{"id":"3eeeda54-bb22-4276-a579-ce85e5d284ca","arxiv_id":"2607.05855","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":3,"one_line_summary":"TENSOR detects information operation users by fusing Temporal Point Process anomaly scores with LLM-derived evidence via post-hoc adjustment, outperforming baselines on five real-world datasets.","lead":"The paper introduces TENSOR, a system that detects state-backed social media manipulators by combining temporal posting patterns with LLM-based language analysis, without needing labeled training data. It matters because influence operations are a recognized threat to democratic discourse and existing detection tools struggle to adapt to new campaigns.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"The LLM fusion improves over TPP-alone, but the claimed mechanism — contamination mitigation — is not supported by the paper's own data: improvement does not correlate with contamination level across datasets.","rationale":"The reader correctly identified that the LLM evidence function's contribution is questionable, but framed the concern around independence and noise. The more precise and load-bearing concern is that the paper's stated mechanism — contamination mitigation via EPHAD — is contradicted by its own cross-dataset results. The improvement from LLM fusion does not scale with contamination level (Table 1 vs. Table 7), which is what we would expect if contamination mitigation were the operative mechanism. This matters because the entire architectural motivation (using EPHAD to correct contaminated TPP) rests on this claim. However, the verdict remains CONDITIONAL rather than moving to REJECT because: (1) the performance results (TENSOR outperforming baselines on AUPRC, a threshold-free metric) are valid regardless of the mechanism; (2) the ablation in Table 7 does show LLM fusion helps over TPP-alone and over random evidence, confirming the LLM provides useful signal; (3) the method is practically useful even if the mechanistic explanation is incorrect. The threshold-tuning concern the reader raised is real but less load-bearing since AUPRC results don't require threshold selection. The β=0.5 concern is also less load-bearing since the main results use this fixed value without label-based optimization. The paper would be strengthened by either (a) demonstrating the contamination mitigation mechanism with controlled experiments, or (b) reframing the contribution as multimodal fusion rather than contamination correction.","tokens_in":15758,"tokens_out":5533,"duration_ms":394977,"concrete_test":"Construct training sets with controlled contamination ratios by subsampling IO users from the training split at rates of 1%, 5%, 10%, 20%, and 40% (keeping test sets fixed). For each contamination level, measure AUPRC of TPP-alone vs. TENSOR (TPP+LLM) on the held-out test set. If the improvement delta (TENSOR AUPRC minus TPP-alone AUPRC) increases monotonically with contamination level, the contamination mitigation claim is supported. If the delta is flat or decreases — as the cross-dataset pattern already suggests — the claim should be revised: the LLM provides complementary signal, not contamination correction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim states that EPHAD fusion of LLM evidence with TPP scores 'effectively mitigates training data contamination.' If this mechanism were genuine, the improvement from adding the LLM evidence function should scale with the contamination level in the training data. The paper's own data contradicts this. From Table 1 and Table 7: Egypt has 47.5% IO users (219/461) and shows 11.2% relative AUPRC improvement from LLM fusion (0.6916→0.7690); China_1 has only 1.9% IO users (537/28982) yet shows 19.3% improvement (0.4740→0.5654); UAE has 33.5% IO users (3337/9972) but only 6.9% improvement (0.8009→0.8562). There is no positive correlation between contamination level and LLM-induced improvement (if anything, the trend is inverted). This suggests the LLM is providing complementary language signal unrelated to contamination correction, and the 'mitigating training data contamination' framing is a misattribution of the mechanism. The performance results themselves (TENSOR > baselines) likely hold regardless of the mechanism, but the specific claim about contamination mitigation — which is the paper's stated motivation for the EPHAD fusion — is not substantiated by the evidence presented.","agreement_with_reader":"partial"},"referee_report":{"model":"glm-5.2","summary":"This paper proposes TENSOR, an unsupervised anomaly detection method for Information Operations (IO) user detection on social media. The approach fuses two signals: (1) a Temporal Point Process (TPP) trained on user posting timestamps to capture behavioral anomaly, and (2) an LLM-derived evidence function that scores whether a user's post timeline resembles an IO account. These are combined via the EPHAD framework (Patra et al. [24]), which uses exponential tilting to post-hoc adjust the TPP