Pith. sign in

REVIEW 1 major objections 6 minor 32 references

Discovering Coordinated Processes From Social Online Networks

T0 review · 1 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Pith's one-line read Applying process mining to retweet timing data, the paper shows that the structure and dynamics of discovered Petri net models can separate coordinated AI and human behavior from organic activity on Twitter.

desk verdict Genuinely new application of process discovery to retweet logs, but the headline claim outruns the evidence because every metric rests on an untested trace-truncation choice and descriptive comparisons. read the letter →

arxiv 2506.12988 v1 pith:ETSXD7YX submitted 2025-06-15 cs.SI

classification cs.SI
keywords processminingsocialnetworkanalysiscoordinatedinauthenticbehaviorstochasticPetrinetsretweeteventlogsKolmogorov-SinaientropyInductiveMiner
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that process mining, a family of techniques usually reserved for business workflows, can be turned on social media metadata to expose coordinated inauthentic behavior. Using retweet traces as event logs, it learns stochastic Petri nets that encode who retweets whom through parallel, sequential, and choice routing. The authors show that models learned from known coordinated campaigns in UAE, Honduras, and Brazil differ measurably from uncoordinated activity: coordinated models are denser, more compact, have faster mean retweet times, and often higher Kolmogorov-Sinai entropy. These signatures come from timing metadata alone, not from post content, so the approach could work even when LLM-generated text is indistinguishable from human writing.

What carries the argument

The central object is a free-choice stochastic Petri net, a Petri net extended with output-arc probabilities and random transition delays. It carries the argument because it represents both the structure of information flow (parallel, choice, and loop patterns) and the stochastic dynamics of that flow, going beyond static graphs and Markov chains. Discovery is performed with the Inductive Miner algorithm with a noise threshold of 0.2, and then probabilities and time distributions are fitted from the original event log; behavioral analysis uses graph density, graph diameter, mean user waiting times, and Kolmogorov-Sinai entropy computed from a Markov chain induced on the reachability graph.

What would settle it

A direct test would be to rerun the same discovery pipeline on the same datasets with full-length traces (or with cutoff lengths of 20, 50, and 100 events) and check whether the density and entropy ordering between coordinated and uncoordinated groups persists; if the ordering flips or the gap vanishes, the reported signatures are artifacts of the first-10-events truncation.

Watch

Extended reading notes

Core claim

The central claim is that event logs of retweets can be mined with existing process discovery algorithms to produce free-choice stochastic Petri nets, and that the structural and behavioral properties of these models reveal whether online behavior is coordinated or organic. In the paper's own terms, the approach is effective in practice in categorizing user behavior online and can be applied to identify, visualize, and simulate coordinated behavior, with structural measures like lower density and larger diameter marking uncoordinated behavior, while faster mean waiting times and higher entropy mark coordinated behavior in the UAE and Honduras datasets.

Load-bearing premise

The load-bearing premise is that taking only the first 10 retweet events of each tweet, and only the first few hundred tweets per country, still yields process models that faithfully preserve the differences between coordinated and organic behavior.

Editorial extensions

If this is right

  • If the approach is correct, content-free timing metadata alone can flag coordinated AI-driven misinformation campaigns, bypassing the difficulty of detecting LLM-generated text.
  • The discovered stochastic Petri nets are executable, so a matched campaign can be simulated to forecast how quickly and broadly it would spread before it happens.
  • Because the reported differences appear even when traces are truncated to their first 10 events, the method points toward early detection of coordination from just the opening moments of a retweet cascade.
  • For mixed datasets such as the Brazil election data, the paper suggests that sub-parts of the discovered process models can be inspected individually to isolate bot-like behavior, providing a way to cope with imperfect ground-truth labels.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own truncation results hint that coordination is visible in the leading edge of a cascade; an explicit testable extension would be to measure how early a reliable coordination signal emerges as a function of the number of initial events.
  • The structural separations reported here are discovered post hoc on three datasets; a natural next step would be to use the same features (density, diameter, waiting-time distribution, entropy) as inputs to a classifier trained on labeled traces and validated on unseen countries or platforms.
  • Because the method relies only on retweet identifiers and timestamps, it may transfer to other platforms with similar resharing semantics, such as Mastodon or Threads, though the meaning of 'directly-follows' edges would need re-examination for platforms without strict retweet chains.
  • The authors note that time distributions in social networks can be heavy-tailed, so the fitted exponential-based delays may understate coordination; replacing them with heavy-tailed fits could sharpen the waiting-time signal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 6 minor

