{"id":"7f058f0a-8b37-41e7-aaa7-6d57bfed71e6","arxiv_id":"2505.14453","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SI2AF attacks GNN fake news detectors by using structural entropy to find post communities and coordinating bot, cyborg, and worker agents to connect malicious accounts to related posts.","lead":"This paper introduces SI2AF, an attack framework that uses community structure in social networks to trick graph-based fake news detectors into misclassifying posts. The authors report that it outperforms prior attack methods and that retraining detectors on manipulated graphs makes them more robust.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 16.71% attack-effectiveness claim relies on structural-entropy communities capturing task-relevant post relatedness, yet no control replaces the community with an equal-size random subgraph; if that control matches SI2AF, the core mechanism is unsupported.","rationale":"I focused on the community-relevance premise rather than the other flagged issues because it is the causal link between the method's novelty and the headline number. The reader's weakest_assumption is exactly this, and Section 5.5's K-sensitivity is insufficient evidence: it varies subgraph size, not subgraph composition. A random-subgraph control is the standard ablation that would settle it. I also inspected the other concerns: the 41.54% robustness enhancement is indeed not directly derivable from Table 3, and Algorithm 1's slicing appears to produce empty groups for the stated budgets (likely a typesetting error), but both are report-level fixes. If the random-subgraph control fails to differentiate SI2AF from random, the central claim should be downgraded; if it differentiates, the structural-information mechanism is supported. The verdict should remain CONDITIONAL pending this control and the missing robustness table.","tokens_in":27500,"tokens_out":12692,"duration_ms":118706,"concrete_test":"Run the full SI2AF pipeline on Politifact and Gossipcop, but for each target post replace the structural-entropy-derived post subset P_alpha with a uniformly random subset of posts of the same size, drawn from the same graph while preserving the number of fake and real posts, and keep the multi-agent RL, account budgets, t_max, and total added edges identical. Compare average success rates over the five detectors against the reported SI2AF numbers. If the random-subgraph variant is statistically indistinguishable (e.g., within one standard deviation) or if its improvement over MARL is comparable, the structural-information premise is not doing the causal work claimed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that SI2AF outperforms baselines because structural information (structural entropy over a user-post graph) identifies hierarchical communities whose post subsets are task-relevant, enabling indirect and feedback attacks. The support for this is Table 2 (aggregate success rates) and Section 5.5's K-sensitivity, which shows that too-large K dilutes the attack. But K-sensitivity only shows subgraph size matters; it does not show that the structural-entropy choice of which posts belong to the subgraph matters. If the associated subgraph G_alpha were replaced by an equal-size random set of posts (or by clusters from a trivial degree-based partition), the multi-agent RL could still add edges to non-target posts and potentially achieve comparable success. In that case the 16.71% average improvement over MARL/GAFSI would be attributable to the broader action space, the centralized weighted sampling, or the unconstrained edge budget, not to the structural-information premise that the paper advertises as its novelty. Section 5.5's own admission that unrelated posts reduce effectiveness is consistent with either interpretation: random larger subgraphs also dilute. This is load-bearing because the headline claim is precisely that network structural information drives the improvement.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes SI2AF, an adversarial attack framework for graph-based fake news detectors. It builds a user-post bipartite graph, minimizes structural entropy to obtain a hierarchical community tree, defines an influence metric based on structural entropy, and coordinates three Q-learning agents (bots, cyborgs, workers) that add edges within the target post's associated subgraph via direct, indirect, and feedback attacks. The paper also claims that retraining detectors on the enriched graph improves their robustness by 41.54% on average. Experiments on Politifact and Gossipcop with five GNN detectors report an average attack success improvement of 16.71% over state-of-the-art baselines.","tokens_in":27779,"tokens_out":7474,"duration_ms":67796,"significance":"If the claims are substantiated, the paper makes a useful contribution: it broadens the attack surface for fake news detectors beyond direct edge additions and introduces structural-information-based community selection into adversarial robustness evaluation. Strengths include reporting means and standard deviations over five seeds, evaluating against five graph-based detectors, and ablating the three attack strategies. However, the headline robustness number is not displayed in any table, the height parameter K is selected on the evaluation set, and the causal role of structural entropy is not isolated by a control experiment. These issues must be addressed before the contribution is fully supported.","major_comments":[{"comment":"The abstract's headline claim that SI2AF 'enhances GNN-based detection robustness by 41.54% on average' is not supported by any displayed result. Table 3 reports detection accuracy before and after attacks, but never shows the accuracy (or fake-news probability) of detectors after Algorithm 2's retraining on the enriched graph. The text states that 'the drop in predictive