BotVA: Combating Social Bots via Variational Feature Augmentation and Adversarial Graph Learning

1 Introduction

The rapid proliferation of social bots on social media platforms poses systemic risks to information integrity and platform security [Cresci, 2020]. Operated by malicious actors, these automated accounts can strategically disseminate disinformation [Starbird, 2019], manipulate public opinion [Caldarelli et al., 2020], interfere with political processes [Deb et al., 2019], and steadily erode trust in online discourse [Javed et al., 2024]. These harms compound over time and at scale, distorting public communication and increasing content moderation and governance costs for platforms [Shao et al., 2018]. Against this backdrop, developing robust bot detection methods is essential for safeguarding the long-term health of social media ecosystems and preserving a trustworthy online public sphere.

Early work on social bot detection relied on handcrafted features derived from user metadata [Yang et al., 2020], textual content [Kudugunta and Ferrara, 2018], or structural properties of social graphs [Beskow and Carley, 2018], typically coupled with classical classifiers such as random forests [Schnebly and Sengupta, 2019] and support vector machines [Alarifi et al., 2016]. Such feature-based pipelines depend strongly on domain knowledge and have limited capacity to capture higher-order dependencies across network neighborhoods. To overcome these limitations, recent studies model social media as graphs and employ graph neural networks (GNNs) [Feng et al., 2021c; Feng et al., 2022], which encode node attributes together with topology to represent interaction patterns more effectively. Representative examples include BotDGT [He et al., 2024], which adopts dynamic graphs to model temporal and relational dependencies, thereby improving detection of complex and adaptive bots, and CAGCL [Wei et al., 2025], which leverages latent community discovery and contrastive learning to yield more discriminative representations. Despite these advances, translating graph-based methods into reliable detectors in real-world deployments remains challenging. As illustrated in Figure 1, two fundamental obstacles persist and often co-occur in practice:

Class Imbalance. While curated benchmarks may have varying class ratios, real-world studies [Cresci, 2020; Javed et al., 2024] confirm bots constitute only 8-18% in actual networks. This severe class imbalance biases empirical risk minimization toward the majority class, causing decision boundaries to shift away from optimal separating hyperplanes and reducing recall for minority instances [Johnson and Khoshgoftaar, 2019]. Models trained on such skewed distributions tend to maximize overall accuracy by prioritizing abundant human accounts, resulting in the systematic misclassification of scarce bot accounts.

Camouflaged Edges. Bots often establish deceptive connections to humans to evade detection. These camouflaged edges violate the homophily assumption underlying most GNNs, which expect connected nodes to share similar attributes and labels [Kipf and Welling, 2017]. When bots inject such adversarial links into the social graph, the resulting spurious message aggregation corrupts node representations [Schlichtkrull et al., 2018]. The classifier then receives misleading neighborhood information that degrades both predictive accuracy and robustness against adaptive attacks.

To address these challenges, we present BotVA, a social Bot detection framework that couples Variational feature augmentation with Adversarial graph learning. The first module learns class-conditional latent distributions for minority instances and synthesizes semantically coherent features via latent sampling and reconstruction, thereby enlarging minority support in the representation space and reducing decision boundary shifts induced by class imbalance. The adversarial graph module complements this approach by modeling camouflage as structured perturbations on the graph. Specifically, a generator creates deceptive connections between bots and humans to simulate adversarial camouflage strategies, while a discriminator instantiated as a graph transformer with semantic attention learns to identify and downweight such edges by adaptively emphasizing reliable neighborhoods and suppressing suspicious links. Taken together, BotVA provides a unified treatment of sample scarcity and structural noise within a single learning pipeline and can be instantiated with standard GNN backbones. Our key contributions are summarized as follows:

• We formulate bot detection under two practical constraints (class imbalance and camouflaged edges) and introduce a
• unified framework that addresses both challenges jointly.
• We propose a variational feature augmentation module that learns class-conditional latent distributions of minority instances and synthesizes informative features via latent sampling and reconstruction, effectively expanding minority support and mitigating imbalance-induced boundary shifts.
• We introduce an adversarial graph learning mechanism where a generator simulates deceptive edge formations and a discriminator with graph transformers and semantic attention learns robust representations by adaptively selecting reliable neighborhoods under structural perturbations.
• Extensive experiments on multiple real-world datasets demonstrate state-of-the-art performance, strong robustness under varying imbalance ratios and edge perturbations, and competitive results with limited supervision.

