---
title: Coordinated Inauthentic Behavior (CIB)
url: https://www.emergentmind.com/topics/coordinated-inauthentic-behavior-cib
type: topic
---

# Coordinated Inauthentic Behavior (CIB)

Coordinated Inauthentic Behavior (CIB) denotes concerted online activity in which multiple accounts work together in ways that mislead audiences about “who they are or what they are doing, with the end goal of manipulating public debate” [2006.04959]. In empirical research, CIB is treated less as a property of any single post than as a pattern of behavioral traces—shared retweets, identical likes, synchronized posting, repeated URL sharing, multimedia reuse, or other forms of “exceptional similarity” across accounts [2109.13046]. The concept is therefore adjacent to, but not identical with, misinformation, propaganda, echo chambers, automation, or bot activity: a post may be false yet spread organically, and highly coordinated communities may be authentic activist groups rather than deceptive campaigns [2309.07745].

## 1. Definitional core and conceptual boundaries

The platform-origin definition most frequently cited in the literature is Facebook’s December 2018 formulation of CIB as “the use of multiple Facebook accounts—often fake—working in concert to mislead people about who they are or what they are doing, with the end goal of manipulating public debate” [2006.04959]. In that framework, the two core elements are **coordination** and **inauthenticity**. Coordination requires that accounts operate as part of a concerted campaign rather than independently; inauthenticity requires concealment or falsification of origin, identity, or purpose [2006.04959].

Subsequent research has sharpened this definition in two ways. First, CIB is often operationalized behaviorally rather than semantically. One Facebook-group study explicitly states that CIB “is not defined by the truth value of a message but by the behavioral patterns through which that message is disseminated,” and distinguishes it from both generic misinformation and organic echo chambers generated by selective exposure or algorithmic filtering [2309.07745]. Second, some work separates coordination from manipulative intent and treats CIB as their conjunction: “CIB ≈ (high coordination) + (high intent to manipulate),” where propaganda supplies the “intent to manipulate” signal and coordination supplies the “organized action” signal [2109.13046].

The concept remains contested. A taxonomic critique argues that binary distinctions such as coordination vs. non-coordination, program vs. person, deception vs. forthrightness, and inauthenticity vs. authenticity are “philosophically and practically untenable” [2006.04959]. That critique formalizes fake accounts as
$$
\mathrm{Fake}=\{\,a\in A\mid \mathrm{Allonymy}(a)\lor \mathrm{Pseudonymy}(a)\},
$$
and proposes analysis along continuous dimensions of scale, user(s), purpose(s) and technique(s), and audience impact(s) [2006.04959]. This suggests that CIB is more precisely studied as a multi-dimensional profile than as a single binary status.

## 2. Operationalizations and detection paradigms

A large fraction of the literature operationalizes CIB through pairwise or groupwise similarity. In Twitter retweet data, one influential framework models users as TF–IDF vectors over retweeted tweet IDs and defines pairwise similarity by cosine similarity,
$$
\mathrm{sim}(u_i,u_j)=\frac{x_i\cdot x_j}{\|x_i\|\,\|x_j\|},
$$
followed by multiscale backbone filtering and Louvain community detection [2008.08370]. A related propaganda study uses the same co-retweet representation and then assigns each user a coordination score by iterative edge-weight thresholding, so that the score reflects how long the user remains connected as weaker edges are removed [2109.13046].

A stricter operationalization appears in research on likes and retweets. One Danish-election study defines potential CIB as groups of accounts that perform “exactly the same sequence of liking or retweeting actions on the same set of tweets over a defined time window,” implemented by grouping identical binary like/retweet vectors into “bins” [2305.08621]. A proof-of-concept Twitter-like study represents interactions as a binary matrix
$$
X_{u,t}=
\begin{cases}
1,&\text{if user }u\text{ liked tweet }t,\\
0,&\text{otherwise,}
\end{cases}
$$
and places two users in the same cluster only when their vectors are identical, equivalently when Hamming distance is zero, Jaccard similarity is one, or cosine similarity is one [2305.07384]. In a 30-day \#dkpol collection, this yielded 25,806 nonempty bins; 50 bins had size at least 50; 13,018 accounts, or 27.3% of all likers, belonged to these large perfectly correlated clusters; and the largest cluster contained 3,217 accounts that had each liked exactly the same single tweet [2305.07384].

Temporal semantics constitute another detection family. A coordination-network formulation defines each action as a tuple \(a=(u,r,t)\), where \(u\) is the actor, \(r\) the “reason” such as a retweeted tweet ID or shared URL, and \(t\) the timestamp; two actions coordinate when they share the same reason and satisfy \(|t_i-t_j|\le \gamma\) [2107.02588]. The induced coordination network \(G=(V,E,W)\) aggregates the number of such events into edge weights. This line of work introduces **cheerleaders**: accounts that consistently act second to amplify another account’s activity, generating star-shaped highly coordinating communities [2107.02588].

