Source-linked AI summary
Fake News Detection via NLP is Vulnerable to Adversarial Attacks
Zhixuan Zhou, Huankang Guan, Meghana Moorthy Bhat, Justin Hsu
TL;DR
Fake-news detectors that rely on linguistic characteristics leave fact-checking aside, and the paper examines whether such systems can handle fact-tampered news and under-written real news. It evaluates Fakebox with three attack types and argues for supplementing linguistic analysis with fact-checking, including a crowdsourced knowledge graph as one possible source of timely event information.
Problem
Existing fake-news detectors focus on linguistic patterns without fact-checking, while subtle fact tampering and under-written real news pose challenges for this approach.
Source: §1 · p. 1Method
Results
Experiments show that Fakebox is significantly subverted by the attacks, while its false-positive rate rises on under-written real articles and certain topics.
Source: §7 · p. 6Takeaways & Limitations
The authors argue that multi-source fact-checking should be integrated into detection, with a crowdsourced knowledge graph offered as one possible way to collect timely event facts.
Source: §7 · p. 6The crowdsourced graph depends on high-quality information, but attackers can also create and edit entries, making unreliable accomplice facts a challenge.
Source: §5.1 · p. 5
Abstract
from arXiv · showhide
News plays a significant role in shaping people's beliefs and opinions. Fake news has always been a problem, which wasn't exposed to the mass public until the past election cycle for the 45th President of the United States. While quite a few detection methods have been proposed to combat fake news since 2015, they focus mainly on linguistic aspects of an article without any fact checking. In this paper, we argue that these models have the potential to misclassify fact-tampering fake news as well as under-written real news. Through experiments on Fakebox, a state-of-the-art fake news detector, we show that fact tampering attacks can be effective. To address these weaknesses, we argue that fact checking should be adopted in conjunction with linguistic characteristics analysis, so as to truly separate fake news from real news. A crowdsourced knowledge graph is proposed as a straw man solution to collecting timely facts about news events.
1 INTRODUCTION
NLP-based fake-news detectors can be fooled by fact-tampering attacks and may reject under-written real news. The paper argues for combining linguistic analysis with fact-based knowledge, proposing a crowdsourced knowledge graph as a straw-man approach.
1 INTRODUCTION
- Detectors focused on linguistic patterns can miss subtle, well-written tampering that preserves the article's subject and alignment with its headline.The paper frames such attacks as a weakness of detection without deeper semantic knowledge.Source: §1 · p. 1
- Fakebox achieves low accuracy on adversarial real-news examples modified through fact distortion, subject-object exchange, and cause confounding.The attacks target factual content rather than the article's overall writing style; examples are shown in Table 1.Source: §1 · p. 1, Table 1 · p. 2
- Under-written real news and coverage of some political or religious topics may be wrongly rejected, contributing to reliance on manual review on open platforms.The paper names Twitter in the United States and TouTiao in China as examples of such platforms.Source: §1 · p. 1
- The authors argue that fact-based knowledge should complement NLP and propose a crowdsourced knowledge graph to aggregate event information and assess extracted claims.The paper presents the graph as a straw-man solution, not an established detector.Source: §1 · pp. 1–2
2 ADVERSARIAL ATTACKS
The paper describes three adversarial attack types that tamper with different aspects of an article. Repeating these edits can change its semantic content while preserving its writing style.
2 ADVERSARIAL ATTACKS
- Fact distortion exaggerates or modifies details such as characters, times, locations, relations, or extent.The paper describes substitutions of people, places, or actions as examples of this attack.Source: §2 · p. 2
- Subject-object exchange changes who performs an action and who receives it, potentially confusing readers.The attack can be performed at the sentence level.Source: §2 · p. 2
- Cause confounding builds a causal relationship between independent events or omits parts of a story.The omitted parts can leave readers with only the material the adversary wants to present.Source: §2 · p. 2
- Repeated modifications can substantially change an article's semantic content without distorting its original writing style.Examples of the attack types are shown in Table 1.Source: §2 · p. 2
3 DATASET AND MODEL
The evaluation uses a balanced, manually checked real-and-fake news dataset and describes Fakebox's linguistic and domain-based assessments. Fakebox assigns labels and scores to articles based on these aspects.
3.1 Dataset
- McIntire's dataset contains 6,335 articles: 3,171 labeled real and 3,164 labeled fake, with titles, contents, and veracity labels.The authors manually checked veracity against reputable sources and note that the dataset does not include URLs.Source: §3.1 · p. 2
3.2 Fakebox
- Fakebox assesses headlines for clickbait, article content for real-news style, and domains associated with content such as hoaxes or satire.Its assessment uses NLP models and a manually curated database.Source: §3.2 · p. 2
- Fakebox labels real-style articles impartial with scores of 60–100, non-real-style articles biased with scores of 0–40, and otherwise labels them unsure with scores of 40–60.It assigns labels and quantitative scores for titles, contents, and domains; higher-scoring articles are described as more likely to be reliable.Source: §3.2 · pp. 2–3
4 EXPERIMENTAL EVALUATION
The evaluation tests Fakebox on unmodified news and hand-tampered real articles. Fakebox often misclassifies real news at baseline, while several fact-tampering changes leave its scores largely unchanged or even increase them.
