Metraipolis › archive › dc_753dc4efca36

Auditing Representation-Space Fraud Detection: A Bayesian IRL Framework for Calibrated Uncertainty and Its Limits — arXiv:2611.02673

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.02673
License (as archived): CC0-1.0
Archived: 2026-11-03T11:03:18.914Z
SHA-256 of the archived text: dd58fce641f2f6882f5109a115c9445fa9255cb74149575b1964cfcc079ac381
Stable URL of this page: https://metraipolis.com/documento/dc_753dc4efca36

How to cite

Auditing Representation-Space Fraud Detection: A Bayesian IRL Framework for Calibrated Uncertainty and Its Limits — arXiv:2611.02673 — arXiv (en), https://arxiv.org/abs/2611.02673 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_753dc4efca36 (Metraipolis archive dc_753dc4efca36, sha256 dd58fce641f2f6882f5109a115c9445fa9255cb74149575b1964cfcc079ac381)

BibTeX

@misc{dc753dc4efca36,
  title = {Auditing Representation-Space Fraud Detection: A Bayesian IRL Framework for Calibrated Uncertainty and Its Limits — arXiv:2611.02673},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.02673},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_753dc4efca36; sha256 dd58fce641f2f6882f5109a115c9445fa9255cb74149575b1964cfcc079ac381},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.02673. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Shilling detectors for recommender systems are almost always evaluated by one number, detection AUROC, with no account of when it can be trusted. We audit representation-space detection with VEIL (Variational Evaluation via Inverse-reinforcement Learning), a pairwise (Bradley-Terry) Bayesian reward-inference framework over frozen encoder embeddings, following the Bayesian auditing paradigm for LLM alignment [1]: (A) a base posterior; (B) a hierarchical ARD extension with learned confidence; and (C) a label-routed organic/attacker mixture used as an evidence-accumulation this http URL prove (Proposition 1) that no detector built on a representation invariant to a transformation of user profiles can outperform chance against an attack that is indistinguishable from organic profiles under that this http URL is near-perfect against synthetic-structure attacks (AUROC 0.936-1.000) but collapses under donor-mimicry, which clones a real user's item set and splices in 1-3 target items. Performance falls to chance on MovieLens-1M (0.48-0.51), partially degrades on Amazon Musical Instruments, and degrades least on this http URL -mimicry is not undetectable: a non-learned baseline, based on each profile's maximum raw item-set Jaccard similarity to any other profile, reaches AUROC 0.92-0.97 (average precision 0.50-0.57) on all four donor-mimicry configurations, including ML-1M, where every embedding-based score is at this http URL signal is present in the raw profiles, but LightGCN's representation discards it, placing injected profiles closer to their true donor than its zero-propagation MF reduction does (distance 1.98 vs. 3.09). Severity varies by dataset, encoder, and detection method, with no single axis predicting the others. The limit lies in the representation, not the attack, and raw-similarity checks are a necessary complement to any learned detector.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2611.02673 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T10:59:45.840Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).