anomaly score using the LLM evidence, motivated by the claim that this mitigates training data contamination (IO users present in the control training set). TENSOR is evaluated on five real-world IO datasets against three baselines (Clustering, BLOC, LLM-based zero-shot), showing improvements in AUPRC and other metrics. Ablation studies isolate the contributions of the TPP and LLM components, and sensitivity analyses examine different LLMs and temperature values.","tokens_in":16010,"tokens_out":1537,"duration_ms":236107,"significance":"The paper addresses a practically important problem (unsupervised IO user detection) and the multimodal fusion of temporal behavioral signals (TPP) with language signals (LLM evidence) via EPHAD is a reasonable and novel application of the post-hoc adjustment framework. The inclusion of ablation studies (Table 7), alternative fusion comparisons (Table 8), multi-LLM sensitivity (Table 9), and temperature sensitivity (Figure 4, Table 10) strengthens the empirical contribution. The code release is a positive sign of reproducibility. The five real-world datasets span different countries and contamination levels, providing a reasonable breadth of evaluation.","major_comments":[{"comment":"§1, §4.3, §6: The paper's central motivational claim is that EPHAD fusion of LLM evidence with TPP scores 'mitigates training data contamination.' However, the paper's own data does not substantiate this specific mechanism. From Table 1 and Table 7: Egypt has 47.5% IO users (219/461) and shows 11.2% relative AUPRC improvement from LLM fusion (0.6916→0.7690); China_1 has 1.9% IO users (537/28982) yet shows 19.3% improvement (0.4740→0.5654); UAE has 33.5% IO users (3337/9972) but only 6.9% improvement (0.8009→0.8562). If the mechanism were contamination mitigation, improvement should scale with contamination level, but no such correlation exists (if anything, the trend is inverted). This suggests the LLM provides complementary language signal unrelated to contamination correction. The performance results likely hold regardless of mechanism, but the 'contamination mitigation' framing — the纸","section":null},{"comment":"§5, Evaluation Metrics: The threshold epsilon is tuned by maximizing F1 on a labeled validation set. While the paper states labels are used 'solely for performance evaluations,' threshold tuning on labeled data is a form of supervised model selection that weakens the 'unsupervised' framing for the precision/recall/F1 metrics. The AUPRC and AUC metrics (which are threshold-free) are more appropriate for evaluating the unsupervised claim, and the paper does report these. However, the F1 results in Table 4 and precision/recall in Tables 2-3 should be clearly caveated as requiring a labeled validation set, or the unsupervised threshold selection procedure should be elaborated.","section":null},{"comment":"§4.3, Eq. (9): The evidence function T(t_i, c_i) is defined as the softmax of semantic similarities between the LLM output and reference texts ('IO account' vs. 'Control account'). The paper's own ablation (Table 7, 'TENSOR without TPP') shows the LLM alone performs poorly at zero-shot IO detection (average AUPRC 0.2857). This raises a concern: if the LLM's zero-shot judgments are weak, is the evidence function providing signal that is genuinely independent of the TPP score, or is it primarily adding noise that the exponential tilting happens to regularize? The paper should discuss whether the LLM evidence and TPP score are sufficiently independent for the EPHAD adjustment to be theoretically justified, or provide empirical evidence of their decorrelation.","section":null}],"minor_comments":[{"comment":"§5.1: The text states 'One outlier is Egypt, where Clustering performs better on AUPRC' but Table 6 shows TENSOR (0.7690) vs. Clustering (0.8232) on Egypt — the statement is correct but could note that this is the only dataset where Clustering wins on AUPRC.","section":null},{"comment":"§4.3, Eq. (9): The similarity function sim(x, y) is mentioned but not defined until later (bge-m3-v2 reranker). A forward reference or brief definition at first use would improve readability.","section":null},{"comment":"Table 10 caption: States 'temperature β = 0.5 for TENSOR results in the second column' but the first column is 'TENSOR with best β' — the caption should clarify how 'best β' was selected (presumably per-dataset optimization on validation AUPRC).","section":null},{"comment":"§5.4: The text mentions 'it is consistently around 0.3 for gpt-oss-120B' but Figure 4 shows substantial variation across datasets (Egypt peaks near 0.1, UAE near 0.5). The claim of consistency should be softened.","section":null},{"comment":"§3, Eq. (1): The threshold epsilon is introduced here but its determination is deferred to Section 5. A brief forward reference at this point would help the reader.","section":null},{"comment":"Table 1: The total row sums (7,466 IO users, 59,574 control users) are useful but the percentage of IO users per dataset is not shown