4 EXPERIMENTAL EVALUATION
- The baseline used 6,335 unmodified headlines and articles from McIntire’s dataset, while attack examples were hand-generated from real articles Fakebox labeled impartial.The attacks included substituting people, places or actions, exchanging subjects and objects, and combining unrelated articles.Source: §4.1 · p. 3, §4.2 · p. 4
4.1 Baseline Performance
- Fakebox reached 52.77% accuracy on McIntire’s dataset, with a 31.79% false rate and 15.44% of samples marked unsure.Excluding unsure cases, overall accuracy was 62.40%; the false positive rate was 56.03%, compared with a 19.74% false negative rate.Source: §4.1 · p. 3
- False positives included real articles about sensitive terms such as “anti,” “prison,” “terror,” “Islamism” and “Trump.”Many misclassified real articles were under-written and not in a journalistic style.Source: §4.1 · p. 3
4.2 Attack-time Performance
- Fact distortion changed Fakebox’s score by only 0.0073, subject-object swaps left it unchanged, and mixing Walmart and Cleveland articles raised it to 0.8585.The mixed article was still labeled impartial, illustrating that unrelated events can be combined without fact checking.Source: §4.2 · p. 4
5 DISCUSSION
The discussion argues that linguistic analysis alone is vulnerable to fact tampering and can reject under-written real news. It proposes pairing NLP with timely facts from a crowdsourced knowledge graph, while noting risks in fact quality and defining what counts as a fact.
5 DISCUSSION
- NLP-only detection is vulnerable to fact tampering and can be biased against under-written articles and certain topics; fact checking is largely absent from current models.The authors argue that fact checking could help address these weaknesses.Source: §5 · p. 4
5.1 A Straw Man Solution
- News fact checking requires timely comparison against a changing knowledge graph, but media experts have limited time and early detection is difficult.The proposal builds on an approach also described by Pan et al. (2018).Source: §5.1 · p. 4
- A dynamically updated, crowdsourced knowledge graph could collect timely event facts from informed locals and help detect fact tampering in news articles.The proposed interface would let users enter subject, action, object, time and location information.Source: §5.1 · p. 5
- Crowdsourced graph entries may be unreliable because attackers can contribute false “accomplice” facts, undermining their use in detection.The authors identify collecting high-quality information as the proposal’s main drawback.Source: §5.1 · p. 5
5.2 What is a Fact?
- The paper treats a fact qualitatively as a statement generally conforming to an event or knowledge, while acknowledging that the concept needs further specification.The authors note that a clear, flexible definition across information-propagation contexts is difficult.Source: §5.2 · p. 5
6 RELATED WORK
The related work reviews foundational task classifications, linguistic and network-based detection, and hybrid models. It identifies fact checking as absent from existing models and says most commercial detectors rely only on linguistic features.
6.1 Foundational Works
- The review groups fake-news detection methods into three main categories and summarizes early foundational work on tasks, methods, platforms and datasets.Rubin et al. (2015) classified fake news by type, while Conroy et al. (2015) described linguistic-cue and network-analysis approaches.Source: §6 · p. 5, §6.1 · p. 5
6.2 Linguistic Approaches
- Linguistic approaches examine grammar, word patterns, term counts and expressions, with prior work addressing clickbait, headline stance, style and text classification.Examples include Chen et al. (2015) on clickbait cues and Bourgonje et al. (2017) on headline stance.Source: §6.2 · p. 5
6.3 Network Approaches
- Network approaches use background information such as conflicting viewpoints, speaker profiles and social interactions, but may lose performance when related information is scarce.The review also describes intervention frameworks and classification using Facebook users’ likes.Source: §6.3 · p. 6
6.4 Hybrid Approaches
- Hybrid approaches combine linguistic and network information; the review notes that fact checking is absent from existing models and most commercial detectors use linguistic features alone.Ruchansky et al. (2017) combined article text, user response and promoting-source users.Source: §6.4 · p. 6
7 CONCLUSION
The experiments show that three adversarial attacks significantly subvert Fakebox, supporting the concern that detectors based solely on linguistic characteristics are vulnerable to tampering. The conclusion advocates multi-source fact checking and describes a crowdsourced knowledge graph as one possible source of timely facts.
7 CONCLUSION
- Experiments show that fact-distortion, subject-object exchange, and cause-confounding attacks significantly subvert Fakebox.The paper evaluates Fakebox against all three attack types.Source: §7 · p. 6
- Tampering can preserve an article’s overall writing style, so linguistic-only models may be less effective in real-world detection.The paper notes that this subtlety may let tampering evade similarity detection.Source: §7 · p. 6
- False-positive rates rise for under-written real articles and articles on certain topics, motivating fact-checking as a supplement.The authors suggest fact-checking to lessen the negative effect of false-positive judgments.Source: §7 · p. 6
- A crowdsourced knowledge graph, dynamically updated by local, well-informed contributors, could provide timely facts for comparison with article claims and veracity labeling.The paper presents this as one possible approach.Source: §7 · p. 6
- Future work includes a visualization interface to make graph crowdsourcing easier for non-experts and examining fake-news propagation in its social context.The authors also plan to study human factors.Source: §7 · p. 6