2 RelatedWork

2.1 Feature-basedMethods

Early social bot detection relied on feature engineering from user metadata [Alothali et al., 2021] or text content [Hayawi et al., 2022], combined with traditional classifiers [Varol et al., 2018]. Deep learning approaches using CNNs [Fazil et al., 2021] and Bi-LSTM [Alkahtani and Aldhyani, 2021] have since improved detection capability. However, these methods assume balanced class distributions, overlooking that bots are scarce in real networks. To address this imbalance, recent feature-centric graph methods such as OS-GNN [Shi et al., 2024] and HOVER [Ashmore and Chen, 2023] leverage linear interpolation to reduce class bias. However, these approaches build upon conventional resampling techniques like SMOTE [Chawla et al., 2002] or GraphSMOTE [Zhao et al., 2021], which often introduce noise and overfitting. To address these limitations, we propose a variational inference-based augmentation framework that captures minority class latent distributions and synthesizes diverse features to improve decision boundary quality.

2.2 Graph-basedMethods

Graph-based approaches detect camouflaged bots by modeling user interactions as graphs [Shi et al., 2025]. Existing methods utilize homogeneous GNNs (e.g., GCN [Kipf and Welling, 2017], GAT [Veliˇckovi´c et al., 2018]) or heterogeneous GNNs (e.g., RGCN [Schlichtkrull et al., 2018]) for feature extraction. Recent advances such as BotDGT [He et al., 2024] incorporate dynamic graphs with temporal modeling to capture evolutionary patterns. However, bots disrupt graph topology via spurious relationships [Yang et al., 2020], creating structural perturbations that corrupt node embeddings. While SEBot [Yang et al., 2024] and BotHP [He et al., 2025] address camouflage through contrastive and heterogeneityaware learning, these passive defense methods remain inadequate against dynamic structural attacks. In contrast, BotVA frames camouflage as an adversarial attack and filters spurious relationships via dynamic attack-defense cycles, improving robustness against structural perturbations.

3 ProblemDefinition

Social Bot Detection. We formulate social bot detection as semi-supervised binary node classification on a social graph G = (V,E,X), where V = {vi}ni=1 is the set of user nodes with n = |V |, E = ⋃Rr=1 Er is the edge set with R relation types (e.g., follower, friend), and X ∈ Rn×κ is the node-feature matrix whose i-th row xi encodes κdimensional attributes of vi (e.g., metadata, textual embeddings). Let Y = {yi}ni=1 be the label set with yi ∈ {0, 1}, where 0 denotes a human and 1 denotes a bot. Given labels on a subset of nodes Vtrain ⊆ V with Ytrain, the goal is to learn a node-level predictor f : (G, Ytrain) → ˆ Ytest that maximizes prediction accuracy for unlabeled nodes Vtest = V \ Vtrain.

4 Methodology

Figure 2 presents BotVA, which integrates three components: user node representation, Variational Feature Augmentation (VFA), and Adversarial Graph Learning (AGL). The pipeline proceeds as follows. First, the user representation module normalizes raw attributes and encodes heterogeneous signals into a unified node embedding space. Second, the VFA module learns class-conditional latent distributions for minority instances with a variational autoencoder and synthesizes semantically coherent features via latent sampling and reconstruction to alleviate class imbalance. Third, the AGL module models camouflaged edges as structured perturbations on the graph: a generator proposes deceptive connections that emulate bot behavior, and a discriminator, instantiated as a semantic-aware graph transformer, learns to identify and downweight these perturbations by emphasizing reliable neighborhoods. Training alternates between the generator and the discriminator until convergence, after which the discriminator is used for inference on unseen nodes.

4.1 User Node Representation

User information comprises profile attributes and textual content. Profile attributes include numerical and boolean fields, while textual content consists of descriptions and tweets. We encode each source with a dedicated pathway: numerical attributes are z-score normalized and linearly projected to xvi ; boolean attributes are one-hot encoded and transformed via a linear layer with LeakyReLU to obtain xbi ; textual content is encoded by a pre-trained language model [Liu et al., 2019] and linearly projected to xdi and xti , respectively.

To fuse multimodal heterogeneous signals and capture high-order interactions among users, we apply a multihead self-attention layer:

where da = κ/A is the dimension per head, (Qa,Ka,Va) are query, key, and value matrices for the a-th head with learnable parameters (Wa,q,Wa,k,Wa,v), and ∥ concatenates outputs of A heads to yield ˆX.

