Exploring the Impact of Trolls on Activity Dynamics in Real-World Collaboration Networks

When new users join social networking websites, they often form collaboration ties with existing users, which in turn may result in some level of activity on the site. However, for various reasons, new users often fail to create such ties and their contributions to the system's overall activity remain insignificant. For example, on Question and Answering portals, such as the StackExchange network, users collaborate to find the best answers for a given set of questions. However, the intentions of new users are highly diverse. While the contributions of most users positively impact the evolution of a community, other participants might just try to steer discussions off-topic or purposely generate discord. To better understand such malicious behavior, it is important to model and quantify the impact of such users on the overall activity in collaboration networks. In this paper we simulate and investigate the influence of trolls---users who intentionally contribute detrimental content---on the total activity of several different StackExchange instances, Semantic MediaWikis and Subreddits. The contributions of this paper are three-fold. First, we simulate activity dynamics in the context of trolls in online collaboration networks. Second, we analyze and quantify the impact of trolls on the levels of activity in these networks. Third, we discuss our results and put them into a real-world context.


INTRODUCTION
The success of online platforms and communities is often determined by the number of unique active users over an arbitrary time span. Further, on many successful websites users rarely act on their own-instead they form connections with other users and develop a sense of belonging to a specific community. However, activity (and hence, the number of active users) on such websites is influenced by a plethora of highly diverse extrinsic and intrinsic factors. For example, whenever new users join, the overall activity of a collaboration network might change depending on those new users' intentions. In . particular, newly joined trolls-users that consciously contribute detrimental content-could lead to a decline of productive contributions in networks. Modeling and quantifying the influence of trolls and their implications on the overall levels of activity would allow website operators (i) to uncover and measure the resilience of their collaboration networks against trolls, (ii) estimate the impact of a systematic attack of trolls and (iii) help them to make informed decisions to sustain a positive evolution of their websites.
In this paper, we make use of dynamical systems on networksin the form of the Activity Dynamics framework 1 [19]-in a novel application and context to model and simulate the emergence of trolls in collaboration networks. This framework is based on the formalism of dynamical systems on networks, consisting of a set of coupled (differential) equations that determine the change in user participation over time. We conduct a total of two different experiments, each of them following a different strategy to uncover different aspects of trolls in real-world collaboration networks. To that end, we define trolls as users that intentionally contribute detrimental content-represented as negative activity-that needs to be compensated by existing users to prevent declines in productive activity. For each experiment we perform a (i) random and (ii) informed selection of users that newly joined trolls will connect to and investigate the resulting differences in activity and affected users. We apply these experiments on a set of two real-world Question and Answering datasets from the StackExchange Web portal, two Semantic MediaWikis, as well as two Subreddits to demonstrate the general applicability of the Activity Dynamics framework.
The contributions of this paper are three-fold. First, we present a novel application for the Activity Dynamics model to simulate the impact of trolls on activity dynamics as well as the levels of overall activity in empirical collaboration networks. Second, we analyze and quantify the impact of each experiment on the overall activity of the corresponding collaboration network. Third, we discuss the influence of trolls on existing users and put our results in a real-world context.

RELATED WORK
In general, a dynamical system represents any system that changes in time with some predefined behavior (i.e., by a set of rules or a set of equations). In particular, dynamical systems (on networks) are often used to define the microscopic behavior of the nodes (i.e., users) of a network and investigate the macroscopic impact and influences. Especially in a non-network context, dynamical systems have received a lot of interest from scientists and engineers in the past. We can distinguish between continuous and discrete, as well as between deterministic and stochastic dynamical systems. As the topic of dynamical systems is quite comprehensive we would like to point the interested reader towards Strogatz [17] and Barrat et al. [2] for exhaustive introductions into the field. Different applications of dynamical systems, within the context of the Web, cover the analysis and understanding of various different information diffusion processes in online social networks [12,18], such as the analysis of online memes and viral marketing [10,11]. Iribarren and Moro [7] have conducted an experiment, involving e-mails with "viral" content, that allows them to track the diffusion of information in a social network. They were able to reveal that information diffusion in social networks can not be modeled with a simple growth equation from epidemic models.
Further, epidemic models represent special cases of dynamical systems [14]. Similarly to human diseases outbreaks, researchers have made use of such epidemic models to simulate the spread for various properties in different kinds of networks. For example, for modeling how computer viruses spread in computer networks [8,15] or for modeling the propagation of information in social networks (e.g., memes) [10]. Ribeiro [16] conducted a detailed analysis of the daily number of active users for specific websites by fitting a model to predict if a website has reached self-sustainability. Other methods, besides dynamical systems on networks, such as random surfer models or critical mass theory, have been used to investigate user behavior in online collaboration networks [20,9,6,5].
The Activity Dynamics model [19] we use to simulate activity is based on the formalism of dynamical systems on networks. We strongly believe that the presented novel application of the model represents a first stepping-stone towards a new line of tools that allow website administrators to analyze activity dynamics as well as a new opportunity to broaden our understanding of the intricate dynamics of activity in collaboration networks.

