PaperlayerView exact revision on arXiv

Source-linked AI summary

Feature-Context Consistency: Unsupervised Adversarial Detection with Drift Stability on Attributed Graphs

Firas Bayram, Maxime Cordy

arXiv:2610.16694v1cs.LGcs.AI

TL;DR

Adversarial detection on evolving attributed graphs must contend with labels that arrive late or not at all and natural drift that can stale decision boundaries. The paper uses Context Boost in an RBM to measure feature-context consistency, with theoretical separation and drift guarantees. Across XBlock and Reddit, it reports strong zero-label attack detection and drift performance.

  • Problem

    Adversarial detection on evolving attributed graphs lacks reliable labels early and must contend with natural drift that erodes trained decision boundaries.

    Source: §1 · p. 1

  • Method

    CB-RBM uses the Context Boost, a free-energy reduction from neighborhood context, to score feature-context consistency without adversarial labels.

    Source: §1 · p. 2

  • Results

    Across XBlock and Reddit, CB-RBM achieves AUROC ≥0.96 on all non-white-box attacks and Combined Score ≥0.87 at T=20 under drift.

    Source: §7 · p. 10

  • Takeaways & Limitations

    The paper’s results link label-free detection and drift calibration to the same feature-context correlation signal.

    Source: §7 · p. 10

    The guarantees rely on positive legitimate feature-context correlation and smooth drift, and detection weakens when the context-correlation gap collapses.

    Source: §6.5 · p. 10

Abstract

from arXiv · show

Adversarial detection on evolving attributed graphs faces two challenges: fraud labels arrive late or not at all, and natural distributional drift erodes any trained decision boundary. Modern detectors can reach strong detection rates when labels are available and the distribution is stationary; sustaining that quality without labels and under drift is the open problem. We identify feature-context consistency -- the alignment between a node's attributes and its aggregated neighborhood attributes -- as a single structural signal that addresses both. We formalize it as the Context Boost (CB) score within a Restricted Boltzmann Machine framework (CB-RBM) and prove two complementary worst-case guarantees: a strict separation between the expected CB of legitimate and adversarial nodes, with gap growing linearly in model capacity, whenever the adversary's context stays far enough from legitimate neighborhood context; and a Wasserstein-Lipschitz bound on how far the CB distribution moves under natural drift. We validate on XBlock Ethereum phishing (~153K nodes) and Reddit banned-user detection (~11K nodes), with two further datasets in the appendix spanning diverse domains. With zero labels, CB-RBM achieves AUROC >= 0.96 on four adversarial attacks and keeps FPR close to its calibrated 5% target under drift -- outperforming supervised GNNs (hundreds of labels), unsupervised graph-anomaly baselines, and a standard RBM whose FPR collapses to 89-100%. What typically requires separate mechanisms -- label-free operation and drift stability -- here follows from a single structural regularity of the data. Code: https://github.com/serval-uni-lu/CB-RBM.

1 Introduction

Evolving attributed graphs pose a joint challenge: adversarial labels arrive late or never, while natural drift can make trained decision boundaries stale. The paper proposes feature-context consistency as a shared signal for label-free detection and drift stability.

Motivation

  • Late or missing labels and continuously evolving behavior, topology, and features make adversarial detection difficult to deploy reliably on evolving graphs.Fraud entities may operate for days or weeks before being flagged, while drift can make a snapshot-trained boundary stale and trigger false alarms.Source: §1 · pp. 1–2

Core idea

  • Feature-context consistency aligns a node’s attributes with aggregated neighbor attributes and is proposed as one signal for label-free detection and drift robustness.The paper argues that legitimate features and mean-pooled context move together under natural drift, while injected adversaries lack a consistent neighborhood history.Source: §1 · p. 2

Approach and guarantees

  • CB-RBM operationalizes this signal as the Context Boost, a free-energy reduction from conditioning on neighborhood context, and the paper proves separation and drift bounds under stated assumptions.The separation gap grows linearly in model capacity when adversarial context stays sufficiently far from legitimate neighborhood context; the drift result is a Wasserstein-Lipschitz bound.Source: §1 · p. 2

