Contributions
- Demonstrates that machine learning models trained on pre-2019 Russian troll data generalize to contemporaneous accounts, establishing continued troll activity.
- Develops classifiers using profile features, behavioral features, stop-word frequencies, language distribution, and bag-of-words on 2,286 Russian troll accounts and 171,291 control accounts.
- Identifies specific linguistic and behavioral markers distinguishing trolls: keywords like "danger," "crisis," "maga," and abnormally high mention/hashtag usage.
- Provides quantitative evidence that Russian trolls occupy approximately 2.6% of mentions to high-profile journalists.
- Develops human evaluation protocol to validate model predictions; moderate inter-rater agreement (Krippendorff's α = 0.512) reflects difficulty of task but indicates salient behavioral differences exist.
Method
Data: The authors use 2,286 Russian troll accounts (1.4% of sample) identified by Twitter and released post-2016-election, with 346,711 tweets, compared to 171,291 control US-based accounts (98.6% of sample) with 29,960,070 tweets.
Features (five categories):
- Profile features: account age, profile description length, follower/following counts and ratios.
- Behavioral features: hashtag usage, mention counts per tweet, link sharing rates, tweet volume and rate, tweet length.
- Stop-word usage: frequency of 179 function words and common content words, motivated by research showing non-native English speakers use function words differently.
- Language distribution: proportion of tweets in each of 82 detected languages.
- Bag of Words (BoW): unigrams and bigrams from 5,000 most frequent n-grams.
Classifiers: Logistic Regression (LR), Decision Tree (max depth 10), and Adaptive Boosted Decision Tree. Cross-validation prioritizes precision to minimize false positives.
Out-of-sample evaluation: The logistic regression model trained on all features is applied to 39,103 unique accounts that mentioned 57 high-profile political journalists in late 2018. Three trained raters (including one with political science expertise) independently scored 50 flagged and 50 unflagged accounts on a 1–5 scale for likelihood of being a Russian troll.
Results
In-domain (10-fold cross-validation): Logistic Regression achieves 78.5% precision, 83.5% recall, 98.9% AUC, and 99.4% accuracy. Adaptive Boosted Decision Tree achieves higher precision (94.2%) but lower AUC (91.2%). Bag-of-Words features alone yield 98% AUC and 58% precision, outperforming individual feature categories.
SAGE analysis: Top 30 distinguishing n-grams show trolls use keywords associated with chaos and distrust (danger, disaster, crisis, emergency, attacks), political figures (hillary clinton, obama), conservative-aligned terms (maga), and Fukushima disaster keywords. Raw frequencies dominated by high-volume Ukrainian and Russian-language content.
Out-of-sample testing: 1,466 of 39,103 accounts (3.7%) flagged as likely trolls—average 25.7 per journalist. All 57 journalists had at least one flagged account. Median rater score across all 100 accounts: 2.5/5; median for flagged accounts: 3.12/5. 50% (25/50) of flagged accounts scored above 3, indicating close resemblance to troll behavior; 70% of flagged accounts had at least 2 raters assigning score >3.
Botometer analysis: Flagged accounts score higher on bot characteristics than unflagged accounts (0.91 vs. 0.54 on 5-point scale) but both remain under 1.0, suggesting trolls employ human-assisted strategies rather than pure automation.
Behavioral characteristics of flagged accounts:
- Newer account creation (average 1,202 days vs. 2,175 for unflagged).
- Higher follower/following counts.
- Tweet rate of 41.99 tweets/day (vs. 26.83 for unflagged), with higher variance.
- Elevated Russian language tweets (3,145 vs. 3,145 for unflagged in same sample).
- Heavy use of political hashtags (#MAGA 12,385 uses vs. 4,553 for unflagged).
- Qualitative observations: profile mismatches (bio does not reflect tweet content), reused or geographically inconsistent profile pictures, aggressive behavior, high retweet rates of political content.
Notes
Strengths: The paper demonstrates that adversarial account detection is feasible using externally-accessible features, and it validates models on contemporary out-of-sample data rather than relying solely on in-domain evaluation. The human evaluation protocol, despite moderate inter-rater agreement, provides credible evidence of generalization. The finding that Russian trolls are not primarily software-controlled bots is important for platforms designing defenses.
Limitations: Moderate inter-rater agreement (α = 0.512) reflects the difficulty of manual annotation without ground truth; the model may still misclassify accounts. The study is limited to accounts mentioning journalists, which is a specific behavioral pattern and may not generalize to trolls targeting other audiences. Account suspension/deletion by January 2019 (12 of 1,466 flagged accounts) suggests Twitter was taking some action, but the scale of detection is unknown.
Open questions: Whether similar models can transfer to other platforms (Facebook, Reddit) where Russian campaigns operated with different strategies; how troll tactics and targets have evolved since 2018; whether platform-internal signals (IP logs, device fingerprints, payment methods) would yield substantially higher precision.