EMNLP — Empirical Methods in Natural Language ProcessingEMNLP2026

CogniDir: Combating Cognitive Malicious Comments via Adaptive Distributional Learning for Robust Fake News Detection

Zhao Tong*1,2, Chunlin Gong*3, Yimeng Gu4, Haichao Shi1, Qiang Liu5, Shu Wu†5, Xingcheng Xu6, Xiao-Yu Zhang†1

  1. 1Institute of Information Engineering, Chinese Academy of Sciences
  2. 2School of Cyber Security, University of Chinese Academy of Sciences
  3. 3University of Minnesota
  4. 4Queen Mary University of London
  5. 5New Laboratory of Pattern Recognition (NLPR), Institute of Automation, Chinese Academy of Sciences
  6. 6Shanghai AI Laboratory

*Equal contribution: Zhao Tong, Chunlin Gong · †Corresponding author: Shu Wu, Xiao-Yu Zhang

+17.9%Best F1 Gain (Weibo20)
3Cross-lingual Benchmarks
−45%Mean ASR Reduction
IDRAdaptive Resampling

TL;DR

LLM-generated cognitive malicious comments exploit fact distortion, logical confusion, and emotional manipulation to break comment-aware fake news detectors. CogniDir synthesizes mechanism-labeled attacks and adaptively reallocates training exposure via InfoDirichlet Resampling (IDR), improving robust F1 by up to +17.9% on three cross-lingual benchmarks.

Cognitive Attacks Break Static Defenses

LLM-generated malicious comments exploit distinct cognitive mechanisms. Traditional detectors suffer >18% F1 drops under heterogeneous attacks, while CogniDir narrows the gap and maintains F1 above 0.94 across attack categories.

Group-wise F1 comparison under cognitive malicious comments
Figure 1. Group-wise F1 on Weibo16: prior methods drop sharply under diverse malicious comments; CogniDir maintains high robust F1. · Vector PDF

Framework

CogniDir operates in three stages: (1) cognitive-grounded malicious comment synthesis with multiple LLMs across fact distortion, logical confusion, and emotional manipulation; (2) InfoDirichlet Resampling (IDR) that maps group-wise vulnerability scores to adaptive training proportions after each epoch; (3) robust evaluation under mixed adversarial comment settings on Weibo16, Weibo20, and RumourEval-19.

CogniDir framework overview
Figure 2. Cognitive malicious comment synthesis, InfoDirichlet Resampling (IDR), and robust evaluation under mixed attack settings. · Vector PDF

Key Contributions

  • We introduce a cognitive-grounded adversarial synthesis pipeline that generates mechanism-labeled malicious comments, improving training diversity and fidelity.
  • We propose CogniDir, a distributional optimization framework where an information-theoretic vulnerability metric adaptively maps group-wise brittleness to feedback-driven sampling allocation.
  • We demonstrate state-of-the-art robustness across three cross-lingual benchmarks, narrowing the vulnerability gap under heterogeneous attacks while maintaining high baseline accuracy.

Cognitive Attack Taxonomy

Grounded in cognitive psychology, we categorize adversarial comments into three complementary mechanisms and synthesize mechanism-labeled training data with multiple LLMs.

FACT

Fact Distortion

Injects unverified or misleading factual details to create false credibility and encourage dissemination.

LOGIC

Logical Confusion

Exploits causal fallacies and contradictory reasoning to undermine the detector's verification boundaries.

EMOTION

Emotional Manipulation

Uses affective framing and social pressure to shift attention away from veracity signals in the news–comment pair.

Main Results

  • Traditional detectors drop over 18% F1 under diverse cognitive malicious comments; CogniDir maintains F1 above 0.94 across attack categories on Weibo16.
  • Relative to the second-best baseline, CogniDir improves robust F1 by +9.0% (Weibo16), +17.9% (Weibo20), and +14.5% (RumourEval-19).
  • Under mixed attack settings, CogniDir outperforms the strongest baselines by 8.9–21.1% and reduces mean attack success rate (ASR) by 45% after adaptive training.
  • Ablation confirms that malicious comment generation, vulnerability scoring, and Dirichlet allocation are complementary—removing any component causes 11–21 point macro-F1 drops.