Empirical validation

  • With zero labels, CB-RBM achieves AUROC ≥0.96 on all non-white-box attacks and keeps FPR close to its calibrated 5% target under 20-step drift, outperforming the reported baselines.The comparison includes supervised GNNs trained on hundreds of labels, unsupervised graph-anomaly baselines, and a standard RBM whose FPR rises to 89–100%.Source: §1 · p. 2

2 Related Work

Related work spans supervised fraud detection, unsupervised graph anomaly detection, drift adaptation, and detectors transferred across graphs. The paper positions CB-RBM around a context-based score and guarantees for separation and drift.

Graph anomaly detection

  • Supervised fraud detectors depend on labeled adversaries, while unsupervised graph detectors score reconstruction, neighborhood, contrastive, or one-class anomalies.The listed methods include CARE-GNN, GraphConsis, PC-GNN, BWGNN, DOMINANT, DAE, GAD-NR, CoLA, CONAD, and OCGNN.Source: §2 · pp. 2–3

Distribution shift and dynamic graphs

  • Drift approaches use adaptation, robustness objectives, embedding alignment, or temporal modeling, whereas CB-RBM evaluates with trained parameters and threshold frozen under smooth drift.The paper states that Theorem 2 bounds how far its scores move under this setting.Source: §2 · p. 3

Generalist detectors

  • Generalist detectors address transfer across graphs, while this paper studies temporal drift within one deployed graph.The cited generalist methods include ARC, UNPrompt, and AnomalyGFM.Source: §2 · p. 3

Positioning

  • The paper’s distinction from these families is the Context Boost differential and its conditional score-separation and Wasserstein drift analyses.Section 6.4 and Appendix D compare representatives of node-level detector families under the paper’s protocol.Source: §2 · p. 3

3 Problem Setup

The setup treats entities and interactions as an attributed directed graph and trains a one-class detector on a pool assumed legitimate. It defines neighborhood context and four injected-adversary strategies, while delimiting attack families outside the evaluation scope.

Graph and data

  • The detector uses no adversarial labels: it trains on a pool assumed legitimate and sets its threshold on a held-out slice of that pool.In practice, the pool consists of accounts with no abuse report after an aging window.Source: §3 · p. 3

Neighborhood context

  • Neighborhood context is aggregated from a node’s neighbors, with a per-dimension sign vector used to correct anti-homophilic dimensions.The sign vector makes signed context positively correlated with legitimate node features; its construction is detailed in §4.Source: §3 · p. 3

Threat model

  • The threat model includes isolated injection, feature camouflage, Sybil decoys, and relation camouflage using high-degree legitimate nodes.These strategies range from random or fabricated context to partially genuine context from selected legitimate neighbors.Source: §3 · p. 3

Scope

  • The evaluated scope excludes training-time graph or label manipulation such as topology poisoning and backdoor attacks.White-box PGD requiring detector gradient access is treated separately as a stress test, and training-pool contamination is separately evaluated.Source: §3 · pp. 3–4

4 CB-RBM

CB-RBM extends a Gaussian-Bernoulli RBM with a context pathway and uses the free-energy reduction from context as its detection signal. The section describes its context construction, one-class training, and calibrated detection threshold.

Model

  • The model extends a Gaussian-Bernoulli RBM with neighborhood context as an input alongside node features, using binary hidden units.The context pathway conditions hidden-unit activations on neighborhood features.Source: §4 · p. 4

Context construction

  • A label-free sign vector is fitted from training feature statistics to flip anti-homophilic dimensions and is kept fixed during training.The paper says it can be re-estimated on an unlabeled window to restore calibration after sign corruption.Source: §4 · p. 4

Context Boost

  • The Context Boost measures how much neighborhood context reduces free energy beyond features alone.The feature-reconstruction quadratic term cancels, so CB depends on hidden-unit activations; consistent context yields a large score, while absent or random context yields a near-zero score.Source: §4 · p. 4

