TH-GNN Detects LLM-Driven Shilling Through Time and Graphs

Introduction

Shilling attacks against recommender systems are becoming harder to identify as language models make fraudulent activity more realistic. An LLM agent can produce fluent reviews, coherent ratings, and plausible user profiles at scale. A single review may contain no obvious linguistic error, even when it is part of a coordinated effort to promote or suppress items.

The paper introducing TH-GNN approaches this problem as a multi-signal detection task. Rather than treating text analysis and graph anomaly detection as separate alternatives, it combines user and item relationships, review semantics, and the timing of interactions in one model.

Key points

• A heterogeneous graph backbone. TH-GNN uses a two-layer Heterogeneous Graph Transformer. Attention is assigned according to node type and relation type, allowing the model to distinguish, for example, user-review and review-item connections instead of flattening every interaction into the same edge.
• Temporal information on every edge. Learnable sinusoidal temporal encodings are added to edges so that the model can represent when interactions occur. A GRU further processes log inter-arrival times to capture bursty behavior, such as many coordinated actions occurring in a short period.
• Cross-modal fusion. Structural user embeddings are combined with frozen RoBERTa representations of reviews and item descriptions through cross-modal attention. This gives the detector access to both a profile’s position in the interaction network and the meaning of the content associated with it.
• Evaluation across varied attacks. The study evaluates the system on five attack families and four benchmark datasets. TH-GNN reports a grand-mean F1 score of 0.870. On Agent4SR attacks, it exceeds the strongest text-only baseline by 10.9 percentage points, with an 11.5-point advantage at the lowest injection rate.

Why it matters

The central implication is that LLM-generated abuse is not only a language problem. More natural wording may make semantic detectors less sensitive, but coordinated accounts still leave traces in their relationships and operating rhythm. Conversely, a graph-only detector may identify unusual neighborhoods without understanding whether the associated reviews and item descriptions are semantically inconsistent.

TH-GNN offers a practical modeling direction for recommender-system security: move from evaluating isolated reviews to analyzing dynamic interaction patterns. Its results support the value of jointly modeling structure, semantics, and time, particularly when the attack volume is relatively low.

The reported scores should still be read in context. The supplied material describes benchmark experiments, but does not establish how the model performs on live platforms, under continuously adapting attackers, or with production-scale latency and cost constraints. The method is therefore best viewed as evidence for a combined detection strategy, not as a universal guarantee against synthetic reviews.

As generative agents reduce the cost of coordinated manipulation, robust defenses will likely need to inspect what users say, how entities connect, and when actions occur. TH-GNN represents one step toward that dynamic, multimodal view.

Source: arXiv