TH-GNN: Heterogeneous Temporal Graph Neural Networks for LLM-Agent Shilling Attack Detection

# Heterogeneous Temporal Graph Neural Networks for LLM-Agent Shilling Attack Detection
Source: [https://arxiv.org/html/2608.20376](https://arxiv.org/html/2608.20376)
,Divya Prakash ShrivastavaZayed UniversityDubaiUAEandRakesh ThakurJAIN \(Deemed to be University\)BengaluruIndia

\(2026\)

###### Abstract\.

LLM agents can now generate realistic shilling profiles—fluent reviews and coherent ratings—at scale, systematically defeating recommender\-system defences\. Text\-only detectors that flag semantic drift in review embeddings are blind to graph structure and temporal coordination; graph\-only detectors that exploit neighbourhood anomalies cannot reason over review semantics or the cross\-modal inconsistencies produced by LLM\-generated content\. We propose TH\-GNN, a heterogeneous temporal graph neural network with a two\-layer Heterogeneous Graph Transformer backbone that applies per\-type, per\-relation attention augmented with learnable sinusoidal temporal encodings on every edge\. Cross\-modal attention fuses the structural user embedding with frozen RoBERTa representations of reviews and item descriptions; a GRU over log\-inter\-arrival times captures burstiness\. Across five attack families and four datasets, TH\-GNN achieves a grand\-mean F1of 0\.870, outperforming the strongest text\-only baseline on Agent4SR attacks by 10\.9 pp and 11\.5 pp at the lowest injection rate\. Code and data splits are available at[https://github\.com/shiv3589/thgnn\-shilling](https://github.com/shiv3589/thgnn-shilling)\.

shilling attack detection, heterogeneous graph neural networks, temporal encoding, LLM\-generated profiles, recommender systems

††conference:ACM Conference; Year; Location††journalyear:2026††ccs:Computing methodologies Neural networks††ccs:Information systems Recommender systems††ccs:Security and privacy Intrusion detection systems## 1\.Introduction

When an LLM agent constructs a fake recommender\-system profile, it does not simply assign random ratings\. Given a target item and a procedurally generated persona, Agent4SR\(Zhang et al\.,[2024](https://arxiv.org/html/2608.20376#bib.bib29)\)writes 10–20 natural\-language reviews of plausible filler items, assigns ratings consistent with the persona’s stated preferences, and maximally rates the target\. The resulting profile is grammatically fluent, topically coherent, and statistically indistinguishable from genuine users: it matches the global rating distribution, interleaves popular filler items naturally, and produces review text whose semantic embedding sits comfortably within the genuine\-user manifold\. When a campaign injects many such profiles in a coordinated burst, no single anomaly signal—rating statistics, textual outlier scores, or neighbourhood structure—is individually sufficient to flag any one of them\.

Existing detectors split into two families, each blind to one of the dimensions that agent\-generated profiles exploit simultaneously\. Text\-only detectors such as SemanticShield\(Li et al\.,[2025](https://arxiv.org/html/2608.20376#bib.bib12)\)compare each user’s aggregated review embedding against the genuine\-user centroid; they are the strongest single\-modality baseline against LLM\-generated text but collapse on rating\-only datasets, ignore the interaction graph entirely, and detect nothing when profiles are injected across days rather than seconds\. Graph\-only detectors such as Anti\-FakeU\(Zhang et al\.,[2022](https://arxiv.org/html/2608.20376#bib.bib28)\)score users by degree asymmetry and co\-purchase overlap in the user–item bipartite graph; they handle structural attacks well but are blind to the cross\-modal inconsistencies introduced when fluent LLM text accompanies plausible rating patterns, and they discard edge timestamps entirely, missing the synchronised burst fingerprint left by campaigns that inject profiles in coordinated waves\. Neither family is equipped to detect a threat that is simultaneously graph\-plausible, text\-coherent, and temporally coordinated\.

TH\-GNN addresses all three failure modes with a unified architecture built on three non\-redundant signal streams\. The structural backbone is a two\-layer Heterogeneous Graph Transformer that represents users, reviews, and items as distinct node types connected by typedwrites,about, andratesedges, learning per\-type and per\-relation attention patterns that capture the qualitatively different fingerprints each node type carries\. Timestamp information is woven directly into every edge’s attention logit via a learnable sinusoidal encoding, letting the model recognise compressed inter\-arrival times that betray coordinated injection without requiring explicit campaign\-level supervision\. After the graph encoder, a cross\-modal attention block fuses the structural embedding with mean\-pooled RoBERTa representations of the user’s reviews and the items they rated, integrating the textual and relational views under a single learned attention distribution\. A lightweight GRU over each user’s log\-inter\-arrival sequence provides an explicit burstiness signal orthogonal to both graph topology and text content\. A two\-layer MLP over the concatenated streams produces the final fake\-user score\.

TH\-GNN achieves a grand\-mean F1of0\.870across all 20 dataset–attack configurations, uniformly above every baseline on every row\. The gap is widest against Agent4SR, where TH\-GNN reaches mean F1= 0\.825 versus SemanticShield’s 0\.716—a margin of\+\+10\.9 pp—while holding false\-alarm rate below 4\.5 % compared to baselines’ 6\.8–12\.5 %\. At the lowest injection rate \(0\.5 %\), where only 5 fake profiles exist per 1,000 genuine users, the advantage widens to\+\+11\.5 pp on Agent4SR, because graph\-temporal coordination signals become proportionally more salient as the injected mass shrinks below the threshold of count\-based and distributional detectors\.

Contributions\.

- •We propose TH\-GNN, a heterogeneous temporal graph neural network that jointly encodes the user–review–item interaction graph, review and item text streams, and per\-user temporal burstiness for shilling detection—the first detector to close all three failure modes of the prior art simultaneously\.
- •We demonstratestate\-of\-the\-art detection across five attack families \(random, bandwagon, AUSH, GraphAttack, Agent4SR\) and four diverse datasets, with consistent margins that widen at low injection rates where single\-modality baselines degrade fastest\.
- •We providethe first systematic evaluation of shilling detectors against LLM\-agent attacks across multiple datasets and injection rates, establishing a benchmark that cleanly separates multimodal detectors from single\-modality baselines\.
- •We releasecode, configuration files, and reproducibility scripts for all 720 experimental runs to support future work in this area\.

## 2\.Related Work

### 2\.1\.Shilling Attack Detection

Shilling attack detection has a two\-decade history spanning statistical, supervised, and graph\-based paradigms\. The foundational statistical approach treated each user’s rating profile as a feature vector and flagged outliers\. Chirita et al\.\(Chirita et al\.,[2005](https://arxiv.org/html/2608.20376#bib.bib3)\)defined per\-user features—rating deviation from the item mean, weighted deviation from mean average \(WDMA\), profile length, and filler\-item ratio—that together captured the coarse fingerprints of injection: inflated ratings on targets, uniform filler scores, and unnaturally short profiles\. Complementary work applies PCA to the user\-rating matrix, treating injected profiles as low\-rank perturbations whose principal directions separate from genuine user variance\(Williams et al\.,[2007](https://arxiv.org/html/2608.20376#bib.bib24)\)\. Clustering methods extended this idea by grouping users whose rating vectors were suspiciously similar—a pattern induced when an attacker re\-uses a fixed filler template across many fake accounts\(Mehta and Nejdl,[2009](https://arxiv.org/html/2608.20376#bib.bib18)\)\. Statistical detectors were fast and required no labelled data, but they failed against adaptive attacks calibrated to match the genuine rating distribution, such as the bandwagon strategy\(Mobasher et al\.,[2007](https://arxiv.org/html/2608.20376#bib.bib19)\)and its successors\.

Supervised classifiers introduced labelled shilling datasets and per\-user feature engineering\. Random\-forest and SVM detectors trained on rating\-based features achieved strong recall against known attack families but overfitted to the specific injection signature seen at training time and degraded on unseen attack profiles\(Burke et al\.,[2005](https://arxiv.org/html/2608.20376#bib.bib2)\)\. Deep\-learning variants replaced hand\-crafted statistics with recurrent or convolutional encoders over rating sequences, recovering temporal patterns that scalar features discarded\(Wu et al\.,[2021](https://arxiv.org/html/2608.20376#bib.bib26)\)\. However, all of these approaches treat users independently; they miss the relational anomalies produced when a group of fake profiles collectively targets a set of items\.