Training

  • Training uses Contrastive Divergence CD-1 on legitimate node-context pairs without attack labels.The sparsity penalty is set to zero because nonzero sparsity weakens the context contribution.Source: §4 · p. 4

Detection and complexity

  • Detection thresholds the negative Context Boost score at its 95th percentile on a held-out calibration slice, targeting 5% calibration FPR.Training costs O(N ·nh ·nv) per epoch and inference O(nh ·nv) per node, with precomputed single-hop context.Source: §4 · p. 4

5 Theoretical Guarantees

The section gives worst-case certificates for separating legitimate from adversarial nodes and for stability under natural drift. The guarantees depend on stated structural and boundedness assumptions, and are distinct from observed detection error.

5.1 Assumptions

  • The guarantees assume signed structural correlation, coherent hidden-unit activations, bounded moments, limited adversarial context activation, and coherent dominance.The context-gap assumption constrains positive gated-context activation under adversarial context; coherent dominance is checked using legitimate data and the trained model.Source: §5.1 · p. 5

5.2 Separation and Stability

  • Under Assumptions 1–5 and the stated context-gap condition, the expected CB separation is at least nhε, growing linearly with the number of hidden units.The separation condition requires the adversarial positive-context bound to fall below the legitimate dominance margin.Source: §5.2 · p. 5, §5.1 · p. 5
  • The midpoint threshold yields Chebyshev error bounds, but those bounds can be vacuous because the variance bound exceeds measured Var[CB] by 8,300× on XBlock and 237,000× on Reddit.The section distinguishes these worst-case certificates from observed error, which Section 6 measures directly.Source: §5 · p. 5, §5.2 · p. 6
  • Under smooth Wasserstein-1 drift, the CB distribution moves by at most L t δ_drift, while average score-quantile movement is also bounded.The quantile guarantee does not control the 95th percentile pointwise.Source: §5.2 · p. 6
  • In the context-interpolation sweep, detection falls below 50% when the camouflaging share exceeds approximately 0.56 on XBlock and 0.58 on Reddit.The hardest camouflage is the context that brings ρ_eff closest to ρ_0.Source: §5.2 · p. 6

6 Experiments

Experiments evaluate CB-RBM on Ethereum-phishing and Reddit-ban graphs against supervised and unsupervised baselines, using attack detection and drift stability. Results test separation across attacks, performance under gradual drift, and robustness limits.

6.1 Setup

  • The setup uses XBlock (153K Ethereum wallets) and Reddit (11K users), compares supervised and unsupervised detectors, and evaluates TPR at a threshold calibrated to 5% FPR.Supervised GNNs use 932 / 166 labeled adversaries on XBlock / Reddit; other methods use zero labels.Source: §6.1 · pp. 6–7

6.3 Attack Benchmark

  • Across four attacks on both datasets, CB-RBM maintains AUROC ≥96% and TPR@5%FPR ≥88% at zero labels, outperforming supervised and unsupervised baselines.Its AUROC stays above 99% on three attacks and is approximately 97% on Relation Camouflage; CoLA TPR transfers from 84% to 17% across datasets.Source: Table 1 · p. 8, §6.3 · p. 8

6.2 Separation Gap and Theory Validation

  • Legitimate and drifted nodes score above the calibrated threshold while all four attack types cluster predominantly below it; the squared separation gap decreases as adversarial context correlation rises.Relation Camouflage reaches the highest ρeff (0.51–0.64) and steepest gap reduction; Natural Drift retains near-legitimate correlation and near-zero gap.Source: Figure 2 · p. 7, §6.2 · p. 8

6.4 Drift Stability

  • At 20 drift steps, CB-RBM maintains average Combined Score ≥0.87 on both datasets and leads consistently; chronological XBlock validation keeps legitimate-wallet FPR at or below 5%.With the model, sign vector, and threshold frozen on the earliest of five windows, FPR reaches 3.1% by late 2018.Source: Figure 3 · p. 9, §6.4 · p. 9

