Predicting Bot Vulnerability from Posting Trajectories: Censored Functional Regression under Informative Sampling

Source: arXiv:2607.29415 · Published 2026-07-31 · By Jake Koerner, Ana-Maria Staicu, Caitrin Murphy, Eric Laber, Mihai Nicola, William Rand et al.

TL;DR

This paper addresses the challenging problem of predicting future susceptibility of social media users to automated "bot" interactions using longitudinal behavioral data that are censored and observed under informative sampling designs. Unlike prior work which either treated censoring or informative missingness separately, the authors propose a unified framework called Scalar-on Censored Informative-design Functional Regression (SoCIFR). This framework jointly models censored functional predictors and the informative observation process through latent functional processes, enabling extraction of low-dimensional, interpretable features for prediction. The methodology is further extended to matched case-control designs and multiple functional predictors. Through extensive simulations and application to a large matched Twitter/X dataset with 9,586 pairs (about 19,172 users) tracked over one year weekly posting features, SoCIFR successfully accounts for bias in estimation and improves prediction of bot susceptibility over naive methods. Key contributions include explicit modeling of missing-not-at-random censoring, inverse-probability weighting in functional principal components estimation, and a novel multivariate decomposition that balances features across censored and observation processes. The predictive models achieve meaningful accuracy, demonstrating the importance of accounting for both censoring and informative sampling in modern digital trace data.

Key findings

• Ignoring either censoring or informative observation leads to biased parameter estimates in scalar-on-function regression with censored trajectories (Fig 3).
• The SoCIFR method achieves higher mean Area Under the Precision-Recall Curve (AUC-PR) compared to random forest and naive logistic regression models across simulation scenarios, with relative gains up to 15%.
• Joint modeling of latent posting activity process and censored posting features enables recovering the true underlying functional trajectories despite missing-not-at-random patterns.
• In the Twitter/X dataset of 9,586 matched pairs observed weekly over 52 weeks, bot-interacting users show increasing posting activity prior to interaction, captured by the latent observation process modeled in SoCIFR (Supplementary Fig S.1).
• Feature extraction via multivariate functional principal component analysis with standardized scores prevents dominant variance components from biasing the predictive model.
• Using SoCIFR-extracted features in a conditional logistic regression that accounts for matching achieves unbiased estimates and out-of-sample predictions in the matched case-control design.
• Inverse-probability weighting based on estimated observation probabilities corrects for sampling bias in covariance function estimation of the latent censored process.
• Monte Carlo integration is an effective approximation for posterior mean estimation of latent functional scores under censoring.

Threat model

Adversaries correspond to automated bot accounts attempting to interact with users and potentially bias user behavior. The threat considered is indirect: users’ posting patterns are observed subject to natural or designed censoring and informative missingness, not that the adversary controls or fully observes the user data. The adversary cannot directly manipulate the latent processes Z or X used for prediction, but produces outcomes (bot interaction) that depend probabilistically on these latent behaviors.

Methodology — deep read

The proposed approach focuses on modeling scalar (binary) outcomes related to bot interaction susceptibility from censored and informatively observed functional predictors derived from longitudinal social media posting data. The threat model involves an adversary that might influence posting behavior but is not explicitly modeled here; instead, informative sampling corresponds to non-random timing of observed posts due to user inactivity or platform mechanisms.

Data were from a matched case-control Twitter/X dataset comprising 9,586 user pairs (bot-interacting users matched to controls on state and account creation year). For each user, three posting features (log post volume, capped '@'-tweet rate, average tweet length) were aggregated weekly over 52 weeks prior to first bot interaction (or matched period for controls). Due to inactivity, '@'-tweet rate and tweet length are missing (censored) during inactive weeks, and sampling is informative via the latent activity process.

The core model assumes two latent functional stochastic processes per user: Z_i(t) underlying the censored functional predictor process W_i(t) (e.g., posting features subject to censoring bounds); and X_i(t) governing the informative sampling/observation process R_i(t), indicating whether user i is observed at time t. Key assumptions include independence between measurement errors and the observation process given latent functions, and conditional independence of the outcome given the latent functions.

Inference proceeds in three stages: (1) Estimation of class-dependent (bot-interacting vs control) latent observation processes X_i(t) by smoothing observations R_i(t) with a Bernoulli GLMM and truncated Karhunen-Loève expansion to estimate eigenfunctions and scores; (2) Recovery of latent censored trajectories Z_i(t) by local weighted likelihood estimation with inverse-probability weighting based on estimated observation probabilities p_i(t), handling censoring via a censored Gaussian likelihood and smoothing mean and covariance functions with penalized splines; scores for Z are predicted via Monte Carlo approximations of conditional expectations; (3) Extraction of low-dimensional, multivariate functional principal component scores combining both latent processes Z_i and X_i after standardization to prevent dominance. These features serve as regressors in a scalar-on-function regression predicting binary outcome Y_i using logistic (logit) link.