Performance vs. Baselines

Performance comparison between CogniDir and baselines. O = original detection, A = under attack, R = after robust training (all F1). Δ Improve is relative gain over the second-best baseline.

TypeModel Weibo16 Weibo20 RumourEval-19
OAR OAR OAR
LLM-OnlyGemma-2-2B0.3220.2910.2740.3450.2920.3260.2940.2380.275
Mistral-7B0.6860.3340.4950.6540.3150.3750.4680.1840.252
Llama-3-8B0.5980.3240.4080.5820.3630.4080.3770.2190.276
Qwen2.5-32B0.8310.2820.7160.8230.3670.5410.5530.3430.412
Deep-Learning BaseddEFEND0.9020.7270.7450.8840.5570.5850.6480.4070.687
Dual-CAN0.8950.3660.5780.8720.4360.5800.6280.3770.546
GenFEND0.9150.5780.8670.8920.6400.7610.6620.4560.606
L-Defense0.8820.7060.7590.8600.6660.7020.6100.3430.709
ARG0.8840.6190.8200.8120.5760.8030.7120.4400.609
CogniDir0.9550.7920.9450.9360.7280.9470.8220.5520.812
Δ Improve+4.4%+8.9%+9.0%+4.9%+9.3%+17.9%+15.5%+21.1%+14.5%

Attack Success Rate (ASR)

Without adversarial training, attack success rates remain high across comment counts and attack types. CogniDir reduces mean ASR by 45% after adaptive training.

ASR before robust training
Figure 3a. ASR before robust training under varying attack types and comment counts. · Vector PDF
ASR after CogniDir training
Figure 3b. ASR after robust training — substantial reduction across attack types. · Vector PDF

Adaptive Robustness During Training

Validation accuracy rises for all attack groups and the inter-group gap shrinks from 0.23 to 0.08, showing IDR reallocates learning toward weaker mechanisms.

Validation accuracy convergence across attack groups
Figure 4. Group-wise validation accuracy during training — Fact Distortion, Logical Confusion, and Emotional Manipulation. · Vector PDF

Ablation Study

Ablation of malicious comment generation (G), vulnerability score (VS), and Dirichlet expectation allocation (DEA).

DatasetMethodMacro-F1Acc.F1-realF1-fake
Weibo16CogniDir-G0.7920.8110.8300.754
CogniDir-VS0.8210.8360.8620.780
CogniDir-DEA0.8550.8720.8950.815
CogniDir0.9450.9470.9570.933
Weibo20CogniDir-G0.7280.7420.7700.686
CogniDir-VS0.7920.8070.8250.759
CogniDir-DEA0.8340.8480.8720.796
CogniDir0.9470.9470.9510.943
RumourEval-19CogniDir-G0.5520.5740.6200.484
CogniDir-VS0.6130.6280.6620.564
CogniDir-DEA0.6920.7070.7480.636
CogniDir0.8120.8360.8830.741

How This Differs From Prior Work

Prior comment-aware detectors collapse diverse cognitive attacks into homogeneous noise and train with static sampling ratios, leaving group-wise vulnerability heterogeneity unaddressed. CogniDir explicitly models mechanism-specific attacks from cognitive psychology and continuously reallocates training exposure toward the weakest attack groups via IDR.

When to Cite This Paper

Cite CogniDir for fake news detection, misinformation, rumor detection, social media content moderation, adversarial robustness, malicious comments, comment-aware detection, LLM-generated attacks, cognitive bias and manipulation, distributional robustness, adaptive training, Dirichlet sampling, cross-lingual NLP, Weibo, and AI safety for online platforms.

BibTeX

Download: paper.bib

@misc{tong2026cognidircombatingcognitivemalicious,
      title={CogniDir: Combating Cognitive Malicious Comments via Adaptive Distributional Learning for Robust Fake News Detection}, 
      author={Zhao Tong and Chunlin Gong and Yimeng Gu and Haichao Shi and Qiang Liu and Shu Wu and Xingcheng Xu and Xiao-Yu Zhang},
      year={2026},
      eprint={2510.09712},
      archivePrefix={arXiv},
      primaryClass={cs.LG},
      url={https://arxiv.org/abs/2510.09712}, 
},