A General Black-box Adversarial Attack on Graph-based Fake News Detectors

1 Introduction

The rapid expansion of online social media platforms has led to a rise in misinformation, undermining public trust in truth and science. Unlike traditional media, where content is often rigorously fact-checked, the interactive nature of social media accelerates the spread of fake news through commenting and sharing, magnifying its impact. This makes detecting and countering fake news on these platforms both challenging and crucial [A¨ımeur et al., 2023; Cheng et al., 2024].

To tackle this challenge, abundant machine-learning methods are proposed for fake news detection. Besides utilizing single-modal or multi-modal detectors to extract features from content [Dong et al., 2023; Hua et al., 2023; Dong et al., 2024], there is a growing interest in conceptualizing the online social network as a graph structure to leverage the rich social context [Phan et al., 2023;

∗Corresponding author.

Yin et al., 2024]. Among existing studies, the user-news bipartite graph is commonly used for detectors to model user engagement [Nguyen et al., 2020; Wang et al., 2023a; Su et al., 2023]. Besides, the news engagement graph can be constructed to explore relations between news directly [Wu and Hooi, 2023]. Instead of capturing information in the global network, the news's local propagation structure is also investigated. The news-post propagation and dispersion tree [Bian et al., 2020] are constructed to aggregate information from two directions, while the news-user propagation tree [Dou et al., 2021] is constructed to capture user-aware in the propagation structure. Due to the diversity of the graph construction, Graph Neural Network (GNN) is allowed to learn distinctive news embeddings from different perspectives for news classification. Despite their effectiveness in detecting fake news, these detectors have increasingly been found to be vulnerable to adversarial attacks [Wang et al., 2023a]. This vulnerability may be utilized to manipulate public opinion or gain financial benefits. Therefore, it is critical to investigate adversarial attacks on GNN-based fake news detectors to assess and enhance their robustness.

Existing adversarial attacks on GNN are primarily categorized into two types: edge perturbation and node injection. Edge perturbation techniques aim to alter the model's prediction by adding or removing edges in the graph [Z¨ugner et al., 2018; Li et al., 2021; Zhang et al., 2023], while node injection approaches focus on generating and introducing malicious nodes into the graph [Tao et al., 2021; Wang et al., 2022; Zhu et al., 2024b]. Although these methods show promise when the target graph is exposed, their efficacy diminishes in a more realistic black-box setting where the graph construction process is unknown. Given the vast differences in fake news detectors based on various social network structures, assuming a certain graph to conduct attacks becomes impractical for attackers. This situation leads to a crucial question: Is it possible to develop a universal attack strategy that remains effective in a black-box scenario against fake news detectors based on diverse social network structures?

In this paper, we propose a General Attack via Fake Social Interaction (GAFSI) against GNN-based fake news detectors, aiming to alter the prediction of the target news. Unlike existing studies, that are concentrated on a certain graph, we attempt to add social interaction records into the social context and thus can influence the graph representation regardless of the construction methods. Specifically, we employ a fraudster selection module to identify influential fraudsters for creating fraudster-post pairs. Then, through a post injection module, we select the source of new posts in the propagation structure and clone content from existing posts to new ones. Accordingly, the selected fraudsters will send the posts to simulate social interactions. This integration of social interaction records can effectively perturb the social context and fool GNN-based fake news detectors. We validate our framework's effectiveness in attacking various GNN-based fake news detectors with different graph structures. Our extensive experimental results demonstrate that GAFSI is general and capable of deceiving different detectors in a black-box setting, outperforming state-of-the-art methods.

Overall, our contribution is summarized as follows:

• We propose a general black-box attack framework to simulate social interactions, enhancing the effectiveness of the perturbation in a more realistic scenario.
• We propose GAFSI, which leverages gradient-based attention information. It consists of a fraudster selection module and a post injection module.
• Extensive experimental results demonstrate that the perturbation generated by GAFSI on social context can effectively change the prediction of the target news.