Summary. The paper proposes to discover free-choice stochastic Petri nets from social-media retweet logs using the Inductive Miner algorithm, then enrich the discovered nets with arc probabilities and delay distributions estimated from the event data. The resulting models are analyzed through structural measures (graph density and diameter) and behavioral measures (mean user waiting times and Kolmogorov-Sinai entropy). The approach is applied to six Twitter datasets from the UAE, Honduras, and Brazil, with coordinated and uncoordinated behavior defined by the original dataset labels or by Botometer scores. Table 1 reports differences between coordinated and uncoordinated models, and K-S tests on per-user mean waiting times are used to support the separation. The Brazil results run opposite to the UAE/Honduras pattern, which the authors attribute to mixed user types.

Significance. If the claimed separation is robust, the paper would introduce a genuinely new process-mining perspective to the study of coordinated online behavior, with formal semantics for concurrency and choice that go beyond existing graph-based and Markov-chain models. The paper also provides reproducible assets: the code and data are linked in Section 4, the formal definitions are clear, and the use of an established discovery algorithm (Inductive Miner) makes the pipeline easy to replicate. However, the central evidence is currently descriptive and rests on a small number of models, each built from truncated and subsampled logs. The significance therefore depends on whether the reported differences survive sensitivity analysis and out-of-sample validation, which the paper does not yet provide.

major comments (1)
  1. [Section 4, paragraph beginning 'To make Inductive Miner applicable'] The Brazil results are acknowledged to be inconsistent with the UAE and Honduras results: in Brazil, the bot-labeled group has larger waiting times and lower entropy than the non-bot group. The paper explains this by citing the known false-positive/false-negative problem of Botometer and asserts that 'these measures may exhibit inconsistencies'. This is an important caveat, but it also weakens the generality of the claimed behavioral signature. I ask the authors to state clearly which of the three datasets are considered confirmatory and which are exploratory, and to avoid the conclusion that the measures 'consistently characterize bot behavior' without qualifying that this holds only for the two datasets with established ground truth.
minor comments (6)
  1. [Section 4, Figure 5 caption] The caption contains a typo: 'dateset' should be 'dataset'.
  2. [Section 4, last paragraph] The text contains 'Barsil 2 dataset'; this should be 'Brazil 2 dataset'.
  3. [Definition 5] The definition of D as a mapping to 'independent random variables from the set X_D' is underspecified; it would be clearer to define the family of delay distributions (for example, exponential, log-normal, or empirical distributions) and state how the parameters are estimated from data.
  4. [Section 3.3] The construction of the approximating Markov chain is described only verbally; the paper should state explicitly how the transition probabilities P_{i,j} are estimated from event data and how the 'totally connected' version is formed, since the KS entropy value depends on this construction.
  5. [Figures 4 and 5] The two Petri-net fragments are not described in enough detail for the reader to identify the claimed 'flower' loop or the sparsity of the uncoordinated model; adding labels for places and transitions or a zoomed view would improve interpretability.
  6. [Section 4, first paragraph] The sentence 'Consequently, we built two datasets from the the Brazil 2018 election data' contains a duplicated 'the'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper fits stochastic Petri nets to externally labeled event logs and reports fitted structural and behavioral summaries; no prediction is claimed from the fitted values, and no load-bearing self-citation or uniqueness argument is used.

full rationale

The paper's derivation chain is: externally labeled Twitter event logs (UAE/Honduras coordination labels from Cima et al.; Brazil bot-score split) are converted to traces; Inductive Miner discovers a free-choice Petri net per group; the nets are then annotated with arc probabilities and delay distributions estimated from the same logs; and structural (density, diameter) and behavioral (mean waiting time, KS entropy) statistics are read off the annotated models. None of these steps is circular. The labels are not defined in terms of the Petri-net measures, and the measures are not presented as out-of-sample predictions: the text explicitly says the nets were 'enhanced with probabilities and time distributions based on the original event log data' and that entropy was 'calculated ... based on state frequencies and transition probabilities.' Comparing descriptive statistics of models fitted separately to externally defined groups is a standard estimation and comparison exercise, not a reduction of the conclusion to the input. The only potentially problematic choices (truncating traces to 10 events, subsampling 200-400 traces, noise threshold 0.2) affect validity and generalizability, not circularity: the resulting metrics are still computed from the data, not from the labels. The self-citations ([25], [26]) are contextual references to prior agent-mining work and are not load-bearing; no uniqueness theorem from the authors is invoked. Consequently, no specific circular step can be quoted, and the appropriate score is 0.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central results rest on several hand-chosen hyperparameters (noise threshold, trace truncation, subsample sizes, bot score thresholds) and on fitted model parameters (arc probabilities, delay distributions). No new physical or mathematical entities are introduced; the model class is a standard extension of stochastic Petri nets.

