Detecting Coordinated Inauthentic Behavior on Social Media: A Technical Guide

Coordinated inauthentic behavior (CIB) is a network of accounts acting together, under false identities, to make a narrative look more popular or organic than it is. Meta, which coined the term, defines it as "sophisticated forms of Inauthentic Behavior where false identities are central to the operation and operators use adversarial methods to evade detection or appear authentic." Detecting it is a network problem, not a content problem: you look for accounts that do the same thing at the same time, then check whether they are who they claim to be.

This guide walks through the method researchers and trust-and-safety teams use in 2026: collect the data around a narrative, build co-action networks, prune them statistically, detect communities, and validate by hand. We build xpoz, a social data platform that indexes billions of posts across Twitter/X, Instagram, TikTok, and Reddit, and several teams use it as the collection layer for exactly this workflow, so the collection section describes our own tools alongside the open graph tools that do the analysis. Every threshold below is cited to the paper or package it comes from.

What Is Coordinated Inauthentic Behavior?

Meta's platform policy prohibits inauthentic assets used to "deceive Meta or users about the identity, origin of an audience, or the entity they represent," and it treats foreign interference (operators targeting audiences in other countries) as a distinct category. The policy is behavior-based on purpose: enforcement looks at how accounts act together, not at what they say, so it applies whether the content is political, commercial, or entertainment.

The academic definition is wider and more useful for detection. A 2024 survey by Mannocci, Mazza, Monreale, Tesconi, and Cresci ("Detection and Characterization of Coordinated Online Behavior: A Survey", arXiv 2408.01257) defines coordinated online behavior as "a group of users who perform synergic actions in pursuit of an intent" and separates four dimensions: authenticity, harmfulness, orchestration, and time-variance. Detection methods find coordination; the analyst then judges authenticity and harm. That split is the single most important thing to keep straight, because activist groups, newsrooms, and fan communities coordinate authentically every day.

The scale of the problem is documented in platform reports. Meta's first-quarter 2025 Adversarial Threat Report described three CIB networks removed in one quarter, originating in China, Iran, and Romania, the Romanian operation alone spanning roughly 20,000 accounts and about $177,000 in ad spend across platforms (Cyfluence Research summary, June 2025). Meta now publishes these reports semiannually; the first-half 2026 edition appeared on March 11, 2026 and the second-half edition in August 2026.

Which Signals Reveal Coordination?

Coordination leaves traces in timing, content, and structure. The foundational method paper, Pacheco, Hui, Torres-Lugo, Truong, Flammini, and Menczer's "Uncovering Coordinated Networks on Social Media: Methods and Case Studies" (ICWSM 2021), formalised five traces: shared account handles, shared profile images, identical hashtag sequences, co-retweeting, and synchronised posting times. Later work added co-links (the same URL), co-replies (piling onto the same post), and near-duplicate text.

The table below lists the signals you can compute from public data, the computation, and the threshold or heuristic the literature or the reference tools use as a default. Treat the thresholds as starting points to be tuned per dataset, not as verdicts.

Two cautions apply to every row. First, a single signal is weak: retweeting the same viral post within 60 seconds happens organically thousands of times a day. Coordination shows up as repetition across many actions and as dense structure in the network. Second, thresholds interact with dataset size; Pacheco et al. state that support thresholds "depend on the time period under evaluation" and tune them to maximise precision while keeping recall acceptable.

How Do You Collect the Data?

Collection is the hard step in 2026. The official X API bills pay-per-use at $0.005 per post read with a 3 million reads per month cap and 7-day search only; full-archive access requires an Enterprise contract at $42,000 or more a month (docs.x.com, verified September 2026). Reddit announced on August 5, 2026 that new public Data API requests are being gradually restricted in favour of its Developer Platform. TikTok's Research API is open only to approved academics in listed regions. Botometer, once the default bot scorer, has run in archival mode since X ended free access in June 2023 and holds no scores for accounts created after May 31, 2023 (Observatory on Social Media, February 2024).

The practical answer for most teams is a pre-indexed social data platform plus open graph tools. With xpoz, the collection sequence for one narrative on Twitter/X is: search posts by keyword over the rolling 60-day window (getTwitterPostsByKeywords), pull the retweeters, quoters, and repliers of the seed posts (getTwitterPostRetweets, getTwitterPostQuotes, getTwitterPostInteractingUsers), fetch each candidate's recent posts (getTwitterPostsByAuthor) and connections (getTwitterUserConnections), and export everything as CSV. The same shape exists for Instagram, TikTok, and Reddit.

The Free tier covers up to 75,000 results one-time; Pro is $20 a month for up to 1,000,000 results a month. The disclosure matters here: we sell the collection layer, and the analysis layer below is entirely open source.