and would aid interpretation of contamination levels.","section":null},{"comment":"§4.3: The computational complexity claim of O(M_i) for the LLM component is noted as 'O(1)' in footnote 5, but this is only true if the LLM processes the entire timeline in a single forward pass. This should be clarified, as LLM context length limits may require chunking.","section":null}],"recommendation":"major_revision","confidential_remarks":"The contamination mitigation mechanism claim is the most significant concern. The paper's framing positions EPHAD fusion as solving a specific problem (training contamination), but the data does not support this mechanism. The authors could reframe the contribution as 'complementary multimodal signal fusion' rather than 'contamination mitigation,' which would be more accurate to what the data shows. The unsupervised threshold issue is also worth noting to the editor — the AUPRC/AUC results are genuinely unsupervised, but the F1/precision/recall are not. The paper should be clearer about this distinction."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and constructive review. The three major comments are well-taken and have prompted us to reconsider aspects of our framing and presentation. We agree with two of the three comments in full and will revise accordingly; on the third (independence of LLM evidence and TPP scores), we agree the concern is legitimate and will add discussion plus empirical analysis, though we believe the existing ablation results already partially address it.","responses":[{"response":"The referee is correct that our data does not substantiate a contamination-mitigation mechanism in the specific sense of improvement scaling with contamination level. We appreciate this careful analysis. Upon reflection, we agree that the contamination-mitigation framing is not supported by our experimental evidence and that a more accurate characterization is that the LLM evidence provides a complementary language-based signal that improves detection regardless of contamination level. We will revise the manuscript to reframe the motivation: rather than claiming EPHAD mitigates contamination specifically, we will describe the LLM evidence function as providing complementary signal from the content dimension that the TPP (trained on timestamps alone) cannot capture. The EPHAD framework remains theoretically motivated as a principled post-hoc adjustment that combines two imperfect but complementary signals. We will also add an explicit discussion of the contamination-improvement relationship the referee identifies, acknowledging that the absence of correlation rules out the contamination-mitigation mechanism and supporting the complementary-signal interpretation.","revision_made":"yes","referee_comment":"The paper's central motivational claim is that EPHAD fusion mitigates training data contamination, but the data does not substantiate this mechanism: improvement from LLM fusion does not correlate with contamination level (Egypt 47.5% IO → 11.2% improvement; China_1 1.9% IO → 19.3% improvement; UAE 33.5% IO → 6.9% improvement). This suggests the LLM provides complementary language signal unrelated to contamination correction."},{"response":"The referee is correct. Tuning epsilon on a labeled validation set is a form of supervised model selection, and our current presentation does not adequately caveat this. We will make two changes. First, we will add an explicit caveat in Section 5 stating that while TENSOR's scoring is fully unsupervised (the TPP is trained without labels and the LLM evidence function requires no labels), the threshold epsilon for converting scores to binary labels is selected using a labeled validation set, making the precision, recall, and F1 metrics semi-supervised in the threshold-selection step. Second, we will emphasize that AUPRC and AUC, which are threshold-free and fully unsupervised, are the primary metrics for evaluating the unsupervised claim, and will note this explicitly when presenting Tables 2-4. We will also briefly mention that unsupervised threshold selection (e.g., modeling score distributions as two-component mixtures) is possible future work, as we already note for beta optimization.","revision_made":"yes","referee_comment":"The threshold epsilon is tuned by maximizing F1 on a labeled validation set, which is a form of supervised model selection that weakens the 'unsupervised' framing for precision/recall/F1 metrics. The F1 results in Table 4 and precision/recall in Tables 2-3 should be caveated, or the unsupervised threshold selection procedure should be elaborated."