MATERIALS & METHODS
First we start by characterizing the datasets followed by a brief introduction into the methodological background of the Activity Dynamics model and an outline of the simulation process.

Datasets
We extracted and prepared a set of two different instances of the StackExchange (Bitcoin 2 and English 3 ) network, two different Semantic MediaWikis (DotaWiki 4 and NeuroLex 5 ), as well as two different Subreddits (r/Austria 6 and r/StarWars 7 ) of the social news aggregation site Reddit (see Table 1).
In this paper, we define user activity as either posts or replies. In particular, posts for the two StackExchange networks are defined as asking questions, while replies consist of answers and comments. For the two Semantic MediaWiki instances we have defined the creation of an article as a post, while edits to existing articles represent replies. For our two Subreddit datasets we define submissions as posts and comments to submissions (or comments) as replies.
We perform our analysis on collaboration networks, which consist of nodes representing users and collaboration edges. Collaboration edges for the StackExchange datasets are created whenever two users either post an answer to a question, or comment on an answer or a question of each other. For the Semantic MediaWiki datasets, we create edges between two users if they worked on the same article. Edges in Subreddit datasets are created when two users comment on submissions or comments of each other.
All six datasets exhibit long-tailed degree distributions, meaning that there are only a few users with many collaboration edges and numerous users with only few connections. Detailed characteristics of the different datasets can be found in Table 1.

Simulation Model
The Activity Dynamics framework [19] models activity in online collaboration networks using the formalization of dynamical systems on networks. In this model, activity is represented as a continuous real-valued variable x i that is evolving on node i over dimensionless time τ: Intrinsic Activity where A is the adjacency matrix of our network with A i j = 1 if users i and j are connected by a collaboration edge and A i j = 0 otherwise. As a simplification, and to improve computation times, the model assumes that the functions for intrinsic activity evolution as well as peer influence are identical for all nodes and pairs of nodes  respectively. In particular, the Activity Dynamics model builds upon the following two opposing principles: Intrinsic Activity Decay. Users have a tendency to reduce activity if no external incentives or impulses are provided until they exhaust all of their activity-based resources [4]. This decay is modeled as a linear function where λ represents the Activity Decay Rate-the rate at which users reduce their activity per unit time, given a complete absence of other (positive) incentives. Positive Peer Influence. Users in online social networks have a tendency to copy their peers [3,1]. For example, having very active neighbors, users are likely to increase activity as well. The rate at which activity is transferred from active users to their neighbors is defined as µ-the Peer Influence Growth Rate. The maximum amount that is transferred per period of time is naturally limited by the shape (sigmoid) of the peer influence function. Model Parameter Estimation. We estimate the parameter that is required to configure our model-the ratio λ µ , describing how fast users intrinsically lose activity compared to how fast they get it back from their neighbors-using a least-squares approach, given a set of empirically observed activities. In particular, we use a total of 4 data points (i.e., weeks) to estimate the best-performing ratio and predict activity for the immediately succeeding week. For more details see Walk et al. [19] and Newman [13]. Activity Dynamics Simulation. We limit our datasets to only include posts and replies performed within the last 55 weeks of our observation periods and we set our time spans to t = 1 week (meaning that posts and replies are aggregated for each week). Using a rolling-window of 4 weeks to fit our model and predicting the succeeding week, we simulate activity for a total of six different datasets. Figure 1 illustrates an example of these activity simulations for the BitcoinStackExchange network. Other networks exhibit similar performance as depicted by the normalized RMSE (NRMSE; smaller values indicate better performance) in Table 1.
All experiment simulations presented in this paper start at the beginning of week 40-marked with a dashed vertical black linemeaning that the first simulated result of each experiment starts at week 41 and lasts until week 52. To simplify calculations, we use static collaboration networks, representing the state of collaborations at the end of our observation periods. Additionally, we preprocess our datasets by applying a rolling mean of 7 days to smoothen activity. We then aggregate the smoothed activity per user and per calendar week and remove users that have contributed less than one post or reply during the extracted 55 weeks.