2 RelatedWork

2.1 GNN-based Fake News Detection

According to the graph prototypes, GNN-based fake news detectors are primarily categorized into two types: propagationbased detectors and social-context-based detectors [Phan et al., 2023]. The propagation-based detectors employ a treestructured graph to model the propagation process of a single news [Bian et al., 2020; Dou et al., 2021; Silva et al., 2021; Han et al., 2021]. Here, the root node represents a news article and other nodes represent associated posts, while edges depict shared relations among nodes. Besides, social-contextbased detectors prefer to capture global information. Recent work [Nguyen et al., 2020] considers the relations among publishers, news, and users to construct the social context graph. Su et al. [2023] construct a dual-layer graph that contains a news propagation layer and a user interaction layer. They use shared relations to connect the two layers. Wu and Hooi [2023] construct a news engagement graph based on the number of common users. Although some methods utilize additional information to construct the graph, it is worth noting that shared relation remains a key factor in those graph construction processes. Hence, it inspired us to fool the GNNbased fake news detector via fake social interaction.

2.2 Adversarial Attack on GNN

Numerous adversarial attack methods have been proposed to fool classifiers in various domains [Zhu et al., 2023; Tang et al., 2023; Zhu et al., 2024a; Guo et al., 2024]. For graph-related tasks, the attack techniques include attribute perturbation, edge perturbation, and node injection [Liu et al., 2022]. Z¨ugner et al. [2018] first conduct targeted attacks on GNN through greedy-based edge perturbation. To address the inefficiency of the previous methods on large-scale graphs, Li et al. [2021] introduce a method containing a subgraph constructing process. Zhang et al. [2023] focus on finding a minimized set of perturbations to realize an attack with low cost. Recent work [Shang et al., 2023] start to conduct edge perturbation on heterogeneous graphs. They consider that all GNNs take the same graph as input and focus on perturbing the edge that has a larger common weight. Instead of edge perturbation, Tao et al. [2021] propose a targeted attack method by injecting a single node which is obtained from a pre-trained encoder. Wang et al. [2022] regard the node injection attack as a graph clustering problem and solved it based on Euclid's distance between nodes' adversarial feature. Although existing attacks perform well in traditional graph tasks, they demonstrate limitations when attacking GNN-based fake news detectors. The edge perturbation method may break the chain, leading to the destruction of the propagation structure, which is easy to discover. Furthermore, the node injection method generates perturbation in the form of embedding which can not be restored to original attributes. Hence, they are insufficient to conduct attacks against fake news detectors.

Wang et al. [2023a] is the first to attack GNN-based fake news detectors, focusing on manipulating three types of fraudsters to collaborate in deceiving the detector. They formulate the attack problem as attacking GNNs on a user-news bipartite graph and successfully alter the predicted label of the target news. However, they only consider modifying the edge between fraudsters and target news in the user-news bipartite graph. Thus, similar to previous attacks, their method can not attack detectors based on other graph structures.

3 Preliminary and Problem Statement

Social Context inNews Dissemination. The social context in news dissemination is represented as G = (U,Q, P,E), where U = (u1, . . . , um) indicates a set of m users, Q = (q1, . . . , qn) denotes a set of n news, P = (p1, . . . , pl) represents a set of l posts, E = {Eu,Et} represents a set of relation in G. Here, Eu characterizes the user-post relations, with an edge (ui, pj) ∈ Eu signifying that user ui is the author of post pj . Et characterizes a set of the shared relations between news and posts, as well as the shared relations among posts themselves. Then, the fake news detection task based on G can be treated as a binary classification problem. yi ∈ Y is the ground-truth label of the news i where 0 and 1 represent the real news and fake ones respectively.

