BOCLOAK: Optimal Transport-Guided Adversarial Attacks on Graph Neural Network-Based Bot Detection

The rise of bot accounts on social media poses significant risks to public discourse. To address this threat, modern bot detectors increasingly rely on Graph Neural Networks (GNNs). However, the effectiveness of these GNN-based detectors in real-world settings remains poorly understood. In practice, attackers continuously adapt their strategies and must operate under domain-specific and temporal constraints, which can fundamentally limit the applicability of existing attack methods. As a result, there is a critical need for robust GNN-based bot detection methods under realistic, constraint-aware attack scenarios. We introduce BOCLOAK to systematically evaluate the robustness of GNN-based bot detection via both edge editing and node injection adversarial attacks under realistic constraints. BOCLOAK constructs a probability measure over spatio-temporal neighbor features and learns an optimal transport (OT) geometry that separates human and bot behaviors. It then decodes transport plans into sparse, plausible edge edits that evade detection while obeying real-world constraints. We evaluate BOCLOAK across three social bot datasets, five state-of-the-art bot detectors, three adversarial defenses, and compare it against four leading graph adversarial attack baselines. BOCLOAK achieves up to 80.13% higher attack success rates while using 99.80% less GPU memory under real-world constraints. BOCLOAK shows that OT provides a lightweight, principled framework for bridging adversarial attacks and real-world bot detection.

Bots (or fake accounts) on social media are often used to spread spam, scams, and misinformation, so platforms rely on machine learning systems to detect them. Many modern bot detectors look not only at an account’s profile, but also at how it connects and interacts with other accounts. However, it is still unclear how easily a malicious account could modify a few connections to avoid detection while still behaving realistically. In this paper, we study this problem by asking: What small, believable changes could help a bot look more like a human account to a graph-based detector? We introduce BoCloak, a method that compares the local neighborhoods of a bot account with those of human accounts and identifies realistic changes in connections that can make the bot harder to detect. Unlike unrealistic attacks that freely rewrite the social network, our method respects practical constraints, such as only changing connections involving the target account and avoiding impossible interactions. Our results show that current graph-based bot detectors can be vulnerable even under these realistic limits. This finding can help researchers and platform designers build stronger, more trustworthy defenses against adaptive social bots.