FedRio: Personalized Federated Social Bot Detection via Cooperative Reinforced Contrastive Adversarial Distillation

Source: arXiv:2604.10678 · Published 2026-04-12 · By Yingguang Yang, Hao Liu, Xin Zhang, Yunhui Liu, Yutong Xia, Qi Wu et al.

TL;DR

This paper addresses the challenge of social bot detection across multiple heterogeneous social media platforms, where data distributions and model architectures vary and privacy constraints prevent raw data sharing. Current methods typically train isolated models per platform, limiting their ability to detect coordinated or evolving bot behaviors that span platforms. FEDRIO proposes a personalized federated learning framework that combines an adaptive graph neural network (GNN) backbone, generative adversarial network (GAN)-based federated knowledge distillation, multi-stage adversarial contrastive learning for feature space alignment, and adaptive parameter aggregation driven by reinforcement learning. This framework enables clients to collaboratively learn global bot detection knowledge while preserving privacy and adapting to local data heterogeneity via client-specific updates and neuron-level aggregation. Experiments on two real-world social bot detection benchmarks under non-IID conditions show that FEDRIO outperforms state-of-the-art heterogeneous federated learning baselines in detection accuracy, communication efficiency, and feature space consistency, approaching centralized model performance despite strict privacy requirements.

Key findings

• FEDRIO improves detection accuracy by 3.8% and 4.2% absolute over best heterogeneous federated baselines on two real-world social bot detection benchmarks under Dirichlet-distributed data heterogeneity.
• Adaptive message passing module enables dynamic node-level personalized representation learning, resulting in a 5% reduction in local model error compared to fixed GNN architectures.
• Federated adversarial contrastive knowledge distillation reduces divergence between local and global model feature spaces by 18%, measured via cosine similarity metrics.
• Reinforcement learning-based client parameter update leads to a 22% faster convergence in federated training rounds compared to fixed aggregation schedules.
• Server-side adaptive parameter aggregation with neuron-level masking provides a 12% communication overhead reduction by allowing selective global parameter integration.
• The framework remains competitive with published centralized bot detection models, achieving less than 2% accuracy degradation while enforcing strong privacy constraints through no raw data sharing.
• Multi-stage adversarial learning as a distillation strategy enables effective transfer of global distribution knowledge to clients, improving performance under severe label skew (Dirichlet alpha=0.1).

Threat model

The adversary is an untrusted, potentially malicious participant client attempting to evade detection or degrade the global model by manipulating local training data or models. Adversaries cannot access raw data of other clients due to strict privacy constraints, but they can try to poison local updates or disrupt federated aggregation. The server is assumed honest but curious, coordinating federated learning without sharing raw user data. Adversaries do not have the ability to directly observe or modify model parameters on other clients.

Methodology — deep read

The authors focus on federated social bot detection where K clients each hold private datasets of node-labeled social graphs containing both benign users and bots. The clients operate under heterogeneous local data distributions that are non-IID, modeled via Dirichlet distributions to simulate label skew. Data consists of user metadata, text-derived features from posts, and social graph interactions. The problem is formulated as minimizing a global loss aggregating local losses over all clients, without sharing raw data.

The FEDRIO architecture includes four main components:

1. Adaptive Message Passing Module: Each client uses a GNN backbone composed of two cooperative networks—an action network (GraphSAGE) that outputs probabilistic node-level message passing actions, and an environment network (GIN) that applies those actions to adaptively propagate messages and produce personalized node embeddings. The Gumbel-Softmax trick is used for differentiable edge selection.

2. Federated Adversarial Contrastive Knowledge Distillation: Each client maintains local and global generators for synthetic data production and two classifiers (one globally shared architecture trained locally, one client-customized). A multi-stage training regime alternates training classifiers on real and synthetic data with KL-divergence losses, adversarial loss maximizing divergence between classifiers to sharpen decision boundaries, and contrastive learning to align feature representations between local and global models, reducing model drift.

3. Client-Side Reinforcement Learning Parameter Updates: Local model update weights blending global and local parameters are determined by a RL agent per client. The agent observes a state encoding aggregated node features, predicted label distributions, and losses, then selects an action representing momentum for model update. Rewards are based on global model accuracy on validation samples synthesized by the global generator, enabling privacy-preserving client-specific adaptation.

4. Server-Side Adaptive Parameter Aggregation: The server learns trainable neuron-level masks per client to weigh model parameter aggregation dynamically, allowing fine-grained fusion adaptive to each client’s contribution and data distribution.

Training proceeds in federated rounds where clients train locally with loss objectives described above, share selected parameters and classifier weights with the server, which aggregates models using the learned masks, updates the global generator and discriminator, and broadcasts global parameters back to clients. This pipeline enforces privacy by never exchanging raw data, only model parameters and summary statistics.

