IOHunter: Graph Foundation Model to Uncover Online Information Operations
Authors: Marco Minici, Luca Luceri, Francesco Fabbri et al.
Published: 2024-12-19
arXiv: 2412.14663
Source: arXiv (cs.SI, cs.AI, cs.LG)
Abstract
Social media platforms have become vital spaces for public discourse, serving as modern agoràs where a wide range of voices influence societal narratives. However, their open nature also makes them vulnerable to exploitation by malicious actors, including state-sponsored entities, who can conduct information operations (IOs) to manipulate public opinion. The spread of misinformation, false news, and misleading claims threatens democratic processes and societal cohesion, making it crucial to develop methods for the timely detection of inauthentic activity to protect the integrity of online discourse. In this work, we introduce a methodology designed to identify users orchestrating information operations, a.k.a. IO drivers, across various influence campaigns. Our framework, named IOHunter, leverages the combined strengths of Language Models and Graph Neural Networks to improve generalization in supervised, scarcely-supervised, and cross-IO contexts. Our approach achieves state-of-the-art performance across multiple sets of IOs originating from six countries, significantly surpassing existing approaches. This research marks a step toward developing Graph Foundation Models specifically tailored for the task of IO detection on social media platforms.
Why This Work Matters
IOHunter represents a methodological advance in the detection of coordinated inauthentic behavior: it identifies IO drivers (orchestrators) rather than flagging individual inauthentic posts. The distinction is analytically significant — network-level attribution provides structural intelligence about campaign architecture, not just content signals.
The multi-country generalization capability is the key operational contribution. Existing detection systems tend to overfit to specific campaign typologies. IOHunter’s Graph Foundation Model approach maintains detection performance across IO campaigns from six different state-sponsor contexts, making it applicable to novel campaigns without retraining from scratch.
Core Concepts and Contributions
IO driver detection: Rather than classifying individual posts, IOHunter identifies the user accounts coordinating IO campaigns — the structural nodes driving inauthentic behavior. This actor-centric framing aligns with intelligence tradecraft (attribution to orchestrators, not instruments).
Graph Neural Networks + Language Models: Fuses structural graph features (network topology, interaction patterns) with semantic language features (content signals) in a single model. Neither modality alone achieves the cross-campaign generalization demonstrated.
Graph Foundation Model (GFM): The paper positions IOHunter as a step toward GFMs for social media IO — analogous to large language model foundations but operating on graph-structured social network data. This framing suggests the methodology is designed for continued scaling and adaptation.
Cross-IO generalization: Tested across IO campaigns attributed to six countries, including in supervised, scarcely-supervised (few labeled examples), and zero-shot cross-IO settings. State-of-the-art performance across all three regimes is analytically significant for real-world counter-IO deployment.
Connections
- Coordinated Inauthentic Behavior — the primary detection target
- Influence Campaigns — the broader operational category
- Information Operations — the strategic layer
- How Malicious AI Swarms Can Threaten Democracy — describes the threat landscape IOHunter counters
- Designing AI-Enabled Countermeasures to Cognitive Warfare — ethical framework for AI-based defensive IO