free parameters (6)
  • Inductive Miner noise threshold = 0.2
    Set to filter out infrequent behavior in event logs; chosen without sensitivity analysis reported.
  • Trace length limit = 10 events
    Applied to make process discovery computationally tractable; directly affects discovered model structure.
  • Number of traces per dataset = UAE 300, Honduras 400, Brazil 200
    Chosen arbitrarily to keep model sizes manageable; may introduce selection bias.
  • Bot score thresholds = 0.9 and 0.1
    Used to split the Brazil dataset into bot and non-bot groups; thresholds are arbitrary and the paper itself cites concerns about bot score reliability.
  • Arc probabilities = Estimated from event log
    Probabilities on output arcs of places are computed from the same event data used for evaluation, so behavioral measures are directly tied to the fit.
  • Delay distributions = Estimated from event log
    User waiting time distributions are fitted to data, and mean waiting times are derived from these fitted distributions.
assumptions (4)
  • domain assumption Free-choice Petri nets discovered by Inductive Miner adequately represent the coordination structure in retweet event logs.
    The paper relies on this to justify computing structural and behavioral measures from the discovered model.
  • ad hoc to paper Limiting traces to the first 10 events and subsampling the first N traces preserves behavior that differentiates coordinated from uncoordinated users.
    Stated in Section 4; the paper asserts that even the beginning of a trace indicates coordination, but this is not validated.
  • domain assumption A totally connected Markov chain constructed from the reachability graph and transition frequencies approximates the stochastic process well enough to compute Kolmogorov-Sinai entropy.
    Used in Definition 9 and the surrounding text; the entropy is used as a behavioral measure.
  • domain assumption The ground-truth labels in the UAE and Honduras datasets are reliable, while Brazil labels are treated as potentially unreliable.
    The paper uses these labels to define coordinated vs uncoordinated groups; for Brazil it questions the labels after observing anomalous results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Discovering Coordinated Processes From Social Online Networks." pith.science (2026). https://pith.science/paper/ETSXD7YX

@misc{pith2026250612988,
  author       = {Pith},
  title        = {Pith review of: Discovering Coordinated Processes From Social Online Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ETSXD7YX}},
  note         = {Machine review of arXiv:2506.12988}
}
read the original abstract

The rapid growth of social media presents a unique opportunity to study coordinated agent behavior in an unfiltered environment. Online processes often exhibit complex structures that reflect the nature of the user behavior, whether it is authentic and genuine, or part of a coordinated effort by malicious agents to spread misinformation and disinformation. Detection of AI-generated content can be extremely challenging due to the high quality of large language model-generated text. Therefore, approaches that use metadata like post timings are required to effectively detect coordinated AI-driven campaigns. Existing work that models the spread of information online is limited in its ability to represent different control flows that occur within the network in practice. Process mining offers techniques for the discovery of process models with different routing constructs and are yet to be applied to social networks. We propose to leverage process mining methods for the discovery of AI and human agent behavior within social networks. Applying process mining techniques to real-world Twitter (now X) event data, we demonstrate how the structural and behavioral properties of discovered process models can reveal coordinated AI and human behaviors online.

Figures

Figures reproduced from arXiv: 2506.12988 by the authors.

Figure 1
Figure 1. A social network where users B and C follow user A and the dynamics [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. A Petri net modeling the spread of information from user A to users B and C. Figure 1b illustrates a Markov chain rep￾resenting the dynamics of the social net￾work, where states denote its configura￾tions and transitions correspond to user activities. The Petri net, together with its initial marking, that models the spread of information from user A to users B and C is represented in [PITH_FULL_IMAGE:figures/full_f… view at source ↗
Figure 3
Figure 3. A stochastic Petri net for the threshold model. “Black box” transitions indicate silent behavior when the post is not reposted by user B or user C. Threshold models [3], in turn, are used to model concurrent processes within social networks. Consider the social network presented in Figure 1a. In addition to the graph structure of the network, threshold models pro￾vide probabilities that a post will be reposted by fo… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: A fragment of a Petri net discovered from the dataset representing [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: A fragment of a Petri net discovered from the dateset containing un [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: User mean waiting times for process models representing coordinated [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 29 canonical work pages

