Behavioural, not content: why content-based disinformation detection is collapsing
In short. Most disinformation-detection tools read content - they analyse what is said, using language models, fact-checking and harmful-content classifiers. That approach is collapsing, because generative AI now produces unlimited, fluent, native-language text that content classifiers cannot reliably tell from human writing. The durable alternative is behavioural detection: reading how accounts act - their timing, coordination and network structure - rather than what they post. Behaviour is far harder to fake at scale than content, which is why the field, and the platforms themselves, have pivoted to it.
Why content-based detection is collapsing
For a decade, detecting manipulation online meant reading the manipulation. Natural-language models classified posts as toxic or false; fact-checkers verified claims; harmful-content filters scanned for known patterns. That worked while producing convincing false content at scale was expensive. It is no longer expensive.
Generative AI has removed every constraint content detection relied on. It produces unlimited text, fluent in any language, with no repeated fingerprints to match. Studies of AI-text detectors show they fail on short posts and on text that has been lightly edited or fine-tuned - exactly the material a real operation uses. Fact-checking, meanwhile, is human-paced and after-the-fact: by the time a claim is verified, a coordinated campaign has already achieved its reach. And a growing share of harmful narratives are not even false - they are true or misleading information, artificially amplified, which no fact-checker can flag.
The deeper problem is that content is the part of an operation the adversary fully controls. They choose every word. They can rewrite, translate and regenerate endlessly. Building your detection on the one layer your adversary owns outright is a losing position, and it is getting worse with every model release.
What behavioural detection reads instead
Behavioural detection ignores the words and reads the conduct. An operation, however sophisticated its content, still has to do certain things: create accounts, coordinate their timing, amplify in concert, and interact in patterns that genuine, independent users do not. Those behaviours leave signals that are far harder to fake than text:
- Timing and automation. How machine-paced an account is - the tempo and regularity of its activity - places it on a spectrum from clearly automated to clearly human.
- Coordination. Whether a set of accounts is acting together - synchronised amplification, shared interaction patterns, manufactured momentum - is the signature of an operation, as distinct from a genuine groundswell. This is coordinated inauthentic behaviour, the behavioural signature the method targets.
- Network structure. The shape of who-amplifies-whom reveals a coordinated cluster that content analysis, looking post by post, cannot see.
Two properties make this durable. It is language-agnostic - behaviour looks the same whether the posts are in English, Thai or Bahasa, so translation and multilingual campaigns do not defeat it. And it is evasion-robust - an adversary can rewrite content for free, but coordinating a network while making it look uncoordinated is genuinely costly, because an operation has to coordinate in order to be one.
The field already made this move
This is not a contrarian bet; it is where the evidence and the practitioners have converged.
The platforms enforce on behaviour. Meta has stated on the record that generative AI has not impeded its ability to disrupt coordinated inauthentic behaviour, precisely because its takedowns key on behaviour, not content. The academic literature has pivoted with it: timing-only identification of coordinated influence agents is peer-validated, and the authoritative recent surveys name temporal, multiplatform and hybrid behavioural methods as the open frontier. The canonical coordination method - embedding similarity plus interaction-graph analysis - is the production-proven standard behind real platform takedowns.
There is one honest caveat, and we hold it openly. As AI orchestrators start making per-account timing decisions, the texture of any single account’s behaviour will erode before the geometry of a coordinated network does - because an operation must still coordinate to exist. The right response is to weight network-level coordination above per-account signals, which is exactly where the method is strongest.
How we build it
AI UNITI is built on this thesis. PulseCheck scores accounts on a bot-to-human spectrum from behavioural signals - not content. Signal detects and attributes coordinated narrative attacks by reading coordination and network structure across platforms. Where content authenticity matters - a deepfake at the centre of a campaign - we add it as a corroborating signal through our partnership with a specialist detector as part of synthetic-media detection, but the differentiator remains behavioural: we tell you not just whether a piece of media is real, but whether the network pushing it is acting in concert. Behaviour is the method; narrative threat intelligence is the category.
Frequently Asked Questions
What is behavioural detection?
Detecting manipulation by analysing how accounts behave - timing, coordination, network structure - rather than what they post. It is language-agnostic and resistant to AI-generated content.
Why is content-based disinformation detection failing?
Generative AI produces unlimited, fluent, native-language text that content classifiers cannot reliably distinguish from human writing, and much harmful content is not false but truthfully-amplified - so reading the content misses the operation.
Is behavioural detection better than fact-checking?
They answer different questions. Fact-checking assesses whether a claim is true, after the fact. Behavioural detection assesses whether a coordinated, inauthentic operation is amplifying it, in time to act. For coordinated manipulation, behaviour is the signal that scales.
What is coordinated inauthentic behaviour?
A group of accounts working together to mislead while disguising that they are coordinated or not genuine. It is the behavioural signature that behavioural detection targets.