Imagine you run a restaurant and you trust three review sites. One is Yelp, one is Google, one is a niche foodie forum. A competitor can fake reviews on any of them, but faking on the niche forum is dirt cheap while gaming Google costs real money. You currently weight all three equally. This paper asks: when is listening to the cheap-to-fake source strictly worse than ignoring it entirely? And can you figure that out before the competitor starts buying reviews? The committed claim: for multi-relational graph models used in fraud/abuse detection, the authors prove that a "degree gate" — a mechanism that shuts off a relation for nodes that would be isolated on it — strictly dominates any weighting or selection scheme, under precisely characterizable cost conditions. This isn't a heuristic. It's a theorem with a sharp boundary: the gate wins exactly when part of the population is isolated on a relation and the attacker can't afford to bridge the gap. On real graphs, the gain appears on exactly those relations and nowhere else. The second result is arguably more useful for practitioners. They introduce a per-node "exposure" metric — how much an adversary can shift your prediction per unit of manipulation cost — computable without running any attack. This metric, exposure-per-unit-cost, correctly identifies which relation to harden (i.e., which relation's hardening raises the adversarial threshold most) in 15 of 16 tested cases. Competing heuristics — informativeness, cheapness, or equal-cost analysis — top out at 7 of 16. The practical upshot: a platform operator can rank relations by vulnerability without simulating attacks. Architecturally, the work spans linear relational models (where exact worst cases are derived), R-GCN (certified brackets via interval propagation through message passing), and tree ensembles. The theoretical toolkit is spectral-flavored analysis of multi-relational adjacency, combined with cost-parameterized adversarial budgets. This is not a deep learning scaling paper — it's a decision-theory paper that happens to cover GNNs. The key structural insight is that message passing amplifies exposure multiplicatively per hop, making the cost-aware analysis essential rather than optional. Integrity is mixed but honestly reported. The headline number — clean-trained graph detectors fall below their graph-free counterparts in 58 of 90 settings across six graphs — is striking and cuts against the GNN hype cycle. The adversarial validation comes with a finite-sample guarantee, which is rare. But the selection protocol built on these results has only been validated on synthetic graphs for the many-relation regime, and the authors say so plainly. The 15-of-16 exposure result uses real graphs, but the end-to-end pipeline's real-world validation is incomplete. The selection protocol itself follows a conservative logic: with four or fewer relations, it mostly abstains (matching what adversarial validation alone would recommend). It only starts making cost-aware proposals when relations are numerous. This is intellectually honest — the paper admits the regime where its contribution is marginal — but it also means the practical payoff is currently narrow. Without cost information, the paper's own recommendation is to abstain from using the graph entirely. The milestone to watch is real-world deployment on a platform with heterogeneous manipulation costs — think a social network where creating fake friendships costs differently than faking shared-group membership or message history. The theory is ready; the empirical validation on live adversarial environments is the gap. The obvious next experiment — running the selection protocol on real multi-relational graphs with measured or estimated manipulation costs — was not done, almost certainly because obtaining real cost data from platforms is a data-access problem, not a compute problem.