Graph Construction of G for Fake News Detection. To mine rich information in social context G, GNN-based fake news detectors typically consider the entities and relations that can represent a kind of structural pattern to construct a graph. As there are abundant structural patterns in the social context, the graph constructed by different detectors encompasses a variety of types, e.g., the user-news bipartite graph [Wang et al., 2023a], the news engagement graph [Wu and Hooi, 2023], the propagation tree [Dou et al., 2021; Bian et al., 2020]. For simplicity, we describe the graph construction process as:

where r(·) is a function to generate a graph based on social context. After constructing the graph, detectors will utilize a pre-trained language model, e.g., GloVe [Pennington et al., 2014] and BERT [Devlin et al., 2019], to generate the feature matrix X and employ a GNN to learn news embedding, aiming to classify news.

Adversarial Attack on SpecificGraph. Existing adversarial attack methods can easily perturb the graph by adding a small perturbation ξ to the graph Gs. Here, the attack process can be described as:

However, different detectors employ different functions to generate the graph, and thus attackers need to deal with a set of Graphs {G1s , . . . ,Gks } where k is the number of the detectors. Due to structural differences, perturbation ξ is not general for the graphs in the set. In a black-box manner, the problem will become more challenging, thereby encouraging us to develop a general approach to attack the detectors.

Our Attack on Social Context. To execute a generalized attack against GNN-based fake news detectors, a natural way is to perturb the social context G instead of Gs. Therefore, a general attack process can be described as:

However, the small perturbation ξ may disrupt the semantic integrity, making attacks more easily detectable. Hence, we attempt to simulate social interaction to meet practical constraints. Specifically, we manipulate a set of controllable fraudsters Uc to add social interaction records through sharing. The perturbed social context can be represented as:

where P ′ includes new posts sent by fraudsters, E′u and E′t are new user-post and shared relations, respectively. The attack's objective for the k-th news qk is formalized as:

where fθ is the targeted GNN-based fake new detector which has been trained on the clean data, I(·) is an indicator function, X is the feature matrix, z is the predicted label of news qk, L is the cross-entropy loss function and ∆ is the given budget. The goal is to maximize the likelihood of qk being misclassified within the constraints.

4 Method

In this section, we describe our general attack framework which consists of two major modules, i.e., the fraudster selection module and the post injection module, as shown in Figure 2. Given the social context of news dissemination G as input, our framework adds a set of social interaction records and eventually fools the GNN-based detectors.

4.1 Fraudster SelectionModule

To select users to engage in the attack, following [Dou et al., 2021; Wang et al., 2023a], we first utilize a pre-trained language model [Pennington et al., 2014] to extract user representation from the users' historical posts. However, the GNN-based detector's attention on the user representation is often different from the local structure and global structure. To comprehensively consider the impact of user representation on different structures, we utilize the propagation tree to estimate the local influence of the user representation and construct the user-news bipartite graph to estimate the global influence. Accordingly, we propose a selection module that can effectively optimize the set of potential fraudsters.

Local Influence Estimation. To capture local influence, we first construct a propagation tree Gkt = (V k t ,Ek t ) for target news qk, which consists of:

where traversal(Et, qk) indicates a function to traverse a tree with news qk as the root according to Et, and traversalpath(Et, qk) indicates a function to obtain the paths in above traverse process. Then, we let the representations of post nodes in Gkt equal to the user representation of the post owner such that the GNN-based detector can learn user representation in a local view. Empirically, the gradient can characterize the model's attention on different inputs. Inspired by gradient-based attribution methods [Shrikumar et al., 2017; Sanchez-Lengeling et al., 2020], we leverage the model's attention on different feature elements to measure the local influence. Following the black-box manner, a GNN-based graph classifier fθt is trained as a surrogate model to obtain attention information. Given the propagation tree Gkt , the importance weight of the user representation is given by:

where AGkt is the adjacency matrix of Gkt , XGkt is the user representation matrix of Gkt , xvi is the user representation of the publisher of post vi and N is the scale of V k t . The j-th entry in wGkt indicates the relative importance for j-th feature element resulting from classifying qk into the wrong class based on Gkt . Intuitively, users with greater influence should have larger weights on the relatively important feature elements. According to the importance weight, the local influence of a fraudster ui ∈ Uc is measured as:

where xui is the user representation of the fraudster ui. To improve efficiency, we utilize local influence for pruning. Obviously, nodes with lower local influence are not ideal choices. Hence, ceil(α∆) fraudsters will be remained, where their local influence are ceil(α∆)-largest.

