No single signal is proof of inauthenticity
Coordinated inauthentic behavior is designed to look organic. Single-metric approaches — bot detection based on account age alone, or velocity alerts without network analysis — produce high false-positive rates that erode trust in the output.
Rolli IQ uses a multi-signal ensemble approach. The authenticity score is a weighted composite across four signal families: velocity & timing, account behavior, network structure, and content & language. Only when signals converge across multiple families does the score trend toward coordinated.
The score is explicitly probabilistic. A score of 24 does not mean we have proven coordination — it means our models assign 76% confidence that the amplification is not organic. Rolli IQ outputs are intelligence aids for human decision-makers, not automated verdicts.
Signal families
Each narrative is evaluated across all four families. Convergence across families drives a lower authenticity score.
Velocity & Timing
Account Behavior
Network Structure
Content & Language
Approximate signal weights in IQ score
Why 94.2% accuracy matters for your team's credibility
The score ranges from 0 (highly coordinated) to 100 (highly organic).
What Rolli IQ is — and isn't
The pipeline
Five deterministic stages — every narrative runs the same pipeline, every time.
Ingest
Continuous collection across 8 platforms. Posts, replies, reshares, and engagement events are normalized into a unified event schema. Deduplication applied at ingest.
Enrich
Every signal is enriched with topic extraction, entity tagging, emotion classification (6 emotions × platform × country), and narrative velocity metrics.
Score
The multi-signal authenticity model runs across velocity, account, network, and content families. A composite authenticity_score (0–1) is assigned to each narrative cluster.
Structure
Scored signals are organized into narrative clusters, timeline views, and key voice rankings — surfaced in the Rolli IQ dashboard or delivered via REST / MCP stream.
Brief
Rolli IQ Agents synthesize scored data into plain-English intelligence briefs with recommendations — optimized for stakeholder communication and executive decision support.
Data collection
Signal collection — 8 monitored platforms
Rolli IQ ingests behavioral signals continuously across eight major platforms, plus a network of 120,000+ news sources. Each platform contributes distinct signal types that reflect its user base and algorithmic character.
X (Twitter)
Post velocity, retweet chains, account age, follower/following ratios, hashtag adoption timing, cross-account language similarity
Primary signal for real-time narrative injection detection
Post upvote velocity, account karma/age, subreddit cross-posting, comment network analysis, deletion patterns
High-value for detecting astroturfing on topic-specific communities
Page/group engagement rates, share velocity, account age proxies, coordinated page networks
Key platform for detecting domestic CIB operations
Engagement velocity, hashtag coordination, account follower growth patterns, caption similarity scoring
Visual platform signals supplemented by caption/hashtag analysis
YouTube
View velocity anomalies, comment network topology, channel age/activity, cross-channel coordination
Long-form content context for narrative development tracking
Post engagement by verified professional category, company page coordination, cross-account amplification
Professional signal layer — high signal-to-noise for policy/B2B narratives
Bluesky
Starter pack coordination, repost velocity, account age distribution, language fingerprinting
Emerging platform with distinct political composition from X
Threads
Cross-Instagram account correlation, post timing synchrony, engagement rate anomalies
Meta-network signals correlated with Instagram for cross-platform analysis
News source network: In addition to social platforms, Rolli IQ monitors a curated network of 120,000+ news and media sources. This layer provides narrative origin context — identifying when social activity is amplifying news-driven narratives versus when social activity is preceding news coverage, which is a key indicator of coordinated injection.
How the authenticity model is calibrated
Authenticity scoring is calibrated against a ground-truth dataset of 8.4 million known authentic and inauthentic accounts, assembled from platform enforcement disclosures (Meta, Twitter/X, Google), academic CIB datasets, and Rolli's own documented case history. The calibration dataset is updated quarterly to reflect evolving coordination tactics.
The four signal families — velocity & timing, account behavior, network structure, and content & language — each contribute weighted inputs that are dynamically adjusted based on the platform context and narrative type. A hashtag campaign on X is scored with different weight configurations than a cross-platform content seeding operation, because the behavioral signatures of different coordination tactics are not identical across contexts. The multi-signal ensemble approach means that no single signal can produce a false positive in isolation — convergence across families is required to drive a low authenticity score.
Validation
Peer-reviewable results your leadership can defend
Rolli IQ's detection methodology has been evaluated against independent academic datasets and reviewed by researchers at leading institutions studying the information environment.