Graph\-based detectors exploited this relational signal\. Methods that built user\-item bipartite graphs and scored nodes by structural anomaly measures—degree asymmetry, neighbourhood overlap, co\-purchase concentration—substantially outperformed single\-user statistics against structurally coherent attack families such as AUSH\(Lin et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib13)\)\. Anti\-FakeU\(Zhang et al\.,[2022](https://arxiv.org/html/2608.20376#bib.bib28)\)is the most directly comparable prior work: it constructs a bipartite user\-item graph and detects fake users through graph\-based anomaly scoring over first\-order neighbourhood statistics including co\-purchase overlap and degree asymmetry\. Yet Anti\-FakeU encodes neither review text nor edge timestamps, leaving two systematic blind spots: it cannot detect the cross\-modal inconsistencies introduced when LLM\-generated text accompanies structurally plausible rating patterns, and it has no mechanism for recognising the coordinated temporal bursts that distinguish modern injection campaigns from organic activity\. LLM\-based generation has compounded this challenge by eliminating the textual fingerprints that historically distinguished synthetic from genuine profiles\.

### 2\.2\.LLM\-Generated Fake Content Detection

Detecting computationally generated deceptive content is a longstanding problem that has grown substantially harder with the advent of large language models\. Ott et al\.\(Ott et al\.,[2011](https://arxiv.org/html/2608.20376#bib.bib21)\)established crowdsourced deceptive hotel reviews as a benchmark and showed that both human judges and unigram classifiers perform only slightly above chance, motivating automated linguistic approaches\. Subsequent work catalogued the textual fingerprints of platform\-scale review spam—exaggerated sentiment, sparse specifics, heavy first\-person framing, and suspiciously brief activity windows\(Jindal and Liu,[2008](https://arxiv.org/html/2608.20376#bib.bib9)\)—and trained supervised classifiers to exploit them\. These classifiers were effective against template\-based generators but relied on distributional assumptions that neural generators easily violate\.

The GPT era reset the detection landscape\. Zellers et al\.\(Zellers et al\.,[2019](https://arxiv.org/html/2608.20376#bib.bib27)\)demonstrated that neural fake\-news generators produce text that fools both human readers and classical detectors, and that the most effective discriminator is a model of the same family trained adversarially\. Contemporary LLM\-generated text detectors exploit subtle statistical biases in autoregressive sampling—token\-probability curvature, rank\-based features—but these signals vanish under paraphrasing or when the attacker controls the decoding parameters\(Guo et al\.,[2023](https://arxiv.org/html/2608.20376#bib.bib5)\)\. LLM watermarking\(Kirchenbauer et al\.,[2023](https://arxiv.org/html/2608.20376#bib.bib10)\)embeds detectable statistical patterns at generation time by biasing token selection toward a secret hash partition; while theoretically grounded, watermarks are inapplicable when the attacker controls the generator and absent from commercially deployed models\.

SemanticShield\(Li et al\.,[2025](https://arxiv.org/html/2608.20376#bib.bib12)\)targets the recommender\-system setting specifically: it encodes each user’s aggregated review corpus with a pre\-trained language model and flags profiles whose representation drifts from the genuine\-user centroid in embedding space\. SemanticShield is the strongest single\-modality text baseline for LLM\-agent attacks when review text is present\. However, it degrades to chance on datasets without review text, provides no mechanism for detecting temporal coordination among injected profiles, and ignores the structural signals available in the user\-item interaction graph—signals that are informative even when the textual content of fake profiles is indistinguishable from genuine users\. The structural and temporal graph architectures that can provide these complementary signals are surveyed next\.

### 2\.3\.Heterogeneous and Temporal Graph Neural Networks

Standard graph neural networks homogenise all nodes and edges into a single feature space, discarding semantically meaningful type distinctions\. The Heterogeneous Graph Transformer \(HGT; Hu et al\.\(Hu et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib8)\)\) addressed this by parameterising queries, keys, values, and message matrices separately per node type and per relation type, learning qualitatively different interaction patterns for each combination\. HGT achieved state\-of\-the\-art performance on heterogeneous academic network benchmarks and was subsequently adapted for knowledge\-graph reasoning and cross\-domain recommendation\(Lv et al\.,[2021](https://arxiv.org/html/2608.20376#bib.bib17)\)\. The type\-specific parameterisation is critical for the shilling detection setting, where user, item, and review nodes carry structurally and semantically different attack signatures\.

Temporal dynamics introduce a complementary axis\. Temporal Graph Networks \(TGN; Rossi et al\.\(Rossi et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib22)\)\) maintained a per\-node memory updated by a message function conditioned on continuous\-time edge events, enabling representations that tracked the evolving state of each node as new interactions arrived\. TGN demonstrated that even simple time\-encoding—e\.g\. learnable sinusoidal embeddings of inter\-event gaps—yields large gains on link\-prediction benchmarks with bursty arrival processes\. Fraud detection has independently discovered temporal signals: FRAUDRE and related approaches showed that the inter\-arrival time distribution of fraudulent accounts differs markedly from genuine users, producing anomaly signals that static graph features miss entirely\(Liu et al\.,[2025](https://arxiv.org/html/2608.20376#bib.bib16)\)\. Despite these parallel advances, no prior work has combined heterogeneous graph encoding with learnable temporal attention for shilling attack detection, where the three\-type user\-review\-item topology and the timestamped injection signal together provide orthogonal and non\-redundant detection axes\.

### 2\.4\.LLM Agents for Recommendation Attack

Agent4SR\(Zhang et al\.,[2024](https://arxiv.org/html/2608.20376#bib.bib29)\)was the first work to frame shilling attack construction as a multi\-step agentic task: a large language model was prompted to construct a complete fake user persona, generate a coherent review history, and assign ratings consistent with the persona’s stated preferences, all while optimising target\-item exposure\. The resulting profiles were grammatically fluent, topically coherent, and statistically similar to genuine users, systematically evading detectors that relied on either distributional rating anomalies or linguistic outlier detection\. Related work has explored LLM\-based poisoning in broader adversarial recommendation settings\(Deldjoo et al\.,[2024](https://arxiv.org/html/2608.20376#bib.bib4)\), and prompt\-injection attacks against retrieval\-augmented recommenders\(Shi et al\.,[2023](https://arxiv.org/html/2608.20376#bib.bib23)\), but systematic evaluation of detection strategies against agent\-generated profiles across multiple datasets and injection rates remains absent from the literature\.

The gaps surveyed above form three orthogonal failure modes in existing detectors: Anti\-FakeU’s reliance on graph structure alone leaves it blind to the cross\-modal inconsistencies introduced by LLM\-generated review text; SemanticShield’s reliance on text alone renders it ineffective on rating\-only datasets and unable to leverage graph topology; and neither family incorporates temporal information, missing the coordinated injection\-timing signals that are present even when individual profiles appear genuine\. TH\-GNN closes all three gaps simultaneously: the two\-layer HGT backbone encodes the heterogeneous user\-review\-item graph with per\-type and per\-relation parameterisation, the cross\-modal attention fusion integrates review and item text streams with the structural embedding, and the sinusoidal temporal encoding together with the burstiness GRU capture the edge\-timestamp patterns that betray injection campaigns at both the per\-edge and per\-user level\. The result is a detector that is strictly more informative than any single\-modality baseline and, as the ablation study confirms, degrades gracefully when any individual stream is absent rather than failing catastrophically\.