Global Influence Estimation. To estimate the global influence of the user representation, we construct a user-news bipartite graph Gb = (Vb, Eb):

Due to the direct connections between users and news, we can utilize the gradient of the edge between them to estimate the global influence. Similarly, we train a GNN-based node classifier fθb as the surrogate model based on Gb. Subsequently, the gradient of the potential edge between a fraudster ui and the target news qk is calculated as:

where AGb is the adjacency matrix of Gb, XGb is the feature matrix of Gb and L is the cross-entropy loss function. In general, a larger gradient of the potential edge indicates that the corresponding user's participation in the attack will cause a greater impact on the target news. Hence, we select the fraudster ui with the largest gradient in those remaining fraudsters and update the selected fraudster set Ua = Ua ∪ {ui}. The related edge is added to Eb and the selection process will be repeated until ∆ fraudsters have been chosen.

4.2 Post InjectionModule

Once a set of users Ua engaging in the attack is selected, we attempt to determine the targets of sharing behavior for these users such that the shared relations can be established.

Post Initialization. Since the budget for new interactions and the number of selected users are both ∆, each user ui ∈ Ua can send a new post to maximize user participation within the attack budget. Hence, we can obtain a set of new post P ′ and a set of user-post relation E′u . Note that the content of the post is still hard to generate and we temporarily set it to empty. Intuitively, directly sharing the target news qk is not always the best choice. To measure the impact of selecting different shared targets, we employ the previous propagation tree Gkt to model the existing propagation structure of the news qk. Then, the sharing behaviors can be treated as injecting posts into Gkt such that we obtain a new propagation tree Go = (Vo, Eo), where Vo = V k t ∪P ′ and Eo = Ek t . The new adjacency matrix of AGo can be formulated as:

where AGkt is the original adjacency matrix of Gkt , B is the potential edges between injected posts and the posts in the original tree and O is the potential edges between injected posts. At the beginning, B and O are both zero matrices.

Connection Optimization. Subsequently, we leverage the gradient of the edges in B as the proxy of attention to find the optimal connection. Since the content of the post is still hard to optimize, we utilize the user representation to select the shared target. According to Eu and E′u , we let the representations of post nodes in Go equal to the user representation of the post publisher. Then, a GNN-based graph classifier fθt is utilized as a surrogate model to obtain gradient information. We only consider ∆ injected posts and the simplified optimization process is described as:

where ⊙ represents the element-wise product, AGo is the adjacency matrix of Go, XGo is the user representation matrix of Go, C is a mask matrix and aij is the edge with the largest gradient under constraints in B. At the beginning, C is a matrix of ones. We treat aij represents an optimal shared relation and expand Eo = Eo ∪ {(vi, vj)}. Each post has a unique source in the tree. To ensure each new post can only be selected once, we let Ckj = 0, ∀k. Iteratively, we expand Eo until each injected post has one connection in Eo. Hence, we obtain the set of new shared relation E′t = Eo \ Ek t .

Content Clone. According to the new propagation tree Go, we optimize the text representation for injected posts which has been set as empty before. Recent study [Wang et al., 2023b] directly set the feature as zero, indicating an empty message, leading to little impact on detectors. To address this problem, we attempt to clone existing content into our new posts. Similarly, we leverage the model's attention on the text representations to estimate the influence of the existing content. Specifically, we extract text representations from the content of existing posts and retrain a GNN-based graph classifier f ′θt according to the text representations. Then, for a new post pi ∈ P ′ , we let the feature vector of it equal to the zero feature vector due to its empty content. Given the modified propagation tree Go, the attention weight of the text representation for the new post pi can be calculated as:

where X′Go represents the text representation matrix of Go, xpi is the feature vector for post pi. Then, we randomly sample a set of potential post Pr ⊂ P. For each pj ∈ Pr, we calculate the score as:spi,j = xpj · wpi , (14)

where xpj is the text representation of the post pj. After computing the score for all posts in Pr, we select the potential post that has the largest score and clone the post content to the new post pi. The content of all injected posts will be updated and then the completed interaction record can be injected into the social context, thereby fooling GNN-based detectors.

