Organizations: National School of Development, Peking University, Beijing 100871, China · College of Information and Electrical Engineering, China Agricultural University, Beijing 100083, China · School of Foreign Studies, Beijing Language and Culture University, Beijing 100083, China · Artificial Intelligence Research Institute, Tsinghua University, Beijing 100084, China
With the rapid growth of live-streaming e-commerce and digital marketing, abnormal marketing behaviors have become increasingly concealed and coordinated across heterogeneous modalities, challenging platform governance and early risk identification. We propose MM-FGDNet, a data-driven multimodal framework for detecting abnormal behavior in large-scale live-streaming environments from complementary temporal-evolution and group-structure perspectives. A cross-modal temporal alignment module maps video, text, audio, and user behavior into a unified temporal semantic space. A temporal fraud-pattern module captures the progression from weak early signals to abrupt outbreaks, while a cooperative manipulation module identifies coordinated interactions among organized user groups and automated accounts. Experiments on real-world multi-platform live-streaming e-commerce datasets show that MM-FGDNet outperforms representative baselines, achieving an AUC of 0.927, F1 of 0.847, precision of 0.861, recall of 0.834, and an Early Detection Score of 0.689, while reducing false alarms. Ablation studies validate the contribution of each module, and cross-domain experiments demonstrate stable generalization to new streamers, product categories, and platforms. These results indicate that MM-FGDNet provides an effective and scalable solution for proactive detection of coordinated abnormal behavior in live-streaming systems.
Figures & tables
Data Modality
Source
Quantity
Granularity
Live-stream video frames
Live e-commerce platforms
3.2 M frames
Frame-level
Audio segments
Live-stream audio tracks
18,400 clips
Segment-level
Comments & barrage text
Live comment streams
12.6 M entries
Message-level
Transaction records
Tipping and order logs
1.8 M events
Event-level
User interaction sequences
Likes, follows, shares
9.4 M actions
Action-level
Table 1: Overview of the multimodal fraud detection dataset.
Figure 1: Illustration of the cross-modal temporal alignment module.
Figure 2: This figure illustrates the architecture and information flow of the temporal fraud pattern modeling module.
Figure 3: This figure depicts the overall pipeline and structural design of the cooperative manipulation detection module.
Method
AUC ↑
Precision ↑
Recall ↑
F1 ↑
FDR ↑
FAR ↓
EDS ↑
CDGS ↑
Isolation Forest
0.781
0.702
0.648
0.674
0.648
0.142
0.412
0.681
One-Class SVM
0.793
0.718
0.662
0.689
0.662
0.136
0.438
0.695
LSTM
0.834
0.756
0.721
0.738
0.721
0.121
0.502
0.734
GRU
0.842
0.764
0.728
0.746
0.728
0.118
0.517
0.742
Transformer (temporal)
0.867
0.791
0.756
0.773
0.756
0.106
0.561
0.771
GNN-based Fraud Detection
0.872
0.798
0.761
0.779
0.761
0.103
0.548
0.786
Table 2: Overall performance comparison with baseline methods.
Figure 4: Overall performance comparison with baseline methods.
Variant
AUC ↑
F1 ↑
FDR ↑
FAR ↓
EDS ↑
CDGS ↑
Full MM-FGDNet
0.927
0.847
0.834
0.071
0.689
0.872
w / o Cross-Modal Alignment
0.898
0.812
0.798
0.089
0.602
0.821
w / o Temporal Fraud Modeling
0.883
0.799
0.782
0.093
0.531
0.814
w / o Cooperative Detection
0.892
0.807
0.791
0.086
0.578
0.793
w / o Diffusion Augmentation
0.901
0.818
0.804
0.082
0.614
0.839
Table 3: Ablation study of different components in MM-FGDNet.