EXPERIMENTS & RESULTS
Simulation setup. We simulate the impact of trolls by selecting different users that are affected by them. During our simulations we monitor the impact of unproductive activity-represented as negative activity of the trolls-that is injected into the system. Additionally, we disable the intrinsic activity decay for trolls, arguing that they are fully committed to their cause and do not lose interest in contributing detrimental content. This means that trolls spread unproductive (negative) activity throughout the network via their peer influence, but simultaneously receive positive activity from their neighbors, working off the trolls' negative activity over time.
Once users fully compensated a troll's negative activity (i.e., the trolls activity is brought to 0), we remove the node from the network.  , the number of users infected by trolls (red lines), and the overall activity level (green lines) for our Adding Trolls experiment, respectively for the informed (solid lines) and random (dashed lines) approach. Randomly attaching trolls to users in our empirical networks only has a minor impact on overall levels of activity. After a certain tipping-point, the informed approach managed to collapse the core of some datasets, dampening or ceasing productive activity. The amount of users affected or infected by trolls is steadily increasing with higher numbers of trolls in the random approach, whereas these numbers abruptly increase in the informed approach.
We select users that trolls connect to in two different ways: First, we perform a random selection of a given number of users. Whenever we randomly select users, we repeat the experiment 10 times and report average values as results. Second, we preferentially select high-degree (most collaboration edges) users. No repetitions are performed for this kind of experiment as the sequence of selected users does not change. We call this informed selection of users. Note that due to our long-tailed degree distributions across all networks, randomly selected users are more likely to have a small number of collaboration edges.
We conduct a total of two different experiments where we evaluate the impact of trolls by investigating the number of users that have been affected by trolls (i.e., received unproductive activity as peer influence), the number of users that have been infected by trolls (i.e., stopped contributing productively and started spreading negative activity themselves), and the overall activity in the network. We collect these values at the end of our simulations at week 52.

Adding Trolls
For our first experiment, we simulate and measure how different numbers of trolls affect activity and users in online collaboration networks. To that end, we split this experiment into two parts. First, we add a small amount of a total of 0.25%, 0.50%, and 1.00% new users, which are initialized as trolls, and investigate their impact on the overall activity levels at the beginning (week 40) and end (week 52) of our simulations (see Figure 2). Second, we increase the number of trolls in increments of 0.10% until we reach a maximum of 5.00% of existing users. For each iteration, we simulate the relative impact of trolls from week 40 to week 52 (see Figure 3). Further, we set each troll's initial activity to −5 (this can be interpreted as, for example, five detrimental posts) and randomly/informed connect them to the existing users. The number of trolls' connections equals the mean degree of a given network. That way, we achieve similar exposure of our trolls across all datasets. Further, we stop our simulations if each user in the network has an activity < 1, meaning that all users spend all of their time coping with the trolls. Results. For four of our six datasets and smaller numbers of trolls (0.25%, 0.50% and 1.00%), activity within the first three weeks is negatively affected when randomly adding trolls (41 to 43; see Figure 2). On the other hand, when targeting well-connected users in the informed selection, activity levels are not influenced. At the end of our simulations for all datasets and a small number of trolls (informed and random at week 52; not depicted in Figure 2), all networks are able to recover and exhibit little deviation from unaffected activity levels.
When incrementally increasing the number of trolls added to a community, we can observe that the informed approach affects activity faster than the random approach (cf. Figure 3). For example, the BitcoinStackExchange (Figure 3(a)) network only needed 4.00% of added trolls (informed) to reduce the activity of each user to < 1. However, the number of affected and infected users, at first, increases faster when randomly connecting trolls while activity at the end of our simulations is only minimally influenced. The other datasets follow analogously, except for r/StarWars (Figure 3(f)), where activity steadily decreases. Discussion. Whenever a small number of trolls randomly attaches to users of our networks, we can observe larger drops in activity than when they target high-degree users (see Figure 2). As wellconnected users receive and exercise more peer influence and are typically more active, they can better compensate the negative influence of the added trolls, rendering their influence negligible. Further, the influence of randomly added trolls only occurs in the immediate vicinity of the start of our experiments and vanishes over time, as users start to work off, through positive peer influence, the impact of trolls.  However, there appears to be a tipping point (a phase transition) where high-degree users (e.g., around 4.00% of added trolls for Bitcoin StackExchange; see Figure 3(a)) become infected, can't compensate for the negative influence of the trolls and start to spread unproductive activity throughout the whole network. Once that tipping point is reached, the whole network engages in unproductive activity. In turn, when trolls connect to random users they are likely to attach to ones in the network's periphery, as the degree distributions of all networks exhibit a long tail, meaning that there are proportionally large amounts of sparsely connected users. These users typically do not exhibit high activity levels and therefore take longer to compensate for the negative influence of trolls.
In a real-world context, we interpret this experiment as trolls spamming discussion boards or comments on a weblog. With the intention to inject large amounts of unproductive activity, trolls seek to end all user participation. This way, we can learn how many trolls it would need to affect each user and spread their content through the whole network.