## 3\.Methodology

### 3\.1\.Problem Formulation

Let𝒢t=\(𝒱,ℰt\)\\mathcal\{G\}\_\{t\}=\(\\mathcal\{V\},\\mathcal\{E\}\_\{t\}\)be a heterogeneous temporal graph in which every nodev∈𝒱v\\in\\mathcal\{V\}carries a type labelτ​\(v\)∈\{user,item,review\}\\tau\(v\)\\in\\\{\\texttt\{user\},\\texttt\{item\},\\texttt\{review\}\\\}and every directed edgee=\(s,d,te\)∈ℰte=\(s,d,t\_\{e\}\)\\in\\mathcal\{E\}\_\{t\}carries a relation typeϕ​\(e\)∈\{writes,about,rates\}\\phi\(e\)\\in\\\{\\texttt\{writes\},\\texttt\{about\},\\texttt\{rates\}\\\}and a Unix\-second timestampte∈ℝ≥0t\_\{e\}\\in\\mathbb\{R\}\_\{\\geq 0\}\. We write𝒰\\mathcal\{U\},ℐ\\mathcal\{I\},ℛ\\mathcal\{R\}for the disjoint user, item, and review node sets, so\|𝒱\|=\|𝒰\|\+\|ℐ\|\+\|ℛ\|\|\\mathcal\{V\}\|=\|\\mathcal\{U\}\|\+\|\\mathcal\{I\}\|\+\|\\mathcal\{R\}\|\. The three canonical relation types induce the edge partition

\(1\)ℰwrites\\displaystyle\\mathcal\{E\}\_\{\\texttt\{writes\}\}=\{\(u,r,te\)∣u∈𝒰,r∈ℛ\},\\displaystyle=\\\{\(u,r,\\,t\_\{e\}\)\\mid u\\in\\mathcal\{U\},\\;r\\in\\mathcal\{R\}\\\},\(2\)ℰabout\\displaystyle\\mathcal\{E\}\_\{\\texttt\{about\}\}=\{\(r,i,te\)∣r∈ℛ,i∈ℐ\},\\displaystyle=\\\{\(r,i,\\,t\_\{e\}\)\\mid r\\in\\mathcal\{R\},\\;i\\in\\mathcal\{I\}\\\},\(3\)ℰrates\\displaystyle\\mathcal\{E\}\_\{\\texttt\{rates\}\}=\{\(u,i,te\)∣u∈𝒰,i∈ℐ\},\\displaystyle=\\\{\(u,i,\\,t\_\{e\}\)\\mid u\\in\\mathcal\{U\},\\;i\\in\\mathcal\{I\}\\\},withℰt=ℰwrites∪ℰabout∪ℰrates\\mathcal\{E\}\_\{t\}=\\mathcal\{E\}\_\{\\texttt\{writes\}\}\\cup\\mathcal\{E\}\_\{\\texttt\{about\}\}\\cup\\mathcal\{E\}\_\{\\texttt\{rates\}\}\. All three edge sets arising from a single review event share the same timestamptet\_\{e\}\.

Detection task\.Each user carries a binary labelyu∈\{0,1\}y\_\{u\}\\in\\\{0,1\\\}, whereyu=1y\_\{u\}=1denotes a fake profile injected by a shilling attacker\. The objective is to learn a detector

\(4\)fθ:𝒢t⟶\[0,1\]\|𝒰\|\\displaystyle f\_\{\\theta\}:\\mathcal\{G\}\_\{t\}\\;\\longrightarrow\\;\[0,1\]^\{\|\\mathcal\{U\}\|\}producing per\-user shilling scoresp^u=fθ​\(u;𝒢t\)\\hat\{p\}\_\{u\}=f\_\{\\theta\}\(u;\\,\\mathcal\{G\}\_\{t\}\), with the binary predictiony^u=𝟙​\[p^u\>0\.5\]\\hat\{y\}\_\{u\}=\\mathbb\{1\}\[\\hat\{p\}\_\{u\}\>0\.5\]\.

### 3\.2\.Heterogeneous Temporal Graph Construction

Each dataset is converted to𝒢t\\mathcal\{G\}\_\{t\}by a unified pipeline\. Raw interactions are filtered to the 5\-core \(users and items with at least five interactions\), sorted chronologically, and partitioned into train/val/test windows by timestamp \(70 / 10 / 20 %; shared across all detectors and attacks\)\.

User node features\.Each useruuis initialised with a structural feature vector𝐱u∈ℝDu\\mathbf\{x\}\_\{u\}\\in\\mathbb\{R\}^\{D\_\{u\}\}whose first five components are computed directly from the interaction log:

𝐱ubase=\[deg⁡\(u\),r¯u,σr,u,spanu,δ¯u\],\\mathbf\{x\}\_\{u\}^\{\\text\{base\}\}=\\bigl\[\\deg\(u\),\\;\\bar\{r\}\_\{u\},\\;\\sigma\_\{r,u\},\\;\\text\{span\}\_\{u\},\\;\\bar\{\\delta\}\_\{u\}\\bigr\],wheredeg⁡\(u\)\\deg\(u\)is the review count,r¯u\\bar\{r\}\_\{u\}andσr,u\\sigma\_\{r,u\}are the mean and standard deviation of ratings,spanu\\text\{span\}\_\{u\}is the activity window in days, andδ¯u\\bar\{\\delta\}\_\{u\}is the mean inter\-review gap in days\. Dataset\-specific demographics are appended when available: ML\-1M adds gender, normalised age\-group, and normalised occupation \(8 dimensions total\)\.

Item node features\.Items share the same five base statistics plus catalogue\-level features: ML\-1M appends a normalised release year and an 18\-dimensional genre multi\-hot \(24 dimensions\); Amazon datasets appendlog⁡\(1\+price\)\\log\(1\{\+\}\\text\{price\}\), catalogue average rating, andlog⁡\(1\+review count\)\\log\(1\{\+\}\\text\{review count\}\)\(8 dimensions\); Yelp2018 appends business star rating,log⁡\(1\+review count\)\\log\(1\{\+\}\\text\{review count\}\), and an is\-open indicator \(8 dimensions\)\.

Review node features\.Each review noderris assigned a scalar placeholderxr=0x\_\{r\}=0; its semantic content is encoded separately by a frozen language model \(Section[3\.4](https://arxiv.org/html/2608.20376#S3.SS4)\)\.

Text embeddings\.Review texts are encoded as frozen RoBERTa\-base\(Liu et al\.,[2019](https://arxiv.org/html/2608.20376#bib.bib15)\)\[CLS\]vectors𝐞r∈ℝ768\\mathbf\{e\}\_\{r\}\\in\\mathbb\{R\}^\{768\}\. Item texts are constructed per dataset: ML\-1M concatenates the movie title and genre list; Amazon datasets concatenate the product title, up to five feature bullets, and two description sentences; Yelp2018 concatenates the business name and category string\. For ML\-1M, which contains no review text, both the review and item CLS vectors are set to𝟎768\\mathbf\{0\}^\{768\}, isolating the graph and temporal streams for that dataset\. These node features are the input to the HGT encoder described next\.

### 3\.3\.HGT Encoder with Temporal Encoding

TH\-GNN uses a two\-layer Heterogeneous Graph Transformer \(HGT;\(Hu et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib8)\)\) as the structural backbone \(Figure[1](https://arxiv.org/html/2608.20376#S3.F1)\)\. Input features of each node type are first mapped to a shared hidden dimensionD=128D=128by type\-specific linear projections𝐖inτ∈ℝDτ×D\\mathbf\{W\}\_\{\\mathrm\{in\}\}^\{\\tau\}\\in\\mathbb\{R\}^\{D\_\{\\tau\}\\times D\}\.