},{"response":"This is a legitimate and important concern. We agree that the EPHAD framework's theoretical justification assumes the evidence function provides signal not already captured by the base detector. We will address this in two ways. First, we will add discussion noting that the TPP score is computed solely from timestamps (behavioral patterns), while the LLM evidence function is computed from post content (language patterns), so the two signals are derived from fundamentally different data modalities, which provides a structural basis for independence. Second, we will add an empirical analysis computing the correlation between the TPP scores and LLM evidence scores across users on each dataset. We expect this to show low correlation, supporting the claim that the LLM evidence provides genuinely complementary signal. We also note that the existing ablation in Table 7 already provides relevant evidence: 'TENSOR with random evidence' (uniform noise replacing the LLM) performs worse than 'TENSOR without LLM' on average (0.6299 vs. 0.6506), while TENSOR with the actual LLM evidence performs substantially better (0.7154). If the LLM evidence were merely noise that exponential tilting regularizes, the random-evidence ablation should perform comparably to the real-evidence version. The fact that real LLM evidence significantly outperforms random noise demonstrates that the LLM provides useful signal beyond what the TPP captures, even though the LLM alone is a weak detector. We will make this argument explicit in the revised manuscript.","revision_made":"partial","referee_comment":"The LLM's zero-shot judgments are weak (average AUPRC 0.2857 without TPP). Is the evidence function providing signal genuinely independent of the TPP score, or is it primarily adding noise that exponential tilting happens to regularize? The paper should discuss independence/decorrelation or provide empirical evidence."}],"tokens_in":15941,"tokens_out":1095,"duration_ms":146537,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"Two things matter here. First, TENSOR is a genuinely new combination: a Temporal Point Process for behavioral anomaly detection fused with an LLM-derived evidence function via EPHAD post-hoc adjustment, applied to information operations user detection. The evidence function design (Eq. 9) — mapping LLM responses to quantitative scores via semantic similarity rather than strict text matching — is a clean, practical idea that handles LLM non-determinism well. Code is available, experiments span five real-world datasets, and the ablations are thorough. Second, the stress-test concern about the contamination-mitigation mechanism lands. The paper's stated motivation is that LLM evidence corrects TPP outputs degraded by IO users in the training data. If that were the mechanism, improvement from LLM fusion should scale with contamination level. It does not. China_1 has 1.9% IO users but shows 19.3% relative AUPRC improvement; UAE has 33.5% IO users but only 6.9% improvement. The LLM is providing complementary language signal, not contamination correction. The framing is a misattribution, but the performance gains are real regardless of which mechanism explains them. The 'unsupervised' label is also slightly oversold. The threshold epsilon is tuned by maximizing F1 on a labeled validation set (Section 5). That is standard practice for threshold selection and does not undermine the core method, but the paper should be upfront about it rather than burying it. The beta=0.5 default inherited from prior work is acknowledged as suboptimal — the authors' own Table 10 shows improvements at lower beta — and they flag unsupervised beta optimization as future work. Fair enough, but it means the headline numbers are known-suboptimal. The LLM alone is weak at zero-shot IO detection (Table 7), which raises a fair question about fusion robustness, but the ablation showing TENSOR with random evidence underperforms TENSOR without LLM confirms the LLM signal is genuinely informative, not just noise. Overall: the method works, the experiments are solid, the contamination framing needs correction. This is for trust-and-safety researchers and anyone working on unsupervised anomaly detection with multimodal signals. It deserves a serious referee who can push the authors to either substantiate or retract the contamination-mitigation claim and to address the unsupervised beta optimization problem.","headline":"TENSOR fuses TPP behavioral anomaly scores with LLM-derived evidence via EPHAD for unsupervised IO detection; the fusion works but the contamination-mitigation framing is not supported by the data.","tokens_in":16732,"tokens_out":580,"would_cite":false,"duration_ms":149023,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"Fusing posting-time patterns with LLM judgments detects coordinated influence operations","keywords":[],"falsifier":"Construct a dataset where the LLM's IO judgments are systematically biased in the same direction as the TPP's errors (e.g., both miss the same class of IO users), and show that the exponential tilting adjustment degrades rather than improves detection performance compared to the TPP alone.","tokens_in":15892,"feed_emoji":"🔍","tokens_out":757,"duration_ms":71992,"temperature":0.7,"pith_summary":"The paper proposes TENSOR, a method for detecting Information Operations (IO) users on social media without requiring labeled training data. The