  1. [1]

    In: BPM 2004

    van der Aalst, W.M.P., Song, M.: Mining social networks: Uncovering interaction patterns in business processes. In: BPM 2004. pp. 244–260. Springer, Berlin (2004)

  2. [2]

    Automatica100, 219–230 (2019)

    Bolzern, P., Colaneri, P., De Nicolao, G.: Opinion influence and evolution in social networks: A Markovian agents model. Automatica100, 219–230 (2019)

  3. [3]

    Knowledge-Based Systems 134, 149–158 (2017)

    Bozorgi, A., Samet, S., Kwisthout, J., Wareham, T.: Community-based influ- ence maximization in social networks under a competitive linear threshold model. Knowledge-Based Systems 134, 149–158 (2017)

  4. [4]

    IEEE Access12, 61568–61585 (2024)

    Cima, L., Mannocci, L., Avvenuti, M., Tesconi, M., Cresci, S.: Coordinated behav- ior in information operations on Twitter. IEEE Access12, 61568–61585 (2024)

  5. [5]

    Decision Support Systems 160, 113819 (2022)

    Cinelli, M., Cresci, S., Quattrociocchi, W., Tesconi, M., Zola, P.: Coordinated inau- thentic behavior and information spreading on Twitter. Decision Support Systems 160, 113819 (2022)

  6. [6]

    Journal of Computational Social Science7(2), 1139–1160 (2024)

    Graham, T., Hames, S., Alpert, E.: The coordination network toolkit: a framework for detecting and analysing coordinated behaviour on social media. Journal of Computational Social Science7(2), 1139–1160 (2024)

  7. [7]

    In: Proceedings of the AAAI Conference

    Hu, B., Sheng, Q., Cao, J., Shi, Y., Li, Y., Wang, D., Qi, P.: Bad actor, good advisor: Exploring the role of large language models in fake news detection. In: Proceedings of the AAAI Conference. vol. 38, pp. 22105–22113 (2024)

  8. [8]

    Engineering Sci

    Karadoğan, A., Karcı, A.: Marked social networks: A new model of social networks based on dynamic behaviors. Engineering Sci. and Technology35, 100924 (2022)

Show all 32 references
  1. [9]

    In: 2024 6th International Conference on Process Mining

    Kirchdorfer, L., Blümel, R., Kampik, T., Van der Aa, H., Stuckenschmidt, H.: Agentsimulator: An agent-based approach for data-driven business process simula- tion. In: 2024 6th International Conference on Process Mining. pp. 97–104 (2024)

  2. [10]

    In: ICPM 2024

    Klijn, E.L., Tentina, I., Fahland, D., Mannhardt, F.: Decomposing process perfor- mance based on actor behavior. In: ICPM 2024. pp. 129–136 (2024)

  3. [11]

    IEEE Access (2025) 12 Anna Kalenkova , Lewis Mitchell, Ethan Johnson

    Kwon, S., Jang, B.: A comprehensive survey of fake text detection on misinforma- tion and LM-generated texts. IEEE Access (2025) 12 Anna Kalenkova , Lewis Mitchell, Ethan Johnson

  4. [12]

    In: Application and Theory of Petri NetsandConcurrency.pp.91–110.SpringerInternationalPublishing,Cham(2014)

    Leemans, S.J.J., Fahland, D., van der Aalst, W.M.P.: Discovering block-structured process models from incomplete event logs. In: Application and Theory of Petri NetsandConcurrency.pp.91–110.SpringerInternationalPublishing,Cham(2014)

  5. [13]

    Information Systems124, 102383 (2024)

    Leemans, S.J., Maggi, F.M., Montali, M.: Enjoy the silence: Analysis of stochastic Petri nets with silent transitions. Information Systems124, 102383 (2024)

  6. [14]

    CoRRabs/2404.03021 (2024)

    Loth, A., Kappes, M., Pahl, M.: Blessing or curse? A survey on the impact of generative AI on fake news. CoRRabs/2404.03021 (2024)

  7. [15]

    online behavior: A survey

    Mannocci,L.,Mazza,M.,Monreale,A.,Tesconi,M.,Cresci,S.:Detectionandchar- acterization of coord. online behavior: A survey. CoRRabs/2408.01257 (2024)

