Hopfield Networks for Wikipedia Manipulation Detection

Figure 2: Cross-Article Contributor Network. Nodes represent Wikipedia articles within the corpus, sized proportionally to their combined risk score and coloured by risk profile type. Edges connect articles that share at least one common editor among their top five contributors (as identified through MediaWiki API usercontribs queries). Edge colour distinguishes individual editors; thicker edges indicate editors who have been flagged by Wikipedia Sockpuppet Investigation (SPI) process. This network reveals coordination structures that are fundamentally invisible from CSV-derived features alone — an editor systematically editing multiple politically sensitive articles may indicate either legitimate topical expertise or coordinated information operations. The graph layout uses a force-directed algorithm (Fruchterman-Reingold via D3.js) with charge repulsion calibrated to corpus size. Network constructed from MediaWiki API enrichment data. Isolated nodes (no shared editors) are omitted for clarity.

Figure 3: Hopfield Anomaly Detection Matrix. Each row represents an observation (article x month), and each column represents one of six binary Hopfield detectors: Temporal, Network, Contributor, Manipulation, Epistemic, and Volatility. Cells are coloured by detector energy score (darker = higher anomaly energy). The matrix is sorted by descending total anomaly count, then by combined risk score. Multi-detector convergence — where 2+ independent detectors flag the same observation — provides substantially higher confidence than any single detector, as it indicates that anomalous patterns manifest simultaneously across orthogonal feature spaces. The Hopfield network energy-based formulation ensures that stored normal patterns act as attractors: observations that settle into high-energy states (far from any attractor) exhibit behaviour inconsistent with the learned baseline. Hopfield detectors use the Storkey learning rule with feature-specific thresholds (temporal: 0.3, network: 0.25, account: 0.4).

Figure 4: Engine Score Profiles by Risk Cluster. Each radar chart shows the mean engine scores (Temporal, Network, Contributor, Manipulation, Cross-Language Synchrony) for observations grouped by their k-means cluster assignment. Cluster profiles reveal qualitatively distinct manipulation strategies: some clusters exhibit elevated temporal scores (suggesting coordinated editing bursts), while others show network or contributor anomalies (suggesting sockpuppet or single-purpose account activity). The API enrichment layer contributes additional sub-signals to each engine — notably cross-article editor overlap (Network engine) and single-purpose account scoring (Contributor engine) — which were previously unavailable from CSV-derived features. Radar values are mean engine scores per cluster, scaled to [0, 1]. Cluster assignment via k-means (k=5) on z-normalised feature matrix.

Interpretation notes. The governance asymmetry analysis identifies articles where Wikipedia's protective mechanisms (semi-protection, extended-confirmed protection, full protection) were applied with substantial delay relative to the onset of anomalous editing patterns. A governance lag exceeding 30 days suggests that the article was exposed to sustained manipulation before administrative intervention. The enrichment layer provides actual protection log timestamps from the MediaWiki API, replacing the binary proxy used in the CSV-only baseline. Articles with high manipulation scores and absent governance flags represent the highest-risk category: active manipulation with no administrative response.

Figure 5: Pearson Correlation Matrix of Risk Features. The matrix reveals a three-cluster structure in the nine-dimensional feature space, validated across both the Moldova (MD) and Romania (RO) corpora. Pearson correlations computed on raw (un-normalised) feature values. MD values shown first; RO values in parentheses where they differ substantially.