probability ... is significantly mitigated after optimization, with a reduction of at average 41.54%', yet no post-optimization numbers appear anywhere in the paper. Please add a table or figure reporting the refined detectors' performance and the precise computation of the 41.54% figure.","section":"5.2, Table 3"},{"comment":"The tree height K is selected on the evaluation set: the authors report that 'in the smaller network Politifact, SI2AF achieves its best performance when K=3, while in the larger-scale network Gossipcop, peak performance occurs when K=4'. This is test-set tuning and biases the reported attack success rates upward. The paper should either report the full K-sweep (as in Figure 7) as the primary result, or select K on a held-out validation split and report only the validation-selected K in the main tables.","section":"5.5"},{"comment":"The central novelty claim—that structural entropy's hierarchical communities drive the attack's effectiveness—is never tested against a non-structural control. The associated subgraph G_alpha is always the community produced by minimizing structural entropy; replacing P_alpha with an equal-sized random set of posts, or with clusters from a trivial degree-based partition, would show whether the improvement over MARL/GAFSI comes from the structural-information mechanism or simply from the expanded action space of indirect/feedback attacks. Section 5.5 shows only that subgraph size matters, not that the choice of which posts are inside the subgraph matters.","section":"4.1, 4.3"},{"comment":"The proof of Theorem 4.1 is incomplete. The bound q1(x') <= b/(1 - log2 e c) is derived after 'substituting the bounds for q0', but no upper bound on q0 is stated or proven; a probability density on [1, b/2] can exceed 1, and without an assumption such as q0(x) <= 1 the inequality does not follow. Furthermore, the theorem bounds the transformed density but does not establish the stated purpose of the influence metric, namely reducing the occurrence of accounts with identical influence values. Either add the missing assumption and prove the tie-breaking claim, or remove or reposition the theorem as a peripheral observation.","section":"Appendix B / Theorem 4.1"}],"minor_comments":[{"comment":"The source text contains stray glyph sequences (e.g., '/uni0000002a/uni00000024/...') inside the table; the camera-ready version must be regenerated cleanly.","section":"Table 2"},{"comment":"The abstract's 16.71% average improvement is not directly traceable to Table 2; the 'Abs.(%) Avg.↑' rows are per-detector, and no single table cell averages to 16.71%. Please state explicitly how this number is computed.","section":"Abstract and Section 5.2"},{"comment":"The parameter c in Eq. (7) is never assigned a value or given a sensitivity analysis in Section 5. The reader cannot assess how the attack depends on this free parameter.","section":"4.2"},{"comment":"The RL training details are missing: state representation, policy network architecture, learning rate, t_max, and the update interval t_up. These are needed for reproducibility.","section":"4.3 and Algorithm 3"},{"comment":"The summation range 'V_ν ⊆ V_α ⊂ V' is unclear; it should be over nodes α on the path from the root to leaf ν in the encoding tree.","section":"Eq. (7)"}],"recommendation":"major_revision","confidential_remarks":"The methodology draws heavily on the authors' own structural-information series (e.g., refs. [25, 26, 45-48]), and the novelty relative to that line is not crisply delineated. If the paper is revised, the editor may ask the authors to articulate precisely which component (community extraction, influence metric, or the multi-agent subgraph attack) is the new contribution. The fit with KDD is reasonable given the social-network domain, but the unverifiable robustness claim and the test-set selection of K are concerns that should be resolved before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nQuick take: this is a competent but incremental paper. The new combination is structural-entropy hierarchical communities plus a three-strategy multi-agent RL attack, applied to GNN fake-news detectors. On the empirical side, Table 2 is the core evidence: SI2AF beats MARL, GAFSI, SGA, and DICE on most of the twenty detector-dataset cells, with small standard deviations, and the ablations and efficiency tables are reported cleanly. That part holds up.\n\nWhat is actually new: the influence metric that uses path entropy to rank accounts, and the three attack strategies (direct, indirect, feedback) that act on the community subgraph rather than only the target post. The case study and single-agent comparison are useful details. The authors also include a limitations section that acknowledges unmodeled genuine-user dynamics and other malicious behaviors, which is honest.\n\nThe soft spots are about the central mechanism, not the empirical effort. The paper claims structural information is what drives the 16.71% improvement, yet there is no control that replaces the structural-entropy subgraph with an equal-size random or degree-based subgraph. Section 5.5's K-sensitivity shows subgraph size matters, not that the hierarchical community choice matters. If a random subgraph gives the same attack success, the structural-information framing collapses to 'we gave the agent a larger action space.' This is the main reason the paper is not ready as-is.\n\nTwo smaller issues: Theorem 4.1's proof bounds the transformed density q1 by b/(1-log2(e c)) without stating that the original density q0 is bounded by 1; as written, the inequality doesn't follow. This is not load-bearing for the attack results, but it should be fixed. And the 41.54% robustness improvement is asserted in the text but not directly shown in Table 3; the authors should present the drop-reduction calculation.