Automated Detection of Coordinated Inauthentic Behavior on Social Media: Graph Neural Networks on Temporal Account Activity Networks With LLM-Assisted Content Features

This study investigates graph neural network detection of coordinated inauthentic behavior (CIB) networks on Twitter/X using temporal account activity graphs combined with LLM-generated content feature embeddings within the context of computational social science and AI safety, an area of growing scientific importance given its implications for platform trust and safety CIB detection system design, election integrity monitoring, and state-sponsored disinformation attribution methodology. Using temporal account activity graph construction (co-retweet, co-hashtag, reply network edges), GraphSAGE with temporal attention, LLM-generated content feature vectors (GPT-4o embeddings), and ensemble with metadata features evaluated on held-out CIB campaigns, we examine coordinated campaigns exhibiting temporal synchrony (burst co-activity), topological cohesion (dense intra-cluster edges), and content homogeneity (low embedding variance) — patterns exploitable by GNN trained on labeled network snapshots in 28,400 CIB accounts (48 Twitter Transparency Report campaigns) and 142,000 matched organic accounts; held-out evaluation on 8 unseen campaigns (2023-2024) drawn from Twitter/X Academic API historical data access; CIB ground truth from Twitter Transparency Report public disclosures; LLM embedding via GPT-4o API for 170 million tweets. Results indicate that full ensemble (GNN + LLM content + metadata) achieves account-level F1 0.88 and AUC 0.94 on held-out campaigns; GNN alone F1 0.78, content alone F1 0.72; campaign-level detection precision 0.92 at 84.2% recall threshold for new unseen campaigns (p < 0.001), with full ensemble F1 0.88, AUC 0.94; campaign detection precision 0.92 at 84.2% recall as the primary quantitative benchmark. Concordance between primary and confirmatory measurement approaches exceeded 93%, validating the analytical framework. These findings contribute empirically to computational social science and AI safety and carry actionable implications for the design of programs and policies targeting platform trust and safety CIB detection system design, election integrity monitoring, and state-sponsored disinformation attribution methodology.