, belonged to these large perfectly correlated clusters; and the largest cluster contained 3,217 accounts that had each liked exactly the same single tweet (Jahn et al., 2023).

Temporal semantics constitute another detection family. A coordination-network formulation defines each action as a tuple $a=(u,r,t)$, where $u$ is the actor, $r$ the “reason” such as a retweeted tweet ID or shared URL, and $t$ the timestamp; two actions coordinate when they share the same reason and satisfy $|t_i-t_j|\le \gamma$ (Weber et al., 2021). The induced coordination network $G=(V,E,W)$ aggregates the number of such events into edge weights. This line of work introduces cheerleaders: accounts that consistently act second to amplify another account’s activity, generating star-shaped highly coordinating communities (Weber et al., 2021).

Recent work extends these ideas beyond text-centric Twitter. A TikTok framework constructs user similarity networks from synchronized posting, repeated use of similar captions, multimedia content reuse, and hashtag-sequence overlap; prunes the resulting graphs by high-percentile edge filtering and eigenvector-centrality thresholds; and extracts dense subnetworks of likely coordinated accounts (Luceri et al., 16 May 2025). A cross-platform election study on $\mathbb{X}$ builds a bipartite user–URL graph with TF–IDF edge weights, projects it into a cosine-similarity user graph, computes eigenvector centrality $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$0, and flags accounts above the 99th percentile of the centrality distribution (Minici et al., 2024).

Causal and behavioral-language approaches broaden the methodological repertoire. A causality-based method applies Convergent Cross Mapping (CCM) to binned user activity series and declares a causal influence edge when the slope of $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$1 over library length is positive and $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$2 with $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$3 (Manchanayaka et al., 2024). The BLOC line of work represents an account’s timeline as action and content symbol strings, converts them into TF–IDF features, and uses cosine similarity or KNN classification to detect CIB (Nwala et al., 2022). A later extension measures behavioral change between BLOC segments with cosine distance or Normalized Compression Distance, converts the resulting distributions into 20-dimensional histogram features, and uses KNN to detect information-operation accounts (Ariyarathne et al., 3 Mar 2026).

3. Structural analysis of coordination and diffusion

CIB research is strongly network-centric. In the 2019 UK General Election dataset of 11,264,820 tweets by 1,179,659 users, the top 1% superspreaders by retweet volume—10,782 users—were used to construct a filtered similarity graph with 276,775 edges, from which seven major coordinated communities were identified: CON, LAB, TVT, SNP, B60, ASE, and LCH (Nizzoli et al., 2020). The same framework defines a continuous coordination “extent”

$$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$4

so that coordination is not reduced to a binary coordinated/uncoordinated label (Nizzoli et al., 2020). Large political blocs such as CON and LAB retained dense cores up to $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$5–$$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$6, whereas TVT and SNP lost most members by $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$7–$$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$8 (Nizzoli et al., 2020).

Temporal coordination networks add role semantics to structure. In an RNC 2020 dataset, an HCC around @TrumpWarRoom displayed star topology and ordering analysis showed that @TrumpWarRoom always acted first, while four heavy-tie accounts always acted second; the accompanying account profiles had long-term activity as high as 92 tweets/day and Botometer-CAP scores from 0.73 to 0.92 (Weber et al., 2021). The same study shows that execution time grows sharply with the coordination window $$\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},$$9, from 4:43 at $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$0 seconds to 533:54 at $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$1 minutes, underscoring the computational consequences of temporal semantics (Weber et al., 2021).

Information-cascade analysis offers a complementary perspective. A 2025 Twitter study reports that coordinated accounts, on average, “occupy higher positions of the information cascade (i.e., closer to the root), spread messages faster and involve a slightly higher number of users,” and that cascades with a systematically larger proportion of coordinated accounts show clear differences in size, number of edges, and height relative to statistical null models (Cinelli et al., 19 Mar 2025). The same study introduces two measures of coordinated-account infectivity and interaction with non-coordinated accounts, and finds that interactions between the two classes follow a saturation-like process: after a threshold value of approximately 50%, involving more coordinated accounts within a cascade yields a null marginal effect (Cinelli et al., 19 Mar 2025).

A post-hoc cascade-optimization study reaches a different conclusion about realized impact. It defines the influence of a labeling $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$2 on a directed tree $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$3 as

$$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$4

where $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$5 is the set of coordinated nodes and $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$6 counts non-coordinated children of $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$7 (Marco et al., 2024). On 4,119 reconstructed Twitter retweet trees from the 2019 UK General Election, observed coordinated placements substantially underperformed both an unconstrained optimum and a fixed-budget greedy heuristic. The Kullback–Leibler divergences, $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$8 and $$X_{u,t}= \begin{cases} 1,&\text{if user }u\text{ liked tweet }t,\ 0,&\text{otherwise,} \end{cases}$$9, indicate that real placements were much closer to random than to the greedy benchmark (Marco et al., 2024). This suggests that structural presence in a cascade does not automatically imply strategically efficient influence.

