Online news comment sections can become flashpoints during elections and national crises, where arguments over politics, identity, and social issues rapidly spread across gender, generational, and ideological lines. Researchers at the Korea Advanced Institute of Science and Technology (KAIST) have now developed an artificial-intelligence system designed to detect a more organized force behind some of these disputes: foreign-linked online influence operations. By examining 110 million comments posted on Naver News across two decades, the system identifies suspicious accounts, maps their behavior, and explains the linguistic and emotional signals behind its decisions.
The research was conducted by a team led by Professor Wonjae Lee of KAIST’s Graduate School of Culture Technology, Professor Meeyoung Cha of KAIST’s School of Computing and the Max Planck Institute for Security and Privacy, and Professor Alice Oh of KAIST’s School of Computing, in collaboration with Professor Thorsten Holz of the Max Planck Institute. Their goal was not simply to create another automated blacklist. Instead, they sought to build an explainable detection framework capable of showing why a particular account or comment might be associated with an influence operation, a coordinated effort to shape public opinion or intensify social conflict.
The researchers began with 70 foreign-linked accounts previously identified by South Korea’s Institute for National Security Strategy. These accounts served as starting points for tracing networks of related activity. The team searched for users who repeatedly interacted with the same news articles, exhibited links to the initial accounts, or displayed similar patterns of posting. The resulting dataset included approximately 110 million Naver News comments published between 2006 and 2025, allowing the researchers to study behavioral changes and recurring communication strategies over an unusually long period.
The AI system evaluates suspicious activity through three interconnected stages. First, it searches for indicators that an account or author may be connected to a foreign source. These indicators can include network relationships, synchronized behavior, unusual activity patterns, or repeated interactions with other accounts under investigation. Second, the system analyzes the emotional and rhetorical characteristics of comments, looking for expressions that may encourage polarization, including moral condemnation, hostility, exaggerated praise, or language designed to provoke outrage. Finally, it examines the direction of that emotional framing, identifying which country, political group, public figure, or social target is being praised or attacked.
A central feature of the system is its ability to provide evidence rather than merely assign a label. When the model identifies a potentially coordinated account, it highlights phrases that contributed to the decision and combines the linguistic findings with behavioral measurements. These measurements include how frequently an account posts, how long it remains active, and whether its activity overlaps with other suspected accounts. This combination of natural-language processing and network analysis allows investigators to examine both what an account says and how it behaves within the wider online ecosystem.
Across roughly four million Naver News users, the model identified 23,998 accounts whose activity patterns were consistent with suspected public-opinion manipulation. The result does not mean that every identified account was definitively operated by a foreign organization, nor does it establish that every comment represented an organized attack. Rather, the system generates an evidence-based pool of accounts for further examination. The researchers emphasize that explainability and human review are essential, particularly because automated systems can misinterpret satire, political activism, coordinated grassroots campaigns, or intense but legitimate public debate.
The analysis produced an unexpected picture of the suspected influence strategy. Instead of consistently promoting one political party or openly praising a foreign government, the accounts appeared more focused on increasing confrontation within South Korean society. Among the ten targets that received the highest levels of public engagement, measured through likes and other reactions, seven were major domestic political figures. The targets included former and current presidents, presidential candidates, and political parties from both progressive and conservative camps, suggesting that the objective was not necessarily to secure victory for one ideological side.
According to the research team, this pattern is consistent with a strategy sometimes described as “divisive” or “polarization-based” influence. Rather than persuading citizens to support a single alternative, such campaigns seek to reduce trust, intensify hostility, and make opposing groups view one another as irreconcilable. Comments criticizing South Korea or domestic political figures often attracted greater visibility than messages directly praising foreign countries. This finding suggests that influence operations may be more effective when they blend into existing social tensions instead of presenting themselves as obvious foreign propaganda.
The researchers say the technology could be used by online platforms, election-monitoring organizations, and public institutions to prioritize investigations during elections or periods of national emergency. It could help identify sudden influxes of coordinated accounts, detect attacks directed at political figures, and reveal the language most closely associated with emotional escalation. However, the team warns that the AI should not be used to automatically remove or block users. Its intended role is to support expert reviewers by organizing large volumes of evidence and drawing attention to patterns that would be difficult to detect manually. The study, led by KAIST researchers Jaehong Kim and Hyeonseung Kim as co-first authors, is scheduled for presentation at the USENIX Security Symposium 2026. The paper argues that defending the digital public sphere requires not only faster detection, but also transparent reasoning that allows investigators and the public to understand how suspicious behavior is identified.
Subject of Research: AI detection of foreign-linked online influence operations and coordinated opinion manipulation in news comments.
Article Title: Cross-National Information Attacks: A Two-Decade Analysis of Troll Behavior in Korea
News Publication Date: 22-Jun-2026
Web References: https://doi.org/10.48550/arXiv.2606.22785
References: arXiv preprint; scheduled presentation at the USENIX Security Symposium 2026.
Image Credits: KAIST
Keywords
Artificial intelligence, online influence operations, foreign interference, misinformation, political polarization, social media analysis, explainable AI, natural-language processing, network analysis, cybersecurity, Naver News, troll detection, Korea, coordinated behavior, digital trust