What you need in the export, whichever source you use: post id, author id, timestamp to the second, the id of any reposted or quoted post, the reply-to id, the text, and the URLs. Those eight columns are exactly what the QUT toolkit's CSV loader expects (message_id, user_id, username, repost_id, reply_id, message, timestamp, urls), and CooRTweet's prep_data function maps any table with an object id, an account id, and a time column.

How Do You Build the Coordination Network?

The pipeline in every reference implementation is the same four moves, described most clearly by Pacheco et al.: choose a trace, build a bipartite network of accounts and traces, project it onto accounts with a similarity weight, and filter weak edges. A minimal version in Python looks like this:

import pandas as pd, networkx as nx
from itertools import combinations

posts = pd.read_csv("export.csv", parse_dates=["timestamp"])
reposts = posts.dropna(subset=["repost_id"]).sort_values("timestamp")

pairs = {}
for _, group in reposts.groupby("repost_id"):
    rows = group[["user_id", "timestamp"]].values
    for (u1, t1), (u2, t2) in combinations(rows, 2):
        if u1 != u2 and abs((t2 - t1).total_seconds()) <= 10:
            key = tuple(sorted((u1, u2)))
            pairs[key] = pairs.get(key, 0) + 1

G = nx.Graph()
for (u1, u2), w in pairs.items():
    if w >= 2:
        G.add_edge(u1, u2, weight=w)

This is the co-retweet network with CooRTweet's defaults (a 10-second window, at least two shared actions per pair). The weight is plain co-occurrence; Pacheco et al. note that Jaccard, cosine, mutual information, or chi-square work as alternatives, and that popularity normalisation (an IDF-style weight) is needed when many accounts legitimately share the same viral item.

Filtering is where false positives are won or lost. Two published approaches: keep only the top percentile of edge weights (Pacheco et al. kept the largest 1 percent in their image-sharing case study), or apply a statistical backbone. Ng and Iamnitchi ("Coordinated Information Campaigns on Social Media: A Multifaceted Framework for Detection and Analysis", MISDOOM 2023, arXiv 2309.12729) drop all weight-1 edges, then retain an edge only if its weight exceeds 2.32 times the standard deviation expected under a noise-corrected null model, which approximates a 0.01 significance level. That step removed 59 percent of edges in their Internet Research Agency dataset and 88 percent in a benign data-science control.

How Do You Find and Score the Communities?

With the pruned network in hand, community detection turns edges into candidate groups. Pacheco et al. used connected components for simplicity; Ng and Iamnitchi and Nizzoli et al. (ICWSM 2021, UK general election) used Louvain modularity optimisation, which handles weights and separates large components into meaningful clusters. In Ng and Iamnitchi's IRA dataset, Louvain produced six clusters of 37 to 937 accounts.

Ranking the clusters is the next step, because a dozen communities will fall out of any large dataset and only a few deserve investigation. Ng and Iamnitchi compute four features per account (content similarity of shared text via multilingual sentence embeddings, median inter-arrival time between co-shares, node2vec structural similarity, and total co-occurrence weight) and run an Isolation Forest with 100 estimators inside each cluster to flag the most anomalous accounts. A simpler heuristic that works in practice: rank clusters by the product of density, median action count per member, and the share of members created within the same 30-day window.

Cross-platform coordination is increasingly the norm. Cinus, Minici, Luceri, and Ferrara ("Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election", arXiv 2410.22716) built similarity networks across X, Facebook, and Telegram and found coordinated communities promoting Russian-affiliated media across Telegram and X. The EU DisinfoLab's detection tree lists the cheap cross-platform checks: identical usernames on several platforms, matching profile pictures found by reverse image search, and shared links in biographies.

Video-first platforms need different traces. Luceri and colleagues ("Coordinated Inauthentic Behavior on TikTok: Challenges and Opportunities for Detection in a Video-First Ecosystem", 2025) report that text-based signals such as transcript similarity fail on TikTok, and propose synchronised posting, repeated captions, multimedia reuse, and hashtag-sequence overlap instead. On TikTok, collect captions, sounds, and hashtags per post, not just text.

How Do You Validate a Flagged Cluster?

Every cluster that survives ranking gets a manual pass before anyone uses the word "inauthentic." The Mannocci et al. survey is explicit that coordination and authenticity are independent dimensions, and the false-positive cases are predictable: a K-pop fandom co-retweeting within seconds, a newsroom's staff accounts sharing every story, an NGO's volunteer network amplifying a campaign hashtag. All three are coordinated; none is inauthentic.

Work through the same checks for each member account: creation date and its distribution across the cluster, profile photo provenance (reverse image search; AI-generated faces are common in removed networks), handle patterns such as name plus digits, posting hours against the claimed location, whether the account ever posts anything but the campaign, and whether its replies come from inside the cluster. Record every check. A cluster with four independent indicators is a finding; a cluster with one is a lead.