![Refer to caption](https://arxiv.org/html/2608.20376v1/x1.png)Figure 1\.TH\-GNN architecture\. The two\-layer HGT backbone with learnable sinusoidal temporal encodings produces per\-user structural embeddings\. Cross\-modal attention fuses them with frozen RoBERTa representations of review and item text; a GRU over log\-inter\-arrival times contributes a burstiness embedding\. All streams are concatenated and passed to a two\-layer MLP classifier\.Heterogeneous attention\.At layerll, for each directed edgee=\(s,d\)e=\(s,d\)of relation typeϕ​\(e\)\\phi\(e\), the per\-head attention logit is

\(5\)ATT​\(s,e,d\)\\displaystyle\\mathrm\{ATT\}\(s,e,d\)=1dh​𝐪​\(d\)⊤​𝐖attϕ​\(e\)​𝐤​\(s\)⏟relation\-specific bilinear\+φ​\(Δ​ts​d\),\\displaystyle=\\frac\{1\}\{\\sqrt\{d\_\{h\}\}\}\\;\\underbrace\{\\mathbf\{q\}\(d\)^\{\\\!\\top\}\\mathbf\{W\}\_\{\\mathrm\{att\}\}^\{\\phi\(e\)\}\\mathbf\{k\}\(s\)\}\_\{\\text\{relation\-specific bilinear\}\}\\;\+\\;\\varphi\(\\Delta t\_\{sd\}\),wheredh=D/H=32d\_\{h\}=D/H=32is the per\-head dimension \(H=4H=4heads\) and the query, key, and value projections are type\-specific:

\(6\)𝐪​\(d\)\\displaystyle\\mathbf\{q\}\(d\)=𝐖Qτ​\(d\)​𝐡d\(l\),\\displaystyle=\\mathbf\{W\}\_\{Q\}^\{\\tau\(d\)\}\\mathbf\{h\}\_\{d\}^\{\(l\)\},𝐤​\(s\)\\displaystyle\\mathbf\{k\}\(s\)=𝐖Kτ​\(s\)​𝐡s\(l\),\\displaystyle=\\mathbf\{W\}\_\{K\}^\{\\tau\(s\)\}\\mathbf\{h\}\_\{s\}^\{\(l\)\},𝐯​\(s\)\\displaystyle\\mathbf\{v\}\(s\)=𝐖Vτ​\(s\)​𝐡s\(l\)\.\\displaystyle=\\mathbf\{W\}\_\{V\}^\{\\tau\(s\)\}\\mathbf\{h\}\_\{s\}^\{\(l\)\}\.The per\-relation weight𝐖attϕ​\(e\)∈ℝH×dh×dh\\mathbf\{W\}\_\{\\mathrm\{att\}\}^\{\\phi\(e\)\}\\in\\mathbb\{R\}^\{H\\times d\_\{h\}\\times d\_\{h\}\}learns a distinct interaction pattern for each of the three edge types\. Softmax is computed jointly over*all*incoming edges of nodedd, irrespective of edge type, before weighting the relation\-specific messagesMSG​\(s,e,d\)=𝐖msgϕ​\(e\)​𝐯​\(s\)\\mathrm\{MSG\}\(s,e,d\)=\\mathbf\{W\}\_\{\\mathrm\{msg\}\}^\{\\phi\(e\)\}\\mathbf\{v\}\(s\)\. The output is formed by aggregation, output projection, and residual layer normalisation:

\(7\)Agg​\(d\)\\displaystyle\\mathrm\{Agg\}\(d\)=∑\(s,e\)∈𝒩​\(d\)softmax​\[ATT​\(s,e,d\)\]⋅MSG​\(s,e,d\),\\displaystyle=\\sum\_\{\(s,e\)\\in\\mathcal\{N\}\(d\)\}\\mathrm\{softmax\}\\\!\\bigl\[\\mathrm\{ATT\}\(s,e,d\)\\bigr\]\\cdot\\mathrm\{MSG\}\(s,e,d\),\(8\)𝐡d\(l\+1\)\\displaystyle\\mathbf\{h\}\_\{d\}^\{\(l\+1\)\}=LayerNorm​\(𝐖outτ​\(d\)​GELU​\(Agg​\(d\)\)\+𝐖resτ​\(d\)​𝐡d\(l\)\)\.\\displaystyle=\\mathrm\{LayerNorm\}\\\!\\left\(\\mathbf\{W\}\_\{\\mathrm\{out\}\}^\{\\tau\(d\)\}\\,\\mathrm\{GELU\}\\\!\\left\(\\mathrm\{Agg\}\(d\)\\right\)\+\\mathbf\{W\}\_\{\\mathrm\{res\}\}^\{\\tau\(d\)\}\\,\\mathbf\{h\}\_\{d\}^\{\(l\)\}\\right\)\.
Relative temporal encoding\.The scalar biasφ​\(Δ​ts​d\)\\varphi\(\\Delta t\_\{sd\}\)in Equation \([5](https://arxiv.org/html/2608.20376#S3.E5)\) injects the elapsed time between interacting events directly into the attention logit, without altering node feature dimensions\. LetΔ​ts​d=\|ts−td\|\\Delta t\_\{sd\}=\|t\_\{s\}\-t\_\{d\}\|\(seconds\)\. The encoding uses learnable sinusoidal frequencies:

\(9\)φ​\(Δ​t\)=𝐰p⊤​\[sin⁡\(𝝎⋅Δ​t86400\+𝝍\)cos⁡\(𝝎⋅Δ​t86400\+𝝍\)\],\\displaystyle\\varphi\(\\Delta t\)=\\mathbf\{w\}\_\{p\}^\{\\\!\\top\}\\begin\{bmatrix\}\\sin\\\!\\left\(\\bm\{\\omega\}\\cdot\\tfrac\{\\Delta t\}\{86400\}\+\\bm\{\\psi\}\\right\)\\\\\[2\.0pt\] \\cos\\\!\\left\(\\bm\{\\omega\}\\cdot\\tfrac\{\\Delta t\}\{86400\}\+\\bm\{\\psi\}\\right\)\\end\{bmatrix\},where𝝎,𝝍∈ℝdT/2\\bm\{\\omega\},\\bm\{\\psi\}\\in\\mathbb\{R\}^\{d\_\{T\}/2\}are learnable frequencies and phases \(dT=64d\_\{T\}=64\) and𝐰p∈ℝdT\\mathbf\{w\}\_\{p\}\\in\\mathbb\{R\}^\{d\_\{T\}\}is a learned projection vector\. Time deltas are normalised to days to keep initial frequency values near zero meaningful;𝐰p\\mathbf\{w\}\_\{p\}and its bias are zero\-initialised so the temporal term starts at zero and grows only as the loss demands\.

### 3\.4\.Multimodal Fusion

AfterL=2L=2HGT layers, each useruuhas a structural embedding𝐡u\(L\)∈ℝD\\mathbf\{h\}\_\{u\}^\{\(L\)\}\\in\\mathbb\{R\}^\{D\}\. TH\-GNN combines this with two text streams and a burstiness stream before the classification head \(Figure[1](https://arxiv.org/html/2608.20376#S3.F1)\)\.

Three input streams\.

1. \(1\)*Graph stream\.*The HGT user node output𝐡u\(L\)∈ℝ128\\mathbf\{h\}\_\{u\}^\{\(L\)\}\\in\\mathbb\{R\}^\{128\}\.
2. \(2\)*Review text stream\.*Mean\-pooled RoBERTa\[CLS\]vectors over the user’s reviews:𝐫u=1\|ℛu\|​∑r∈ℛu𝐞r∈ℝ768\\mathbf\{r\}\_\{u\}=\\tfrac\{1\}\{\|\\mathcal\{R\}\_\{u\}\|\}\\sum\_\{r\\in\\mathcal\{R\}\_\{u\}\}\\mathbf\{e\}\_\{r\}\\in\\mathbb\{R\}^\{768\}\.
3. \(3\)*Item text stream\.*Mean\-pooled RoBERTa\[CLS\]vectors of items reviewed byuu:𝐳u=1\|ℛu\|​∑r∈ℛu𝐞i​\(r\)∈ℝ768\\mathbf\{z\}\_\{u\}=\\tfrac\{1\}\{\|\\mathcal\{R\}\_\{u\}\|\}\\sum\_\{r\\in\\mathcal\{R\}\_\{u\}\}\\mathbf\{e\}\_\{i\(r\)\}\\in\\mathbb\{R\}^\{768\}, wherei​\(r\)i\(r\)is the item covered by reviewrr\.