4.2 Variational Feature Augmentation

VFA identifies the specific minority class via training labels and employs a conditional variational autoencoder [Sohn et al., 2015] to model minority class latent distributions and synthesize semantically coherent features, augmenting minority representations without introducing noisy edges. Given a feature xi ∈ Rκ and label yi ∈ {0, 1}, VFA concatenates xi with the one-hot encoded label. The encoder estimates the mean µi and log-variance logσ2 i of the latent variable:

where fϕ,µ(·) and fϕ,σ(·) are the mean and variance prediction heads. The approximate posterior is:

where zi ∈ Rκ is the latent variable. We apply the reparameterization trick [Kingma et al., 2015] for differentiable sampling:

The decoder reconstructs features x∗i by concatenating zi with the label embedding:

where gθ(·) is a multi-layer decoder. Virtual nodes inherit minority labels and are generated iteratively to achieve class balance. The optimization objective is:

where p(z) = N(0, I) is the prior distribution over the latent variables, DKL(·∥·) denotes KL divergence, and β balances reconstruction fidelity against regularization.

4.3 Adversarial Graph Learning

Camouflage in social networks manifests as structured perturbations of the graph. Malicious bots introduce deceptive connections that corrupt message passing in GNNs and mislead downstream classifiers. Static filtering or heuristic edge reweighting offers limited protection against evolving camouflage patterns. We therefore introduce AGL that formulates detection under camouflage as a generator-discriminator game on the graph.

Generator Attack. The generator constructs sparse perturbations by connecting bots to nearby human communities. Target endpoints are restricted to second-order human neighbors, excluding VFA-generated nodes, to maintain stealth. Let Vb ⊆ V and Vh = V \ Vb denote bot and human node sets. For each bot vi ∈ Vb, the candidate interaction set is:

where N 2 h (vi) is the second-order human neighbor set. A two-layer MLP predicts connection probability pij for each candidate edge:

Motivated by [Jang et al., 2017], we cap adversarial edges via Top-k selection for sparsity and use Gumbel-Sigmoid to obtain differentiable weights sij for backpropagation:

where gij ∼ Gumbel(0, 1) represents independent noise, τ is the temperature parameter, and σ(·) is the sigmoid function. To reflect heterogeneous relation semantics in real-world social networks, perturbations from high-influence bots (top 10% by degree) are instantiated as bidirectional links, while others are unidirectional. The camouflaged edges merge with the original graph to form the adversarial graph G′ .

Discriminator Defense. The discriminator module employs a graph transformer [Yun et al., 2019] with relationspecific multi-head attention. For each node pair (vi, vj) under relation r and head c, the attention score is:

where ⟨q, k⟩ = exp(qT k/√dc), dc = κ/C, and N r (i) is the neighborhood of vi under relation r. Node representations are aggregated as:

where C is the number of attention heads. A semantic attention network integrates cross-relation features:

where βr(l) m is the weights at semantic head m,W(l) m and q(l) m are learnable parameters. The final node representation is:

where M counts semantic attention heads. A linear layer with Softmax yields predicted labels, optimized via cross-entropy:

where yi ∈ {0, 1} is the ground-truth label.

4.4 Learning and Optimization

We adopt a two-stage training strategy for high-quality minority synthesis and stable adversarial optimization.

Stage 1 (VFAPretraining). The VFAmodule is trained by minimizing LVFA to synthesize minority nodes without noisy edges, expanding minority representations to mitigate class imbalance. VFA parameters are then frozen to prevent interference with adversarial optimization.

Stage 2 (AGL Alternating Optimization). Training alternates between discriminator and generator. With the generator fixed, adversarial edges form G′ , and the discriminator minimizes (LAGL + λL′AGL) on both G and G′ . With the discriminator fixed, the generator minimizes -L′AGL to maximize classification difficulty. After AGL converges, the discriminator is frozen and deployed as the final detector.

This framework ensures VFA generates minority samples before AGL fortifies robustness against camouflaged edges.

5 Experiments

5.1 Experimental Settings

Datasets. We evaluate on three widely used social bot detection benchmarks: Cresci-15 [Cresci et al., 2015], TwiBot20 [Feng et al., 2021b], and MGTAB [Shi et al., 2025]. For Cresci-15 and TwiBot-20, we adopt the user-profile and textual features released by [Feng et al., 2021c]; for MGTAB, we follow the extraction protocol in [Yang et al., 2024].