  8. [16]

    Nesterov, R., Bernardinello, L., Lomazova, I.A., Pomello, L.: Discovering architecture-aware and sound process models of multi-agent systems: a compo- sitional approach. Softw. Syst. Model.22(1), 351–375 (2023)

  9. [17]

    Applied Network Science8 (2023)

    Ng, L., Carley, K.: A combined synchronization index for evaluating collective action social media. Applied Network Science8 (2023)

  10. [18]

    Information Systems Frontiers26(2), 443–458 (2024)

    Olan, F., Jayawickrama, U., Arakpogun, E., Suklan, J., Liu, S.: Fake news on social media: the impact on society. Information Systems Frontiers26(2), 443–458 (2024)

  11. [19]

    In: WWW ’24

    Pacheco, D.: Bots, elections, and controversies: Twitter insights from Brazil’s po- larised elections. In: WWW ’24. p. 2651–2659 (2024)

  12. [20]

    Interna- tional Journal of Information Technology16(3), 1333–1345 (Mar 2024)

    Parmar, S., Rahul: Fake news detection via graph-based Markov chains. Interna- tional Journal of Information Technology16(3), 1333–1345 (Mar 2024)

  13. [21]

    ACM Trans

    Polyvyanyy, A., Solti, A., Weidlich, M., Di Ciccio, C., Mendling, J.: Monotone pre- cision and recall measures for comparing executions and specifications of dynamic systems. ACM Trans. Softw. Eng. Methodol.29(3) (2020)

  14. [22]

    PLOS ONE15(10), e0241045 (2020)

    Rauchfleisch, A., Kaiser, J.: The false positive problem of automatic bot detection in social science research. PLOS ONE15(10), e0241045 (2020)

  15. [23]

    Rizoiu, M.A., Lee, Y., Mishra, S., Xie, L.: Hawkes processes for events in social media, p. 191–218. ACM and Morgan & Claypool (2017)

  16. [24]

    In: Business Process Man- agement Workshops

    Rogge-Solti, A., van der Aalst, W.M.P., Weske, M.: Discovering stochastic Petri nets with arbitrary delay distributions from event logs. In: Business Process Man- agement Workshops. pp. 15–27. Springer International Publishing, Cham (2014)

  17. [25]

    IEEE Access9, 99480–99494 (2021)

    Tour, A., Polyvyanyy, A., Kalenkova, A.: Agent system mining: Vision, benefits, and challenges. IEEE Access9, 99480–99494 (2021)

  18. [26]

    In: Business Process Man- agement

    Tour, A., Polyvyanyy, A., Kalenkova, A., Senderovich, A.: Agent miner: An algo- rithm for discovering agent systems from event data. In: Business Process Man- agement. pp. 284–302. Springer Nature Switzerland, Cham (2023)

  19. [27]

    In: WWW’18

    Wang, P., Angarita, R., Renna, I.: Is this the era of misinformation yet: Combining social bots and fake news to deceive the masses. In: WWW’18. p. 1557–1561 (2018)

  20. [28]

    In: 2015 IEEE 12th International Con- ference on Networking, Sensing and Control

    Wang, Z., Wen, T., Wu, W.: Modeling and simulation of rumor propagation in social networks based on Petri net theory. In: 2015 IEEE 12th International Con- ference on Networking, Sensing and Control. pp. 492–497 (2015)

  21. [29]

    Social Network Analysis and Mining 11 (2021)

    Weber, D., Nasim, M., Mitchell, L., Falzon, L.: Exploring the effect of streamed social media data variations on social network analysis. Social Network Analysis and Mining 11 (2021)

  22. [30]

    Pew Research Center (2018)

    Wojcik, S., Messing, S., Smith, A., Rainie, L., Hitlin, P.: Bots in the Twittersphere: An analysis of the links automated accounts share. Pew Research Center (2018)

  23. [31]

    arXiv preprint arXiv:2403.03506 (2024)

    Zeng, Z., Liu, S., Sha, L., Li, Z., Yang, K., Liu, S., Gašević, D., Chen, G.: Detect- ing AI-generated sentences in human-AI collaborative hybrid texts: Challenges, strategies, and insights. arXiv preprint arXiv:2403.03506 (2024)

  24. [32]

    Microelec- tronics Reliability 31(4), 627–644 (1991)

    Zuberek, W.: Timed Petri nets definitions, properties, and applications. Microelec- tronics Reliability 31(4), 627–644 (1991)

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.