All three streams are projected to a shared dimensiondp=128d\_\{p\}=128via type\-specific linear maps𝐖sub\\mathbf\{W\}\_\{\\mathrm\{sub\}\},𝐖rev\\mathbf\{W\}\_\{\\mathrm\{rev\}\},𝐖item\\mathbf\{W\}\_\{\\mathrm\{item\}\}:

𝐡~u=𝐖sub​𝐡u\(L\),𝐫~u=𝐖rev​𝐫u,𝐳~u=𝐖item​𝐳u\.\\tilde\{\\mathbf\{h\}\}\_\{u\}=\\mathbf\{W\}\_\{\\mathrm\{sub\}\}\\mathbf\{h\}\_\{u\}^\{\(L\)\},\\quad\\tilde\{\\mathbf\{r\}\}\_\{u\}=\\mathbf\{W\}\_\{\\mathrm\{rev\}\}\\mathbf\{r\}\_\{u\},\\quad\\tilde\{\\mathbf\{z\}\}\_\{u\}=\\mathbf\{W\}\_\{\\mathrm\{item\}\}\\mathbf\{z\}\_\{u\}\.
Cross\-modal attention\.The graph stream acts as the query; the two text streams form the key–value sequence\. The fused representation is produced by a transformer block with a single query token:

\(10\)𝐟~u,𝜶utxt\\displaystyle\\tilde\{\\mathbf\{f\}\}\_\{u\},\\;\\bm\{\\alpha\}\_\{u\}^\{\\mathrm\{txt\}\}=MHA​\(𝐡~u,\[𝐫~u;𝐳~u\],\[𝐫~u;𝐳~u\]\),\\displaystyle=\\mathrm\{MHA\}\\\!\\left\(\\tilde\{\\mathbf\{h\}\}\_\{u\},\\;\\;\\bigl\[\\tilde\{\\mathbf\{r\}\}\_\{u\};\\;\\tilde\{\\mathbf\{z\}\}\_\{u\}\\bigr\],\\;\\;\\bigl\[\\tilde\{\\mathbf\{r\}\}\_\{u\};\\;\\tilde\{\\mathbf\{z\}\}\_\{u\}\\bigr\]\\right\),\(11\)𝐪u′\\displaystyle\\mathbf\{q\}\_\{u\}^\{\\prime\}=LN​\(𝐡~u\+𝐟~u\),\\displaystyle=\\mathrm\{LN\}\\\!\\left\(\\tilde\{\\mathbf\{h\}\}\_\{u\}\+\\tilde\{\\mathbf\{f\}\}\_\{u\}\\right\),\(12\)𝐟u\\displaystyle\\mathbf\{f\}\_\{u\}=LN​\(𝐪u′\+FF​\(𝐪u′\)\)∈ℝdp,\\displaystyle=\\mathrm\{LN\}\\\!\\left\(\\mathbf\{q\}\_\{u\}^\{\\prime\}\+\\mathrm\{FF\}\(\\mathbf\{q\}\_\{u\}^\{\\prime\}\)\\right\)\\in\\mathbb\{R\}^\{d\_\{p\}\},whereMHA\\mathrm\{MHA\}usesH=4H=4heads,𝜶utxt∈ℝ2\\bm\{\\alpha\}\_\{u\}^\{\\mathrm\{txt\}\}\\in\\mathbb\{R\}^\{2\}is the learned attention distribution over the review and item streams, andFF\\mathrm\{FF\}is a two\-layer position\-wise feed\-forward network \(hidden size4​dp4d\_\{p\}, GELU activation\)\.

Temporal burstiness GRU\.Coordinated injection campaigns produce characteristic review timing patterns that are not captured by graph topology or text content alone\. For useruuwith reviews at sorted timestampst1<t2<⋯<tLut\_\{1\}<t\_\{2\}<\\cdots<t\_\{L\_\{u\}\}, we compute the log\-inter\-arrival sequence

\(13\)𝐛uin=\[log⁡\(1\+t2−t1\),log⁡\(1\+t3−t2\),…,log⁡\(1\+tLu−tLu−1\)\]\\displaystyle\\mathbf\{b\}\_\{u\}^\{\\mathrm\{in\}\}=\\bigl\[\\log\(1\+t\_\{2\}\-t\_\{1\}\),\\;\\log\(1\+t\_\{3\}\-t\_\{2\}\),\\;\\ldots,\\;\\log\(1\+t\_\{L\_\{u\}\}\-t\_\{L\_\{u\}\-1\}\)\\bigr\]and encode it with a single\-layer GRU \(hidden size 32\):𝐛u=GRU​\(𝐛uin\)∈ℝ32\\mathbf\{b\}\_\{u\}=\\mathrm\{GRU\}\(\\mathbf\{b\}\_\{u\}^\{\\mathrm\{in\}\}\)\\in\\mathbb\{R\}^\{32\}\. Users with fewer than two reviews receive𝐛u=𝟎32\\mathbf\{b\}\_\{u\}=\\mathbf\{0\}^\{32\}\.

Classification head\.The fused representation and the burstiness vector are concatenated and passed through a two\-layer MLP with a LayerNorm input gate:

\(14\)𝐜u\\displaystyle\\mathbf\{c\}\_\{u\}=\[𝐟u;𝐛u\]∈ℝ160,\\displaystyle=\[\\mathbf\{f\}\_\{u\};\\;\\mathbf\{b\}\_\{u\}\]\\in\\mathbb\{R\}^\{160\},\(15\)p^u\\displaystyle\\hat\{p\}\_\{u\}=σ​\(𝐖2​GELU​\(𝐖1​LN​\(𝐜u\)\)\),\\displaystyle=\\sigma\\\!\\left\(\\mathbf\{W\}\_\{2\}\\;\\mathrm\{GELU\}\\\!\\left\(\\mathbf\{W\}\_\{1\}\\,\\mathrm\{LN\}\(\\mathbf\{c\}\_\{u\}\)\\right\)\\right\),where𝐖1∈ℝ64×160\\mathbf\{W\}\_\{1\}\\in\\mathbb\{R\}^\{64\\times 160\},𝐖2∈ℝ1×64\\mathbf\{W\}\_\{2\}\\in\\mathbb\{R\}^\{1\\times 64\}, andσ\\sigmais the sigmoid\. We train the full model end\-to\-end using the focal loss objective described next\.

### 3\.5\.Training Objective

Class imbalance\.Shilling attacks are sparse by design\. At our lowest injection rate \(0\.5 %\), the genuine\-to\-fake user ratio reaches200:1200\\\!:\\\!1on ML\-1M \(≈30\{\\approx\}30injected profiles among 6 040 users\)\. Standard binary cross\-entropy is dominated by easy negatives under such imbalance, yielding near\-zero gradient signal for the minority fake class\.

Focal loss\.We replace cross\-entropy with the binary focal loss\(Lin et al\.,[2017](https://arxiv.org/html/2608.20376#bib.bib14)\), which down\-weights well\-classified negatives via a modulating factor\(1−pt\)γ\(1\-p\_\{t\}\)^\{\\gamma\}:

\(16\)ℒFL=−1\|ℬ\|​∑u∈ℬαt​\(1−pt\)γ​log⁡pt,\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{FL\}\}=\-\\frac\{1\}\{\|\\mathcal\{B\}\|\}\\sum\_\{u\\in\\mathcal\{B\}\}\\alpha\_\{t\}\\left\(1\-p\_\{t\}\\right\)^\{\\\!\\gamma\}\\log p\_\{t\},whereℬ\\mathcal\{B\}is the training mini\-batch and

\(17\)pt=\{p^uif​yu=1,1−p^uif​yu=0,αt=\{αif​yu=1,1−αif​yu=0\.\\displaystyle p\_\{t\}=\\begin\{cases\}\\hat\{p\}\_\{u\}&\\text\{if \}y\_\{u\}=1,\\\\ 1\-\\hat\{p\}\_\{u\}&\\text\{if \}y\_\{u\}=0,\\end\{cases\}\\qquad\\alpha\_\{t\}=\\begin\{cases\}\\alpha&\\text\{if \}y\_\{u\}=1,\\\\ 1\-\\alpha&\\text\{if \}y\_\{u\}=0\.\\end\{cases\}We setγ=2\.0\\gamma=2\.0andα=0\.25\\alpha=0\.25\. At a moderately confident prediction ofpt=0\.5p\_\{t\}=0\.5, the factor\(1−pt\)2=0\.25\(1\-p\_\{t\}\)^\{2\}=0\.25reduces the contribution of easy negatives by4×4\\timesrelative to cross\-entropy, concentrating gradient mass on rare fake profiles and on ambiguous boundary cases\. Atpt=0\.9p\_\{t\}=0\.9\(a confidently correct genuine\-user prediction\), the factor falls to0\.010\.01, contributing negligibly to the loss\.

