Instance Admins: Check Your Instance for Vote Manipulation Accounts [PSA]

We have our own astroturfing bots, did we make it?

After digging into it, we banned the two sh.itjust.works accounts mentioned in this post. A quick search of the database did not reveal any similar accounts, though that doesn't mean they aren't there.

My bachelor's thesis was about comment amplifying/deamplifying on reddit using Graph Neural Networks (PyTorch-Geometric).

Essentially: there used to be commenters who would constantly agree / disagree with a particular sentiment, and these would be used to amplify / deamplify opinions, respectively. Using a set of metrics [1], I fed it into a Graph Neural Network (GNN) and it produced reasonably well results back in the day. Since Pytorch-Geomteric has been out, there's been numerous advancements to GNN research as a whole, and I suspect it would be significantly more developed now.

Since upvotes are known to the instance administrator (for brevity, not getting into the fediverse aspect of this), and since their email addresses are known too, I believe that these two pieces of information can be accounted for in order to detect patterns. This would lead to much better results.

In the beginning, such a solution needs to look for patterns first and these patterns need to be flagged as true (bots) or false (users) by the instance administrator - maybe 200 manual flaggings. Afterwards, the GNN could possibly decide to act based on confidence of previous pattern matching.

This may be an interesting bachelor's / master's thesis (or a side project in general) for anyone looking for one. Of course, there's a lot of nuances I've missed. Plus, I haven't kept up with GNNs in a very long time, so that should be accounted for too.

Edit: perhaps IP addresses could be used too? That's one way reddit would detect vote manipulation.

[1] account age, comment time, comment time difference with parent comment, sentiment agreement/disgareement with parent commenters, number of child comments after an hour, post karma, comment karma, number of comments, number of subreddits participated in, number of posts, and more I can't remember.

Thank you for the list, we'll remove the Jlai.lu account

I swear I’m not a bot.

I just had a look at https://lemy.lol/, and they have email verification enabled, so it's not just people finding instances without email check to spam account on there.

@iso@lemy.lol and @QuazarOmega@lemy.lol FYI

I think what we need is an automated solution which flags groups of accounts for suspect vote manipulation.

We appreciate the work you put into this, and I imagine it took some time to put together. That will only get harder to do if someone / some entity puts money into it.

Sigh...

I'll look into it. Thanks for pointing them out.

As an end user, ie. not someone who either hosts an instance or has extra permissions, can we in anyway see who voted on a post or comment?

I'm asking because over the time I've been here, I've noticed that many, but not all, posts or comments attract a solitary down vote.

I see this type of thing all over the place. Sometimes it's two down votes, indicating that it happens more than once.

I note that human behaviour might explain this to some extent, but the voting happens almost immediately, in the face of either no response, or positive interactions.

Feels a lot like the Reddit down vote bots.

How did you discover this? I wonder if private voting will make it too difficult to discover

But this is SOO tedious. The annoying bit is it could just be one person who set it up over a weekend, has a script that they plug into when wanting to be a troll, and now all admins/mods have to do more work.

You're fighting the good fight! So annoying that folks are doing it on freaking lemmy.

Is there any existing opensource tool for manipulation detection for lemmy? If not we should create one to reduce the manual workload for instance admins

What stops the botters from setting up their own instances to create unlimited users for manipulating votes?

I guess admins also have to be on top of detecting and defederating from such instances?

Thank you for your service 🫡

Fedia hiding the activity is one of those things that I kinda dislike, as it was an easy way to detect certain trolls.

@ptz@dubvee.org I have cleaned these and some other bot accounts from my instance. I was ok to open registrations to this point because we were able to get reports for almost every activity and we could easily manage them. But unfortunately Lemmy does not have a regulatory mechanism for votes, so I'll keep it manual approval until then.

Also it looks like they're manually creating accounts since we had captcha + email approval in our instance from the beginning. So this means that even with manual approvals, a botnet can be created – just in a delayed manner.

You should out the users and topics they are engaging with.

I have a manual process for admitting people, do I need to do anything if I know exactly who is on my instance, or do I need to do anything to protect my instance from other bad acting instances (beyond defederating, which I do when I notice a lot of spam). Any queries you recommend?

Hats off, Admiral, thank you for doing your due diligence and sharing with the community.

I see most of them are on the same "lemy.lol" instance.

Users could also be doing and reporting the checking up - if votes were transparent - and they would be able to do it on far wider scale. Oh those leopards, eating your faces, vote obfuscation proponents.

Another data point in favor of supporters of Dead Internet Theory .

Also, this is one more example of why it would be better if instances charged a little bit from everyone: spammers will rather run things from their own machines (or some illegal botnet) than paying something with a credit card.

Is it possible to get a report of which posts are being voted by them?

In case people are wondering these bots are advocating for Kamala Harris.

Dessalines is the developer of Lemmy and occasionally notifies users their posts are being botted

Dessalines notified me on two of my own posts that they were heavily downvoted by low /zero content accounts in the past as well.

Lemmy should have the option to defederate from instances depending on automated criteria. Sign ups without admin checks are a great attribute to use for defederation, because it leads to such abuse. I've finally blocked most communities and instances that have news about US politics and have a clean feed, but for newcomers, that shit is everywhere.

Anti Commercial-AI license

Lemmy should do something like make captcha and email verification the default in the next version, and reject federation from anyone with a lower version. If we accept federation from any instance where this was never turned on, banning accounts one by one is worse than Sisyphean. They'll just keep finding more vulnerable instances that are already trusted and abuse them to spam the rest of the fediverse.

If admins want to manually turn it off, then they should be prepared to manage that.

It's painfully obvious lemmy is overrun with astroturf. Kamala spam has been oppressive and it's just cringe most of the time. I refuse to believe that most of the real users here are that cringe. Also, I support Kamala.