5 Experiment

5.1 Experimental Settings

Datasets. We adopt two real-world datasets [Shu et al., 2017; Fey and Lenssen, 2019], i.e., Politifact and Gossipcop, from the PyTorch-Geometric library. To train detectors and our surrogate model, we split the data into 20% for the training, 10% for the validation, and 70% for the testing. The testing set is also treated as the set of the news to be attacked.

GNN-based Fake News Detectors. We investigate the robustness of different GNN-based fake news detectors. For social-context-based detectors, following [Wang et al., 2023a], we construct a user-news bipartite graph. Leveraging Glove [Pennington et al., 2014], we extract the features of user nodes from their historical posts and the features of news nodes from the news contents. Subsequently, we attack three variants of GNN, i.e., GCN [Kipf and Welling, 2017], GraphSAGE [Hamilton et al., 2017], and GAT [Veliˇckovi´c et al., 2018]. Besides, following [Wu and Hooi, 2023], we construct a news engagement graph and attack the related proposed model. For propagation-based detectors, following [Dou et al., 2021], we construct a tree-structured propagation graph. The features of post nodes are derived from the historical posts of their owner. Then, we investigate three variants of UPFD [Dou et al., 2021]. We also investigate BiGCN [Bian et al., 2020] on a propagation and dispersion bi-directional tree. Different from the previous tree, the features of post nodes are derived from the post content.

For clarity, we use G1, G2, G3, and G4 to represent a bipartite graph, a news engagement graph, a propagation tree, and a bi-directional tree mentioned above, respectively.

Baselines. Since there is no attempt to conduct a general attack on detectors based on different graph structures, we need to make some necessary assumptions to extend the existing methods. The baseline method will conduct the attack on the user-news bipartite graph and connect users with the target news. To obtain a complete record of social interaction, we assume the users selected by the baselines randomly share the related post of target news and the new posts have empty content. The detailed baselines are described as follows:

Random, which randomly establishes a connection between a user and the target news.

DICE [Waniek et al., 2018], which randomly connects the target news to several users with a different label. The pseudo-labels of users are obtained from the surrogate model.

SGA [Li et al., 2021], one of the most effective targeted attacks on the node classification task. SGA constructs a subgraph for the target node and computes gradients of edges in the subgraph to generate edge perturbation.

MARL [Wang et al., 2023a], which is the first work to attack GNN-based fake news detectors utilizing a multiagent reinforcement learning framework.

5.2 Performance Analysis

Comparison with State-of-the-art Methods. Our goal is to change the prediction of the target news. To this end, we evaluate the success rate of the attack which is defined as the number of misclassified news after the attack divided by the total number of target news. A larger success rate means better attack performance. Following the existing targeted attacks [Z¨ugner et al., 2018; Li et al., 2021], the budget of new records ∆ equals to the degree of the target node in the usernews bipartite graph which represents the original number of people engaged in sharing the news. For each target news, we repeat the attack 10 times and report their average results.

Table 1 shows the attack performance when changing the prediction of fake news and real news respectively. Our method outperforms all baselines in most cases, particularly against propagation-based detectors on G3 and G4. Besides, GAFSI achieves a greater improved amount of success rate in the larger dataset, i.e., Gossipcop, demonstrating the ability to deal with large-scale graphs. Compared to SGA, GAFSI has less influence on target news in three cases. This is because SGA solely focuses on modifying the user-news bipartite graph, while GAFSI makes a trade-off between different graph structures, improving the transferability with relatively minor costs. Furthermore, the attack performance between different variants also improves in some cases, especially against GraphSAGE.