6.5 Discussion

  • CB detects absence of legitimate neighborhood context rather than feature deviation: legitimate features with random or absent context score Combined ≥0.91, while legitimate features with legitimate context score ≤0.11.An XBlock median legitimate node has CB 1046, compared with 952 after 20 drift steps and 28 for an injected adversary.Source: §6.5 · p. 9
  • Under natural drift, the observed CB shift at 20 steps is over two orders of magnitude smaller than the worst-case bound, with 526× slack on XBlock and 4,540× on Reddit.At that step, the legitimate-score 95th percentile shifts by 42.7 on XBlock and 3.4 on Reddit; mean frozen-threshold FPR is 6.1% and 7.1%, respectively.Source: §6.5 · p. 10
  • Removing context collapses Combined Score by two to three orders of magnitude; on YelpChi, stacking CB-RBM eliminates 87.6–93.5% of supervised baselines’ drift-induced false alarms.With a Sybil clique growing from 2 to 50 members, CB-RBM flags 100% of attackers on both datasets from step 10.Source: §6.5 · p. 10
  • CB-RBM relies on ρ0 > 0 and is most effective when adversaries lack legitimate neighborhood history; genuine hub connections narrow the detection gap, while abrupt or adversarial shifts may need other mechanisms.Substantial topology change can impair frozen-threshold calibration, and white-box gradient access can lower detection.Source: §6.5 · p. 10

7 Conclusion

CB-RBM uses feature-context consistency for label-free detection, and its reported results span adversarial detection and drift stability. The conclusion identifies missing legitimate network context as its detection boundary.

7 Conclusion

  • AUROC ≥0.96 on all non-white-box attacks at zero labels and Combined Score ≥0.87 at T=20 under drift; the paper reports stronger results than supervised GNNs, unsupervised baselines, and Std-RBM.CB-RBM is evaluated on XBlock and Reddit; the conclusion says supervised GNNs underperform even with their full label set, unsupervised baselines collapse under drift, and Std-RBM loses calibration entirely.Source: §7 · p. 10
  • CB-RBM detects absence of legitimate network context, not feature deviation, and the paper identifies genuine adversarial connections as its fundamental limit.The conclusion names dynamic graphs with streaming edges and applying Context Boost to other generative architectures as extensions.Source: §7 · p. 10

A Pipeline and Algorithm

  • Figure 4 routes the sign-corrected neighbor mean through a GLU-gated pathway; Context Boost is the context-driven free-energy reduction, with the quadratic feature term cancelling.The sign vector and threshold can be refreshed from a current unlabeled window without retraining.Source: Figure 4 · p. 15, A Pipeline and Algorithm · p. 15

B.1 Supporting Lemmas

  • CB is Lipschitz on the stated bounded-context region, with constant L = Lv + Lc, supporting the paper’s drift-stability analysis.The supporting lemma gives the bound for contexts with norm at most Mc.Source: §B.1 · p. 16

B.2 Proof of Theorem 1 (Separation)

The proofs establish separation when coherent hidden units provide a legitimate-context gain that exceeds the adversarial-context bound. They also derive a worst-case drift horizon and qualify both the error and quantile guarantees.

B.2 Proof of Theorem 1 (Separation)

  • The expected legitimate–adversarial CB gap is at least nhε under the stated separation conditions, with coherent units supplying a positive legitimate gain and adversarial context bounded above.Units with Uj = 0 contribute nothing to the context gain, and small ∥Uj∥ units contribute proportionally little to the adversarial bound.Source: §B.2 · p. 17
  • The Chebyshev error bounds are finite for thresholds between the expected-score bounds, but need not fall below one and do not predict observed error rates.An additional O(1/nh) refinement requires pairwise uncorrelated unit contributions, beyond Assumptions 1–5.Source: §B.2 · p. 17

B.3 Proof of Corollary 1 (Detection Guarantee)

