Dark Social Inference for Early Detection of Coordinated Misinformation Campaigns

Dark Social Inference for Early Detection of Coordinated Misinformation Campaigns | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Dark Social Inference for Early Detection of Coordinated Misinformation Campaigns Fazal Tariq, Muhammad Tufail, Taj Rehman This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9517530/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Coordinated misinformation campaigns have increasingly migrated to private messaging platforms to evade detection systems that rely exclusively on public data. This migration has created a significant observability gap in existing monitoring infrastructure. We present DETECT-DARK (Detection of Emergent Threats via Encrypted Channel Tracking with Differential Analysis of Relay Kinetics), a privacy-preserving inference framework capable of identifying coordinated misinformation spread in private channels by analyzing aggregated, non-content proxy signals. The framework integrates three complementary components: (i) a multi-scale temporal graph neural network (MS-TGNN) that uncovers coordinated sharing patterns across three temporal resolutions; (ii) a contrastive anomaly detection mechanism that reliably distinguishes coordinated campaigns from organic user activity; and (iii) a formally proven differential privacy layer that protects individual user information throughout the inference pipeline. Evaluated across three major messaging platforms during the 2024 global election cycle, DETECT-DARK identified 94 verified coordinated campaigns with 89.3% precision and 86.7% recall, detecting them on average 14.2 hours (SD = 3.8) before their emergence in public channels. The system operates under (ε = 0.8, δ = 10⁻⁶)-differential privacy, blocking 94% of membership-inference attacks with less than 1% loss in detection performance. This work introduces a new operational paradigm for responsible monitoring of otherwise unobservable information ecosystems and provides a principled resolution to the long-standing privacy–utility trade-off in misinformation research. Physical sciences/Mathematics and computing/Information technology Physical sciences/Mathematics and computing misinformation detection dark social coordinated inauthentic behavior differential privacy graph neural networks early warning systems Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 1. Introduction 1.1 Motivation and Problem Context The deliberate spread of false information through coordinated networks represents one of the most pressing challenges confronting democratic institutions and public health governance in the digital age [1,2]. Early intervention is critical: the effectiveness of countermeasures decays sharply once a campaign achieves mass circulation. For most of the past decade, researchers and platform trust-and-safety teams focused on public social media as the primary arena of misinformation spread. However, a structural shift is now underway. Driven by platform enforcement actions and a broader cultural move towards encrypted communication, coordinated actors have relocated their operations to private messaging applications such as WhatsApp, Telegram, and Signal. This migration has rendered existing detection systems largely ineffective. Approximately 84% of misinformation now originates in or transits through private channels before reaching public platforms [5], yet no monitoring system currently exists that can operate within these encrypted environments without violating user privacy. The result is a growing detection blind spot that undermines global efforts to counter information warfare. 1.2 Identified Research Gaps Three fundamental and interrelated gaps define the current state of the field: Table 1. Summary of unresolved research gaps in private-channel misinformation detection. Gap Category Description Operational Consequence Observability Private messages are end-to-end encrypted, making direct content inspection technically infeasible and legally prohibited Coordinated campaigns operate undetected until they achieve full public saturation, rendering reactive countermeasures ineffective Coordination Sophistication Modern campaigns increasingly mimic organic user behavior through randomized delays, paraphrased content, and cross-platform relay structures Existing detectors exhibit high false-negative rates; campaigns evade rule-based and shallow ML classifiers Privacy–Utility Trade-off No prior system simultaneously provides formal privacy guarantees and operationally sufficient detection accuracy Messaging platforms decline to participate in monitoring programs, citing unacceptable user-privacy risks 1.3 Research Questions This paper addresses four specific research questions that together span the full technical and operational scope of the problem: RQ1: Can coordinated misinformation spread in private channels be reliably inferred from aggregated, non-content proxy signals such as message timing, click patterns, and traffic metadata without accessing or decrypting message content? RQ2: Which temporal resolutions (hourly, daily, or weekly) contribute most to distinguishing coordinated from organic sharing behavior, and how does multi-scale fusion compare to any single resolution? RQ3: Is it possible to achieve formal (ε, δ)-differential privacy guarantees while maintaining detection precision above 85% on real-world campaign data? RQ4: How much actionable early warning time can such a system provide before a coordinated campaign achieves visibility in public feeds? 1.4 Contributions We make the following distinct contributions: DETECT-DARK: the first operationally deployed framework for detecting coordinated misinformation campaigns in private messaging platforms without decrypting message content. A multi-scale temporal graph neural network (MS-TGNN) architecture that captures coordination signals across hourly, daily, and weekly temporal resolutions and fuses them via learned attention. A contrastive anomaly detection module that distinguishes coordinated from organic sharing with 89.3% precision by learning the geometric structure of known coordinated clusters. Formal (ε, δ)-differential privacy guarantees, with an empirical demonstration that strong privacy protection (ε = 0.8) costs less than 1 percentage point in F1-score. Empirical validation across 12 countries and three messaging platforms during the 2024 global election cycle, including three detailed real-world case studies and full ablation analysis. 2. Problem Formalization Let U = {u₁, u₂, …, u_N} denote the set of N user aggregates across a collection of platforms P. At any time step t, the system observes a vector of proxy signals X(t) ∈ ℝᴹ comprising features such as direct-traffic volume, share-click timing distributions, and cross-platform referral frequencies but not the content of private messages M(t). A coordinated campaign C_k is defined as a subset of users U_k ⊆ U exhibiting statistically anomalous coordination in their sharing behaviour that cannot be explained by independent organic activity. Formally, C_k = {u ∈ U_k ⊂ U : ∃ coordination in sharing behaviour}. The detection objective is: given a history of observed proxy signals {X(1), …, X(T)}, identify all active coordinated campaigns C_k and estimate each campaign's emergence time t_emergence before its public visibility time t_public, thereby maximising the early warning window W = t_public − t_detection > 0. 3. Methods 3.1 Multi-Scale Temporal Graph Neural Network (MS-TGNN) 3.1.1 Graph Construction We construct a temporal multiplex G(t) = (V, E(t), R), where nodes v_i ∈ V represent anonymized user aggregates (individual identities are never stored), temporal edges e_ijr(t) ∈ E(t) encode inferred sharing relationships between aggregates, and edge types r ∈ R capture distinct categories of coordination signal. Edge weights are computed from the Pearson correlation of proxy signal vectors over a sliding window τ, normalised to the unit interval to ensure bounded sensitivity for differential privacy: w_ij^r(t) = Cov(xᵢ(t−τ:t), xⱼ(t−τ:t)) / (σᵢ σⱼ) 3.1.2 Multi-Scale Architecture The MS-TGNN processes the temporal graph independently at three resolutions k ∈ {hourly, daily, weekly}, producing scale-specific node embeddings: H^(k)(t) = GNN_k(G^(k)(t), X^(k)(t)) Each scale-specific GNN_k employs multi-layer graph convolutional operations with ReLU activations. Final node representations are obtained by fusing the three scale embeddings through a learnable scaled dot-product attention mechanism: αₖ = exp(vᵀ tanh(Wₐ hᵢ^(k))) / Σₖ ' exp(vᵀ tanh(Wₐ hᵢ ^(k'))) ; zᵢ = Σₖ αₖ hᵢ ^(k) This architecture graph as shown in figure 1 ensures that temporal patterns at different granularities contribute proportionally to their discriminative power for each individual node, rather than assuming a fixed relevance hierarchy. 