\n\nAlso, the encoding-tree height K is tuned on the evaluation set (Figure 7), which inflates the headline numbers a bit. A proper validation split would make the success rates more convincing.\n\nWho is this for: people working on adversarial robustness of graph-based misinformation detection, especially those who want a stronger black-box attack benchmark. It deserves a serious referee, but the revision needs the random-subgraph control, a clean treatment of K, and a corrected theorem. If the control matches SI2AF, the framework is still useful, but the structural-information claim should be downgraded.\n\nMy recommendation: send to peer review with major revision.","headline":"Useful, incremental attack framework for GNN fake-news detectors; the structural-information mechanism is plausible but not yet tested against a random-subgraph control.","tokens_in":28267,"tokens_out":5450,"would_cite":true,"duration_ms":48342,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Graph-based fake-news detectors are substantially easier to evade when the attacker exploits the hierarchical community structure of the user-post network, discovered by minimizing structural entropy, rather than only linking malicious…","keywords":["fake news detection","adversarial attack","graph neural networks","structural entropy","multi-agent reinforcement learning","hierarchical community detection","robustness evaluation","social networks"],"falsifier":"Train the five GNN detectors on the paper's Politifact and Gossipcop splits, run SI2AF, then repeat the attack with indirect and feedback targets replaced by randomly sampled posts outside the identified community at the same edge budget; if the average success-rate gain over the random-post condition is zero, the structural-community mechanism is not doing the work.","tokens_in":1840,"feed_emoji":"🎯","tokens_out":3226,"duration_ms":88876,"temperature":0.7,"pith_summary":"This paper sets out to show that graph-based fake-news detectors can be attacked far more effectively when the attacker uses the network's own hierarchical community structure instead of only wiring malicious accounts to the target post. The proposed framework, SI2AF, first minimizes the structural entropy of a bipartite user-post graph to obtain an encoding tree whose internal nodes define communities of users and posts. It then assigns controlled accounts to three agent types (bots, cyborgs, crowd workers) by a structural-entropy influence metric and coordinates them to add edges to the target post, to real posts in the same community, or to other fake posts. On the Politifact and Gossipcop datasets, the paper reports an average 16.71% improvement in attack success over state-of-the-art baselines across five GNN detectors, and a 41.54% average reduction in the attack-induced drop in prediction probability when detectors are retrained on the enriched graph. If these numbers hold, robustness evaluation for news detection needs to treat coordinated, community-aware manipulation as a primary threat.","feed_headline":"Community-aware attacks beat fake-news detectors by 16.71%","feed_subtitle":"A structural-entropy attack framework also cuts attack-induced detection drops by 41.54% on average.","key_machinery":"The load-bearing mechanism is structural entropy and its optimal encoding tree: structural entropy quantifies the uncertainty of a random walk between vertices under a hierarchical partition of the graph, and the $K$-dimensional structural entropy $\\mathcal{H}^K(G)=\\min_T H_T(G)$ is minimized to produce an encoding tree whose internal nodes are the communities. Each target post gets an associated subgraph consisting of all users plus the posts in its chosen community level, and the three attack strategies determine which posts inside that subgraph the controlled accounts connect to. The second piece is the influence metric $\\mathcal{I}(G_{up};u)$, which sums the structural entropies along the path from the root to a user's leaf node, and is used to categorize accounts into low-, medium-, and high-influence groups managed by separate agents. The agents' policies are trained by Q-learning with a reward that depends on whether the target post and its related fake posts are misclassified, and the final action is a weighted sample of the agents' individual actions.","core_discovery":"The central claim is that a black-box attacker can be made substantially stronger by exploiting the hierarchical community structure of the social network itself. The paper shows that minimizing the structural entropy of a bipartite user-post graph produces an encoding tree whose communities group semantically and structurally related posts, and that an attacker who connects malicious accounts to other posts within the target's community (real news and other fake news alike) changes the target's learned representation more effectively than an attacker who only touches the target post. This is operationalized as a three-agent Q-learning framework where each agent controls a different class of malicious account, and the empirical finding is that the combined direct, indirect, and feedback attack strategies raise the misclassification rate on both fake and real news across GCN, GAT, GraphSAGE, GCAN, and Bi-GCN detectors on two real-world datasets, while retraining those detectors on the adversarially enriched graph measurably restores their robustness.","pith_inferences":["Beyond the paper, the same structural-entropy communities could be used defensively: posts that adversarial agents repeatedly connect to within a community might be flagged as targets of coordinated manipulation, turning the attack machinery into a detection signal.","A natural and testable extension is to filter the associated subgraph by content similarity before attacking; the paper's own $K$-sensitivity result implies that removing unrelated posts from a community while keeping the same edge budget should