Baselines. We compare BotVAwith representative featurebased and graph-based methods. Feature-based baselines include Yang et al. [Yang et al., 2020], Wei et al. [Wei and Nguyen, 2019], Varol et al. [Varol et al., 2017], and SATAR [Feng et al., 2021a]. Graph-based competitors include GCN [Kipf and Welling, 2017], GAT [Veliˇckovi´c et al., 2018], RGT [Feng et al., 2022], BotRGCN [Feng et al., 2021c], BotMoE [Liu et al., 2023], CAGCL [Wei et al., 2025], BotBR [Lin and Zhou, 2025], BotDGT [He et al., 2024], OS-GNN [Shi et al., 2024], HOVER [Ashmore and Chen, 2023], SEBot [Yang et al., 2024], and BotHP [He et al., 2025].

5.2 Performance Comparison

We evaluate BotVA against representative baselines and summarize the results in Table 1.

Overall. BotVA achieves the best results on all three datasets. The consistent gains across varying dataset scales and topological characteristics confirm that jointly addressing class imbalance and camouflaged edges yields reliable improvements.

Cresci-15. BotVA reaches 99.74% accuracy and 99.62% F1-score, improving upon SEBot and BotMoE by 0.85% in accuracy and 0.75% in F1-score, respectively. As a moderately sized dataset with relatively clean structure, performance here primarily reflects representation quality. The variational feature augmentation effectively expands minority coverage, producing cleaner decision boundaries.

TwiBot-20. BotVA attains 87.48% accuracy and 88.67% F1-score, outperforming the strongest baseline BotHP. Small standard deviations indicate stable training despite larger graph size and heterogeneous relations. The adversarial graph module proves particularly important on this dataset, as the discriminator learns to downweight deceptive edges while preserving informative neighborhood signals.

MGTAB. BotVA achieves 91.74% accuracy and 89.40% F1-score, outperforming the second-best methods by 0.88% and 2.48%, respectively. This dataset exhibits pronounced label skew and substantial edge noise. The combination of variational minority synthesis and adversarial training effectively improves recall on rare bot instances while maintaining high precision.

5.3 Ablation Study

To quantify component contributions, we conduct controlled ablations on TwiBot-20 and MGTAB with fixed data splits and optimization settings. We evaluate five variants: (i) w/o MA removes multi-head attention in the node encoder, (ii) w/o VFA disables the VFA module, (iii) w/o SAN discards the semantic attention network, (iv) w/o GEN omits the generator, and (v) w/o AGL removes the entire AGL module and uses an MLP classifier. Results are reported in Table 2.

Overall Observations. The full BotVA attains the highest accuracy and F1-score on both datasets. Removing any component yields consistent drops, indicating that each module contributes meaningfully.

Multi-Head Attention. Ablating MA produces moderate declines (TwiBot-20 accuracy -0.22%, MGTAB F1-score Variational Feature Augmentation. Without VFA, accuracy decreases by 0.62% on TwiBot-20 and 0.71% on MGTAB, with F1-score drops of 0.66% and 0.72%, confirming that class-conditional synthesis effectively expands minority coverage under label skew.

Table 2: Ablation study of BotVA on TwiBot-20 and MGTAB.

SemanticAttentionNetwork. Removing SAN reduces accuracy by 0.45%-0.47% with F1-score declines of 0.46%- 0.55%, indicating that relation-level weighting outperforms uniform averaging across heterogeneous edge types.

Adversarial Generator. Eliminating GEN causes larger drops (TwiBot-20: accuracy -0.84%, F1-score -0.81%; MGTAB: accuracy -1.61%, F1-score -0.94%), indicating that the generator can force the discriminator to learn robust representations by simulating deceptive edge patterns.

Adversarial Graph Learning. Removing the entire AGL module causes the most severe degradation (TwiBot-20: accuracy -1.83%, F1-score -2.84%; MGTAB: accuracy -4.30%, F1-score -3.21%), confirming AGL as the primary driver of robustness against structural perturbations.

Dataset-SpecificEffects. Ablations show larger impacts on MGTAB, particularly for GEN (1.61% vs 0.84%) and AGL (4.30% vs 1.83%). This aligns with MGTAB's more pronounced label skew and noisier connectivity, suggesting that adversarial components provide greater benefits when camouflage is prevalent.