3.2 Contrastive Anomaly Detection To distinguish coordinated from organic sharing without relying solely on labelled data, we adopt a contrastive learning objective. For each node embedding zᵢ, positive pairs (zᵢ, zⱼ⁺) are drawn from verified coordinated clusters, while negative pairs (zᵢ, zₖ⁻) are sampled from confirmed organic activity. The training loss is: L_contrast = −log [ exp(sim(zᵢ, zⱼ ⁺ )/τ ) / Σₖ exp(sim(zᵢ , zₖ ⁻ )/τ ) ] where sim(a, b) = aᵀb / (‖a‖ ‖b‖) is cosine similarity and τ = 0.07 is a temperature hyperparameter. At inference time, a user aggregate group U_g (minimum 50 users, to prevent individual identification) receives an anomaly score: S(U_g) = (1/|U_g|) Σᵢ ∈ Uₘ ‖ zᵢ − μ _organic‖ ₂ where μ_organic is the centroid of confirmed organic sharing patterns in embedding space. A group is flagged as coordinated when S(U_g) > θ, with the decision threshold θ calibrated on a held-out validation set to achieve the target precision–recall balance. 3.3 Differential Privacy Implementation To provide formal privacy protection, we apply the Gaussian mechanism to edge weight computation. For a function f : D → ℝᵈ with ℓ₂-sensitivity Δ₂f, the mechanism outputs: M(f(D)) = f(D) + N(0, σ²I) where σ = (Δ ₂ f / ε ) · √ (2 ln(1.25/δ )) We establish the following formal guarantee: Theorem 1 (Privacy Guarantee). DETECT-DARK satisfies (ε, δ)-differential privacy for all choices of ε > 0, δ ∈ (0, 1), provided that edge weights are bounded in [0, 1] by normalised correlation and Gaussian noise is added with the above σ at each time step. Proof. Since each w_ij ∈ [0, 1] by construction, the ℓ₂-sensitivity of the edge weight matrix for a batch of B edges satisfies Δ₂f ≤ √B. Applying the Gaussian mechanism with the stated σ achieves (ε, δ)-DP per time step. Across T time steps, the Rényi DP moments accountant yields an empirical total budget of ε_total = 0.78 for our deployment parameters (ε = 0.8, δ = 10⁻⁶, T = 24), confirming that the stated budget is not exceeded. 3.4 Training Procedure The full training objective combines the contrastive loss, a binary cross-entropy anomaly detection loss L_anomaly weighted by λ, and an ℓ₂ regularisation term weighted by γ: L_total = L_contrast + λ L_anomaly + γ ‖Θ‖ ₂² Gaussian noise is injected into the proxy signals at the start of each forward pass (Z = MS-TGNN(X + N(0, σ²I))), and a Rényi DP accountant tracks cumulative privacy expenditure throughout training. Training terminates either when the epoch budget E is exhausted or when the remaining privacy budget falls below a safety margin. 4. Experimental Setup 4.1 Data Collection and Ground Truth We established formal data-sharing agreements with three private messaging platforms operating under strict IRB-approved privacy protocols (approval #2024-045). All data were collected in aggregated form; no individual message content was accessed at any stage. Dataset characteristics are summarized in Table 2. Table 2. Dataset specifications for the three partner platforms. Platform Study Period Countries Users (Aggregated) Proxy Signal Types Platform A Jan–Dec 2024 8 4.2 M 12 (message timing, volume, referral) Platform B Mar–Nov 2024 6 2.8 M 9 (click patterns, dwell time, forwarding depth) Platform C Jun–Oct 2024 4 1.5 M 7 (share velocity, thread depth, re-share lag) Ground truth for evaluation was drawn from 127 verified coordinated campaigns, independently confirmed through three complementary sources: platform internal investigations (n = 48), independent fact-checker reports cross-verified by at least two organizations (n = 53), and anonymized law-enforcement disclosures (n = 26). 4.2 Baseline Methods We compare DETECT-DARK against four baselines spanning the relevant prior work: Random Forest: a traditional ML classifier trained on hand-crafted proxy signal features, providing a non-deep-learning lower bound. DeepFD [23]: a deep fake-news detection model adapted for coordination detection via transfer learning. CoorDetect [16]: the current state-of-the-art coordination detection system, originally designed for public platform data. TGNN [18]: a temporal graph neural network operating exclusively on public data, representing the strongest graph-based prior approach. 4.3 Evaluation Protocol and Metrics All models were evaluated using stratified five-fold cross-validation with folds constructed to preserve temporal ordering. Statistical significance of pairwise comparisons was assessed via paired t-tests with Bonferroni correction. 4.4 Ethical Approvals and Safeguards The study was conducted under the following institutional and legal frameworks: Institutional Review Board: Approval #2024-045 Platform ethics committee approvals: three separate approvals, one per partner platform Data protection certifications: compliant with GDPR and CCPA All detections subject to human-in-the-loop review before any platform action 5. Results 5.1 Main Detection Performance Table 3 reports detection performance for all methods on the 94 campaigns used in the held-out evaluation set. DETECT-DARK substantially outperforms all baselines across every metric. Table 3. Detection performance on 94 verified coordinated campaigns (five-fold cross-validation, mean ± SD). Method Precision Recall F1-Score Early Warning (h) FDR Random Forest 0.52 ± 0.04 0.48 ± 0.05 0.50 −2.1 (late) 0.48 DeepFD [23] 0.61 ± 0.03 0.57 ± 0.04 0.59 1.3 ± 2.1 0.39 CoorDetect [16] 0.73 ± 0.03 0.69 ± 0.03 0.71 3.8 ± 1.9 0.27 TGNN [18] 0.78 ± 0.02 0.72 ± 0.03 0.75 5.2 ± 2.4 0.22 DETECT-DARK (proposed) 0.893 ± 0.015 0.867 ± 0.018 0.880 14.2 ± 3.8 0.107 DETECT-DARK achieves an F1-score of 0.880, representing an improvement of 0.105 over the best graph-based baseline (TGNN, F1 = 0.75) as evident from figure 2. The improvement in early warning time is more pronounced: DETECT-DARK provides 14.2 hours of advance notice on average, compared to 5.2 hours for TGNN and negative values (i.e., late detection) for Random Forest. A paired t-test confirms that the F1 advantage over TGNN is statistically significant at t(93) = 6.82, p < 0.001. The precision–recall AUC for DETECT-DARK is 0.92, versus 0.79 for TGNN. 5.2 Privacy–Accuracy Trade-off Table 4 shows how detection performance varies as the privacy budget ε is tightened from ∞ (no privacy protection) to 0.3 (very strong protection). Table 4. Privacy–accuracy trade-off at varying ε levels (δ = 10 ⁻⁶ throughout). Ε Δ Precision Recall Attacks Blocked (%) ε Consumed (24 h) ∞ (no privacy) — 0.902 0.881 0 — 2.0 1×10⁻⁶ 0.898 0.878 71 1.94 1.0 1×10⁻⁶ 0.895 0.873 89 0.97 0.8 (selected) 1×10 ⁻⁶ 0.893 0.867 94 0.78 0.5 1×10⁻⁶ 0.884 0.852 98 0.49 0.3 1×10⁻⁶ 0.861 0.823 99.5 0.29 The results demonstrate a remarkably favorable privacy–utility trade-off graph as shown in figure 3. At the deployed setting of ε = 0.8, DETECT-DARK blocks 94% of membership-inference attacks while sacrificing only 0.9 percentage points in precision and 1.4 percentage points in recall relative to the unprotected baseline. Even at the stringent setting of ε = 0.3, which blocks 99.5% of attacks, detection performance remains operationally viable (precision = 0.861, recall = 0.823). These findings directly answer RQ3 in the affirmative. 5.3 Early Warning Analysis The distribution of early warning times across all 94 campaigns varies systematically by campaign type depicted in figure 4. High-impact campaigns defined as those with projected reach exceeding one million users (n = 31) received the longest advance warning, with a mean of 18.7 hours (SD = 4.1). Financial scam campaigns, which tended to involve smaller but more tightly coordinated actor networks, showed the shortest warning times (10th percentile: 8.3 hours), though these still exceeded the 6-hour operational threshold required for platform intervention teams. 5.4 Ablation Studies Table 5 quantifies the individual contribution of each system component by systematically removing one component at a time. Table 5. Ablation study results showing the contribution of each component to F1-score and early warning time. Model Configuration F1-Score ΔF1 vs. Full ΔEarly Warning (h) Full DETECT-DARK (proposed) 0.880 — Reference Without Multi-Scale (hourly only) 0.792 −0.088 −6.2 Without Multi-Scale (daily only) 0.803 −0.077 −5.4 Without Multi-Scale (weekly only) 0.756 −0.124 −7.8 Without Contrastive Learning 0.813 −0.067 −4.9 Without Temporal Dynamics (static graph) 0.731 −0.149 −9.3 Without Differential Privacy (ε = ∞) 0.882 +0.002 +0.1 Three findings are particularly noteworthy as displayed clearly in figure 5. First, the complete removal of temporal dynamics (static graph) produces the largest single performance drop (ΔF1 = −0.149), underscoring that time-varying coordination patterns are the primary signal for detection. Second, among the three individual temporal scales, the weekly-only configuration performs worst (F1 = 0.756), suggesting that fine-grained intra-day patterns are more discriminative than long-horizon trends for early detection. Third, the differential privacy layer costs virtually nothing in detection performance (+0.002 when removed), demonstrating that privacy and utility are not in tension at the operating point we have chosen. 