  • With a threshold midway between the expected-score bounds, the proof bounds the adversarial miss rate by 4 Var[CB | Pfraud, Qrand] / (Ψ −Φ)2.The proof states both class variances are finite and the separation gap is positive, so the bounds are finite.Source: §B.3 · p. 17

B.4 Proof of Theorem 2 (Drift Stability)

  • Under the drift conditions, the legitimate mean stays above the midpoint threshold while t < (Ψ −Φ)/(2Lδdrift), yielding a worst-case drift horizon.The proof carries the separation gap forward using the Lipschitz bound and per-step drift budget.Source: §B.4 · p. 18

B.5 Proof of Corollary 2 (Quantile Stability)

  • The Wasserstein bound controls average score-quantile displacement, not an individual quantile such as the 95th-percentile calibration threshold.The proof describes the bound as worst-case and loose for natural drift, whose joint feature-context movement follows nearly flat directions.Source: §B.5 · p. 18

C Datasets

The experiments use XBlock and Reddit, with distinct graph types, feature sets, and label-graph correlations. The accompanying setup describes calibration, drift evaluation, and the compared detector families.

C Datasets

  • XBlock contains 153,477 Ethereum wallets and 715,573 directed transaction edges, while Reddit contains 10,984 users and 168,016 co-participation edges.XBlock has 38 transaction-statistic features and sign-corrected feature-context correlation ρ0 = 0.30; Reddit has 73 linguistic and structural features and ρ0 = 0.68.Source: C Datasets · p. 19

D Additional Baselines

  • The evaluation freezes models and thresholds at t=0 under drift, uses the same legitimate evaluation nodes and attack reserve, and reports a Combined Score.CONAD and AnomalyDAE exhausted memory on XBlock under the stated configuration and are reported only on Reddit.Source: D Additional Baselines · p. 19
  • The ablations compare a signed-cosine score, −cos(xi, ci), using sign-corrected context and no learning, with a two-layer Context-MLP trained on legitimate pairs to predict x from c.The Context-MLP is scored by ∥x −ˆx(c)∥2, retaining context conditioning without the free-energy differential or GLU gate.Source: D Additional Baselines · p. 19

E.1 Contaminated training pool

The experiments test contamination of the assumed-legitimate training and calibration pools, refresh of the sign vector, and controlled swaps of features and context. Results indicate robustness to these tested perturbations while showing that context is the primary detection signal.

E.1 Contaminated training pool

  • At natural, 5%, and 10% fraud contamination levels, no sign dimension flips, and Isolated Injection, Feature Camouflage, and Sybil remain at 100% TPR on XBlock and at least 92% on Reddit.The protocol refits the sign vector, model, and threshold on the contaminated pool and measures FPR on held-out legitimate nodes.Source: §E.1 · p. 20, Table 5 · p. 21

E.2 Sign vector

  • Re-estimating the sign vector from unlabeled nodes recovers all 38 XBlock and 73 Reddit dimensions and restores Isolated Injection TPR to 100% and 97.5%.With 1,061 Reddit samples every seed recovers all signs; smaller samples can leave some signs wrong and cause wide FPR variation.Source: §E.2 · p. 21, Table 6 · p. 21, Table 7 · p. 22

F Feature-Context Decomposition

  • Random context triggers detection with either legitimate or adversarial features, while legitimate features paired with legitimate context yield near-zero scores; legitimate context suppresses scores on XBlock but not fully on Reddit.The reported interpretation is that CB-RBM primarily detects absent context, with secondary feature sensitivity on Reddit.Source: F Feature-Context Decomposition · p. 21, Table 8 · p. 22

G Ablation

The appendix tests CB-RBM’s context pathway, capacity, and pooling choices, then evaluates robustness under adversarial perturbations and several forms of drift. Across these settings, context-aware scoring remains more effective or stable than the standard RBM, with performance depending on attack and dataset.