In Rolli IQ internal validation, Rolli's detection model achieved 94.2% precision on coordinated inauthentic behavior detection — meaning 94.2% of clusters flagged as coordinated were confirmed as coordinated by ground-truth labels.
The same evaluation achieved 91.7% recall — meaning Rolli's model identified 91.7% of all confirmed coordinated clusters in the dataset, with 8.3% missed (false negatives). This tradeoff is calibrated to minimize false positives at the cost of some false negatives.
External review
Rolli's methodology is aligned with frameworks used by leading research institutions studying coordinated inauthentic behavior. We welcome scrutiny from the research community — contact research@rolli.ai to discuss methodology or request documentation.
Transparency
Honest documentation of what Rolli IQ cannot do is as important as documenting what it can. We publish our limitations publicly because responsible deployment requires users to understand the boundaries of any analytical tool.
Public content only
Rolli IQ monitors publicly accessible social media content only. We do not access private messages, closed groups, direct messages, or any non-public content. This is a deliberate design constraint — not a technical limitation. The intelligence we provide is fully reproducible from public sources.
Language coverage
Our models are optimized for English-language content. Spanish and French are in beta, with accuracy levels below our English-language benchmarks. Arabic, Mandarin, Russian, and German are on the development roadmap. For non-English campaigns, we recommend treating scores as directional indicators and applying human review.
Probabilistic, not deterministic
Authenticity scoring is probabilistic — it estimates the probability that observed behavior is organic, not coordinated. Scores in the 30–70 range represent genuine ambiguity where behavioral evidence is mixed. Human expert review is strongly recommended before making high-stakes decisions based on scores in this range.
Novel coordination tactics
The calibration dataset and model are updated quarterly, but sophisticated actors continuously evolve their tactics. Novel coordination techniques that differ significantly from documented patterns may initially receive higher authenticity scores until the pattern is characterized and the model is updated. Rolli's human analyst team monitors for emerging tactics as a first-line detection layer.
Platform access constraints
Signal coverage depends on what data is made available by each platform through official APIs and public-facing access. Changes to platform API policies can affect signal availability. In the event of a platform access change that materially affects coverage quality, we notify customers and update our public methodology documentation.
Step-by-step guide
How Rolli Detects Coordinated Inauthentic Behavior
From raw signal ingestion to delivered intelligence brief — the complete 8-step detection pipeline that runs on every narrative Rolli IQ monitors.
Signal Ingestion
Every 15 minutesRolli collects posts, engagement data, and account metadata from 8 platforms — X, Reddit, YouTube, Facebook, Instagram, Threads, Bluesky, and LinkedIn. Each signal is normalized into a unified behavioral schema for cross-platform comparison.
Account Profiling
Real-time per accountEach account is scored on 14 behavioral signals including posting cadence, network clustering, and content repetition. The resulting behavioral fingerprint is updated with each new signal received.
Authenticity Scoring
Real-time, continuously updatedAccounts below 40/100 on the authenticity scale are flagged as likely inauthentic. Scores above 70 indicate predominantly organic behavior. The 30–70 band surfaces for analyst review before any escalation recommendation is made.
Narrative Clustering
Every signal cycleNLP models group posts by semantic similarity to identify coordinated messaging patterns. Posts that share vocabulary, framing, and rhetorical structure across nominally independent accounts are grouped into coordination candidate clusters.
Velocity Measurement
Compared to 30-day baselineSpread rate is calculated against a rolling 30-day baseline for each narrative topic. A rate 3x above baseline or higher triggers an alert. Organic viral events typically show gradual velocity ramps; coordinated injection events show near-instantaneous spikes.
Coordination Detection
Per cluster, continuouslyAccount clusters amplifying the same narrative within tight time windows are flagged as coordinated. The coordination confidence score reflects the density and timing synchrony of shared amplification — distinguishing genuine fan communities from manufactured networks.
Origin Attribution
After coordination confirmedThe earliest accounts in the amplification network are identified as likely origin nodes. This temporal analysis gives analysts a starting point for further investigation and documents the seeding pathway for the intelligence record.
Brief Generation
On-demand or automatedA structured intelligence brief is generated with key findings, evidence, a coordination confidence score, and recommended actions. The brief is formatted for direct stakeholder delivery or integration into existing crisis communications workflows.
Questions about methodology?
Research teams, journalists, and procurement teams with methodology questions can reach us directly. We publish our approach publicly because auditability is part of responsible deployment.