Optimisation\.The model is trained end\-to\-end with Adam \(lr=10−3\\text\{lr\}=10^\{\-3\}, weight decay10−410^\{\-4\}, batch size 512\) for up to 100 epochs; training terminates early when validation F1does not improve for 10 consecutive epochs\. RoBERTa weights are frozen throughout\.

## 4\.Experiments

### 4\.1\.Datasets

We evaluate on four publicly available benchmarks spanning diverse domains, review densities, and temporal extents \(Table[1](https://arxiv.org/html/2608.20376#S4.T1)\)\. All datasets are filtered to the 5\-core \(users and items with at least five interactions\), split 70/10/20 by timestamp, and shared across all detectors and attacks\.

Table 1\.Dataset statistics after 5\-core filtering\.†ML\-1M contains no review text; text\-stream inputs receive zero\-padded RoBERTa embeddings for all users\.MovieLens\-1M\(Harper and Konstan,[2015](https://arxiv.org/html/2608.20376#bib.bib6)\)is the canonical collaborative\-filtering benchmark for shilling\-attack research, providing a dense, well\-curated rating signal over a controlled three\-year window\.Amazon\-Books\(Ni et al\.,[2019](https://arxiv.org/html/2608.20376#bib.bib20)\)is the largest dataset in our suite; its lengthy review corpus is the primary testbed for evaluating detection of LLM\-generated textual profiles\.Amazon\-Clothing\(Ni et al\.,[2019](https://arxiv.org/html/2608.20376#bib.bib20)\)has the sparsest interaction graph of the four, stressing detection performance when fake profiles must be identified within thin neighbourhood structure\.Yelp2018\(He et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib7)\)spans a physically grounded business domain with 14 years of timestamped check\-in reviews, introducing realistic temporal burstiness patterns that are qualitatively different from product\-catalogue data\. Together, these four datasets provide complementary test conditions spanning rating\-only and text\-rich settings, sparse and dense interaction graphs, and short and long temporal windows\.

### 4\.2\.Baselines

We compare against three representative shilling\-attack detectors that collectively cover the statistical, text\-semantic, and graph\-structural detection paradigms\.

Statistical baseline\(Chirita et al\.,[2005](https://arxiv.org/html/2608.20376#bib.bib3)\)extracts per\-user rating features—rating deviation from the item mean, weighted deviation from mean average \(WDMA\), profile length, and filler\-item ratio—and trains a random\-forest classifier on top\. It is fast and broadly applicable but has no access to review text or graph topology, limiting its effectiveness against adaptive attacks that mimic the rating distribution\.

SemanticShield\(Li et al\.,[2025](https://arxiv.org/html/2608.20376#bib.bib12)\)encodes each user’s review text with a pre\-trained language model and scores profiles by their semantic drift from the population centroid, treating outlier embeddings as injection signals\. SemanticShield is the strongest single\-modality baseline for LLM\-agent attacks when review text exists, but degrades on rating\-only datasets \(ML\-1M\) and provides no temporal signal, leaving co\-ordinated burst campaigns undetected\.

Anti\-FakeU\(Zhang et al\.,[2022](https://arxiv.org/html/2608.20376#bib.bib28)\)builds a user–item bipartite graph and detects fake users through graph\-based anomaly scoring over first\-order neighbourhood statistics, including co\-purchase overlap and degree asymmetry\. Anti\-FakeU outperforms statistical methods against structural attacks \(AUSH, GraphAttack\) but ignores review text and edge timestamps, making it insensitive to the cross\-modal inconsistencies and temporal fingerprints introduced by modern adversarial profiles\. We evaluate all three baselines against the five attack families described next\.

### 4\.3\.Attack Setup

We evaluate five attacks from four conceptual families\. In all settings each fake profile is assigned a budget of 10 % of the item catalogue \(budget\_pct= 0\.10\) and the attacker targetsn=5n\\\!=\\\!5items sampled from the top\-10 % most popular\. Injection rates are swept over\{0\.5%,1%,5%\}\\\{0\.5\\%,1\\%,5\\%\\\}\.

Classic attacks\.The*random*attack\(Lam and Riedl,[2004](https://arxiv.org/html/2608.20376#bib.bib11)\)assigns each fake profile ratings drawn uniformly from the global distribution, with target items scored maximally\. The*bandwagon*attack\(Mobasher et al\.,[2007](https://arxiv.org/html/2608.20376#bib.bib19)\)additionally assigns the maximum rating to a fixed set of globally popular “filler” items to mimic realistic user behaviour and exploit popularity bias in the victim recommender\. Both attacks are parameter\-free and serve as the detection lower bound\.

GAN\-based attack\.AUSH\(Lin et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib13)\)trains a generative adversarial network whose generator produces user rating profiles conditioned on the target items, while the discriminator enforces statistical indistinguishability from real users\. AUSH generates rating vectors only; no review text is produced, so text\-stream detectors receive zero\-padded embeddings for all injected profiles\.

GNN\-targeted attack\.GraphAttack\(Wu et al\.,[2022](https://arxiv.org/html/2608.20376#bib.bib25)\)first trains a two\-layer surrogate GNN \(32\-dimensional embeddings, 15 epochs\) on a partial view of the interaction graph, then applies 20 steps of gradient\-based perturbation to craft rating vectors that maximise target\-item exposure against the surrogate while satisfyingℓ∞\\ell\_\{\\infty\}invisibility constraints\. This is the hardest structural adversary and the most challenging for count\-based detectors at low injection rates\.

LLM\-agent attack\.Agent4SR\(Zhang et al\.,[2024](https://arxiv.org/html/2608.20376#bib.bib29)\)drives a large language model agent to generate natural\-language reviews and coherent rating histories for each fake user; profiles are cached after generation to avoid redundant API calls across the injection\-rate sweep\. The resulting profiles are grammatically fluent, topically consistent, and statistically similar to real users, defeating all detectors that rely on either textual anomalies or rating distributional signals alone\.

### 4\.4\.Implementation Details

TH\-GNN uses a 2\-layer HGT encoder \(hidden dimension 128, 4 attention heads\), a 64\-dimensional sinusoidal temporal encoding fused at each layer, 128\-dimensional cross\-modal attention projections for the review and item text streams \(RoBERTa\-base\(Liu et al\.,[2019](https://arxiv.org/html/2608.20376#bib.bib15)\), frozen, 768\-dim output\), a 32\-dimensional GRU for the temporal\-burstiness stream, and a two\-layer MLP classifier \(64 hidden units, sigmoid output\)\. The model is trained with Adam \(l​r=10−3lr=10^\{\-3\}, weight decay10−410^\{\-4\}, batch size 512\) for up to 100 epochs with patience\-10 early stopping on validation F1; class imbalance at low injection rates is addressed by focal loss\(Lin et al\.,[2017](https://arxiv.org/html/2608.20376#bib.bib14)\)\(γ=2\.0\\gamma=2\.0,α=0\.25\\alpha=0\.25\)\. The downstream victim model is LightGCN\(He et al\.,[2020](https://arxiv.org/html/2608.20376#bib.bib7)\)\(64\-dim embeddings, 3 propagation layers, evaluated at NDCG@10 and HR@10\)\. All 720 main experiments \(4 datasets×\\times5 attacks×\\times3 rates×\\times3 seeds×\\times4 detectors\) were run on a single NVIDIA A100 80 GB GPU \(Intel Xeon Gold 6248R, 256 GB RAM, Ubuntu 22\.04, PyTorch 2\.2\.1\+cu121\), requiring approximately 18 hours wall\-clock time for the full matrix\.

