Evolving to Evade: Exposing and Mitigating LLM-Assisted Persona Camouflage in Social Bot Detection

Abstract

: Large language models (LLMs) are reshaping social bot detection by decoupling automated intent from surface-level expression. This decoupling weakens a central assumption behind contemporary detectors: that an account’s textual persona, profile metadata, and graph position remain jointly stable across evaluation. An adversary can now retain an established bot account and its structural capital while rewriting the public-facing persona into fluent, personalized language. We formalize this threat as LLM-assisted in-place persona camouflage and evaluate it through a controlled same-account counterfactual stress test that rewrites persona-facing text within fixed account snapshots while preserving labels, metadata, graph context, semantics, and protected evidence. Across TwiBot-20 and TwiBot-22, Bot Recall often deteriorates more sharply than Macro-F1 across text-only, graph-based, relation-aware, and multi-view detectors; when aggregate performance remains comparatively stable, this gap creates an illusory impression of robustness. To close this gap, we propose SAIL (Semantic-Anchor Invariant Learning), an attack-aligned framework that turns persona evolution into offline adversarial rehearsal. By combining multi-view supervised risk, semantic-anchor alignment, and same-account cross-view consistency, SAIL encourages detectors to separate account-level invariants from superficial stylistic shortcuts. On TwiBot-20 RoBERTa, average Bot Recall rises from 41.44% without defense to 75.88% with CF-Aug and 76.65% with full SAIL. Counterfactual exposure supplies the primary recovery, while SAIL stabilizes the recovered boundary across alternate personas and preserves aggregate discrimination. The recovery extends to TwiBot-22 and held-out Luna views with no online LLM call at deployment. These findings indicate that robust social bot detection in the LLM era must follow the account as its public persona evolves.