4. Content, propaganda, and campaign semantics

One major research direction studies CIB jointly with content manipulation. In the UK election setting, propaganda is operationalized by a binary classifier, “Proppy,” trained to distinguish propagandistic from non-propagandistic text; user-level propaganda scores aggregate item-level predictions, and community-level scores aggregate user-level ones (Hristakieva et al., 2021). The key analytical object is the relationship between propaganda and coordination within communities. Seven coordinated communities were identified, and the correlations differed sharply: TVT and ASE showed strong positive association between coordination and propaganda, with values such as $a=(u,r,t)$0, $a=(u,r,t)$1; B60 and LCH showed strong negative association, including $a=(u,r,t)$2 for B60, $a=(u,r,t)$3 (Hristakieva et al., 2021). The study explicitly concludes that purely network-based coordination detectors will flag both harmful troll farms and harmless activist groups (Hristakieva et al., 2021).

A multilingual French-election study extends this logic with socio-linguistic models for attitudes, concerns, and emotions (Burghardt et al., 2023). Coordinated accounts were identified primarily through hashtag-sequence matching: two users were coordinated if each had authored at least one original tweet with the same ordered sequence of five or more hashtags (Burghardt et al., 2023). Although coordinated accounts comprised only 0.28 percent of all users, they contributed 5–10 percent of tweets, replies, and retweets, and produced 18.7 percent of #MacronLeaks tweets (Burghardt et al., 2023). Coordinated-account content consisted of retweets of other coordinated accounts at a rate of 33 percent, and coordinated tweets promoted a candidate at three times the rate of non-coordinated tweets, with 35 percent versus 8.2 percent when binarized for “vote for” stance (Burghardt et al., 2023). These findings situate CIB as a content-amplification process rather than merely a structural anomaly.

Facebook-group research links coordination to disinformation echo chambers. Using posts, URLs, and images from 19,457 Facebook posts across 3,912 public groups, one study defines a coordination event when high-fidelity content matching—cosine text similarity at least $a=(u,r,t)$4, URL identity or Jaccard $a=(u,r,t)$5, or identical perceptual hash—co-occurs with $a=(u,r,t)$6 seconds (de-Lima-Santos et al., 2023). In that setting, 1,504 groups, approximately 38.5%, exhibited at least one coordination event; manual validation of 200 flagged events found more than 92% true coordination; and large communities such as a 117-group cluster reached clustering coefficient $a=(u,r,t)$7 (de-Lima-Santos et al., 2023). The study’s formulation is explicit: CIB is the “behavioral counterpart to content-based echo chambers” (de-Lima-Santos et al., 2023).

Cross-platform information operations reveal the same logic in URL infrastructures. In election-related discussion on $a=(u,r,t)$8, a similarity network of roughly 2,000 users and roughly 7,000 edges produced 34 highly coordinated accounts in May 2024; extension into June and July expanded the set to 40 (Minici et al., 2024). These accounts promoted six suspicious web domains for a total of 15,509 shares, generated synchronized bursts averaging approximately 5,600 tweets/day at peak, and often linked $a=(u,r,t)$9, YouTube, and clone news sites in a “tri-partite amplification loop” (Minici et al., 2024). Eight of the 40 accounts were later suspended and two restricted, while more than 75% remained active at the time of writing (Minici et al., 2024).

5. Evaluation, benchmarks, and relation to automation

Evaluation is difficult because large-scale ground truth is rare. Several studies therefore rely on partial labels, structural validation, or precision-oriented manual review. In the Twitter-like collection around #dkpol, purchased test likes on six dedicated tweets produced bins whose sizes exactly matched the number of likes ordered, demonstrating recovery of vendor-driven campaigns under the strict perfect-correlation criterion (Jahn et al., 2023). Data completeness was also measured: for 39.98% of the 6,702 tweets subject to final harvest, the collected liker-set size exactly equaled the tweet’s maximum 48-hour like count, and for 93.7% the count was within 10% of the true count (Jahn et al., 2023).

The relation between CIB and botness is empirically unstable. In the Danish-election note that binned identical like/retweet behavior, neither bin size nor likelihood of suspension/deletion correlated significantly with Botometer v4 or Botometer Lite scores; all reported Pearson $u$0 values were close to zero, with $u$1 and confidence intervals including $u$2 (Jahn et al., 2023). In the UK-election coordination framework, coordination degree $u$3 correlated weakly with bot scores or suspension rates, with $u$4, leading the authors to state that coordination is orthogonal to automation (Nizzoli et al., 2020). By contrast, the propaganda study found that TVT and ASE combined high coordination, high propaganda, high botness, and high suspension, whereas B60 and SNP combined high coordination, low propaganda, and low suspension (Hristakieva et al., 2021). Taken together, these results indicate that bot scores can be informative in some communities but are not a universal proxy for CIB.

