Campaign Firewall: inspect coordinated review evidence

Score the signals, then explain the finding

Combine four signal families

Writing patterns, account behavior, peak timing and account relationships contribute to a capped heuristic score. The fixture models 90 days of history; the temporal detector examines peak 72-hour windows. The score is not a calibrated probability.

Require an account relationship

Shared devices or sufficiently overlapping product histories create graph edges. Product overlap requires at least 0.5 Jaccard similarity within the same listing and no more than 72 hours between records. Timing alone creates no link.

Keep the route inspectable

Connected components become campaign clusters when size and cohesion meet configured rules. Deterministic scoring assigns CLEAR, REVIEW or modeled AUTO eligibility before a narrative is written. REVIEW remains a route for human judgment, not a completed investigation.

Preserve evidence behind the prose

The recorded investigation replays a cached Codex response after scoring. A deterministic filter checks numbers, token overlap and verdict reversals; it does not establish every retained sentence as true. JSON retains campaign membership, numeric component scores and an unfiled dispute draft. Printable HTML shows the campaign profile, per-review signal names and the draft; it does not display numeric component breakdowns.

The graph uses interpretable connected-components clustering. No trained graph neural network or production platform integration is implemented in this demonstration.

Follow a review campaign from signals to evidence

All reviews, account histories, devices and platform feeds in these actual application captures are synthetic. The primary example follows 15 modeled competitor reviews from a campaign finding through a human review route to the exported record.

Worked example: 15 plausible reviews, one relationship pattern

The fixture labels this case as an all-human paid campaign, but neither authorship nor payment is established by the detector. Eleven of its 15 reviews have a stylometric component at most 4: little writing-pattern anomaly in this implementation. Their account histories provide the reason to examine them together.

Two synthetic campaign cards: a 67-review cross-platform cluster and a 15-review product-history cluster. — The second card summarizes the 15-review case across 70.8 hours. Its mean confidence label is a heuristic score of 70.3/100, not a probability of fraud. Open the image for full-size inspection.

1. Inspect what links the accounts

The 15 reviews share sufficiently overlapping product histories on the same listing within the configured 72-hour limit. This creates 105 product-overlap pair edges, linking every pair in the cluster, with cohesion 1.0. There are no shared-device edges in this case; the finding does not depend on device reuse. Timing alone would not create an edge.

Coordination graph showing separate 15-review and 67-review synthetic clusters with platform shapes. — The graph displays two clusters and a subset of their edges. Each node represents a review; colors distinguish clusters, not CLEAR and REVIEW routes. The green 15-review cluster is still routed to REVIEW. Open the image for full-size inspection.

2. Compare the text signal with the resulting route

The local text-only baseline flags four of the 15 records. It therefore misses campaign-level detection under this harness's rule that at least 60% of a planted label must be flagged. The ensemble combines writing, behavior, timing and network components and routes all 15 to REVIEW, rather than AUTO.

What the complete synthetic 15-review case establishes
Evidence or decision	Observed result	Interpretation
Writing-pattern signal	11 of 15 have stylometric component at most 4	Low anomaly is not a human-authorship certificate.
Account relationship	105 product-overlap pair edges; no shared-device edges	A shared history pattern supports examining the accounts together.
Local text-only baseline	4 of 15 flagged	This implemented comparator misses the campaign under the 60% rule.
Ensemble route	15 REVIEW; 0 AUTO	All 15 are routed for human judgment. No review is removed.

Eight selected synthetic review rows comparing component signals, REVIEW and CLEAR routes, and text-only baseline decisions. — This selected eight-row comparison illustrates both REVIEW and CLEAR outcomes; it is not the complete 15-review cluster. Amber REVIEW means a route for human judgment. Green CLEAR means below the configured threshold, not independently authenticated. Open the image for full-size inspection.

3. Keep the narrative separate from the decision

Deterministic scoring sets the tiers before the optional model describes the finding. The recorded investigation replays a cached response from the real Codex bridge. Its grounding filter checks numbers, token overlap and verdict reversals; retained prose still needs analyst review and cannot change the score or tier.

Synthetic 15-review investigation with cached Codex provenance, heuristic filter, indicative rule mapping and an unfiled draft. — The investigation preserves the product-overlap evidence and identifies the cached narrative source. The rule mapping is indicative. UI wording such as Platform takedown draft describes an unfiled template, not an executed platform action. The native draft says per-review timestamps are included, but this export contains only a record-generation timestamp, not per-review timestamps. Open the image for full-size inspection.

4. Preserve the finding in an inspectable export

The actual JSON export retains campaign membership, tier breakdown, contributing signals and each record's component scores. The printable HTML renders a campaign profile, the cached narrative, indicative rule mapping, an unfiled dispute draft and all 15 flagged rows. An analyst can check why a record was routed instead of relying only on the narrative. The native dispute draft overstates timestamp coverage: the JSON and printable report include a record-generation timestamp, but no per-review timestamps. Those would need to be added and verified before external use.

This is the application's native printable report rendered from the actual downloaded JSON. All 15 rows remain REVIEW. Confidence values are heuristic scores; the record is descriptive documentation, not proof of a legal violation, a filed dispute or independent custody. The native draft says per-review timestamps are included, but this export contains only a record-generation timestamp, not per-review timestamps. Open the image for full-size inspection.