5.4 Sensitivity Analysis

We analyze sensitivity to the VFA coefficient β ∈ {0.1, 0.3, 0.5, 0.7, 1.0} and AGL loss weight λ ∈ {0.1, 0.3, 0.5, 0.7, 1.0} on TwiBot-20 and MGTAB (Figure 3). Performance with respect to β peaks at β = 0.3 on both datasets (87.48% accuracy on TwiBot-20, 89.40% F1-score on MGTAB). Small β values provide insufficient regularization, leading to a fragmented latent space, while large values over-emphasize the prior constraint, compromising reconstruction fidelity. For λ, which balances supervision from the original and perturbed graphs, optimal performance occurs in [0.3, 0.5]. Values below 0.1 provide insufficient adversarial signal, whereas λ = 1.0 overemphasizes adversarial objectives at the expense of classification accuracy on clean structures. Across all configurations, performance variations remain below 1.4% for accuracy and 1.6% for F1-score, indicating that BotVA is robust to hyperparameter selection within reasonable ranges.

5.5 Data Efficiency Study

To assess performance under limited supervision, we train on random subsets comprising 10%-100% of the original training split while evaluating on unchanged test sets. As shown in Figure 4, BotVA demonstrates strong data efficiency. With only 10% training data, it attains 82%-87% accuracy across datasets, surpassing several baselines trained on full data (Table 1). Performance improves consistently with more labels, saturating earlier on simpler graphs (60%-70%) and later on larger, noisier graphs (80%-90%). This efficiency stems from two complementary mechanisms: VFA expands minority support through class-conditional synthesis, while AGL learns robust representations via adversarial training. Notably, BotVA trained on 70%-90% of data matches or exceeds baselines trained on full datasets, demonstrating practical value in label-scarce scenarios.

5.6 Visualization Analysis

Generated Sample Fidelity. We visualize kernel densityestimate contours for original and VFA-generated minority samples on Cresci-15 and MGTAB (Figure 5). On Cresci-15, the two distributions show substantial overlap with closely aligned density peaks, indicating that VFA captures the underlying minority distribution. On the larger and more heterogeneous MGTAB, distributions are more dispersed, yet generated samples still cover core high-density regions, demonstrating effective minority support expansion under pronounced class imbalance.

Robustness to Camouflage Attacks. We evaluate robustness by injecting 0%-25% additional bot-human edges into TwiBot-20. As shown in Figure 6, BotVA maintains the highest F1-score across all perturbation levels. While all methods degrade with increasing attack intensity, degradation rates differ substantially. Methods without heterogeneous relation modeling (e.g., BotMoE) degrade rapidly, while heterogeneity-aware approaches (e.g., BotHP, SEBot) show improved resilience but still lag behind BotVA. These results confirm that simulating camouflage strategies during training yields superior robustness.

Framework Generality. To verify extensibility, we integrate four representative GNN backbones into BotVA (Figure 7). Results show consistent performance improvements across all architectures. The F1-score gains on MGTAB are particularly pronounced compared to accuracy gains on Cresci-15, indicating that BotVA is especially effective in imbalanced scenarios where VFA enriches minority class representations. This confirms BotVA as a model-agnostic framework capable of empowering standard GNNs.

Representation Discriminability. We project final-layer embeddings to two dimensions using t-SNE (Figure 8). BotDGT and SEBot display coarse inter-class separation but substantial intra-class overlap. BotHP exhibits improved intraclass cohesion yet maintains weaker inter-class margins. In contrast, BotVA achieves both clear inter-class separation and compact within-class clusters, validating its superiority.

BotHP

BotVA

Figure 8: Visualization of account representations on TwiBot-20. Red represents bots and blue represents humans.

6 Conclusion

We presented BotVA, a unified framework for graph-based bot detection that jointly tackles class imbalance and structural noise from camouflaged edges. BotVA uses a conditional variational autoencoder to generate semantically coherent minority-class features, mitigating decision boundary shifts, and introduces adversarial graph learning, where a generator injects deceptive edges while a graph-transformer discriminator with semantic attention learns robust representations. With a two-stage training strategy, BotVA achieves stable sample generation and adversarial optimization. Experiments show that BotVA delivers state-of-the-art performance, strong robustness to structural perturbations, and competitive results under limited supervision, highlighting the value of jointly modeling minority-class distributions and adversarial structural attacks.

Acknowledgments

This work was supported by the National Natural Science Foundation of China (62572404 and 62402458), the Guangdong Basic and Applied Basic Research Foundation (2025A1515011565), the China Postdoctoral Science Foundation (2025M784417), the Key Research and Development Program of Shaanxi (2024GX-ZDCYL-01-20), and the Beijing Natural Science Foundation (4262061).