Node Injection-Based Adversarial Attack and Defense on Social Bot Detection

Social platforms such as Twitter are increasingly threatened by automated social bots, which can manipulate public opinion, spread misinformation, and compromise platform integrity. To detect such accounts, various methods have been proposed, with many recent approaches leveraging graph neural networks (GNNs) due to their ability to model relational structures among users. However, these models may be vulnerable to adversarial perturbations that exploit their structural dependencies. To investigate this vulnerability, we propose a targeted black-box node injection attack that deceives detection models by injecting a new bot near a target bot, causing both to evade detection. This attack is specifically designed to exploit GNN-based model behaviors and does not require any access to model parameters or architecture. Given the success of this attack in exposing structural weaknesses, it is essential to develop effective defenses to improve the robustness of detection models. To this end, we introduce a cost-efficient adversarial training method with reweighted supervision, which selectively emphasizes adversarial samples during learning. This approach improves model robustness without increasing computational cost or requiring additional data. The effectiveness of our attack and defense methods is demonstrated through experiential evaluations conducted on six different models. Specifically, we achieve a maximum attack success rate (ASR) of 95.74% and robustness improvement of 95.74% in Cresci-2015 and achieve a maximum ASR of 97.15% and robustness improvement of 56.20% in TwiBot-22. The detection performance of the models fluctuates less than 2% after adversarial training.