Increasing Trolls' Exposure
In this experiment we introduce a total of 1.00% of existing users as trolls and change the amount of users that our trolls connect to. This will allow us to examine to which extent users can resist the detrimental content of trolls. To that end, we start our experiments with a total of 10 connections per troll and increase this amount by increments of 10 until trolls are either connected to a maximum of 500 users or to all existing users of the collaboration network. Due to the size of some of our datasets, we decided to use absolute numbers for this experiment (e.g., 1.00% of added edges for r/StarWars would equal a total of > 2, 000 edges). As previously, we set the initial activity of the trolls to −5 and we stop the simulations as soon as each user in the network reaches an activity < 1.
Results. The results for this experiment are depicted in Figure 4. For BitcoinStackExchange (Figure 4(a)) the random experiment stopped at 270 connections per introduced troll, as activity for each user in the network was smaller than 1. In contrast, trolls in the informed approach only needed 250 connections to reach this point. While the amount of affected and infected users increased continuously for the random approach, numbers decreased at 70 connections and began to increase again after 80 connections (marked with A in Figure 4(a)) during the informed simulations. In contrast, r/Austria (see Figure 4(c)) only ceased all productive activity with trolls randomly connecting to 410 users. For both of our Semantic MediaWiki datasets (Figures 4(b) and 4(e)) we had to abort simulations early due to the small number of users to connect trolls to. Here, overall activity was not affected at the end of simulations even though 100% (DotaWiki) and 96.49% (NeuroLex) of users have been affected by the trolls. The number of introduced trolls did not manage to increase the number of infected users when increasing connections for both approaches (area marked with B in Figures 4(b) and 4(e)). Similarly, the EnglishStackExchange (Figure 4(d)) did not encounter changes in overall activity, but exhibited the same temporary decrease of affected users as BitcoinStackexchange around 380 connections. In contrast, r/StarWars (Figure 4(f)) was more effectively influenced by the informed approach, where only 40 connections per troll were needed to end productive activity and infect almost all existing users within the network (area marked with C in Figure 4(f)). However, in the random approach, users managed to resist the trolls for up to 350 connections after which the users in the network slowly succumbed and started to reduce productive activity. Note that at 500 connections per troll, more than 80% of all users have been infected but still create productive activity. Discussion. The results of this experiment suggest that users are more effectively influenced by trolls that are randomly connecting to existing users. Similar to the Adding Trolls experiment, highly connected and more active users can better compensate for the impact of trolls. However, we again observed a tipping point, at which the right number of informed selected users collapses a network. For example, r/StarWars, where the number of added trolls at 1.00% (311) is high enough to infect and collapse the core of the network, instantly diffusing unproductive activity throughout the whole network. Furthermore, high-degree users in BitcoinStackExchange, EnglishStackExchange and r/Austria temporarily managed to reduce the influence of trolls as the number of negatively affected users decreases at certain amounts of connections (see areas marked with A in Figure 4). However, once the trolls connect to larger amounts of high-degree users, the number of affected users increases again. It appears as if the number of informed selected users and their activity is crucial for the trolls' ability to affect existing users in networks. For example, 10 users with high levels of activity at the time the trolls connect to them can better compensate for the trolls' detrimental content than 10 users with low activity.
To put this in a real-world context, we argue that a small amount of trolls either sends private messages to users in the periphery of collaboration networks or posts a new topic that addresses to highly active users. This experiment allows us to learn to which extent the users in networks can be exposed to trolls before they start to collapse.

CONCLUSIONS & FUTURE WORK
In this paper we simulated and investigated the impact of trolls in online collaboration networks. Our results showed that small amounts of trolls have a higher impact when connecting to users in the networks' periphery, as those users receive and exercise less peer influence and cannot compensate for the negative influence of trolls as well as highly connected and highly active users can. However, larger amounts of trolls influence activity levels more when performing informed selection of high-degree users. While these users-building the core of the networks-are able to compensate for the trolls' influence longer, overall activity is drastically reduced once high-degree users are infected and start spreading unproductive activity themselves. Additionally, there appears to be optimal upper thresholds of users that can be targeted by a single troll to maximize impact in the form of affected and infected users. If the number of the trolls (or the negative activity) is not large enough and activity is more equally distributed across users, increasing the number of targeted (i.e., connected to) users might even dampen the impact of trolls.
For future work we plan on further extending this analysis by crawling and adapting our model towards simulating empirically observed events of online vandalism (e.g., Wikipedia) and spam (e.g., deleted posts on StackOverflow or Reddit).
We strongly believe that the presented analyses of two different experiments regarding trolls represents a very important first stepping stone towards a new line of tools, methodologies and models to simulate the impact of internal and external factors on activity dynamics of collaboration networks.

ACKNOWLEDGEMENTS
Parts of this work were funded by the KONDE project of the Austrian Federal Ministry of Education.