Search papers, labs, and topics across Lattice.
This paper introduces the Build it, Break it, Repeat (BiBiR) framework to evaluate and enhance the robustness of disinformation detection models against adversarial transformations. Through iterative testing, the study identifies that the most effective disinformation evasion techniques combine back-translation and LLM persona-based rewriting, achieving a 95% label flip rate while maintaining semantic integrity. The best-performing detection model, utilizing a triplet contrastive architecture with dynamic anchor switching, achieved a 72.68% accuracy, significantly outperforming existing baselines by 15 percentage points under adversarial conditions.
Iterative adversarial testing reveals that top disinformation evasion strategies can achieve a staggering 95% label flip rate while preserving original meanings.
Detecting machine-generated disinformation on social media is increasingly difficult as large language models (LLMs) make it easier to generate and rewrite misleading content at scale. Static benchmark evaluations, measuring detector performance on fixed held-out datasets, do not capture how detectors behave when posts are deliberately transformed to evade classification. This paper adapts the Build it, Break it, Fix it framework into Build it, Break it, Repeat (BiBiR): iterative sessions designed to stress-test detectors' robustness under iterative adversarial conditions, evaluating whether models remain reliable when disinformation posts are systematically transformed to evade classification. Across five iterations, the findings show that the best adversarial breakers' transformations came from a combination of back-translation and LLM persona-based rewriting, with the best performing technique achieving a 95% label flip rate (LFR), whilst still preserving the meaning of the original posts. The best builders' model was a triplet contrastive model with a dynamic anchor switching (DASS) architecture, which achieved an average accuracy of 72.68%, outperforming the strong baseline (a fine-tuned e5-small-LoRA) by 15 percentage points on the most robust set of breakers' adversarial attacks. The results demonstrate that an iterative framework best exposes detector weaknesses and pushes robustness improvements; however, it may still require semantic preservation analysis to distinguish valid adversarial evasion from transformations that changed the original disinformation claims' meaning.