core idea is that IO users are rare and exhibit distinct temporal behavioral patterns (e.g., coordinated posting times) that differ from normal users. TENSOR trains a Temporal Point Process (TPP) on user posting timestamps to flag anomalous behavioral patterns, but this TPP is trained on contaminated data containing both normal and IO users, which degrades its accuracy. To correct for this, the paper introduces an evidence function: a Large Language Model (LLM) is prompted with each user's post timeline and its text output is converted into a quantitative score via semantic similarity mapping. This LLM-derived score is then fused with the TPP score through exponential tilting (EPHAD), a post-hoc adjustment mechanism that corrects the TPP's predictions at test time. The paper demonstrates that neither the TPP alone nor the LLM alone performs well, but their fusion yields a system that outperforms existing unsupervised baselines across five real-world IO datasets.","feed_headline":"LLM judgments fix contaminated anomaly detector for influence operations","feed_subtitle":"Fusing weak language-model evidence with temporal posting patterns catches coordinated IO users without labeled data, beating baselines on 5","key_machinery":"Temporal Point Process (TPP), exponential tilting (EPHAD), evidence function from LLM semantic similarity","core_discovery":"The central mechanism is the fusion of a temporal-behavioral anomaly score from a TPP with a language-aware evidence score from an LLM via exponential tilting. The key finding is that an LLM that performs poorly at zero-shot IO detection on its own still provides useful corrective signal when used as an evidence function to adjust a TPP that was trained on contaminated data. The LLM's judgments, even if noisy, carry information about IO characteristics that is complementary to what the TPP captures from temporal patterns alone, and the exponential tilting formula provides a principled way to combine them.","pith_inferences":[],"forward_implications":["Platforms could deploy TENSOR-style detectors that adapt to new IO campaigns without needing labeled examples of those specific campaigns, addressing the generalization bottleneck of supervised methods.","The evidence-function approach could generalize beyond IO detection to any anomaly detection task where a contaminated training set is unavoidable and a separate, imperfect signal source is available for post-hoc correction.","The finding that a weak LLM signal can correct a contaminated statistical model suggests a broader design pattern: using LLMs as evidence providers rather than primary classifiers in domains where they lack sufficient zero-shot accuracy.","Unsupervised optimization of the temperature parameter beta, which the paper identifies as promising but leaves open, could make the method fully label-free for deployment."],"fun_headline_variants":["Noisy LLM judgments correct temporal anomaly detectors for influence operations","Fusing LLM evidence with temporal patterns flags coordinated influence accounts","Unsupervised IO detection via fused temporal patterns and LLM evidence scores","LLM evidence function fixes contaminated temporal models for IO detection","Combining weak LLM evidence with temporal point processes detects IO users"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The LLM-based evidence function provides signal that is genuinely complementary to the TPP score rather than correlated with the TPP's errors. The paper shows the LLM alone performs poorly at zero-shot IO detection, yet assumes its output is sufficient to correct the TPP through exponential tilting. If the LLM's judgments are systematically wrong in the same way the TPP is wrong, the adjustment could reinforce errors rather than correct them.","fun_headline_variants_meta":{"raw":{"variants":["Noisy LLM judgments correct temporal anomaly detectors for influence operations","Fusing LLM evidence with temporal patterns flags coordinated influence accounts","Unsupervised IO detection via fused temporal patterns and LLM evidence scores","LLM evidence function fixes contaminated temporal models for IO detection","Combining weak LLM evidence with temporal point processes detects IO users","Exponential tilting merges language evidence with temporal patterns to catch IO"]},"model":"glm-5.2","effort":"high","cost_usd":0.0,"raw_usage":{"total_tokens":1166,"prompt_tokens":553,"completion_tokens":613,"prompt_tokens_details":null},"tokens_in":553,"tokens_out":613,"duration_ms":13687,"temperature":1.0,"reasoning_tokens":590,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-08T22:16:34.939294+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"Construct a dataset where the LLM's IO judgments are systematically biased in the same direction as the TPP's errors (e.g., both miss the same class of IO users), and show that the exponential tilting adjustment degrades rather than improves detection performance compared to the TPP alone.","supporting_citations":[],"review_version":1}