### 4\.5\.Main Results

Table 2\.Detection performance \(F1 / DR / FAR, mean±\\pmstd over 3 seeds\)\. Best per row inbold, second\-bestunderlined\. TH\-GNN is our method\.†Statistical did not converge on Agent4SR \(LLM\-generated profiles evade rating\-pattern heuristics\)\.Table 3\.NDCG@10 / HR@10 of LightGCN after TH\-GNN filtering vs\. baselines\. Higher is better\. ‘No defense’==unfiltered attacked graph\.Bold==best per row\.Overall detection performance\.Table[2](https://arxiv.org/html/2608.20376#S4.T2)reports F1, detection rate \(DR\), and false\-alarm rate \(FAR\), each averaged over three seeds and three injection rates\. TH\-GNN achieved F1between 0\.816 \(Agent4SR, Amazon\-Clothing\) and 0\.924 \(Random, Amazon\-Books\), with a grand mean of0\.870across all 20 dataset–attack configurations, uniformly above every baseline on every row\. TH\-GNN’s FAR stayed below 4\.5 % throughout \(range: 3\.2–4\.4 %\), whereas the best\-performing baselines incurred FAR between 6\.8 % \(SemanticShield, Random\) and 12\.5 % \(Statistical, Agent4SR\), which is operationally significant because false positives remove legitimate users from the recommendation graph\. On ML\-1M, which contains no review text, the review and item text streams fell back to zero vectors; TH\-GNN still achieved 0\.867 F1, isolating the contribution of the graph and temporal streams alone\.

LLM\-agent attack\.The performance gap was starkest on Agent4SR, where fluent LLM\-generated reviews and plausible rating histories defeated detectors that relied on statistical anomalies or text\-only signals\. TH\-GNN achieved a mean F1of 0\.825 on Agent4SR \(averaged across four datasets\) against SemanticShield’s 0\.716—a margin of\+\+10\.9 pp—and the Statistical baseline’s 0\.675 \(\+\+15\.0 pp\)\. Notably, TH\-GNN’s DR on Agent4SR \(0\.825–0\.843 across datasets\) exceeded the F1of any baseline, indicating that temporal\-coordination patterns in LLM campaigns were detectable even when individual review text was indistinguishable from genuine users\.

Downstream recommendation quality\.Table[3](https://arxiv.org/html/2608.20376#S4.T3)reports LightGCN NDCG@10 and HR@10 after each detector filters injected profiles from the training graph\. Without defence, GraphAttack reduced NDCG@10 on ML\-1M from a clean 0\.224 to 0\.170 \(−\-24 %\); TH\-GNN filtering restored it to 0\.219 \(97\.8 % of clean\), while the next\-best detector \(Statistical\) reached only 0\.210 \(93\.8 %\)\. TH\-GNN ranked first in both NDCG@10 and HR@10 across all 20 dataset–attack conditions \(average rank 1\.00 for both metrics\), confirming that higher detection F1translates directly to downstream ranking quality\.

Low\-budget regime\.Figure[2](https://arxiv.org/html/2608.20376#S4.F2)plots F1against injection rate on ML\-1M\. At the lowest rate \(0\.5%\), where only 5 fake profiles exist per 1,000 real users, the gap between TH\-GNN and baselines*widened*rather than closed: for Agent4SR, TH\-GNN achieved F1= 0\.806 versus SemanticShield’s 0\.691 \(\+\+11\.5 pp\); for GraphAttack the margin was 0\.827 vs\. 0\.722 \(\+\+10\.5 pp\)\. This widening occurred because graph\-temporal signals—coordination timestamps and heterogeneous edge patterns—became proportionally more salient when the injected mass was too small to trigger count\-based or distributional detectors\.

![Refer to caption](https://arxiv.org/html/2608.20376v1/x2.png)Figure 2\.Detection F1vs\. injection rate on ML\-1M for all detectors and attack families\. TH\-GNN’s advantage over baselines*widens*at the lowest injection rate \(0\.5 %\), where graph\-temporal coordination signals are the primary discriminative cue\.
### 4\.6\.Ablation Study

Table 4\.Ablation study at 1% injection rate, averaged over 4 datasets and 5 attacks\.Bold==full model\.Table[4](https://arxiv.org/html/2608.20376#S4.T4)reports F1, DR, and FAR at 1 % injection rate, averaged over four datasets and five attacks\. Removing the temporal\-encoding stream \(sinusoidalΔ​t\\Delta tbias \+ burstiness GRU\) caused the largest single degradation: F1fell 5\.1 pp from 0\.872 to 0\.821, and FAR nearly doubled from 4\.1 % to 6\.5 %, confirming that timestamped edge features are the most discriminative signal across all five attack families, including classic attacks whose flat injection timeline is already distinctive\. Replacing the heterogeneous graph transformer with a static homogeneous GCN cost 4\.2 pp F1\(0\.872→\\to0\.830\), demonstrating that per\-type and per\-relation parameterisation is necessary when structurally heterogeneous node types \(users, items, reviews\) carry qualitatively different attack fingerprints\. Removing both text streams yielded the smallest drop \(3\.3 pp\), though the degradation was concentrated on Agent4SR where review\-text coherence provided the only non\-graph signal; the cross\-attack average understated the text stream’s value for LLM\-based threats specifically \(see Figure[3](https://arxiv.org/html/2608.20376#S4.F3)\)\. Crucially, all three ablated variants still surpassed the best baseline in grand\-mean F1\(≥\\geq0\.821 vs\. Anti\-FakeU 0\.770\), confirming that the architectural combination—not any single stream—drives the gain over prior GNN detectors\.

![Refer to caption](https://arxiv.org/html/2608.20376v1/x3.png)Figure 3\.Per\-stream ablation on LLM\-agent \(Agent4SR\) vs\. GAN\-based \(AUSH\) attacks \(1 % injection rate, averaged over four datasets\)\. Removing the text streams harms Agent4SR detection substantially more than AUSH, confirming that cross\-modal text signals are the primary discriminator for LLM\-generated profiles\.

## 5\.Conclusion

TH\-GNN demonstrates that shilling attack detection improves substantially when treated as a joint heterogeneous\-graph, multimodal\-text, and temporal\-burstiness classification task\. The three signal streams—a two\-layer HGT backbone with learnable sinusoidal temporal encoding, cross\-modal attention over review and item text, and a GRU over log\-inter\-arrival times—address orthogonal failure modes of prior detectors: the temporal stream catches coordinated injection campaigns that text\-only methods miss; the text streams expose cross\-modal inconsistencies that graph\-only methods miss; and the heterogeneous graph encoding preserves type\-specific fingerprints that homogeneous GNNs discard\. Across five attack families and four datasets, TH\-GNN achieved a grand\-mean F1of 0\.870, with a\+\+10\.9 pp margin over the strongest text\-only baseline on LLM\-agent attacks—a margin that widened to\+\+11\.5 pp at the lowest injection rate, precisely where single\-modality detectors are most vulnerable\.

Two limitations warrant attention\. First, the temporal stream requires per\-event timestamps; platforms that expose only aggregate interaction counts would reduce TH\-GNN to a text\-and\-graph detector \(the ablation study estimates a−\-5\.1 pp cost for removing the temporal stream entirely\)\. Second, LLM\-generated profiles will evolve as models improve, and periodic retraining on fresh adversarial samples will be necessary to sustain detection accuracy against next\-generation agents\. Future work should investigate adaptive attacks that specifically target temporal coordination signals, online detection settings where profiles must be scored incrementally as reviews arrive, and cross\-platform transfer where a detector trained on one review domain is applied to another\.

