Disinformation Source Attribution with ML: Tracing Narratives Back to Their Origin

Detection is the easy part. Any competent classifier can flag a piece of content as likely disinformation. The harder problem, and the one that actually matters for intelligence work, is attribution: who seeded this narrative, when, through which channels, and to what strategic end?

Photo by Pixabay on Pexels.

Source attribution for disinformation is essentially a provenance problem. A narrative does not spontaneously generate across fifty Telegram channels simultaneously. It originates somewhere, propagates through specific vectors, and mutates as it travels. The job is to reconstruct that chain.

Why Standard NLP Falls Short

Most off-the-shelf classification models answer one question: is this content false or misleading? That framing discards the forensic signal embedded in how the content was written and distributed. Authorship attribution research has existed in computational linguistics for decades, but applying it to influence operations requires a different set of features.

State-sponsored disinformation has stylometric fingerprints. Word choice distributions, sentence complexity ratios, punctuation patterns, and even subtle translation artifacts (text originally drafted in Russian or Mandarin and then rendered into English carries detectable residue) all carry signal. When you aggregate these features across hundreds of seeding posts, the noise drops and something coherent surfaces.

Vector embedding models trained on large multilingual corpora can cluster documents by latent style rather than topic. Two articles arguing opposite positions can share a common authorship fingerprint if they came from the same content farm. That kind of cross-topic, same-source clustering is invisible to keyword or topic-based approaches.

The Attribution Pipeline

A working attribution system has four distinct stages, and collapsing them together is how most implementations go wrong.

graph TD
    A[/Ingested Content/] --> B(Stylometric Feature Extraction)
    B --> C{Cluster by Authorship Fingerprint}
    C --> D[Timeline Reconstruction]
    D --> E[Infrastructure Correlation]
    E --> F((Attribution Assessment))

Feature extraction comes first. Beyond stylometrics, this includes metadata signals: posting timestamps relative to breaking news events, account creation dates, follower growth velocity, and cross-platform coordination timing. An account that posts within four minutes of a state media outlet publishing a story is telling you something even if the content itself looks organic.

Clustering by authorship fingerprint separates the seeding layer from the amplification layer. Organic amplifiers, people who share content because they genuinely believe it, have different behavioral signatures than coordinated boosters. Distinguishing them matters because it tells you whether a campaign is astroturfing its reach or whether it has achieved genuine traction.

Timeline reconstruction is where graph analysis earns its place. You build a directed graph where edges represent information flow between accounts, weighted by temporal proximity and content similarity. Finding the earliest nodes in that graph, especially those that appear before any corroborating news hook, identifies the injection points.

Infrastructure correlation closes the loop. IP clustering from leaked or scraped data, shared URL shorteners, domain registration patterns, hosting provider overlap: these tie the content graph to real-world infrastructure. A narrative seeded from three accounts sharing hosting infrastructure with a known GRU-affiliated domain is a different assessment than one originating from an unaffiliated network.

The Hard Part: Uncertainty Under Attribution Pressure

Here is where analysts and ML engineers reliably disagree. Policymakers want a clean answer: Russia did this. Model outputs give you probability distributions, not verdicts. The temptation to collapse that uncertainty into a confident attribution claim has caused serious analytical failures before, and it will again.

A well-calibrated attribution system should output something like: 72% probability this narrative originates from infrastructure previously associated with actor cluster X, based on stylometric similarity (high confidence), timing correlation (medium confidence), and infrastructure overlap (low confidence, single data point). Each sub-claim deserves its own confidence weighting. Fusing them into a single number erases the information an analyst needs to assess the strength of evidence.

Confidence decomposition by feature type is not optional. It is the difference between intelligence and guessing.

What Operational Systems Look Like

Production attribution systems at serious organizations run continuous ingestion from dozens of platforms, maintain persistent entity models for known actor clusters, and update attribution assessments as new content arrives. Cold-start attribution on a fresh narrative might take hours. Incremental updates for a recognized campaign can trigger in near-real-time.

The models require ongoing maintenance. Actor clusters evolve their tactics. A content farm that switched to GPT-generated text in late 2024 broke stylometric classifiers trained on human-authored samples. Retraining cadence matters; a model that was accurate eighteen months ago may be confidently wrong today.

The goal is not a black-box verdict. The goal is a structured, auditable evidence chain that an analyst can interrogate, a lawyer can review, and a policymaker can act on. Building that kind of transparent attribution capability is slower than shipping a classifier. It is also the work that actually supports the mission.