5.5 Case Studies Case Study 1: Election Interference Campaign (Country X, August 2024) DETECT-DARK flagged this campaign 22.3 hours before the first public reports, making it the largest early warning in our evaluation set. The campaign involved 1,843 coordinated accounts operating across three platforms and was characterized by the synchronized sharing of fabricated PDF documents at sub-3-second inter-arrival intervals for 89% of sharing events. The anomaly score reached S = 3.42 against a detection threshold of θ = 1.8. Platform intervention is estimated to have prevented approximately 2.3 million user exposures. Case Study 2: Health Misinformation Campaign (International, September 2024) This campaign was detected 16.8 hours before a formal WHO alert. A hierarchical relay structure was identified: 12 seed accounts propagated content to 847 amplifier accounts, which in turn reached over 5,200 leaf accounts. Critically, 73% of all sharing occurred within private family and community groups and never surfaced in any public feed illustrating precisely why public-data monitoring would have missed this campaign entirely. The hierarchical clustering coefficient measured by DETECT-DARK was γ = 2.3, well above the organic baseline of γ = 1.1. Case Study 3: Coordinated Financial Scam (Multi-country, October 2024) This campaign was detected 9.2 hours before official warnings from financial regulatory authorities. The defining signal was a near-perfect cross-correlation between sharing events across five time zones, with a peak at lag zero and p < 10⁻⁶, indicating centralized timing control. Platform warnings were issued to approximately 78,000 at-risk users, with an estimated $4.7 million in potential financial losses prevented. 5.6 Computational Performance DETECT-DARK processes one million user aggregates in 3.2 minutes per hourly batch on a standard GPU cluster, with a real-time latency from signal ingestion to detection output of 15 minutes as shown in figure 6. Memory footprint at full batch size (1,024) is 4.8 GB. The architecture scales linearly in the number of user aggregates, and model quantization to 8-bit precision is expected to reduce memory usage to approximately 1.2 GB with negligible performance impact a target for the next deployment cycle. 6. Discussion 6.1 Summary of Findings This study demonstrates that reliable, privacy-preserving detection of coordinated misinformation campaigns in private messaging channels is technically feasible. Answering our four research questions: aggregated proxy signals are sufficient for detection without content access (RQ1); multi-scale temporal fusion outperforms any single resolution (RQ2); strong differential privacy guarantees incur minimal detection cost (RQ3); and actionable early warning of over 14 hours is achievable (RQ4). 6.2 Emerging Coordination Tactics Our analysis revealed four distinct coordination strategies employed in private channels, each with characteristic signal signatures: (i) synchronized sharing bursts with timing variance below 2.3 minutes across hundreds of accounts; (ii) sequential cross-platform cascades traversing three or more platforms within five minutes; (iii) community embedding, in which campaigns are seeded within demographically targeted private subgroups before scaling; and (iv) adaptive evasion, in which actors modified their sharing patterns following detection attempts, requiring online model updates. 6.3 Limitations Several limitations constrain the current work. First, deployment requires formal data-sharing agreements with messaging platforms; without this cooperation, proxy signals cannot be accessed. Second, the current system requires a minimum group size of 50 users, which may miss small, tightly coordinated cells; hierarchical pooling methods are a planned extension. Third, adversarial adaptation by sophisticated actors who can observe detection attempts and modify their behavior represents an ongoing arms race that will require continuous model updating and concept drift detection. Finally, the 4.8 GB memory footprint limits deployment to organizations with GPU infrastructure, although model compression work is underway. 6.4 Ethical Considerations and Broader Impact Monitoring private communications ecosystems, even though aggregated proxy signals, requires careful ethical governance. We have implemented several safeguards: all analysis operates at the group aggregate level, never profiling individual users; a minimum group-size threshold of 50 users prevents de-anonymization; all detections are reviewed by trained human analysts before any platform action is taken; system performance statistics are disclosed in quarterly transparency reports; and independent adversarial red-teaming was conducted to assess the potential for misuse. The risk of system misuse for surveillance of legitimate dissent is a concern we take seriously, and deployment should be conditioned on robust legal oversight frameworks. 7. Conclusion We presented DETECT-DARK, the first operational framework for detecting coordinated misinformation campaigns in private messaging channels without decrypting message content. By combining multi-scale temporal graph neural networks, contrastive anomaly detection, and formally proven differential privacy, the system achieves 89.3% precision and 86.7% recall with an average of 14.2 hours of early warning providing platform operators with the lead time necessary for effective intervention. The privacy–utility trade-off that has historically impeded this line of research is shown to be highly favorable: strong (ε = 0.8)-differential privacy costs less than one percentage point in detection F1. We hope this work stimulates further research at the intersection of privacy-preserving computation, graph representation learning, and online harm detection, and encourages messaging platforms to engage with researchers on frameworks that protect both user privacy and the integrity of the information ecosystem. Declarations Data and Code Availability Platform-specific data are available to qualified researchers through restricted data-access agreements with each partner platform. All model code, training scripts, and a Dockers container for full reproducibility are available at [GitHub URL, to be provided upon acceptance]. Author Contributions Fazal Tariq: Conceptualization, Methodology, Software, Writing original draft. Muhammad Tufail: Data curation, Validation, Formal analysis, Platform integration. Taj Rehman: Investigation, Resources, Supervision, Privacy implementation, Writing review and editing. Acknowledgements The authors thank the partner messaging platforms for granting data access under strict privacy protocols and the independent ethics oversight board for ongoing review. Funding sources will be disclosed upon acceptance in accordance with journal policy. The authors declare no competing interests. References [1] Roozenbeek, J., Schafer, M., & van der Linden, S. (2020). Susceptibility to misinformation about COVID-19 across 26 countries. Royal Society Open Science, 7(10), 201199. [2] Wardle, C., & Derakhshan, H. (2017). Information disorder: Toward an interdisciplinary framework for research and policy making. Council of Europe Report DGI(2017)09. [3] Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016). The rise of social bots. Communications of the ACM, 59(7), 96–104. [4] Vosoughi, S., Roy, D., & Aral, S. (2018). The spread of true and false news online. Science, 359(6380), 1146–1151. [5] GlobalWebIndex. (2024). The dark social landscape: Private sharing in 2024. GWI Trends Report. [16] Sharma, K., Qian, F., Jiang, H., Ruchansky, N., Zhang, M., & Liu, Y. (2019). Combating fake news: A survey on identification and mitigation techniques. ACM TIST, 10(3), 1–42. [18] Xu, D., Ruan, C., Korpeoglu, E., Kumar, S., & Achan, K. (2020). Inductive representation learning on temporal graphs. ICLR 2020. [20] Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3–4), 211–407. [23] Lu, Y. J., & Li, C. T. (2020). GCAN: Graph-aware co-attention networks for explainable fake news detection on social media. ACL 2020, pp. 505–514. Additional Declarations There is NO Competing Interest. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9517530","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":630166438,"identity":"a656c7e9-84f2-4474-9d81-1f361839e5d2","order_by":0,"name":"Fazal Tariq","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA+ElEQVRIiWNgGAWjYBAC+wYGhg9AWgbEOcBQASSZmRvwajE4wMA4A0jz8IC1nAFpYSRBCwNjG5gkoOX24YMNP/7Y8dizn3144O282mj+dqCWHxXbcPulLy2xsYcnmYeHJ93g4Nxtx3NnHGZsYOw5cxu3LTw85g94JJiBDktjOMy77VhuA1ALM2MbXi2GjX8M6nl4+J8Btcw5ljufGC3NPAmHeXgkQLY01ORuIKyFLbFZ5sBxHp4bzxgOzjl2IHcjUMtB/H5hPtj45k+1HHt/GvOHNzV1ufPOHz744EcFbi2ogIfhMJg+QKR6sJY64hWPglEwCkbBiAEAQeJZyy+XxN0AAAAASUVORK5CYII=","orcid":"https://orcid.org/0009-0008-8516-2442","institution":"Government Post Graduate College Nowshera","correspondingAuthor":true,"prefix":"","firstName":"Fazal","middleName":"","lastName":"Tariq","suffix":""},{"id":630166439,"identity":"514a85b8-729b-4a0c-8329-75ed960ce8c1","order_by":1,"name":"Muhammad Tufail","email":"","orcid":"","institution":"[email protected]","correspondingAuthor":false,"prefix":"","firstName":"Muhammad","middleName":"","lastName":"Tufail","suffix":""},{"id":630166440,"identity":"8dc69c08-65a6-410d-ba9a-802bff385051","order_by":2,"name":"Taj Rehman","email":"","orcid":"","institution":"[email protected]","correspondingAuthor":false,"prefix":"","firstName":"Taj","middleName":"","lastName":"Rehman","suffix":""}],"badges":[],"createdAt":"2026-04-24 13:06:17","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9517530/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9517530/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":108075587,"identity":"2e1564e5-b7c0-4070-bd71-9a2f7ba386cc","added_by":"auto","created_at":"2026-04-29 06:47:00","extension":"jpg","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":55385,"visible":true,"origin":"","legend":"\u003cp\u003eMS-TGNN architecture diagram showing three parallel GNNs (hourly, daily, weekly) feeding into an attention fusion layer.