## References

- \(1\)
- Burke et al\.\(2005\)Robin Burke, Bamshad Mobasher, Chad Williams, and Runa Bhaumik\. 2005\.Segment\-Based Injection Attacks against Collaborative Filtering Recommender Systems\. In*Proceedings of the 5th IEEE International Conference on Data Mining \(ICDM\)*\. IEEE, 577–580\.
- Chirita et al\.\(2005\)Paul\-Alexandru Chirita, Wolfgang Nejdl, and Cristian Zamfir\. 2005\.Preventing Shilling Attacks in Online Recommender Systems\. In*Proceedings of the 3rd International Workshop on Adversarial Information Retrieval on the Web \(AIRWeb\), WWW 2005*\. ACM, 67–74\.
- Deldjoo et al\.\(2024\)Yashar Deldjoo, Vito Walter Anelli, Tommaso Di Noia, Luigi Bellomarini, and Markus Zanker\. 2024\.A Review of Adversarial Attack and Defense Methods for Recommender Systems\.*Comput\. Surveys*56, 7 \(2024\)\.
- Guo et al\.\(2023\)Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu\. 2023\.How Close is ChatGPT to Human Experts? Comparison Corpus, Evaluation, and Detection\.*arXiv preprint arXiv:2301\.07597*\(2023\)\.
- Harper and Konstan \(2015\)F\. Maxwell Harper and Joseph A\. Konstan\. 2015\.The MovieLens Datasets: History and Context\.*ACM Transactions on Interactive Intelligent Systems*5, 4, 19:1–19:19\.
- He et al\.\(2020\)Xiangnan He, Kuan Deng, Xiang Wang, Yan Li, Yongdong Zhang, and Meng Wang\. 2020\.LightGCN: Simplifying and Powering Graph Convolution Network for Recommendation\. In*Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval*\. ACM, 639–648\.
- Hu et al\.\(2020\)Ziniu Hu, Yuxiao Dong, Kuansan Wang, and Yizhou Sun\. 2020\.Heterogeneous Graph Transformer\. In*Proceedings of the Web Conference 2020 \(WWW\)*\. ACM, 2704–2710\.
- Jindal and Liu \(2008\)Nitin Jindal and Bing Liu\. 2008\.Opinion Spam and Analysis\. In*Proceedings of the 1st ACM International Conference on Web Search and Data Mining \(WSDM\)*\. ACM, 219–230\.
- Kirchenbauer et al\.\(2023\)John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein\. 2023\.A Watermark for Large Language Models\. In*Proceedings of the 40th International Conference on Machine Learning \(ICML\)*\. PMLR, 17061–17084\.
- Lam and Riedl \(2004\)Shyong K\. Lam and John Riedl\. 2004\.Shilling Recommender Systems for Fun and Profit\. In*Proceedings of the 13th International World Wide Web Conference \(WWW\)*\. ACM, 393–402\.
- Li et al\.\(2025\)Kaihong Li, Huichi Zhou, Bin Ma, and Fangjun Huang\. 2025\.SemanticShield: LLM\-Powered Audits Expose Shilling Attacks in Recommender Systems\.arXiv:2509\.24961
- Lin et al\.\(2020\)Chen Lin, Si Chen, Hui Li, Yanghua Xiao, Lianyun Li, and Qian Yang\. 2020\.Attacking Recommender Systems with Augmented User Profiles\. In*Proceedings of the 29th ACM International Conference on Information and Knowledge Management*\. 855–864\.[https://doi\.org/10\.1145/3340531\.3411884](https://doi.org/10.1145/3340531.3411884)
- Lin et al\.\(2017\)Tsung\-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár\. 2017\.Focal Loss for Dense Object Detection\. In*Proceedings of the IEEE International Conference on Computer Vision \(ICCV\)*\. IEEE, 2980–2988\.
- Liu et al\.\(2019\)Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov\. 2019\.RoBERTa: A Robustly Optimized BERT Pretraining Approach\.*arXiv preprint arXiv:1907\.11692*\(2019\)\.
- Liu et al\.\(2025\)Y\. Liu, J\. Shen, D\. Fang, and H\. Xu\. 2025\.Fraud Detection on Multi\-relational Graphs via Semantic Extraction and Topological Enhancement\. In*Advanced Intelligent Computing Technology and Applications \(ICIC 2025\)**\(Communications in Computer and Information Science\)*, Vol\. 2565\. Springer, Singapore\.[https://doi\.org/10\.1007/978\-981\-96\-9946\-9\_37](https://doi.org/10.1007/978-981-96-9946-9_37)
- Lv et al\.\(2021\)Qingsong Lv, Ming Ding, Qiang Liu, Yuxiang Chen, Wenfeng Feng, Siming He, Chang Zhou, Jianguo Jiang, Yuxiao Dong, and Jie Tang\. 2021\.Are We Really Making Much Progress? Revisiting, Benchmarking, and Refining Heterogeneous Graph Neural Networks\. In*Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining*\. ACM, 1150–1160\.
- Mehta and Nejdl \(2009\)Bhaskar Mehta and Wolfgang Nejdl\. 2009\.Unsupervised Strategies for Shilling Detection and Robust Collaborative Filtering\.*User Modeling and User\-Adapted Interaction*19, 1–2 \(2009\), 65–97\.
- Mobasher et al\.\(2007\)Bamshad Mobasher, Robin Burke, Runa Bhaumik, and Chad Williams\. 2007\.Attacks and Remedies in Collaborative Recommendation\.*IEEE Intelligent Systems*22, 3 \(2007\), 56–63\.
- Ni et al\.\(2019\)Jianmo Ni, Jiacheng Li, and Julian McAuley\. 2019\.Justifying Recommendations using Distantly\-Labeled Reviews and Fine\-Grained Aspects\. In*Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*\. Association for Computational Linguistics, 188–197\.
- Ott et al\.\(2011\)Myle Ott, Yejin Choi, Claire Cardie, and Jeffrey T\. Hancock\. 2011\.Finding Deceptive Opinion Spam by Any Stretch of the Imagination\. In*Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics \(ACL\)*\. Association for Computational Linguistics, 309–319\.
- Rossi et al\.\(2020\)Emanuele Rossi, Ben Chamberlain, Fabrizio Frasca, Davide Eynard, Federico Monti, and Michael Bronstein\. 2020\.Temporal Graph Networks for Deep Learning on Dynamic Graphs\.*arXiv preprint arXiv:2006\.10637*\(2020\)\.ICML 2020 Workshop on Graph Representation Learning\.
- Shi et al\.\(2023\)Yupeng Shi, Fuli Feng, Xiangnan He, Xiang Wang, and Tat\-Seng Chua\. 2023\.Exploring Large Language Model Based Intelligent Agents for Adversarial Attacks on Recommender Systems\. In*Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval*\. ACM\.
- Williams et al\.\(2007\)Chad A\. Williams, Bamshad Mobasher, and Robin Burke\. 2007\.Defending Recommender Systems: Detection of Profile Injection Attacks\.*Service Oriented Computing and Applications*1, 3 \(2007\), 157–170\.Extended from ECAI 2006 Workshop version\.
- Wu et al\.\(2022\)Binchi Wu, Zhiqian Chen, Shangbin Zhang, Yao Xu, and Weili Ku\. 2022\.Practical Graph\-Based Attack against Recommender Systems via Surrogate Gradient Estimation\. In*Proceedings of the 31st ACM International Conference on Information and Knowledge Management \(CIKM\)*\. ACM\.
- Wu et al\.\(2021\)Chenwang Wu, Fangzhao Wu, Suyu Ge, Tao Qi, Yongfeng Huang, and Xing Xie\. 2021\.Fighting Fake Reviews: Feature\-Enhanced Graph Auto\-Encoder for Manipulation Detection\. In*Proceedings of the Web Conference 2021 \(WWW\)*\. ACM\.
- Zellers et al\.\(2019\)Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi\. 2019\.Defending Against Neural Fake News\. In*Advances in Neural Information Processing Systems \(NeurIPS\)*, Vol\. 32\. Curran Associates\.
- Zhang et al\.\(2022\)Ge Zhang, Xiaowei Chen, Hai Wang, Yu Li, Yongdong Li, and Zheng\-Jun Zha\. 2022\.Anti\-FakeU: Defending Shilling Attacks on Graph Neural Network\-Based Recommender Model\. In*Proceedings of the Web Conference 2022 \(WWW\)*\. ACM, 1Anti–FakeU\.Page range to be confirmed\.
- Zhang et al\.\(2024\)Yudong Zhang, Fuli Feng, Xiangnan He, Jizhi Zhang, Xiang Wang, and Tat\-Seng Chua\. 2024\.Agent4SR: An LLM\-Agent Framework for Shilling Attack in Sequential Recommender Systems\. In*Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval*\. ACM\.