G Ablation

  • Removing the context pathway drops mean Combined Score to ≈0.001 on XBlock and ≈0.010 on Reddit, versus 0.94 and 0.88 for CB-RBM.The comparison combines attack-benchmark TPR with T=20 drift FPR.Source: G Ablation · p. 22
  • XBlock’s capacity envelope rises through nh=256, while Reddit peaks at nh=128 and Relation Camouflage Combined Score falls from 0.81 to 0.33 for nh ≥256.The main-body settings are nh=256 for XBlock and nh=128 for Reddit.Source: G Ablation · p. 22, Figure 5 · p. 23
  • On XBlock, mean and attention pooling tie at Combined=0.95 for Isolated Injection; under PGD, max pooling collapses to 0.15 while mean and attention retain meaningful scores.The ablation compares Isolated Injection and PGD; all four operators preserve per-dimension alignment.Source: G Ablation · pp. 22–23, Table 10 · p. 24

H PGD Budget Sweep

  • Under white-box PGD, AUROC falls from 0.90 at ϵ=0.01 to 0.66 at ϵ=0.5 on XBlock, and from 0.42 at ϵ=0.1 to 0.07 at ϵ=0.5 on Reddit.Detection degrades monotonically on both datasets; XBlock remains above chance across the tested range.Source: H PGD Budget Sweep · p. 23, Figure 6 · p. 24

I.1 Alternative drift regimes

  • Across five alternative drift regimes, CB-RBM stays at ≤16% FPR on both datasets, while Std-RBM exceeds 55% in every regime and 95% in four XBlock regimes.The tested increments vary in correlation and tail heaviness; the reported per-step variance budget differs from the headline simulation.Source: §I.1 · p. 24, Table 11 · p. 25

I.2 Threshold-level drift

  • At T=20, the frozen-threshold FPR rises from 5% to 6.1% on XBlock and 7.1% on Reddit, while the 95th-percentile threshold shifts by 42.7 and 3.4, respectively.The reported threshold percentile is tracked in a separate three-seed run with the model and threshold frozen at t=0.Source: §I.2 · p. 25, Table 12 · p. 25, Table 13 · p. 26

I.3 Correlation-weakening drift

  • Under correlation weakening, threshold refresh restores FPR to 5% by construction; with 50% edge growth, frozen FPR reaches 37.3% on XBlock and 34.6% on Reddit before refresh restores 5%.Under edge growth, Isolated Injection TPR after refresh is 100% on XBlock and 91.0% on Reddit at 50% growth.Source: §I.3 · pp. 25–26, Table 14 · p. 26

I.4 Real temporal validation (XBlock)

  • On real XBlock temporal windows, CB-RBM maintains TPR=100%, while GAT holds around 84%–89%, as the feature-distribution drift grows to approximately 73.The calibrated 5%-FPR operating point is used across five windows; Figure 7 plots FPR and TPR.Source: §I.4 · pp. 26–27, Figure 7 · p. 27

I.5 Detection latency

The latency evaluation contrasts the first alarm under benign natural drift with alarms along four adversarial trajectories. CB-RBM stays silent under natural drift and fires on adversarial trajectories, with timing depending on whether the attack is fixed-state or evolving.

I.5 Detection latency

  • CB-RBM stays silent under natural drift and fires on every adversarial trajectory, whereas Std-RBM false-alarms on drift at T=15 on XBlock and T=23 on Reddit and misses every attack.CB-RBM fires immediately on fixed-state Sybil and Relation Camouflage, but at T=18–26 on evolving Isolated Injection and Feature Camouflage.Source: §I.5 · p. 27, Table 16 · p. 28
  • As the Sybil clique grows, CB-RBM flags 100% of attack nodes on both datasets by step 10, while Std-RBM remains at 51.3% on XBlock and 9.5% on Reddit.With a two-member clique, CB-RBM already flags 92.3% on XBlock and 61.0% on Reddit.Source: §I.5 · pp. 27–28, Table 17 · p. 28

J Context Interpolation Sweep

The appendix varies context continuously to probe when camouflage closes CB-RBM’s detection margin, then tests whether the consistency principle extends beyond the finance and social-media datasets. Tolokers results provide evidence in a denser crowdsourcing graph with a lower feature-context correlation.