Computational Efficiency. We demonstrate the average running time for attacking single news in Table 2. Compared to SGA, we generate more complex and complete social interaction in a similar running time. MARL suffers from low time efficiency due to the vast search space and multiple samplings. In contrast to MARL, our approach shows a noticeable advantage in computational efficiency through utilizing a hierarchical strategy in the fraudster selection module.

5.3 Ablation Studies and Other Analysis

Effects of Varying Hyper-parameters. We examine the performance of GAFSI with different parameters α to make a trade-off between local influence and global influence in the fraudster selection module. The results against detectors on G1 and G3 are shown in Figure 3, GAFSI achieves a poor performance against detectors on G1 when only considering local influence, i.e., α = 1. As α increases, we observe that enhancing the attack performance against detectors on G1 sacrifices the attack performance against detectors on G3. When α is smaller, this trade-off is worthwhile. Ultimately, the method's attack performance achieves a balance, indicating that subsequent nodes have a low impact on any models.

Effects of Different Post Sources. To demonstrate the validity of the post injection module in GAFSI, we conduct ablation experiments on the connection strategy. A source of a post could be a news or a related post. To conduct the ablation study, we provide two strategies for comparison. Fraudsters can choose to directly share the target news, which is regarded as a Root strategy. Another choice for fraudsters is to randomly share a related post, which is regarded as a Random strategy. We conduct experiments against detectors on G3. As shown in Table 3, we compare these two strategies to ours, indicating that our approach can cause a greater impact on the propagation tree of the target news.

Effects of Different Post Content. For the ablation study of post content generation, we directly set the new post as an empty text or randomly assign the existing content to it. In contrast to previous experiments, the detectors to be attacked classify news based on the content of posts. Therefore, we leverage text representation to train the detector on G3 and G4 before the attack. Table 4 reports the results of different strategies against detectors that leverage text representation as post nodes' features. It is obvious that our strategy contributes to enhancing the attack performance.

Effects of Different Budgets. To better evaluate the effectiveness of GAFSI with different budgets, as shown in Figure 4, we gradually reduce the budget to observe changes in attack performance on the detectors based on G1 and G3, respectively. As the budget increases, our method widens the gap in attack performance compared to others. We also observe a slowing growth rate, which could be attributed to two factors. Firstly, later-selected users often have lower influences than earlier-selected ones, Secondly, the increase in the number of users might dilute the impact of single users.

Effects of Different News Degrees. Intuitively, the degree of node has a large impact on attack performance. Since relatively low degrees constitute a significant portion of realworld datasets, nodes that have a degree less than 100 are selected for further investigation. We group the news based on their node degrees on the bipartite graph. As shown in Figure 5, the success rate of our method decreases when the degree of news increases. This implies that the detectors are more robust when predicting news with more participants involved. Besides, compared to detectors working on G1, those working on G3 seem less sensitive facing varying degrees, which may be attributed to their tree structures.

6 Conclusion

In this paper, we propose a general black-box adversarial attack framework against GNN-based fake news detectors with different graph structures. The key idea is to add fake social interaction to the social context via fraudster's sharing behaviors. Extensive experimental results demonstrate the effectiveness and superiority of our method in attacking different fake news detectors. In the future, we plan to investigate the engagement pattern and realize a more imperceptible attack.

Acknowledgements

This work was supported in part by the National Science Fund for Distinguished Young Scholarship of China (Grant no. 62025602), the National Natural Science Foundation of China (Grant nos. U22B2036, 62073263, 62203363, 62102105), the Fundamental Research Funds for the Central Universities (Grant no. D5000230112), the Tencent Foundation and XPLORER PRIZE, the Young Talent Fund of Association for Science and Technology in Shaanxi (Grant no. 20240105), and the Shaanxi Provincial Natural Science Foundation (Grant no. 2024JC-YBQN-0620).