Text–relation joint modeling improves the robustness of Chinese social bot detection against paraphrasing attacks

Generative language models have made paraphrasing a low-cost and practical evasion strategy against social bot detectors, especially on Chinese platforms where textual content is a major detection signal. We introduce TRJD-AT, a text-relation joint framework that combines a Chinese MacBERT encoder, a two-layer heterogeneous graph attention network over user-post publication and user-user follow relations, a lightweight gated fusion module, and Fast Gradient Method (FGM) training on input embeddings. We further define a three-tier paraphrasing protocol - lexical substitution, sentence-level rewriting, and benign-token insertion - with explicit attack budgets and automatic semantic-preservation constraints, while separating post-level attack construction from account-level evaluation. On the Chinese Weibo Social Bot dataset, TRJD-AT obtains a clean macro-F1 of 0.891. Under the default Tier 2 condition (semantic-similarity threshold 0.80), it obtains a macro-F1 of 0.835, corresponding to a 5.6-percentage-point reduction, whereas the MacBERT + MLP text-only baseline obtains 0.733, corresponding to a 13.4-point reduction. Clean performance and adversarial degradation are reported as distinct quantities. Ablation results indicate that the observed robustness is mainly associated with relational modeling; FGM improves clean performance in this setting but does not provide an independent gain in attacked macro-F1. A density-based analysis further identifies reduced relational benefit for accounts with sparse interaction histories.