← MIRAGE
Methodology brief · mirage-0.1.0

How MIRAGE works

How a rented crowd is told apart from a real one — and why the result is evidence, not an accusation.

The idea

Coordinated inauthentic behavior leaves fingerprints. MIRAGE reads engagement around a target account across five independent signal families, then asks one disciplined question: do enough of them converge? It works in two directions — Manufactured Popularity (a crowd boosting a target) and Manufactured Hate (a crowd attacking one) — with one engine.

The five signal families
Accountweight 0.2

Creation-date clustering, stock/AI/default avatars, random-digit handles, reused bios, lopsided follow ratios, near-zero original posts.

Contentweight 0.2

Templated replies (normalized edit distance), identical links/hashtags in lockstep, implausibly uniform messaging.

Networkweight 0.3

Co-engagement on the same posts, cluster density, one-directional flow (ring→subject, no reciprocity), shared link infrastructure. Highest weight — the hardest signal to fake cheaply.

Temporalweight 0.15

Engagement spikes with no triggering event, synchronized sub-minute windows, time-zone mismatch vs. the claimed constituency.

Cross-platformweight 0.15

The same narrative or links surfacing across platforms inside a coordinated window.

The convergence rule
band = elevated  ⟺  weighted_sum ≥ 0.5 AND3 of 5 families over threshold
band = moderate  ⟺  some convergence, below the gate
band = low    ⟺  no convergence

The whole point is that no single number convicts. A swarm of new accounts means little on its own; new accounts and templated replies and synchronized timing anda one-directional ring — that converges, and that’s what MIRAGE flags.

Guardrails (enforced in code)
Convergence, not a single tell

A reading reaches "elevated" only when the weighted sum clears 0.5 AND at least 3 of 5 families exceed their thresholds. One strong family is never enough.

Conservative language

Output is always "indicators of coordination" with a band — never "bot," "fraud," or "proven." MIRAGE scores behavior, not identity or intent.

Observe, don't collect

MIRAGE scores only what you paste. It does not auto-fetch, scrape, or bypass anything. Public data and your own observation only.

Privacy floor

An account must engage the same target at least 3 times before it counts as part of a ring. Ordinary one-time engagers are never enumerated; private individuals are never de-anonymized.

Reproducible & signed

Every Discern Report carries a methodology block (weights, thresholds, tool version, timestamp) and a SHA-256 signature over the whole report. Same observations + same config ⇒ same report ⇒ same signature.

Human in the loop

MIRAGE produces evidence. A reporting decision rests with a human, with counsel — it never auto-files or auto-accuses.

Does it work? See calibration →See a worked example →Check an account →

Detection over operation · Evidence over accusation · Document over speculate