Optimal Transport-Guided Adversarial Attacks on Graph Neural Network-Based Bot Detection

TL;DR

BOCLOAK is introduced to systematically evaluate the robustness of GNN-based social bot detection via both edge editing and node injection adversarial attacks under realistic constraints and shows that optimal transport provides a lightweight, principled framework for bridging the gap between adversarial attacks and real-world bot detection.

Abstract

The rise of bot accounts on social media poses significant risks to public discourse. To address this threat, modern bot detectors increasingly rely on Graph Neural Networks (GNNs). However, the effectiveness of these GNN-based detectors in real-world settings remains poorly understood. In practice, attackers continuously adapt their strategies as well as must operate under domain-specific and temporal constraints, which can fundamentally limit the applicability of existing attack methods. As a result, there is a critical need for robust GNN-based bot detection methods under realistic, constraint-aware attack scenarios. To address this gap, we introduce BOCLOAK to systematically evaluate the robustness of GNN-based social bot detection via both edge editing and node injection adversarial attacks under realistic constraints. BOCLOAK constructs a probability measure over spatio-temporal neighbor features and learns an optimal transport geometry that separates human and bot behaviors. It then decodes transport plans into sparse, plausible edge edits that evade detection while obeying real-world constraints. We evaluate BOCLOAK across three social bot datasets, five state-of-the-art bot detectors, three adversarial defenses, and compare it against four leading graph adversarial attack baselines. BOCLOAK achieves up to 80.13% higher attack success rates while using 99.80% less GPU memory under realistic real-world constraints. Most importantly, BOCLOAK shows that optimal transport provides a lightweight, principled framework for bridging the gap between adversarial attacks and real-world bot detection.

Figures (10)

• Figure 1: Relationship counts for classified bots in TwiBot-22 by BotRGCN. Counts are computed from the perspective of bot accounts. Each category indicates whether a bot has at least one outgoing or incoming relationship of the specified type. Categories are not mutually exclusive: a single bot may contribute to multiple bars. Misclassified bots are more likely to have edges incident to humans, especially incoming follows.
• Figure 2: Overview of BoCloak. The method learns an optimal transport geometry over $k$-hop neighborhood distributions and uses transport plans to guide sparse, plausible local edge edits for evasion.
• Figure 3: BoCloak pipeline for node injection and node editing. It operates on local neighborhoods rather than individual edges. Boundary bot cloaks are identified in the learned optimal transport geometry and used to guide sparse, plausible edge edits. (a) Injection constructs a new bot with a human-like neighborhood. (b) Editing transforms an existing bot’s neighborhood to induce misclassification.
• Figure 4: Node Injection Attack: Misclassification rate ($\uparrow$, in %) for fifty target nodes by BoCloak against best sota bot detector, BotRGCN. Extended results in App. \ref{['tab:new-node-1']} and \ref{['tab:new-node-def-rest']}.
• Figure 5: Sensitivity Analysis of OT regularizer ($\varepsilon$) and margin threshold ($\tau_{\mathrm{bdry}}$) Misclassification rate ($\uparrow$, in %) for flipping fifty existing correctly classified bots as $\varepsilon$ and $\tau_{\mathrm{bdry}}$ is varied. Extended results in App. \ref{['tab:sensitivity']}.