Sock farming is a type of abuse against the Wikimedia community and projects in which a bad actor creates many sock puppets, develops each of them with an editing history, reserves them in anticipation of later misconduct, then deploys them as semi-disposable accounts for some bad purpose. As an example, these accounts might be sold to do undisclosed paid editing or troll a serious community discussion.

Historically sock puppets existed in small numbers as developed by human labor. As machine learning techniques became easier to deploy, sock farming became easier with automatic techniques to create accounts which are mostly automated but pass the Turing test for the growth phase of the fake account life cycle.

1. account creation
   1. Bad actor creates many user accounts as a cohort
   2. Older accounts might be better because they seem more genuine
2. growth phase
   1. accounts have to make edits to seem human and genuine
   2. automated processes, like grammar and spell checking, seem positive and useful but may be machines
3. deployment phase
   1. in the black market, bad actors buy and sell Wikimedia accounts
   2. someone planning misconduct buys an account from a farm
4. misconduct phase
   1. the account is presented as a human who is genuine and merits respect
   2. expecting the assumption of good faith, the bad actor operates the farmed account to do misconduct

Various machine learning projects are identifying what seem to be clusters of sock farmed accounts.

• Similar usernames (repetitive structure, themed naming). Again, this is Not definite proof but it is a possible sign

•Unusual activity - sudden bursts of edits after long dormancy, repetition of stock phrasing, or synchronized participation. Some such accounts have similar edit size or overly generic tone. Possible sign, Not Definite Proof

• Task oriented editing, narrow use, single use accounts, or identical looking user pages. Possible sign

• User page deviations. Accounts may exhibit absence of signatures or descriptions and generally have identical looking user pages. Accounts may also exhibit blank or near blank user pages, default templates / boilerplate content, and similar formatting, sometimes with generic introduction text that is rehashed and reused for other account user pages. Again, this Is Not Enough for accusations, but it can be an identifier / indication.

• The editor / user who wants these sock farmed sock puppets for misconduct will usually assume good faith of other editors and exploit it via minimal editing. Possible sign

Technical analysis is required to definitely prove Sock Farming. Check User inquiries, blocks / range blocks, edit filters, custom scripts, and edit checking tools to check for edit patterns can catch Sock Farming. For the signs of Sock Farming and how sock farms differ, read the text provided above about signs.