Recent work extends these ideas beyond text-centric Twitter. A TikTok framework constructs user similarity networks from synchronized posting, repeated use of similar captions, multimedia content reuse, and hashtag-sequence overlap; prunes the resulting graphs by high-percentile edge filtering and eigenvector-centrality thresholds; and extracts dense subnetworks of likely coordinated accounts [2505.10867]. A cross-platform election study on \(\mathbb{X}\) builds a bipartite user–URL graph with TF–IDF edge weights, projects it into a cosine-similarity user graph, computes eigenvector centrality \(c=\lambda^{-1}Ac\), and flags accounts above the 99th percentile of the centrality distribution [2409.15402].

Causal and behavioral-language approaches broaden the methodological repertoire. A causality-based method applies Convergent Cross Mapping (CCM) to binned user activity series and declares a causal influence edge when the slope of \(\rho(L')\) over library length is positive and \(\rho_{\max}>\theta\) with \(\theta=0.5\) [2407.11690]. The BLOC line of work represents an account’s timeline as action and content symbol strings, converts them into TF–IDF features, and uses cosine similarity or KNN classification to detect CIB [2211.00639]. A later extension measures behavioral change between BLOC segments with cosine distance or Normalized Compression Distance, converts the resulting distributions into 20-dimensional histogram features, and uses KNN to detect information-operation accounts [2603.03128].

## 3. Structural analysis of coordination and diffusion

CIB research is strongly network-centric. In the 2019 UK General Election dataset of 11,264,820 tweets by 1,179,659 users, the top 1% superspreaders by retweet volume—10,782 users—were used to construct a filtered similarity graph with 276,775 edges, from which seven major coordinated communities were identified: CON, LAB, TVT, SNP, B60, ASE, and LCH [2008.08370]. The same framework defines a continuous coordination “extent”
$$
c_i=\frac{|\{w\in W^*\mid w\le t_i\}|}{|W^*|}\in[0,1],
$$
so that coordination is not reduced to a binary coordinated/uncoordinated label [2008.08370]. Large political blocs such as CON and LAB retained dense cores up to \(c\approx0.8\)–\(0.9\), whereas TVT and SNP lost most members by \(c\approx0.4\)–\(0.5\) [2008.08370].

Temporal coordination networks add role semantics to structure. In an RNC 2020 dataset, an HCC around @TrumpWarRoom displayed star topology and ordering analysis showed that @TrumpWarRoom always acted first, while four heavy-tie accounts always acted second; the accompanying account profiles had long-term activity as high as 92 tweets/day and Botometer-CAP scores from 0.73 to 0.92 [2107.02588]. The same study shows that execution time grows sharply with the coordination window \(\gamma\), from 4:43 at \(\gamma=10\) seconds to 533:54 at \(\gamma=15\) minutes, underscoring the computational consequences of temporal semantics [2107.02588].

Information-cascade analysis offers a complementary perspective. A 2025 Twitter study reports that coordinated accounts, on average, “occupy higher positions of the information cascade (i.e., closer to the root), spread messages faster and involve a slightly higher number of users,” and that cascades with a systematically larger proportion of coordinated accounts show clear differences in size, number of edges, and height relative to statistical null models [2503.15720]. The same study introduces two measures of coordinated-account infectivity and interaction with non-coordinated accounts, and finds that interactions between the two classes follow a saturation-like process: after a threshold value of approximately 50%, involving more coordinated accounts within a cascade yields a null marginal effect [2503.15720].

A post-hoc cascade-optimization study reaches a different conclusion about realized impact. It defines the influence of a labeling \(\ell\) on a directed tree \(T=(V,E)\) as
$$
I_\ell(T)=\sum_{v\in V_1^\ell} d_0^\ell(v),
$$
where \(V_1^\ell\) is the set of coordinated nodes and \(d_0^\ell(v)\) counts non-coordinated children of \(v\) [2401.01684]. On 4,119 reconstructed Twitter retweet trees from the 2019 UK General Election, observed coordinated placements substantially underperformed both an unconstrained optimum and a fixed-budget greedy heuristic. The Kullback–Leibler divergences,
\(D_{KL}(p_{\mathrm{real}}\|q_{\mathrm{greedy}})=4.278\) and \(D_{KL}(p_{\mathrm{real}}\|q_{\mathrm{random}})=0.097\),
indicate that real placements were much closer to random than to the greedy benchmark [2401.01684]. This suggests that structural presence in a cascade does not automatically imply strategically efficient influence.