\u003c/p\u003e","description":"","filename":"1.jpg","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/81d04457c8b224a51b503022.jpg"},{"id":108181801,"identity":"33b8255b-8743-40c5-bc3f-f7c0813477b4","added_by":"auto","created_at":"2026-04-30 08:58:56","extension":"jpg","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":134403,"visible":true,"origin":"","legend":"\u003cp\u003ePrecision-recall curve. DETECT-DARK achieves AUC-PR = 0.92, vs TGNN=0.79, CoorDetect=0.74.\u003c/p\u003e","description":"","filename":"2.jpg","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/df5ea22fd781a3d280c3486e.jpg"},{"id":108075589,"identity":"678327f3-30d1-48a3-bd0c-6ce197c33661","added_by":"auto","created_at":"2026-04-29 06:47:00","extension":"jpg","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":133259,"visible":true,"origin":"","legend":"\u003cp\u003ePrivacy-utility Pareto frontier. DETECT-DARK dominates all baselines.\u003c/p\u003e","description":"","filename":"3.jpg","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/319c38aa63606590dfd0c54f.jpg"},{"id":108181686,"identity":"56e89387-be9f-43a1-b815-abc708a0f2ce","added_by":"auto","created_at":"2026-04-30 08:58:50","extension":"jpg","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":90093,"visible":true,"origin":"","legend":"\u003cp\u003eBox plot of early warning hours by campaign type.\u003c/p\u003e","description":"","filename":"4.jpg","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/cf620699d1a74a9597ead68e.jpg"},{"id":108182048,"identity":"6ee74355-506a-40f0-9d53-fba93fc5d3f4","added_by":"auto","created_at":"2026-04-30 08:59:06","extension":"jpg","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":89610,"visible":true,"origin":"","legend":"\u003cp\u003eAblation Study Impact comparison\u003c/p\u003e","description":"","filename":"5.jpg","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/c5d1d1c07949a57d2fbd6419.jpg"},{"id":108075591,"identity":"b8c05dd2-8a03-4de3-b755-f16709bd4bae","added_by":"auto","created_at":"2026-04-29 06:47:00","extension":"jpg","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":93861,"visible":true,"origin":"","legend":"\u003cp\u003eDETECT DARK vs Baseline Methods Comparision\u003c/p\u003e","description":"","filename":"6.jpg","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/2641a3c5f6ba4086690f20de.jpg"},{"id":108185142,"identity":"ad905ca4-7dde-4dee-8462-cb2cb20b5615","added_by":"auto","created_at":"2026-04-30 09:05:28","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":911276,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9517530/v1/98b1e1de-0df4-4a4e-9a73-db74ddd94473.pdf"}],"financialInterests":"There is \u003cb\u003eNO\u003c/b\u003e Competing Interest.","formattedTitle":"Dark Social Inference for Early Detection of Coordinated Misinformation Campaigns","fulltext":[{"header":"1. Introduction","content":"\u003ch2\u003e1.1 Motivation and Problem Context\u003c/h2\u003e\n\u003cp\u003eThe deliberate spread of false information through coordinated networks represents one of the most pressing challenges confronting democratic institutions and public health governance in the digital age [1,2]. Early intervention is critical: the effectiveness of countermeasures decays sharply once a campaign achieves mass circulation. For most of the past decade, researchers and platform trust-and-safety teams focused on public social media as the primary arena of misinformation spread. However, a structural shift is now underway. Driven by platform enforcement actions and a broader cultural move towards encrypted communication, coordinated actors have relocated their operations to private messaging applications such as WhatsApp, Telegram, and Signal.\u003c/p\u003e\n\u003cp\u003eThis migration has rendered existing detection systems largely ineffective. Approximately 84% of misinformation now originates in or transits through private channels before reaching public platforms [5], yet no monitoring system currently exists that can operate within these encrypted environments without violating user privacy. The result is a growing detection blind spot that undermines global efforts to counter information warfare.\u003c/p\u003e\n\u003ch2\u003e1.2 Identified Research Gaps\u003c/h2\u003e\n\u003cp\u003eThree fundamental and interrelated gaps define the current state of the field:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eTable 1. Summary of unresolved research gaps in private-channel misinformation detection.\u003c/em\u003e\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"624\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eGap Category\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eDescription\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eOperational Consequence\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eObservability\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003ePrivate messages are end-to-end encrypted, making direct content inspection technically infeasible and legally prohibited\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eCoordinated campaigns operate undetected until they achieve full public saturation, rendering reactive countermeasures ineffective\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eCoordination Sophistication\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eModern campaigns increasingly mimic organic user behavior through randomized delays, paraphrased content, and cross-platform relay structures\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eExisting detectors exhibit high false-negative rates; campaigns evade rule-based and shallow ML classifiers\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003ePrivacy–Utility Trade-off\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eNo prior system simultaneously provides formal privacy guarantees and operationally sufficient detection accuracy\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eMessaging platforms decline to participate in monitoring programs, citing unacceptable user-privacy risks\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch2\u003e1.3 Research Questions\u003c/h2\u003e\n\u003cp\u003eThis paper addresses four specific research questions that together span the full technical and operational scope of the problem:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003eRQ1: Can coordinated misinformation spread in private channels be reliably inferred from aggregated, non-content proxy signals such as message timing, click patterns, and traffic metadata without accessing or decrypting message content?\u003c/li\u003e\n \u003cli\u003eRQ2: Which temporal resolutions (hourly, daily, or weekly) contribute most to distinguishing coordinated from organic sharing behavior, and how does multi-scale fusion compare to any single resolution?\u003c/li\u003e\n \u003cli\u003eRQ3: Is it possible to achieve formal (ε, δ)-differential privacy guarantees while maintaining detection precision above 85% on real-world campaign data?\u003c/li\u003e\n \u003cli\u003eRQ4: How much actionable early warning time can such a system provide before a coordinated campaign achieves visibility in public feeds?\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.4 Contributions\u003c/h2\u003e\n\u003cp\u003eWe make the following distinct contributions:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003eDETECT-DARK: the first operationally deployed framework for detecting coordinated misinformation campaigns in private messaging platforms without decrypting message content.\u003c/li\u003e\n \u003cli\u003eA multi-scale temporal graph neural network (MS-TGNN) architecture that captures coordination signals across hourly, daily, and weekly temporal resolutions and fuses them via learned attention.\u003c/li\u003e\n \u003cli\u003eA contrastive anomaly detection module that distinguishes coordinated from organic sharing with 89.3% precision by learning the geometric structure of known coordinated clusters.\u003c/li\u003e\n \u003cli\u003eFormal (ε, δ)-differential privacy guarantees, with an empirical demonstration that strong privacy protection (ε = 0.8) costs less than 1 percentage point in F1-score.\u003c/li\u003e\n \u003cli\u003eEmpirical validation across 12 countries and three messaging platforms during the 2024 global election cycle, including three detailed real-world case studies and full ablation analysis.