Detecting Hashtag Hijacking for Hashtag Activism (2021)

Abstract: Social media has changed the way we engage in social activities. On Twitter, users can participate in social movements using hashtags such as #MeToo; this is known as hashtag activism. However, while these hashtags can help reshape social norms, they can also be used maliciously by spammers or troll communities for other purposes, such as signal boosting unrelated content, making a dent in a movement, or sharing hate speech. We present a Tweet-level hashtag hijacking detection framework focusing on hashtag activism. Our weakly-supervised framework uses bootstrapping to update itself as new Tweets are posted. Our experiments show that the system adapts to new topics in a social movement, as well as new hijacking strategies, maintaining strong performance over time.

## introduction social media has changed the way we live, trade, share news, and engage in social activities. twitter is one of the most popular social networks, where users post short textual messages called "tweets." a hashtag (#) before a particular keyword or phrase in a tweet is used to categorize the tweet, helping users find topics that are of interest to them. one of the achievements of social media is reshaping and re-scaling engagement in social movements via hashtag activism. @xcite defines hashtag activism as large numbers of social media posts using a common hashtagged phrase with a social or political claim. some popular hashtag activism movements include "#metoo," a movement against sexual harassment and assault, and "#black-livesmatter," which campaigns against violence and systemic racism towards african americans. these hashtags help engage people in social movements by raising awareness on a larger scale and by giving opportunities for those with access limitations, like the physically challenged, to participate. unfortunately, hashtag activism is also a good target for spammers. hashtag hijacking occurs when users " @xcite a trending hashtag to promote topics that are substantially different from its recent context" @xcite or "to promote one's own social media agenda" @xcite . while the detection of spam tweets in general is an important issue, the detection of spam related to social movements is of even greater importance because it targets excluded or marginalized groups. we present a weakly-supervised, bootstrapping framework to detect tweet-level hashtag hijacking targeting specific social movements, using a combination of features based on the tweet text, use of other hashtags, replies, and user profile. our experiments focus on #metoo, but our methodology can be applied to any hashtag. prior work on hashtag hijacking has focused on general trending hashtags like #job or #android and could not adapt over time to attacker strategies; these approaches were unable to account for changes in hashtag use over time. ours is the first self-updating approach to be developed for detecting hashtag hijacking at the tweet level. our main contributions are as follows: hashtag hijacking is a relatively new problem, and there is little prior work on the task. previous studies have analyzed cases of political hashtag activism spamming ("hacktivism"), which often involves cyberbullying @xcite @xcite , emphasizing the destructive role of spamming on political movements and protests and how it can change the direction and goals of the targeted movement. lindgren (2019) identifies noise and trolling as the main challenges facing hashtag activism movements, and @xcite discusses on the harmful effects of excessive unwanted information on social media, which can even affect the physical condition of vulnerable users. @xcite evaluate the composition of political networks on twitter; they find that hashtag "hashjacking (encroaching on opposition's keywords to inject contrary perspectives into a discourse stream)" to be one of the main types of strategic political communication on twitter. few studies have investigated computation pipelines to detect hashtag hijacking. prior work focuses exclusively on general trending hashtags and cannot adapt over time to attacker strategies. @xcite proposed an unsupervised framework for detecting hashtag hijacking. they argued that hijacked tweets use different words than do the more common relevant tweets. jain et al. grouped trending hashtags into general categories, such as technology, entertainment, and politics, and calculated words' tf-idf scores at the category level. they then predicted whether or not a tweet using a given hashtag was hijacked based on its word overlap with its category's word list. by using categories, rather than individual hashtags, jain et al. were able to increase the amount of data for calculating their scores, and also to determine which categories of hashtags were more likely to be hijacked. in contrast, our goal is to focus on a specific hashtag associated with social activism. van dam and tan (2016) applied topic learning and time series analysis to the hijacking task for trending hashtags. they analyzed each hashtag's distribution of topics over time: if a hashtag's topic distribution in a one-day window differed significantly from its previous distribution, the hashtag was considered hijacked. van dam and tan's approach operates at the level of hashtags and does not attempt to predict whether or not a specific tweet is hijacked. like jain et al., they assume that a hashtag's topic distribution is constant over time, and that changes in topic indicate hijacking; in contrast, our work assumes that the topics associated with a social activism hashtag can shift over time. virnami et al. (2017) trained a fully supervised neural network to detect hashtag hijacking. they extracted tweet-level features, such as the relatedness among hashtags used and information about the user account that posted the tweet, and trained a feed-forward network to classify tweets as hijacked or not. like jain et al. and van dam and tan, virnami et al. focused on trending hashtags; they used a manually-labeled dataset of ten thousand tweets corresponding to the top ten trending hashtags. like jain et al., virnami et al. treat hijacking as a general problem unrelated to any specific hashtag; their features are independent of the hashtags used in a tweet, allowing them to train a single neural model on a much larger dataset than would be available for any individual hashtag. twitter spam detection is a related area of work. rather than detecting unrelated tweets that hijack a given hashtag, spam detection is a more general task: determine whether or not a tweet is spam, regardless