Two further limits deserve a sentence each. There is no ground truth outside platform takedown lists, so measure your method against a known network (Nizzoli et al. published their UK election dataset on Zenodo; the IRA dataset is public) before trusting it on new data. And operators adapt: once a window of 10 seconds is known, they schedule at 15 minutes, which is why multi-signal detection with a long inter-arrival distribution beats any single fixed window.

How Do You Report the Finding?

A defensible report separates observation from inference. State the narrative and collection window, the data source and its coverage limits, the traces and thresholds used, the number of accounts in the flagged cluster, the validation checks passed and failed, and the confidence level. Export the edge list and the member list so a second analyst can rerun the pipeline. Attribution (who runs the network) is a separate investigation with different evidence standards; the January tutorial on investigating disinformation campaigns with AI and OSINT covers that phase.

For teams working the same problem on a smaller scale, the fake-follower and bot-account detection tutorial covers single-account signals, the bot-network case study shows a commercial variant, and the guides on mapping influence in online communities and mapping influencer networks on Twitter cover the graph techniques from the authentic side. The companion guide on tracking political narratives across platforms during elections applies the same collection layer to narrative measurement.

Frequently Asked Questions

What counts as coordinated inauthentic behavior?

Meta defines coordinated inauthentic behavior as sophisticated forms of inauthentic behavior where false identities are central to the operation and operators use adversarial methods to evade detection or appear authentic. The academic definition is broader: a group of users performing synergic actions in pursuit of an intent (Mannocci et al., 2024). Detection finds the coordination; deciding it is inauthentic and harmful takes manual review.

How do you detect coordinated behavior on social media?

Collect posts and engagement around a narrative, link accounts that perform the same action (retweet, quote, link, hashtag sequence, identical text) inside a short time window, project that bipartite graph into an account-to-account network, drop weak edges, run community detection, and then review each dense community by hand. Published pipelines use 10 to 60 second windows and keep only the top 1 percent of edge weights or edges that pass a statistical backbone test.

Which open tools detect coordinated inauthentic behavior?

CooRTweet (R, defaults time_window 10 seconds and min_participation 2), the QUT Coordination Network Toolkit (Python, 60 second window, six network types including co-retweet and co-similarity), Gephi for visualisation and Louvain community detection, and NetworkX or igraph for scripted pipelines. Botometer runs in archival mode only since June 2023 and cannot score accounts created after that date.

Why is coordination detection hard in 2026?

Three reasons. Data collection is the bottleneck: the X API is pay-per-use with a 7-day search window, Reddit is restricting new public API access, and TikTok's Research API is limited to approved academics. Networks now mix AI-generated text and profile photos with human operators, so per-account bot scores miss them. And there is no ground truth: fan communities, newsrooms, and activist groups coordinate authentically, so every flagged cluster needs manual validation.

Sources

• Meta Transparency Center, Inauthentic Behavior policy: https://transparency.meta.com/policies/community-standards/inauthentic-behavior/
• Meta Transparency Center, threat reporting index (H1 2026 report, March 11, 2026; H2 2026 report, August 2026): https://transparency.meta.com/metasecurity/threat-reporting/
• Cyfluence Research on Meta's Q1 2025 report (June 9, 2025): https://www.cyfluence-research.org/post/meta-takes-down-global-cib-operations-from-iran-china-and-romania
• Pacheco et al., "Uncovering Coordinated Networks on Social Media: Methods and Case Studies", ICWSM 2021: https://arxiv.org/abs/2001.05658
• Ng and Iamnitchi, "Coordinated Information Campaigns on Social Media: A Multifaceted Framework for Detection and Analysis", MISDOOM 2023: https://arxiv.org/abs/2309.12729
• Mannocci et al., "Detection and Characterization of Coordinated Online Behavior: A Survey", 2024: https://arxiv.org/abs/2408.01257
• Nizzoli et al., "Coordinated Behavior on Social Media in 2019 UK General Election", ICWSM 2021: https://arxiv.org/abs/2008.08370
• Cinus et al., "Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election": https://arxiv.org/abs/2410.22716
• Luceri et al., "Coordinated Inauthentic Behavior on TikTok: Challenges and Opportunities for Detection in a Video-First Ecosystem", 2025: https://arxiv.org/abs/2505.10867
• Righetti and Balluff, CooRTweet 2.1.2 (CRAN, 2025-03-11): https://cran.r-project.org/web/packages/CooRTweet/
• Graham, QUT Coordination Network Toolkit: https://github.com/QUT-Digital-Observatory/coordination-network-toolkit
• Observatory on Social Media, "Introducing Botometer X" (February 21, 2024): https://osome.iu.edu/research/blog/introducing-botometer-x
• EU DisinfoLab, CIB Detection Tree (2021): https://www.disinfo.eu/publications/cib-detection-tree-third-branch/