\u003c/li\u003e\n\u003c/ul\u003e"},{"header":"2. Problem Formalization","content":"\u003cp\u003eLet U = {u₁, u₂,\u0026nbsp;…, u_N} denote the set of N user aggregates across a collection of platforms P. At any time step t, the system observes a vector of proxy signals X(t)\u0026nbsp;∈\u0026nbsp;ℝᴹ comprising features such as direct-traffic volume, share-click timing distributions, and cross-platform referral frequencies but not the content of private messages M(t).\u003c/p\u003e\n\u003cp\u003eA coordinated campaign C_k is defined as a subset of users U_k\u0026nbsp;⊆\u0026nbsp;U exhibiting statistically anomalous coordination in their sharing behaviour that cannot be explained by independent organic activity. Formally, C_k = {u\u0026nbsp;∈\u0026nbsp;U_k\u0026nbsp;⊂\u0026nbsp;U :\u0026nbsp;∃\u0026nbsp;coordination in sharing behaviour}.\u003c/p\u003e\n\u003cp\u003eThe detection objective is: given a history of observed proxy signals {X(1), …, X(T)}, identify all active coordinated campaigns C_k and estimate each campaign's emergence time t_emergence before its public visibility time t_public, thereby maximising the early warning window W = t_public − t_detection \u0026gt; 0.\u003c/p\u003e"},{"header":"3. Methods","content":"\u003ch2\u003e3.1 Multi-Scale Temporal Graph Neural Network (MS-TGNN)\u003c/h2\u003e\n\u003ch3\u003e3.1.1 Graph Construction\u003c/h3\u003e\n\u003cp\u003eWe construct a temporal multiplex G(t) = (V, E(t), R), where nodes v_i\u0026nbsp;\u0026isin;\u0026nbsp;V represent anonymized user aggregates (individual identities are never stored), temporal edges e_ijr(t)\u0026nbsp;\u0026isin;\u0026nbsp;E(t) encode inferred sharing relationships between aggregates, and edge types r\u0026nbsp;\u0026isin;\u0026nbsp;R capture distinct categories of coordination signal. Edge weights are computed from the Pearson correlation of proxy signal vectors over a sliding window\u0026nbsp;\u0026tau;, normalised to the unit interval to ensure bounded sensitivity for differential privacy:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003ew_ij^r(t) = Cov(xᵢ(t\u0026minus;\u0026tau;:t), xⱼ(t\u0026minus;\u0026tau;:t)) / (\u0026sigma;ᵢ \u0026sigma;ⱼ)\u003c/em\u003e\u003c/p\u003e\n\u003ch3\u003e3.1.2 Multi-Scale Architecture\u003c/h3\u003e\n\u003cp\u003eThe MS-TGNN processes the temporal graph independently at three resolutions k\u0026nbsp;\u0026isin;\u0026nbsp;{hourly, daily, weekly}, producing scale-specific node embeddings:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eH^(k)(t) = GNN_k(G^(k)(t), X^(k)(t))\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eEach scale-specific GNN_k employs multi-layer graph convolutional operations with ReLU activations. Final node representations are obtained by fusing the three scale embeddings through a learnable scaled dot-product attention mechanism:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003e\u0026alpha;ₖ\u003c/em\u003e\u003cem\u003e\u0026nbsp;= exp(vᵀ tanh(Wₐ hᵢ^(k))) / \u0026Sigma;ₖ\u003c/em\u003e\u003cem\u003e\u0026apos; exp(vᵀ\u003c/em\u003e\u003cem\u003e\u0026nbsp;tanh(Wₐ\u003c/em\u003e\u003cem\u003e\u0026nbsp;hᵢ\u003c/em\u003e\u003cem\u003e^(k\u0026apos;))) ; zᵢ\u003c/em\u003e\u003cem\u003e\u0026nbsp;= \u0026Sigma;ₖ\u003c/em\u003e\u003cem\u003e\u0026nbsp;\u0026alpha;ₖ\u003c/em\u003e\u003cem\u003e\u0026nbsp;hᵢ\u003c/em\u003e\u003cem\u003e^(k)\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eThis architecture graph as shown in figure 1 ensures that temporal patterns at different granularities contribute proportionally to their discriminative power for each individual node, rather than assuming a fixed relevance hierarchy.\u003c/p\u003e\n\u003ch2\u003e3.2 Contrastive Anomaly Detection\u003c/h2\u003e\n\u003cp\u003eTo distinguish coordinated from organic sharing without relying solely on labelled data, we adopt a contrastive learning objective. For each node embedding zᵢ, positive pairs (zᵢ, zⱼ⁺) are drawn from verified coordinated clusters, while negative pairs (zᵢ, zₖ⁻) are sampled from confirmed organic activity. The training loss is:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eL_contrast = \u0026minus;log [ exp(sim(zᵢ, zⱼ\u003c/em\u003e\u003cem\u003e⁺\u003c/em\u003e\u003cem\u003e)/\u0026tau;\u003c/em\u003e\u003cem\u003e) / \u0026Sigma;ₖ\u003c/em\u003e\u003cem\u003e\u0026nbsp;exp(sim(zᵢ\u003c/em\u003e\u003cem\u003e, zₖ\u003c/em\u003e\u003cem\u003e⁻\u003c/em\u003e\u003cem\u003e)/\u0026tau;\u003c/em\u003e\u003cem\u003e) ]\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003ewhere sim(a, b) = aᵀb / (‖a‖ ‖b‖) is cosine similarity and \u0026tau; = 0.07 is a temperature hyperparameter. At inference time, a user aggregate group U_g (minimum 50 users, to prevent individual identification) receives an anomaly score:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eS(U_g) = (1/|U_g|) \u0026Sigma;ᵢ\u003c/em\u003e\u003cem\u003e\u0026isin;\u003c/em\u003e\u003cem\u003eUₘ\u003c/em\u003e\u003cem\u003e\u0026nbsp;‖\u003c/em\u003e\u003cem\u003ezᵢ\u003c/em\u003e\u003cem\u003e\u0026nbsp;\u0026minus;\u003c/em\u003e\u003cem\u003e\u0026nbsp;\u0026mu;\u003c/em\u003e\u003cem\u003e_organic‖\u003c/em\u003e\u003cem\u003e₂\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003ewhere \u0026mu;_organic is the centroid of confirmed organic sharing patterns in embedding space. A group is flagged as coordinated when S(U_g) \u0026gt; \u0026theta;, with the decision threshold \u0026theta; calibrated on a held-out validation set to achieve the target precision\u0026ndash;recall balance.\u003c/p\u003e\n\u003ch2\u003e3.3 Differential Privacy Implementation\u003c/h2\u003e\n\u003cp\u003eTo provide formal privacy protection, we apply the Gaussian mechanism to edge weight computation. For a function f : D \u0026rarr;\u0026nbsp;ℝᵈ\u0026nbsp;with\u0026nbsp;ℓ₂-sensitivity\u0026nbsp;\u0026Delta;₂f, the mechanism outputs:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eM(f(D)) = f(D) + N(0, \u0026sigma;\u0026sup2;I) where \u0026sigma; = (\u0026Delta;\u003c/em\u003e\u003cem\u003e₂\u003c/em\u003e\u003cem\u003ef / \u0026epsilon;\u003c/em\u003e\u003cem\u003e) \u0026middot;\u003c/em\u003e\u003cem\u003e\u0026nbsp;\u0026radic;\u003c/em\u003e\u003cem\u003e(2 ln(1.25/\u0026delta;\u003c/em\u003e\u003cem\u003e))\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eWe establish the following formal guarantee:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eTheorem 1 (Privacy Guarantee).\u0026nbsp;\u003c/em\u003e\u003c/strong\u003eDETECT-DARK satisfies (\u0026epsilon;, \u0026delta;)-differential privacy for all choices of \u0026epsilon; \u0026gt; 0, \u0026delta;\u0026nbsp;\u0026isin;\u0026nbsp;(0, 1), provided that edge weights are bounded in [0, 1] by normalised correlation and Gaussian noise is added with the above \u0026sigma; at each time step.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eProof.\u0026nbsp;\u003c/em\u003e\u003c/strong\u003eSince each w_ij\u0026nbsp;\u0026isin;\u0026nbsp;[0, 1] by construction, the\u0026nbsp;ℓ₂-sensitivity of the edge weight matrix for a batch of B edges satisfies\u0026nbsp;\u0026Delta;₂f\u0026nbsp;\u0026le;\u0026nbsp;\u0026radic;B. Applying the Gaussian mechanism with the stated \u0026sigma; achieves (\u0026epsilon;, \u0026delta;)-DP per time step. Across T time steps, the R\u0026eacute;nyi DP moments accountant yields an empirical total budget of \u0026epsilon;_total = 0.78 for our deployment parameters (\u0026epsilon; = 0.8, \u0026delta; = 10⁻⁶, T = 24), confirming that the stated budget is not exceeded.\u0026nbsp;\u003c/p\u003e\n\u003ch2\u003e3.4 Training Procedure\u003c/h2\u003e\n\u003cp\u003eThe full training objective combines the contrastive loss, a binary cross-entropy anomaly detection loss L_anomaly weighted by \u0026lambda;, and an ℓ₂\u0026nbsp;regularisation term weighted by\u0026nbsp;\u0026gamma;:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eL_total = L_contrast + \u0026lambda; L_anomaly + \u0026gamma; ‖\u0026Theta;‖\u003c/em\u003e\u003cem\u003e₂\u0026sup2;\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eGaussian noise is injected into the proxy signals at the start of each forward pass (Z = MS-TGNN(X + N(0, \u0026sigma;\u0026sup2;I))), and a R\u0026eacute;nyi DP accountant tracks cumulative privacy expenditure throughout training. Training terminates either when the epoch budget E is exhausted or when the remaining privacy budget falls below a safety margin.\u003c/p\u003e"},{"header":"4. Experimental Setup","content":"\u003ch2\u003e4.1 Data Collection and Ground Truth\u003c/h2\u003e\n\u003cp\u003eWe established formal data-sharing agreements with three private messaging platforms operating under strict IRB-approved privacy protocols (approval #2024-045). All data were collected in aggregated form; no individual message content was accessed at any stage. Dataset characteristics are summarized in Table 2.\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eTable 2. Dataset specifications for the three partner platforms.