of the hashtags it uses. most existing techniques for spam detection can be categorized into approaches that focus on user-level features to identify spammers @xcite @xcite , those focus on tweetlevel features to identify spam tweets ( @xcite ), and hybrid approaches that use a combination of features based on both tweet and user @xcite @xcite . a related line of research is the relationship between spam tweets and the hashtags they use; @xcite analyzed hashtags in spam tweets based on their frequency, position, orthography, and co-occurrence counts. it is important to emphasize the difference between hijacked and spam tweets. tweets are hijacked in terms of a specific hashtag; not all hijacked tweets are spam. figure 1 shows examples of hijacked #metoo tweets that are not spam in the general sense. ## data we use data from #metoo, a movement used by women to share their experiences with sexual harassment. the online #metoo movement started in october 2017 with actress alyssa milano's tweet about sexual abuse allegations against harvey weinstein. #metoo has since become widespread and a target for hijackers to increase their own visibility and promote their products. ## methodology to detect hashtag hijacking, we present a weaklysupervised, continuously updating approach inspired by the work of @xcite for detecting twitter spam. the system consists of two alternating components, a tweet hijacking classification module and an update module. our hijacking classification module is an ensemble of classifiers initially fit to our seed training set of 2770 snorkel-labeled #metoo tweets. as new #metoo tweets are posted, we collect them using the twitter streaming api, label them using the classification module, and re-fit the classifiers in the update module. we describe the two modules in detail in the rest of this section. ## seed model results and analysis we report the results of our initial seed-trained model on the expert test set. while there aren't existing systems (section 2) that are directly comparable with our framework, we use the closest, jain et al. (2015), as a baseline; van dam and tan (2016) focused on predicting whether a given trending hashtag was being hijacked, rather than detecting individual hijacked tweets, and virnami et al. (2017) required much larger amounts of handlabeled training data than we have available, as well as non-generalizable domain knowledge, like dictionaries of related hashtags and urls. jain et al. detected hijacking for general hashtags using an unsupervised approach. they used tf-idf scores to create a dictionary of common words for each category of related hashtags, arguing that since hijacked tweets are rare, they can be identified as having fewer words in common with their category. to use jain et al.'s approach as a baseline, we use all 14,262 #metoo tweets that we collected, which we treat as a single category, and we collect an additional 500 tweets for each month between october 2017 and november 2019 from each of jain et al.'s categories ( we compare the performance of our seed-trained model with @xcite , as well as random, majority, and minority baselines in ## batch update results and analysis to evaluate how our framework performs over time, we collect all #metoo tweets posted from februrary to may 2020, totaling 122,792 live tweets, and use the batch update module to update the system every 24 hours: we use the previous model to label all tweets posted in the next 24-hour window, update the training set with any new confidently labeled tweets, and retrain the model. for evaluation, we sample 120 live tweets from each month foot_1 , evenly split between predicted hijacked and predicted valid tweets, and we use our expert annotators to obtain gold labels ( the update all strategy also affects the tweet text classifier much worse than it does the stacking meta-learner. the seed training set is constructed to be balanced between hijacked and valid tweets. however, hijacked tweets are much rarer than valid tweets "in the wild," and as the batch update module adds new tweets to the training data, the valid tweets quickly outnumber the hijacked tweets. with this unbalanced training set, the update all strategy results in very high precision and abysmally low recall for the tweet text classifier. again, the stacking meta-learner ensemble is more robust; while its performance using the update all strategy is worse than with no update or update equal, it is not affected as strongly; it is able to lower the weights of classifiers, like tweet text, that become less reliable as the training data grows imbalanced. overall, the update equal strategy performs the best, adding an equal number of hijacked and valid tweets at each batch update to preserve class balance in the training set. figure 5 shows tweets that are labeled correctly by our live update system, but incorrectly by the seed-trained system. figure 5a is correctly labeled as hijacked after live updates, while the seed system is mislead by the political hashtags. figure 5b is correctly labeled as valid by the live update system, while the seed system labels it as hijacked, likely because of hashtags referring to actor johnny depp, coupled with the word "media." ## conclusion we have presented a weakly-supervised, bootstrapping framework to detect tweet-level hashtag hijacking targeting social movements, using a combination of features based on the tweet text, user profile, and other tweet properties. we focus on the #metoo movement, but our methodology can be applied to any movement or hashtag. our approach is not limited to specific contexts and takes into account the changing characteristics of hashtag use over time. to best of our knowledge, this is the first time that a semi-supervised method is used to detect hashtag hijacking at the tweet level. avenues for future work include addressing the class imbalance and error propagation that results in lower system performance over time, as well as exploring other types of classifiers. a potential solution to the error propagation problem may be to use active learning to obtain human-labeled samples at regular intervals to regulate our system. to reduce the expense of such annotation, submodular data subset selection can again be used to choose the most informative examples to label. additional classifiers, such as one that scrapes linked webpages, or one that handles embedded images, could boost the overall performance of the ensemble. we hope that this work encourages others to address the task of detecting tweet-level hashtag hijacking and to develop other weakly-supervised approaches for twitter data.