My Brother Helps Me: Node Injection Based Adversarial Attack on Social Bot Detection

TL;DR

This paper introduces a novel black-box node injection attack on social bot detection models using graph neural networks, demonstrating high success rates and low detectability on real-world datasets.

Contribution

It is the first to explore graph node injection as an adversarial attack against social bot detection, including an attribute recovery module for effective manipulation.

Findings

Attack success rate exceeds 73% on tested datasets.

Injected nodes are detected as bots less than 13% of the time.

Effective in deceiving multiple GNN-based detection models.

Abstract

Social platforms such as Twitter are under siege from a multitude of fraudulent users. In response, social bot detection tasks have been developed to identify such fake users. Due to the structure of social networks, the majority of methods are based on the graph neural network(GNN), which is susceptible to attacks. In this study, we propose a node injection-based adversarial attack method designed to deceive bot detection models. Notably, neither the target bot nor the newly injected bot can be detected when a new bot is added around the target bot. This attack operates in a black-box fashion, implying that any information related to the victim model remains unknown. To our knowledge, this is the first study exploring the resilience of bot detection through graph node injection. Furthermore, we develop an attribute recovery module to revert the injected node embedding from the graph embedding space back to the original feature space, enabling the adversary to manipulate node perturbation effectively. We conduct adversarial attacks on four commonly used GNN structures for bot detection on two widely used datasets: Cresci-2015 and TwiBot-22. The attack success rate is over 73\% and the rate of newly injected nodes being detected as bots is below 13\% on these two datasets.