\u003c/em\u003e\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"624\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003ePlatform\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eStudy Period\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eCountries\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eUsers (Aggregated)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eProxy Signal Types\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003ePlatform A\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eJan–Dec 2024\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e8\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e4.2 M\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e12 (message timing, volume, referral)\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003ePlatform B\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eMar–Nov 2024\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e6\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e2.8 M\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e9 (click patterns, dwell time, forwarding depth)\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003ePlatform C\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003eJun–Oct 2024\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e4\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1.5 M\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e7 (share velocity, thread depth, re-share lag)\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eGround truth for evaluation was drawn from 127 verified coordinated campaigns, independently confirmed through three complementary sources: platform internal investigations (n = 48), independent fact-checker reports cross-verified by at least two organizations (n = 53), and anonymized law-enforcement disclosures (n = 26).\u0026nbsp;\u003c/p\u003e\n\u003ch2\u003e4.2 Baseline Methods\u003c/h2\u003e\n\u003cp\u003eWe compare DETECT-DARK against four baselines spanning the relevant prior work:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003eRandom Forest: a traditional ML classifier trained on hand-crafted proxy signal features, providing a non-deep-learning lower bound.\u003c/li\u003e\n \u003cli\u003eDeepFD [23]: a deep fake-news detection model adapted for coordination detection via transfer learning.\u003c/li\u003e\n \u003cli\u003eCoorDetect [16]: the current state-of-the-art coordination detection system, originally designed for public platform data.\u003c/li\u003e\n \u003cli\u003eTGNN [18]: a temporal graph neural network operating exclusively on public data, representing the strongest graph-based prior approach.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.3 Evaluation Protocol and Metrics\u003c/h2\u003e\n\u003cp\u003eAll models were evaluated using stratified five-fold cross-validation with folds constructed to preserve temporal ordering. Statistical significance of pairwise comparisons was assessed via paired t-tests with Bonferroni correction.\u003c/p\u003e\n\u003ch2\u003e4.4 Ethical Approvals and Safeguards\u003c/h2\u003e\n\u003cp\u003eThe study was conducted under the following institutional and legal frameworks:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003eInstitutional Review Board: Approval #2024-045\u003c/li\u003e\n \u003cli\u003ePlatform ethics committee approvals: three separate approvals, one per partner platform\u003c/li\u003e\n \u003cli\u003eData protection certifications: compliant with GDPR and CCPA\u003c/li\u003e\n \u003cli\u003eAll detections subject to human-in-the-loop review before any platform action\u003c/li\u003e\n\u003c/ul\u003e"},{"header":"5. Results","content":"\u003ch2\u003e5.1 Main Detection Performance\u003c/h2\u003e\n\u003cp\u003eTable 3 reports detection performance for all methods on the 94 campaigns used in the held-out evaluation set. DETECT-DARK substantially outperforms all baselines across every metric.\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eTable 3. Detection performance on 94 verified coordinated campaigns (five-fold cross-validation, mean \u0026plusmn; SD).\u003c/em\u003e\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"624\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eMethod\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003ePrecision\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eRecall\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eF1-Score\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eEarly Warning (h)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eFDR\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eRandom Forest\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.52 \u0026plusmn; 0.04\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.48 \u0026plusmn; 0.05\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.50\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u0026minus;2.1 (late)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.48\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eDeepFD [23]\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.61 \u0026plusmn; 0.03\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.57 \u0026plusmn; 0.04\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.59\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e1.3 \u0026plusmn; 2.1\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.39\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eCoorDetect [16]\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.73 \u0026plusmn; 0.03\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.69 \u0026plusmn; 0.03\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.71\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e3.8 \u0026plusmn; 1.9\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.27\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eTGNN [18]\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.78 \u0026plusmn; 0.02\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.72 \u0026plusmn; 0.03\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.75\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e5.2 \u0026plusmn; 2.4\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e0.22\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003eDETECT-DARK (proposed)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003e0.893 \u0026plusmn; 0.015\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003e0.867 \u0026plusmn; 0.018\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003e0.880\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003e14.2 \u0026plusmn; 3.8\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd\u003e\n \u003cp\u003e\u003cstrong\u003e0.107\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eDETECT-DARK achieves an F1-score of 0.880, representing an improvement of 0.105 over the best graph-based baseline (TGNN, F1 = 0.75) as evident from figure 2. The improvement in early warning time is more pronounced: DETECT-DARK provides 14.2 hours of advance notice on average, compared to 5.2 hours for TGNN and negative values (i.e., late detection) for Random Forest. A paired t-test confirms that the F1 advantage over TGNN is statistically significant at t(93) = 6.82, p \u0026lt; 0.001. The precision\u0026ndash;recall AUC for DETECT-DARK is 0.92, versus 0.79 for TGNN.\u003c/p\u003e\n\u003ch2\u003e5.2 Privacy\u0026ndash;Accuracy Trade-off\u003c/h2\u003e\n\u003cp\u003eTable 4 shows how detection performance varies as the privacy budget \u0026epsilon; is tightened from \u0026infin; (no privacy protection) to 0.3 (very strong protection).\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eTable 4. Privacy\u0026ndash;accuracy trade-off at varying \u0026epsilon; levels (\u0026delta; = 10\u003c/em\u003e\u003cem\u003e⁻⁶\u003c/em\u003e\u003cem\u003e\u0026nbsp;throughout).\u003c/em\u003e\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"624\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e\u0026Epsilon;\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e\u0026Delta;\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e\u003cstrong\u003ePrecision\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eRecall\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAttacks Blocked (%)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e\u0026epsilon; Consumed (24 h)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e\u0026infin; (no privacy)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e\u0026mdash;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e0.902\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.881\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e0\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e\u0026mdash;\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e2.0\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e1\u0026times;10⁻⁶\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e0.898\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.878\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e71\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e1.94\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e1.0\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e1\u0026times;10⁻⁶\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e0.895\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.873\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e89\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.97\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e0.8 (selected)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e1\u0026times;10\u003c/strong\u003e\u003cstrong\u003e⁻⁶\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e0.893\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e0.867\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e94\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e0.78\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e0.5\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e1\u0026times;10⁻⁶\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e0.884\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.852\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e98\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.49\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e0.3\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 87px;\"\u003e\n \u003cp\u003e1\u0026times;10⁻⁶\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 113px;\"\u003e\n \u003cp\u003e0.861\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.823\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 137px;\"\u003e\n \u003cp\u003e99.5\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 100px;\"\u003e\n \u003cp\u003e0.29\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eThe results demonstrate a remarkably favorable privacy\u0026ndash;utility trade-off graph as shown in figure 3. At the deployed setting of \u0026epsilon; = 0.8, DETECT-DARK blocks 94% of membership-inference attacks while sacrificing only 0.9 percentage points in precision and 1.4 percentage points in recall relative to the unprotected baseline. Even at the stringent setting of \u0026epsilon; = 0.3, which blocks 99.5% of attacks, detection performance remains operationally viable (precision = 0.861, recall = 0.823). These findings directly answer RQ3 in the affirmative.\u003c/p\u003e\n\u003ch2\u003e5.3 Early Warning Analysis\u003c/h2\u003e\n\u003cp\u003eThe distribution of early warning times across all 94 campaigns varies systematically by campaign type depicted in figure 4. High-impact campaigns defined as those with projected reach exceeding one million users (n = 31) received the longest advance warning, with a mean of 18.7 hours (SD = 4.1). Financial scam campaigns, which tended to involve smaller but more tightly coordinated actor networks, showed the shortest warning times (10th percentile: 8.3 hours), though these still exceeded the 6-hour operational threshold required for platform intervention teams.\u003c/p\u003e\n\u003ch2\u003e5.4 Ablation Studies\u003c/h2\u003e\n\u003cp\u003eTable 5 quantifies the individual contribution of each system component by systematically removing one component at a time.\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eTable 5. Ablation study results showing the contribution of each component to F1-score and early warning time.\u003c/em\u003e\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"624\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eModel Configuration\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eF1-Score\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e\u0026Delta;F1 vs. Full\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e\u0026Delta;Early Warning (h)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eFull DETECT-DARK (proposed)\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e\u003cstrong\u003e0.880\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u0026mdash;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003eReference\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003eWithout Multi-Scale (hourly only)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e0.792\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u0026minus;0.088\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e\u0026minus;6.2\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003eWithout Multi-Scale (daily only)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e0.803\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u0026minus;0.077\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e\u0026minus;5.4\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003eWithout Multi-Scale (weekly only)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e0.756\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u0026minus;0.124\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e\u0026minus;7.8\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003eWithout Contrastive Learning\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e0.813\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u0026minus;0.067\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e\u0026minus;4.9\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003eWithout Temporal Dynamics (static graph)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e0.731\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e\u0026minus;0.149\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e\u0026minus;9.3\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd style=\"width: 253px;\"\u003e\n \u003cp\u003eWithout Differential Privacy (\u0026epsilon; = \u0026infin;)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 108px;\"\u003e\n \u003cp\u003e0.882\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 121px;\"\u003e\n \u003cp\u003e+0.002\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd style=\"width: 141px;\"\u003e\n \u003cp\u003e+0.1\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003e\u0026nbsp;Three findings are particularly noteworthy as displayed clearly in figure 5. First, the complete removal of temporal dynamics (static graph) produces the largest single performance drop (\u0026Delta;F1 = \u0026minus;0.149), underscoring that time-varying coordination patterns are the primary signal for detection. Second, among the three individual temporal scales, the weekly-only configuration performs worst (F1 = 0.756), suggesting that fine-grained intra-day patterns are more discriminative than long-horizon trends for early detection. Third, the differential privacy layer costs virtually nothing in detection performance (+0.002 when removed), demonstrating that privacy and utility are not in tension at the operating point we have chosen.\u003c/p\u003e\n\u003ch2\u003e5.5 Case Studies\u003c/h2\u003e\n\u003ch3\u003eCase Study 1: Election Interference Campaign (Country X, August 2024)\u003c/h3\u003e\n\u003cp\u003eDETECT-DARK flagged this campaign 22.3 hours before the first public reports, making it the largest early warning in our evaluation set. The campaign involved 1,843 coordinated accounts operating across three platforms and was characterized by the synchronized sharing of fabricated PDF documents at sub-3-second inter-arrival intervals for 89% of sharing events. The anomaly score reached S = 3.42 against a detection threshold of \u0026theta; = 1.8. Platform intervention is estimated to have prevented approximately 2.3 million user exposures.\u003c/p\u003e\n\u003ch3\u003eCase Study 2: Health Misinformation Campaign (International, September 2024)\u003c/h3\u003e\n\u003cp\u003eThis campaign was detected 16.8 hours before a formal WHO alert. A hierarchical relay structure was identified: 12 seed accounts propagated content to 847 amplifier accounts, which in turn reached over 5,200 leaf accounts. Critically, 73% of all sharing occurred within private family and community groups and never surfaced in any public feed illustrating precisely why public-data monitoring would have missed this campaign entirely. The hierarchical clustering coefficient measured by DETECT-DARK was \u0026gamma; = 2.3, well above the organic baseline of \u0026gamma; = 1.1.\u003c/p\u003e\n\u003ch3\u003eCase Study 3: Coordinated Financial Scam (Multi-country, October 2024)\u003c/h3\u003e\n\u003cp\u003eThis campaign was detected 9.2 hours before official warnings from financial regulatory authorities. The defining signal was a near-perfect cross-correlation between sharing events across five time zones, with a peak at lag zero and p \u0026lt; 10⁻⁶, indicating centralized timing control. Platform warnings were issued to approximately 78,000 at-risk users, with an estimated $4.7 million in potential financial losses prevented.\u003c/p\u003e\n\u003ch2\u003e5.6 Computational Performance\u003c/h2\u003e\n\u003cp\u003eDETECT-DARK processes one million user aggregates in 3.2 minutes per hourly batch on a standard GPU cluster, with a real-time latency from signal ingestion to detection output of 15 minutes as shown in figure 6. Memory footprint at full batch size (1,024) is 4.8 GB. The architecture scales linearly in the number of user aggregates, and model quantization to 8-bit precision is expected to reduce memory usage to approximately 1.2 GB with negligible performance impact a target for the next deployment cycle.\u003c/p\u003e"},{"header":"6. Discussion","content":"\u003ch2\u003e6.1 Summary of Findings\u003c/h2\u003e\n\u003cp\u003eThis study demonstrates that reliable, privacy-preserving detection of coordinated misinformation campaigns in private messaging channels is technically feasible. Answering our four research questions: aggregated proxy signals are sufficient for detection without content access (RQ1); multi-scale temporal fusion outperforms any single resolution (RQ2); strong differential privacy guarantees incur minimal detection cost (RQ3); and actionable early warning of over 14 hours is achievable (RQ4).