## 4. Content, propaganda, and campaign semantics

One major research direction studies CIB jointly with content manipulation. In the UK election setting, propaganda is operationalized by a binary classifier, “Proppy,” trained to distinguish propagandistic from non-propagandistic text; user-level propaganda scores aggregate item-level predictions, and community-level scores aggregate user-level ones [2109.13046]. The key analytical object is the relationship between propaganda and coordination within communities. Seven coordinated communities were identified, and the correlations differed sharply: TVT and ASE showed strong positive association between coordination and propaganda, with values such as \(r=+0.81\), \(p<0.01\); B60 and LCH showed strong negative association, including \(r=-0.90\) for B60, \(p<0.01\) [2109.13046]. The study explicitly concludes that purely network-based coordination detectors will flag both harmful troll farms and harmless activist groups [2109.13046].

A multilingual French-election study extends this logic with socio-linguistic models for attitudes, concerns, and emotions [2305.11867]. Coordinated accounts were identified primarily through hashtag-sequence matching: two users were coordinated if each had authored at least one original tweet with the same ordered sequence of five or more hashtags [2305.11867]. Although coordinated accounts comprised only 0.28 percent of all users, they contributed 5–10 percent of tweets, replies, and retweets, and produced 18.7 percent of \#MacronLeaks tweets [2305.11867]. Coordinated-account content consisted of retweets of other coordinated accounts at a rate of 33 percent, and coordinated tweets promoted a candidate at three times the rate of non-coordinated tweets, with 35 percent versus 8.2 percent when binarized for “vote for” stance [2305.11867]. These findings situate CIB as a content-amplification process rather than merely a structural anomaly.

Facebook-group research links coordination to disinformation echo chambers. Using posts, URLs, and images from 19,457 Facebook posts across 3,912 public groups, one study defines a coordination event when high-fidelity content matching—cosine text similarity at least \(0.9\), URL identity or Jaccard \(=1\), or identical perceptual hash—co-occurs with \(\Delta t\le 30\) seconds [2309.07745]. In that setting, 1,504 groups, approximately 38.5%, exhibited at least one coordination event; manual validation of 200 flagged events found more than 92% true coordination; and large communities such as a 117-group cluster reached clustering coefficient \(C=0.85\) [2309.07745]. The study’s formulation is explicit: CIB is the “behavioral counterpart to content-based echo chambers” [2309.07745].

Cross-platform information operations reveal the same logic in URL infrastructures. In election-related discussion on \(\mathbb{X}\), a similarity network of roughly 2,000 users and roughly 7,000 edges produced 34 highly coordinated accounts in May 2024; extension into June and July expanded the set to 40 [2409.15402]. These accounts promoted six suspicious web domains for a total of 15,509 shares, generated synchronized bursts averaging approximately 5,600 tweets/day at peak, and often linked \(\mathbb{X}\), YouTube, and clone news sites in a “tri-partite amplification loop” [2409.15402]. Eight of the 40 accounts were later suspended and two restricted, while more than 75% remained active at the time of writing [2409.15402].

## 5. Evaluation, benchmarks, and relation to automation

Evaluation is difficult because large-scale ground truth is rare. Several studies therefore rely on partial labels, structural validation, or precision-oriented manual review. In the Twitter-like collection around \#dkpol, purchased test likes on six dedicated tweets produced bins whose sizes exactly matched the number of likes ordered, demonstrating recovery of vendor-driven campaigns under the strict perfect-correlation criterion [2305.07384]. Data completeness was also measured: for 39.98% of the 6,702 tweets subject to final harvest, the collected liker-set size exactly equaled the tweet’s maximum 48-hour like count, and for 93.7% the count was within 10% of the true count [2305.07384].

The relation between CIB and botness is empirically unstable. In the Danish-election note that binned identical like/retweet behavior, neither bin size nor likelihood of suspension/deletion correlated significantly with Botometer v4 or Botometer Lite scores; all reported Pearson \(r\) values were close to zero, with \(p>.05\) and confidence intervals including \(r=0\) [2305.08621]. In the UK-election coordination framework, coordination degree \(c\) correlated weakly with bot scores or suspension rates, with \(|\rho|<0.1\), leading the authors to state that coordination is orthogonal to automation [2008.08370]. By contrast, the propaganda study found that TVT and ASE combined high coordination, high propaganda, high botness, and high suspension, whereas B60 and SNP combined high coordination, low propaganda, and low suspension [2109.13046]. Taken together, these results indicate that bot scores can be informative in some communities but are not a universal proxy for CIB.