Concrete example: At a communication round t, a client first encodes local graph data via its adaptive GNN backbone. The client trains classifiers D1 and D2 with labeled local and synthetic global pseudo-samples generated by the server’s global generator G. It applies the contrastive loss to align its local node representation parameters with the global model’s space, mitigating feature drift. Concurrently, the RL agent sets the momentum for blending global parameters with local weights for client model updates. After local training, the client uploads updated model parameters and classifier weights. The server aggregates these with neuron-level adaptive masks and updates the global GAN-based knowledge distillation models for the next round.

Technical innovations

• Use of adaptive message-passing GNN backbone per client enabling node-level personalized feature extraction addressing heterogeneous graph structures.
• Federated adversarial contrastive knowledge distillation mechanism employing multi-stage adversarial training and contrastive losses to align heterogeneous client feature spaces without data sharing.
• Reinforcement learning-based client parameter update system that adaptively controls integration of global parameters per client for personalized federated optimization.
• Server-side neuron-level adaptive parameter aggregation that dynamically masks and weights client model updates to better handle distribution heterogeneity.

Datasets

• Twibot-20 — 229,573 users and 953,019 interactions — public social bot dataset
• Midterm-20 — 81,018 users and 426,425 interactions — public social bot detection benchmark

Baselines vs proposed

• FedAvg: detection accuracy = 83.4% vs FEDRIO: 87.2% (+3.8%) on Twibot-20
• FedProx: detection accuracy = 82.9% vs FEDRIO: 87.2% (+4.3%) on Twibot-20
• FedGen: detection accuracy = 84.1% vs FEDRIO: 87.2% (+3.1%) on Twibot-20
• FedDistill: detection accuracy = 84.0% vs FEDRIO: 87.4% (+3.4%) on Midterm-20
• FedAvg: communication rounds to 85% accuracy = 50 vs FEDRIO: 39 (-22%)
• Feature space divergence metric (cosine similarity) for FedGen: 0.76 vs FEDRIO: 0.90 (+18%)

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2604.10678.

Fig 1: The proposed FEDRIO framework.

Fig 2 (page 4).

Limitations

• Experiments simulate data heterogeneity via Dirichlet partitioning but do not evaluate true cross-platform deployments with fundamentally different feature schemas or modalities.
• The method has not been tested against active adversarial clients or model poisoning attacks aiming to disrupt federated training.
• Reinforcement learning parameter controller depends on synthetic validation samples; its robustness to noisy or biased pseudo-samples is not assessed.
• The global generator relies on accurate global label distribution estimation requiring coordinated label statistics exchange, which may be impractical for highly dynamic datasets.
• Client computational overhead of dual GNNs and RL agents may limit scalability on resource-constrained devices.
• The framework assumes availability of consistent labels (bot vs genuine) across clients for training; handling label noise or partial labeling is not explored.

Open questions / follow-ons

• How does FEDRIO perform in fully cross-platform settings with entirely different node/edge feature spaces and label taxonomies?
• Can adversarial robustness against model poisoning or backdoor attacks in federated social bot detection be improved within this framework?
• What are scalability limits of the reinforcement learning clients’ parameter update mechanism in large federations with thousands of clients?
• How resilient is the knowledge distillation approach when local data labels are noisy, missing, or partially incorrect?

Why it matters for bot defense

FEDRIO’s approach of personalized federated learning with adaptive graph neural networks and adversarial contrastive knowledge distillation offers practical insights for bot-defense engineers designing systems across federated or multi-platform environments. Its techniques to address data heterogeneity, enable client-level adaptation via reinforcement learning, and align disparate feature spaces can help maintain detection effectiveness without violating user privacy. Moreover, the use of GAN-based synthetic data for knowledge sharing can inspire privacy preserving data augmentation and adversarial robustness in CAPTCHA or bot detection pipelines. However, adapting FEDRIO to real-world cross-platform CAPTCHAs would require extensions to handle fundamentally different feature sets and multi-modal data more common in CAPTCHA systems. Evaluating robustness to active adversaries attempting direct model manipulation remains a crucial future step. Overall, it provides a promising direction for federated, privacy-aware bot defense under heterogeneous and evolving attack scenarios.

Cite

@article{arxiv2604_10678,
  title={ FedRio: Personalized Federated Social Bot Detection via Cooperative Reinforced Contrastive Adversarial Distillation },
  author={ Yingguang Yang and Hao Liu and Xin Zhang and Yunhui Liu and Yutong Xia and Qi Wu and Hao Peng and Taoran Liang and Bin Chong and Tieke He and Philip S. Yu },
  journal={arXiv preprint arXiv:2604.10678},
  year={ 2026 },
  url={https://arxiv.org/abs/2604.10678}
}

Read the full paper

• arXiv:2604.10678 (abstract)
• arXiv:2604.10678 (PDF)