Figure 5: Radar chart illustrating the comprehensive ablation study results, comparing the full MM-FGDNet framework against four variants with specific core components removed. The axes represent six key evaluation metrics: AUC, F1-Score, Fraud Detection Rate (FDR), False Alarm Rate (FAR, plotted inversely where outward indicates lower FAR), Early Detection Score (EDS), and Cross-Domain Generalization Score (CDGS).
Target Scenario
Method
F1 ↑
AUC ↑
EDS ↑
New Streamer
Transformer (temporal)
0.742
0.851
0.512
Multimodal Fusion (MMBT)
0.769
0.873
0.548
GNN-based Fraud Detection
0.779
0.881
0.536
MM-FGDNet
0.816
0.914
0.662
New Product Category
Transformer (temporal)
0.736
0.846
0.498
Multimodal Fusion (MMBT)
0.761
0.869
0.531
Table 4: Cross-domain generalization performance under different target scenarios.
Figure 6: Cross-domain generalization performance under different target scenarios.
The rise of live streaming has transformed online interaction, enabling massive real-time engagement but also exposing platforms to complex risks such as scams and coordinated malicious behaviors. Detecting these risks is challenging because harmful actions often accumulate gradually and recur across seemingly unrelated streams. To address this, we propose CS-VAR (Cross-Session Evidence-Aware Retrieval-Augmented Detector) for live streaming risk assessment. In CS-VAR, a lightweight, domain-specific model performs fast session-level risk inference, guided during training by a Large Language Model (LLM) that reasons over retrieved cross-session behavioral evidence and transfers its local-to-global insights to the small model. This design enables the small model to recognize recurring patterns across streams, perform structured risk assessment, and maintain efficiency for real-time deployment. Extensive offline experiments on large-scale industrial datasets, combined with online validation, demonstrate the state-of-the-art performance of CS-VAR. Furthermore, CS-VAR provides interpretable, localized signals that effectively empower real-world moderation for live streaming.
Yiran Qiao, Xiang Ao, Jing Chen +3
ByteDance China · Institute of Computing Technology, Chinese Academy of Sciences
We present a collaborative streaming anomaly detection system for high-speed data streams that explicitly integrates human analysts into the decision loop. The system combines heterogeneous detectors and aggregates their outputs through a normalization-based weighted consensus, complemented by artifact-aware rules to stabilize anomaly scoring under deployment. To improve interpretability, it derives surrogate models that approximate the ensemble consensus and expose human-readable sensor conditions associated with anomalous behavior. Analysts can actively intervene by reviewing anomaly episodes, adjusting consensus behavior, and refining surrogate rules used for anomaly prediction, producing a human-adjusted ensemble. We evaluate the approach on an industrial stream with 260,000 events and 3 anomalous episodes, showing robust detection and actionable human-AI interaction.
Diogo Risca, Afonso Lourenço, Ricardo Martins +1
GECAD, ISEP, Polytechnic of Porto, Portugal · SISTRADE Software Consulting, Porto, Portugal
User behavior simulation with large language models~(LLMs) is increasingly used to support multi-agent ecosystem simulation. Existing simulators typically rely on static user profiles inferred from historical observations, which become inadequate in socially intensive environments such as live streaming where interaction dynamics continuously reshape user behavior. We propose LiveSim, an LLM-based framework for live-stream ecosystem simulation. It represents users as editable behavioral hypotheses and progressively refines them through trajectory-grounded interactions, where discrepancies between simulated and observed trajectories reveal missing environmental shaping effects. These signals are further extracted as transferable environment-behavior patterns and accumulated in a collective behavioral memory to improve user-level behavioral fidelity and support ecosystem-level simulation. Experiments on real-world live-stream risk-control data validate the effectiveness of LiveSim in improving user-level behavioral fidelity and enabling ecosystem-level analysis of risk evolution and platform intervention effects.
Jiaqi Xu, Yiran Qiao, Jing Chen +3
University of Chinese Academy of Sciences, Beijing 100049, China · ByteDance China