Extensions include matched case-control design handled via conditional logistic regression with pair-specific nuisance intercepts marginalized out, and incorporation of multiple functional covariates grouped by censoring/informative sampling mechanism.

The methodology was evaluated through extensive simulations under varying degrees of censoring and informative observation, showing improved parameter estimation accuracy and predictive AUC-PR over competing baselines. In the motivating Twitter/X data application, the method captured key behavioral dynamics and improved susceptibility prediction.

Code implementing SoCIFR was provided openly for reproducibility. Some details, such as hyperparameter tuning for kernel bandwidth and truncation levels for expansions, rely on standard cross-validation or explained variance thresholds. Computational approximations (e.g., Monte Carlo for conditional score expectations) trade accuracy and runtime. Overall, the pipeline enables principled feature extraction from complex censored, informatively sampled longitudinal digital trace data for binary classification tasks.

Technical innovations

• Unified framework SoCIFR jointly models censored functional trajectories and an informative observation (sampling) process via latent processes.
• Inverse-probability weighting integrated into functional principal component analysis to correct biases from informative sampling designs.
• Monte Carlo approximation of conditional expectations for predicting latent functional principal component scores under censoring.
• Multivariate functional principal component extraction combining scaled latent censored and observation processes to prevent variance domination.
• Extension of SoCIFR to matched case-control designs via conditional logistic regression incorporating functional regression features.

Datasets

• Twitter/X matched-pair dataset — 9,586 matched pairs (19,172 users) — Daily posting features aggregated weekly over 52 weeks prior to bot interaction, provided by authors from Twitter/X user metadata and bot interaction labels.

Baselines vs proposed

• Random forest: mean AUC-PR ~0.40 vs SoCIFR: mean AUC-PR up to ~0.46 in simulations (Fig 4).
• Naive logistic regression ignoring censoring/informative sampling: biased parameter estimates with systematic deviations versus SoCIFR which corrects bias (Fig 3).
• Conditional logistic regression with SoCIFR features outperforms unconditional logistic regression on matched data due to proper accounting of nuisance parameters.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.29415.

Fig 1: Weekly “trajectories” of the proportion of tweets containing “@” (top), log tweet

Fig 2: Mean AUC PR for the proposed SoCIFR models (M1–M3) and random forest

Fig 3 (page 30).

Limitations

• The analysis assumes working independence of longitudinal processes within matched pairs, which may be violated in some applications.
• Monte Carlo integration for conditional score prediction incurs computational overhead and approximation error that may affect small-sample performance.
• The proposed model does not explicitly consider dynamic adversarial manipulation or active bot evasion tactics.
• Handling of multiple functional predictors is outlined but not fully evaluated in extensive empirical scenarios.
• No robustness evaluation under sizeable distribution shifts or adversarial data missingness scenarios.
• Model relies on assumption that all relevant predictive information is captured by latent processes Z_i and X_i; misspecification may reduce accuracy.

Open questions / follow-ons

• How to relax the working independence assumption within matched pairs to explicitly model intra-pair functional dependency?
• Can the SoCIFR framework be adapted to model continuous functional outcomes or multiclass susceptibility to different bot types?
• What are the effects of adversarially manipulated missingness patterns or behavior mimicking bots to evade SoCIFR predictions?
• How does SoCIFR perform under domain shifts such as changes in platform posting norms or bot behavior over time?

Why it matters for bot defense

This work is highly relevant for bot-defense practitioners who seek to predict which users are likely to engage with automated accounts based on complex, longitudinal behavioral signals subject to censoring and irregular sampling. SoCIFR provides a principled statistical approach to extract informative features from noisy, biased digital traces, improving classification of bot susceptibility beyond naive methods that ignore censoring or informative observation biases. CAPTCHA and bot-defense systems could leverage such predictive models to identify vulnerable users early and intensify protective challenges or monitoring. Moreover, the matched case-control extension is useful in operational settings where controlled experiment matches are available. The methodology's explicit modeling of sampling bias and missingness improves robustness and interpretability of behavioral risk scores for bot interactions, an important dimension often overlooked in bot detection literature focused solely on account features or network graph measures.

Cite

@article{arxiv2607_29415,
  title={ Predicting Bot Vulnerability from Posting Trajectories: Censored Functional Regression under Informative Sampling },
  author={ Jake Koerner and Ana-Maria Staicu and Caitrin Murphy and Eric Laber and Mihai Nicola and William Rand and Zakaria Babutsidze },
  journal={arXiv preprint arXiv:2607.29415},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.29415}
}

Read the full paper

• arXiv:2607.29415 (abstract)
• arXiv:2607.29415 (PDF)