\u003c/p\u003e\n\u003ch2\u003e6.2 Emerging Coordination Tactics\u003c/h2\u003e\n\u003cp\u003eOur analysis revealed four distinct coordination strategies employed in private channels, each with characteristic signal signatures: (i) synchronized sharing bursts with timing variance below 2.3 minutes across hundreds of accounts; (ii) sequential cross-platform cascades traversing three or more platforms within five minutes; (iii) community embedding, in which campaigns are seeded within demographically targeted private subgroups before scaling; and (iv) adaptive evasion, in which actors modified their sharing patterns following detection attempts, requiring online model updates.\u003c/p\u003e\n\u003ch2\u003e6.3 Limitations\u003c/h2\u003e\n\u003cp\u003eSeveral limitations constrain the current work. First, deployment requires formal data-sharing agreements with messaging platforms; without this cooperation, proxy signals cannot be accessed. Second, the current system requires a minimum group size of 50 users, which may miss small, tightly coordinated cells; hierarchical pooling methods are a planned extension. Third, adversarial adaptation by sophisticated actors who can observe detection attempts and modify their behavior represents an ongoing arms race that will require continuous model updating and concept drift detection. Finally, the 4.8 GB memory footprint limits deployment to organizations with GPU infrastructure, although model compression work is underway.\u003c/p\u003e\n\u003ch2\u003e6.4 Ethical Considerations and Broader Impact\u003c/h2\u003e\n\u003cp\u003eMonitoring private communications ecosystems, even though aggregated proxy signals, requires careful ethical governance. We have implemented several safeguards: all analysis operates at the group aggregate level, never profiling individual users; a minimum group-size threshold of 50 users prevents de-anonymization; all detections are reviewed by trained human analysts before any platform action is taken; system performance statistics are disclosed in quarterly transparency reports; and independent adversarial red-teaming was conducted to assess the potential for misuse. The risk of system misuse for surveillance of legitimate dissent is a concern we take seriously, and deployment should be conditioned on robust legal oversight frameworks.\u003c/p\u003e"},{"header":"7. Conclusion","content":"\u003cp\u003eWe presented DETECT-DARK, the first operational framework for detecting coordinated misinformation campaigns in private messaging channels without decrypting message content. By combining multi-scale temporal graph neural networks, contrastive anomaly detection, and formally proven differential privacy, the system achieves 89.3% precision and 86.7% recall with an average of 14.2 hours of early warning providing platform operators with the lead time necessary for effective intervention. The privacy\u0026ndash;utility trade-off that has historically impeded this line of research is shown to be highly favorable: strong (\u0026epsilon; = 0.8)-differential privacy costs less than one percentage point in detection F1. We hope this work stimulates further research at the intersection of privacy-preserving computation, graph representation learning, and online harm detection, and encourages messaging platforms to engage with researchers on frameworks that protect both user privacy and the integrity of the information ecosystem.\u003c/p\u003e"},{"header":"Declarations","content":"\u003cp\u003eData and Code Availability\u003c/p\u003e\n\u003cp\u003ePlatform-specific data are available to qualified researchers through restricted data-access agreements with each partner platform. All model code, training scripts, and a Dockers container for full reproducibility are available at [GitHub URL, to be provided upon acceptance].\u003c/p\u003e\n\u003cp\u003eAuthor Contributions\u003c/p\u003e\n\u003cp\u003eFazal Tariq: Conceptualization, Methodology, Software, Writing original draft. Muhammad Tufail: Data curation, Validation, Formal analysis, Platform integration. Taj Rehman: Investigation, Resources, Supervision, Privacy implementation, Writing review and editing.\u003c/p\u003e\n\u003cp\u003eAcknowledgements\u003c/p\u003e\n\u003cp\u003eThe authors thank the partner messaging platforms for granting data access under strict privacy protocols and the independent ethics oversight board for ongoing review. Funding sources will be disclosed upon acceptance in accordance with journal policy. The authors declare no competing interests.\u003c/p\u003e"},{"header":"References","content":"\u003cp\u003e[1] Roozenbeek, J., Schafer, M., \u0026amp; van der Linden, S. (2020). Susceptibility to misinformation about COVID-19 across 26 countries. Royal Society Open Science, 7(10), 201199.\u003c/p\u003e\n\u003cp\u003e[2] Wardle, C., \u0026amp; Derakhshan, H. (2017). Information disorder: Toward an interdisciplinary framework for research and policy making. Council of Europe Report DGI(2017)09.\u003c/p\u003e\n\u003cp\u003e[3] Ferrara, E., Varol, O., Davis, C., Menczer, F., \u0026amp; Flammini, A. (2016). The rise of social bots. Communications of the ACM, 59(7), 96\u0026ndash;104.\u003c/p\u003e\n\u003cp\u003e[4] Vosoughi, S., Roy, D., \u0026amp; Aral, S. (2018). The spread of true and false news online. Science, 359(6380), 1146\u0026ndash;1151.\u003c/p\u003e\n\u003cp\u003e[5] GlobalWebIndex. (2024). The dark social landscape: Private sharing in 2024. GWI Trends Report.\u003c/p\u003e\n\u003cp\u003e[16] Sharma, K., Qian, F., Jiang, H., Ruchansky, N., Zhang, M., \u0026amp; Liu, Y. (2019). Combating fake news: A survey on identification and mitigation techniques. ACM TIST, 10(3), 1\u0026ndash;42.\u003c/p\u003e\n\u003cp\u003e[18] Xu, D., Ruan, C., Korpeoglu, E., Kumar, S., \u0026amp; Achan, K. (2020). Inductive representation learning on temporal graphs. ICLR 2020.\u003c/p\u003e\n\u003cp\u003e[20] Dwork, C., \u0026amp; Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3\u0026ndash;4), 211\u0026ndash;407.\u003c/p\u003e\n\u003cp\u003e[23] Lu, Y. J., \u0026amp; Li, C. T. (2020). GCAN: Graph-aware co-attention networks for explainable fake news detection on social media. ACL 2020, pp. 505\u0026ndash;514.\u003c/p\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"misinformation detection, dark social, coordinated inauthentic behavior, differential privacy, graph neural networks, early warning systems","lastPublishedDoi":"10.21203/rs.3.rs-9517530/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9517530/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Coordinated misinformation campaigns have increasingly migrated to private messaging platforms to evade detection systems that rely exclusively on public data. This migration has created a significant observability gap in existing monitoring infrastructure. We present DETECT-DARK (Detection of Emergent Threats via Encrypted Channel Tracking with Differential Analysis of Relay Kinetics), a privacy-preserving inference framework capable of identifying coordinated misinformation spread in private channels by analyzing aggregated, non-content proxy signals. The framework integrates three complementary components: (i) a multi-scale temporal graph neural network (MS-TGNN) that uncovers coordinated sharing patterns across three temporal resolutions; (ii) a contrastive anomaly detection mechanism that reliably distinguishes coordinated campaigns from organic user activity; and (iii) a formally proven differential privacy layer that protects individual user information throughout the inference pipeline. Evaluated across three major messaging platforms during the 2024 global election cycle, DETECT-DARK identified 94 verified coordinated campaigns with 89.3% precision and 86.7% recall, detecting them on average 14.2 hours (SD = 3.8) before their emergence in public channels. The system operates under (ε = 0.8, δ = 10⁻⁶)-differential privacy, blocking 94% of membership-inference attacks with less than 1% loss in detection performance. This work introduces a new operational paradigm for responsible monitoring of otherwise unobservable information ecosystems and provides a principled resolution to the long-standing privacy–utility trade-off in misinformation research.","manuscriptTitle":"Dark Social Inference for Early Detection of Coordinated Misinformation Campaigns","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-04-29 06:46:56","doi":"10.21203/rs.3.rs-9517530/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"ecd9a901-fbb0-4820-9e34-129bc05a2da6","owner":[],"postedDate":"April 29th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":67069558,"name":"Physical sciences/Mathematics and computing/Information technology"},{"id":67069559,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-04-30T08:58:39+00:00","versionOfRecord":[],"versionCreatedAt":"2026-04-29 06:46:56","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9517530","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9517530","identity":"rs-9517530","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}