Benchmarking across methods shows substantial variation. On the IRA dataset, topic-guided CCM reached Precision \(=91.4\%\), Recall \(=64.0\%\), and \(F_1=75.3\%\) in 11.4 minutes for \(N_C=200, N_N=200\), improving over CCM alone and baselines such as Granger causality, network-based LCN+HCC, language-only classification, and HAGE [2407.11690]. An adaptive, memory-guided extension, ACCD, reports \(F_1=87.3\%\), Precision \(=85.6\%\), Recall \(=89.2\%\), a 68.3% reduction in manual labeling, and a 2.8x speedup over naive CCM on Twitter IRA data [2601.00400]. In graph classification on the LEN dataset of 314 engagement networks—179 campaign and 135 non-campaign—DECODE reaches Accuracy \(0.852\pm0.010\) and \(F_1\,0.877\pm0.010\) in binary classification, improving over raw-feature GNN baselines [2506.13912]. In behavioral-change modeling on 32 information-operation campaigns, the best model yields Precision \(\simeq0.89\), Recall \(\simeq0.88\), and \(F_1\simeq0.88\), compared with \(F_1\simeq0.53\) for co-retweet clustering, \(0.56\) for co-hashtag clustering, and \(0.76\) for temporal activity synchronization [2603.03128].

Video-first platforms impose different validation regimes. On TikTok, the absence of large-scale ground truth led researchers to rely on structural properties and manual inspection: the top hashtag-sequence cluster in August 2024 contained 68 users at density \(1.00\), and 100% of users in that cluster shared identical watermarks, AI-voice use, and username prefixes, whereas 0% of users flagged by Duet/Stitch or transcript-similarity signals formed coherent CIB clusters [2505.10867]. This underscores that evaluation criteria are often platform-specific and method-specific rather than standardized.

## 6. Limitations, controversies, and future directions

A recurrent limitation is that strict operationalizations can miss noisy or adaptive coordination. Exact-equality binning will miss “near-identical but not perfectly matching coordination,” including “off-by-one-tweet patterns” [2305.08621]. Likewise, exact-profile matching in likes does not exploit temporal synchrony and may miss campaigns coordinated tightly in time rather than in exact tweet sets [2305.07384]. Temporal-window methods face the complementary problem that long windows inflate false positives, whereas short windows demand near real-time processing and heavy indexing [2107.02588].

Platform affordances alter which signals generalize. On TikTok, hashtag-sequence overlap, synchronized posting, shared external domains, and multimedia reuse generalized well, but transcript-based similarity, Co-Duet/Co-Stitch, and comment-based URL or reply signals did not [2505.10867]. The paper attributes these failures to remix norms, endemic organic Duet/Stitch use, and high reuse of public speeches and memes [2505.10867]. On Facebook, OCR and perceptual hashing can miss heavily edited memes, and the study proposes more advanced vision embeddings as a possible improvement [2309.07745]. On Twitter-like reaction data, API constraints such as the cap of fetching only the 100 most recent likers per request remain a practical obstacle to scalable deployment [2305.07384; 2305.07350].

A broader controversy concerns the distinction between harmful coordination and benign collective action. The UK-election studies repeatedly show that highly coordinated communities can be authentic, low-propaganda, and low-suspension, as with B60 and SNP, while other highly coordinated communities are strongly associated with propaganda and suspension [2109.13046]. The taxonomic critique therefore recommends moving “from ‘Is CIB? / Isn’t CIB?’ to a multi-dimensional profile across scale, user, purpose, and impact,” and suggests prioritizing removal of high-scale, malicious-purpose armies while preserving benign pseudonymous speech [2006.04959]. This suggests that CIB detection pipelines are most defensible when they separate behavioral coordination from judgments about harm, deception, or automation, and then recombine those signals explicitly.

The research agenda described across the literature is correspondingly plural. Proposed directions include fuzzy clustering with Hamming- or Jaccard-based thresholds, dynamic tracking of bot scores, network topology analyses, and integration of content features for more subtle coordination [2305.08621]; multilayer graph fusion, robust video fingerprinting, synthetic-voice detection, and GNNs on user–entity graphs for video-first ecosystems [2505.10867]; online CCM variants, automated parameter selection, and multi-modal integration for causal detection [2407.11690]; and memory-guided adaptive validation, active learning, and cross-platform memory sharing in end-to-end systems [2601.00400]. Across these directions, the common theme is methodological: CIB is increasingly modeled as a multimodal, temporal, structural, and sometimes causal phenomenon whose empirical signature depends on platform mechanics as much as on adversarial intent.

Source: https://www.emergentmind.com/topics/coordinated-inauthentic-behavior-cib