Benchmarking across methods shows substantial variation. On the IRA dataset, topic-guided CCM reached Precision $u$5, Recall $u$6, and $u$7 in 11.4 minutes for $u$8, improving over CCM alone and baselines such as Granger causality, network-based LCN+HCC, language-only classification, and HAGE (Manchanayaka et al., 2024). An adaptive, memory-guided extension, ACCD, reports $u$9, Precision $r$0, Recall $r$1, a 68.3% reduction in manual labeling, and a 2.8x speedup over naive CCM on Twitter IRA data (Ding et al., 1 Jan 2026). In graph classification on the LEN dataset of 314 engagement networks—179 campaign and 135 non-campaign—DECODE reaches Accuracy $r$2 and $r$3 in binary classification, improving over raw-feature GNN baselines (Gopalakrishnan et al., 16 Jun 2025). In behavioral-change modeling on 32 information-operation campaigns, the best model yields Precision $r$4, Recall $r$5, and $r$6, compared with $r$7 for co-retweet clustering, $r$8 for co-hashtag clustering, and $r$9 for temporal activity synchronization (Ariyarathne et al., 3 Mar 2026).

Video-first platforms impose different validation regimes. On TikTok, the absence of large-scale ground truth led researchers to rely on structural properties and manual inspection: the top hashtag-sequence cluster in August 2024 contained 68 users at density $t$0, and 100% of users in that cluster shared identical watermarks, AI-voice use, and username prefixes, whereas 0% of users flagged by Duet/Stitch or transcript-similarity signals formed coherent CIB clusters (Luceri et al., 16 May 2025). This underscores that evaluation criteria are often platform-specific and method-specific rather than standardized.

6. Limitations, controversies, and future directions

A recurrent limitation is that strict operationalizations can miss noisy or adaptive coordination. Exact-equality binning will miss “near-identical but not perfectly matching coordination,” including “off-by-one-tweet patterns” (Jahn et al., 2023). Likewise, exact-profile matching in likes does not exploit temporal synchrony and may miss campaigns coordinated tightly in time rather than in exact tweet sets (Jahn et al., 2023). Temporal-window methods face the complementary problem that long windows inflate false positives, whereas short windows demand near real-time processing and heavy indexing (Weber et al., 2021).

Platform affordances alter which signals generalize. On TikTok, hashtag-sequence overlap, synchronized posting, shared external domains, and multimedia reuse generalized well, but transcript-based similarity, Co-Duet/Co-Stitch, and comment-based URL or reply signals did not (Luceri et al., 16 May 2025). The paper attributes these failures to remix norms, endemic organic Duet/Stitch use, and high reuse of public speeches and memes (Luceri et al., 16 May 2025). On Facebook, OCR and perceptual hashing can miss heavily edited memes, and the study proposes more advanced vision embeddings as a possible improvement (de-Lima-Santos et al., 2023). On Twitter-like reaction data, API constraints such as the cap of fetching only the 100 most recent likers per request remain a practical obstacle to scalable deployment (Jahn et al., 2023, Jahn et al., 2023).

A broader controversy concerns the distinction between harmful coordination and benign collective action. The UK-election studies repeatedly show that highly coordinated communities can be authentic, low-propaganda, and low-suspension, as with B60 and SNP, while other highly coordinated communities are strongly associated with propaganda and suspension (Hristakieva et al., 2021). The taxonomic critique therefore recommends moving “from ‘Is CIB? / Isn’t CIB?’ to a multi-dimensional profile across scale, user, purpose, and impact,” and suggests prioritizing removal of high-scale, malicious-purpose armies while preserving benign pseudonymous speech (Overdorf et al., 2020). This suggests that CIB detection pipelines are most defensible when they separate behavioral coordination from judgments about harm, deception, or automation, and then recombine those signals explicitly.

The research agenda described across the literature is correspondingly plural. Proposed directions include fuzzy clustering with Hamming- or Jaccard-based thresholds, dynamic tracking of bot scores, network topology analyses, and integration of content features for more subtle coordination (Jahn et al., 2023); multilayer graph fusion, robust video fingerprinting, synthetic-voice detection, and GNNs on user–entity graphs for video-first ecosystems (Luceri et al., 16 May 2025); online CCM variants, automated parameter selection, and multi-modal integration for causal detection (Manchanayaka et al., 2024); and memory-guided adaptive validation, active learning, and cross-platform memory sharing in end-to-end systems (Ding et al., 1 Jan 2026). Across these directions, the common theme is methodological: CIB is increasingly modeled as a multimodal, temporal, structural, and sometimes causal phenomenon whose empirical signature depends on platform mechanics as much as on adversarial intent.