raise attack success further.","The influence metric, with its adjustable parameter $c$, could serve as a general account-influence score for ranking or bot detection independent of adversarial objectives, since it combines degree, content relevance, and hierarchical position.","The black-box success suggests the approach may transfer across platforms and detectors, so a useful stress test is to run SI2AF on the larger Weibo engagement graph used in the paper's scalability appendix and measure whether the accuracy drop matches Politifact and Gossipcop."],"forward_implications":["A black-box attacker controlling about 170 accounts on Politifact (100 bots, 50 cyborgs, 20 workers) can raise fake-news misclassification to 0.31-0.41 depending on the detector, and real-news misclassification to as high as 0.69 on GAT.","Combining direct, indirect, and feedback attacks consistently beats any single strategy, which means the attack's power comes from touching related posts in the same community, not only the target post.","Retraining detectors on the SI2AF-enriched graph reduces the attack-induced drop in predicted fake-news probability by 41.54% on average, indicating that adversarial training with community-aware structural manipulations improves robustness.","The optimal subgraph size is dataset-dependent (about $K=3$ for Politifact and $K=4$ for Gossipcop), and oversizing the community dilutes the attack because it includes posts unrelated to the target.","SI2AF keeps a performance advantage over baselines even on high-engagement, already-widely-shared posts, where prior attack methods weaken due to the posts' dense connectivity."],"supporting_citations":[{"why":"Supplies the structural-information principles, structural entropy, and encoding trees that the entire framework builds on.","marker":"[15]"},{"why":"Provides the HCSE algorithm used to greedily minimize high-dimensional structural entropy and build the optimal encoding tree.","marker":"[25]"},{"why":"Defines the user-preference-aware fake news detection setting and the embedding approach the paper adopts for user and post representations.","marker":"[8]"},{"why":"Supplies the FakeNewsNet datasets (Politifact and Gossipcop) with user-post engagements used in all experiments.","marker":"[34]"},{"why":"GloVe embeddings for post and user content, used to compute the cosine-similarity edge weights in the bipartite graph.","marker":"[27]"},{"why":"The MARL baseline and the three-type malicious account setup (bots, cyborgs, workers) that SI2AF extends with structural information.","marker":"[41]"},{"why":"The GAFSI gradient-based black-box attack baseline that SI2AF compares against in the experiments.","marker":"[50]"},{"why":"The Bi-GCN detector baseline, one of the five graph-based fake news detectors whose vulnerability is tested.","marker":"[3]"}],"fun_headline_variants":["Community structure boosts adversarial attacks on fake-news detectors by 16.71%","How structural entropy reveals weak spots in GNN fake-news detectors","Community-based attack strategy raises fake-news misclassification by 16.71%","Multi-agent attacks guided by community structure outsmart GNN fake-news detectors"],"cache_read_input_tokens":30464,"weakest_assumption_plain":"Everything rests on the assumption that the communities found by minimizing structural entropy align with task-relevant relatedness: if the posts grouped with the target are actually unrelated to it, the indirect and feedback attacks add edges the detector can safely ignore, and the framework degenerates toward random edge addition.","fun_headline_variants_meta":{"raw":{"variants":["Community structure boosts adversarial attacks on fake-news detectors by 16.71%","How structural entropy reveals weak spots in GNN fake-news detectors","Community-based attack strategy raises fake-news misclassification by 16.71%","Multi-agent attacks guided by community structure outsmart GNN fake-news detectors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000461,"raw_usage":{"total_tokens":2316,"prompt_tokens":962,"completion_tokens":1354,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":578,"completion_tokens_details":{"reasoning_tokens":1271}},"tokens_in":578,"tokens_out":1354,"duration_ms":12139,"temperature":1.0,"reasoning_tokens":1271,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:33:43.209841+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the five GNN detectors on the paper's Politifact and Gossipcop splits, run SI2AF, then repeat the attack with indirect and feedback targets replaced by randomly sampled posts outside the identified community at the same edge budget; if the average success-rate gain over the random-post condition is zero, the structural-community mechanism is not doing the work.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the structural-information principles, structural entropy, and encoding trees that the entire framework builds on."},{"cited_title":"An Information-theoretic Perspective of Hierarchical Clustering","cited_arxiv_id":"2108.06036","evidence_quote":"Provides the HCSE algorithm used to greedily minimize high-dimensional structural entropy and build the optimal encoding tree."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the user-preference-aware fake news detection setting and the embedding approach the paper adopts for user and post representations."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The MARL baseline and the three-type malicious account setup (bots, cyborgs, workers) that SI2AF extends with structural information."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The GAFSI gradient-based black-box attack baseline that SI2AF compares against in the experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The Bi-GCN detector baseline, one of the five graph-based fake news detectors whose vulnerability is tested."}],"review_version":1}