J Context Interpolation Sweep

  • The sweep interpolates between revealing and camouflaging contexts to vary effective feature-context correlation and measure where the CB-RBM detection margin closes.For each dataset, α=1 denotes its harder camouflage context.Source: J Context Interpolation Sweep · p. 28
  • On XBlock, TPR falls from 66% at α=0 to 4% at α=1, with a crossing at α∗≈0.56; on Reddit, it falls from 100% to 11%, crossing at α∗≈0.58.The harder camouflage is legit-mean context on XBlock and natural attack context on Reddit.Source: J Context Interpolation Sweep · pp. 28–29, Figure 8 · p. 29

K Generalization across Domains

  • The domain-transfer evaluation adds Tolokers, a crowdsourcing graph, and YelpChi, an e-commerce review-fraud graph, to the finance and social-media datasets.The additional datasets are described as having different graph properties, label distributions, and fraud mechanics.Source: K Generalization across Domains · p. 29

K.1 Tolokers (Crowdsourcing)

  • Tolokers contains 11,758 worker nodes and 1,038,000 edges, with 21.8% unreliable-worker labels and average degree 88.Its sign-corrected ρ0=0.215 is below XBlock’s 0.30 and lies at the lower end of the tested homophily range.Source: §K.1 · p. 29
  • On Tolokers, CB-RBM leads on three of four attacks and is within 0.9 points of the top on Sybil; its drift Combined Score is 0.826, over 0.33 above the best baseline, GCN at 0.493.Under 20-step Gaussian drift, stability is 0.936 (FPR 6.4%), and the Combined Score is approximately 27× the Std-RBM ablation.Source: §K.1 · pp. 29–30, Table 18 · p. 30, Table 19 · p. 30

K.2 YelpChi (E-commerce Review Fraud)

On YelpChi, an unfavorable raw context-correlation gap compresses CB-RBM’s standalone detection margin, though it remains strongest on Relation Camouflage and most stable under drift. As a downstream filter it rescues many drift-induced false positives, while the Context Boost principle can extend to other architectures if model-specific conditions are reverified.

K.2 YelpChi (E-commerce Review Fraud)

  • ∆ρ = −0.013: coordinated fraud rings retain slightly more coherent neighborhood context than typical legitimate reviews, compressing the expected detection margin.The YelpChi evaluation uses the net_rtr subset, which links reviews of the same product posted in the same month.Source: §K.2 · p. 30
  • 74–79% AUROC on three of four YelpChi attacks; supervised SAGE, GCN, and GAT score Combined Score 0.72, 0.51, and 0.49 versus CB-RBM’s 0.41.The exception is Relation Camouflage, where CB-RBM leads on AUROC, TPR@5%FPR, and Combined Score.Source: §K.2 · p. 30, Table 20 · p. 31, Table 21 · p. 31

L CB-RBM as a Drift-Filter Defense

  • At T=20 on XBlock, CB-RBM filtering reduces DOMINANT’s drift FPR from 98.3% to 6.5%, while established-adversary AUROC is 0.84 on XBlock and 0.54 on Reddit.Source: L CB-RBM as a Drift-Filter Defense · p. 31
  • 87.6–93.5% of drift-induced false positives are rescued across seven baselines when CB-RBM is layered downstream.The paper frames CB-RBM as a complement rather than a replacement, with no retraining cost, label cost, or architectural integration.Source: L CB-RBM as a Drift-Filter Defense · p. 31, Table 22 · p. 32

M Transferability of the Context Boost Principle

1. Claims

  • The stated scope boundaries include absent feature-context correlation, genuine adversarial connections, topology change, white-box attacks, and abrupt or adversarial shifts beyond the smooth-drift analysis.Source: §1 · p. 33

Related papers

Loading 2610.16694v1…