A cross-platform contrast: positive and negative reviews in one cluster

A separate synthetic cluster links 67 records: 47 five-star reviews on the modeled Amazon competitor listing, plus 12 Google and eight Yelp reviews targeting the modeled brand. Across 71.8 hours, the cluster has 90 shared-device pair edges and 1,175 product-overlap pair edges. It contains 24 AUTO and 43 REVIEW records; AUTO is eligibility under a modeled policy, not automatic removal.

This case shows why a reviewer may need relationships across modeled feeds rather than a count of negative messages alone. Thirty-one of the 67 records have little stylometric anomaly. Even with a connected pattern, the detector does not establish real payment, customer status or guilt.

Synthetic 67-review investigation showing shared-device and product-overlap evidence, cached narrative and an unfiled dispute draft. — The second example combines modeled competitor boosting and brand-targeted reviews across three platform labels. The native investigation identifies the 67-record cluster and retains its relationship evidence. No connector fetches live reviews and no dispute is filed. The native draft says per-review timestamps are included, but this export contains only a record-generation timestamp, not per-review timestamps. Open the image for full-size inspection.

A timing burst is context, not the campaign membership count

The modeled Amazon competitor listing peaks at 69 reviews in a 72-hour window against an expected 7.8, about 8.85 times the configured baseline. That listing-window count is not the 67-record cross-platform cluster size. A burst contributes a temporal signal; account relationships supply the graph links.

Synthetic listing velocity comparison showing an Amazon competitor burst about 8.85 times the configured baseline. — The temporal view compares listing-level peak windows. Its Amazon competitor burst provides timing context, not proof that every review in that window belongs to a coordinated campaign. Open the image for full-size inspection.

Read the same-fixture comparison with its limits attached

The broader fixture contains 1,530 synthetic records across a modeled 90-day history. The following results reproduce the current loaded thresholds on that same labeled corpus. Both methods derive text percentiles from it, and the ensemble REVIEW threshold was fitted on its labels. These are not held-out or production accuracy results.

Current in-sample synthetic comparison
Measurement	Campaign Firewall ensemble	Local text-only baseline
Planted review records flagged	82 of 82	40 of 82
Genuine-labeled records wrongly flagged	0 of 1,448	306 of 1,448
Planted campaign labels detected	3 of 3	0 of 3

Flagging includes REVIEW and AUTO, not removals. The three planted labels form two graph clusters because the boost and mirror labels connect into the same cross-platform cluster. The false-positive contrast applies only to this implemented baseline and fitted fixture, not commercial detectors or new reviews.

What each layer can support

Layer	Useful evidence	Boundary
Local text-only baseline	Writing-pattern anomalies in individual records	Flags four of 15 in the modeled campaign; no commercial-detector claim
Campaign Firewall ensemble	Writing, behavior, timing and account relationships	Routes all 15 for review in this fitted synthetic fixture
Investigation documentation	Membership, component scores, narrative and dispute draft	Supports inspection; neither files a dispute nor proves a violation

What this demo does not do

All review records, account histories, device fingerprints and platform connections are synthetic. The feeds are modeled, with no live connectors or scraped reviews. The demonstration does not authenticate real authors, remove reviews, complete human investigations or file disputes.

No held-out evaluation, production false-positive rate, analyst-hours saving, ROI or dispute success rate has been measured. The same-fixture results show reproducible configured behavior; they do not establish generalization.

Questions buyers ask

Can it find fake reviews that sound like a real person wrote them?

Campaign Firewall combines writing patterns with account behavior, timing and relationship evidence. In one synthetic 15-review campaign, the local text-only baseline flags four records while the ensemble routes all 15 for human review. This modeled case demonstrates coordination detection; it does not establish real human authorship or performance on new reviews.

What evidence connects the accounts to a campaign?

Shared device fingerprints and overlapping product histories create account relationships in the modeled data. Product-history links require a shared listing, at least 0.5 Jaccard similarity and timestamps no more than 72 hours apart; timing alone creates no edge. Campaign membership, component scores and contributing signals remain available in the evidence export.

Does it pull reviews directly from Amazon, Google and Yelp?

The demonstration uses synthetic records and modeled histories labeled for Amazon, Google and Yelp. It has no live platform connectors, scraped reviews or access to real account, device or purchase histories. Production data access, permissions and integrations would need separate implementation and validation.

Will it remove reviews or submit a dispute for us?

Campaign Firewall exports descriptive JSON and printable HTML evidence with an unfiled dispute draft. REVIEW means a human review route, and AUTO means eligibility under the modeled policy. Neither state removes a review, submits a dispute or completes an investigation.

How do I know it will not flag genuine customers?

The current ensemble clears all 1,448 genuine-labeled synthetic records in this fixture. Its review threshold was fitted on the same labels, and both methods derive text percentiles from this corpus, so that result cannot establish a false-positive rate for unseen data. An evaluation on independent data is still needed before using these routes operationally.

Does a flagged campaign prove an FTC rule violation?

Coordination signals do not establish payment, required sentiment, customer status or a legal violation. The FTC distinguishes fake or false reviews from incentives conditioned on positive or negative sentiment and from review suppression. The demo provides indicative rule mapping and an unfiled draft for substantive review; it does not certify compliance.

Legal context: Federal Trade Commission, Consumer Reviews and Testimonials Rule Q&A (checked 2026). The mapping is descriptive and requires substantive legal review before external use.

Believable reviews can still belong to a coordinated campaign.

A plausible message leaves the coordination question open