What is GraphStrike?
An OpenEnv-compatible reinforcement learning environment where an LLM agent must identify all 10 members of a coordinated fake account ring hidden inside a synthetic social network. The agent learns via Reflexion and a dynamic hybrid rule/LLM policy — no gradient updates, no fine-tuning required.
Submitted to the OpenEnv Hackathon × SCALER School of Technology. Judges deploy this container, run their own LLM agent against it, and score on task quality, environment design, code quality, creativity, and domain quality.
System Architecture
End-to-end pipeline: episode generation → environment server → hybrid agent → reflexion memory
Task Difficulty Tiers
| Task | Network Size | Gang | Decoys | Max Steps | Win Condition | Baseline Score |
|---|---|---|---|---|---|---|
| Easy | 50 accounts | 10 | 0 | 30 | Recall ≥ 0.8, Precision ≥ 0.7 | 0.910 |
| Medium | 200 accounts | 10 | 20 | 50 | Recall ≥ 0.8, Precision ≥ 0.7 | 0.906 |
| Hard | 1000 accounts | 10 | 50 | 80 | Recall ≥ 0.9, Precision ≥ 0.8 | 0.904 |
Hard mode fires 4 evasion events (steps 15, 30, 45, 60) that drop intra-gang follow edges mid-investigation, destroying graph signals.
Detection Signal Hierarchy
Node signals (offline) → Behavioral signals (temporal/device) → Graph signals (live at INSPECT) → False-positive control via hub legitimacy
Node Signals (pre-computed offline)
| Feature | Fake Range | Real Range | What it measures |
|---|---|---|---|
photo_reuse_score | 0.30 – 0.95 | 0.00 – 0.15 | Stolen celebrity photos via pHash fingerprint matching |
bio_template_score | 0.20 – 0.90 | 0.00 – 0.12 | Cosine similarity to known fake bio templates |
comment_repeat_score | 0.60 – 0.90 | 0.00 – 0.08 | Fraction of copy-pasted spam comments across accounts |
Behavioral Signals (temporal + device)
| Feature | Fake Pattern |
|---|---|
avg_post_hour | All 10 gang members post within ±0.5h of each other (coordinated scheduling) |
account_age_days | Created same week — base_age ± 7 days |
shared_ip_count | = 9 for all gang members (one IP subnet per episode, unique seed) |
Graph Signals (computed live at INSPECT)
| Feature | Fake Pattern |
|---|---|
mutual_follow_rate | 0.6 – 0.9 (dense intra-gang mutual follows) |
flagged_neighbor_count | Grows as investigation proceeds — strongest late-game signal |
avg_neighbor_photo_reuse | High when cluster shares stolen content |
Episode Lifecycle & Action Mechanics
Episode flow: reset → inspect/flag/investigate loop → dual SUSPECT cascade → submit → grader score
Action Space
| Action | Step Cost | Effect |
|---|---|---|
INSPECT acc_XXXX | 1 step | Reveals full AccountProfile + follow list; adds 1-hop neighbors to visible set |
INVESTIGATE_NETWORK acc_XXXX | 2 steps | Bidirectional 2-hop expansion (outgoing + incoming edges); re-cascades SUSPECT |
FLAG acc_XXXX | FREE | Marks as fake; triggers dual SUSPECT cascade (follow-graph + IP cluster) |
UNFLAG acc_XXXX | FREE | Removes flag; clears CONFIRMED_FAKE status |
SUBMIT | FREE | Ends episode; triggers grader scoring |
Dual SUSPECT Cascade (triggered by FLAG)
Cascade 1 — Follow-Graph
Every account the flagged member follows (_live_edges) becomes SUSPECT if visible and NORMAL. Gang follow density is 0.70+ so this is high-precision.
Cascade 2 — IP Cluster
Every visible account sharing the same ip_cluster_id becomes SUSPECT. Gang shares ip_gang_<seed>; real accounts have unique IPs. Zero false positives.
Risk Scoring Mathematics
All scoring functions are stateless and deterministic — called inside _build_profile() at every INSPECT
Node risk, Behavior risk, Graph risk components
Hub legitimacy, Composite fake_risk_score formula
Grader Score Formula
Reflexion Learning
Post-episode lessons injected into every future prompt — learning without weight updates
The LLM (Qwen3-80B via AWS Bedrock) cannot be fine-tuned — it is a black-box API. Instead, a separate Qwen3 call generates a 2–3 sentence lesson after each episode. The best winning trajectory is stored as a few-shot example injected into all future prompts.
Episode N:
LLM acts using: system_prompt + reflections[last 4] + best_trajectory
Episode ends → WIN or LOSS
LOSS → generate_reflection(action_log, outcome) → lesson stored
WIN → save trajectory if better reward + generate_success_reflection
Episode N+1:
last 4 reflections + best win trajectory injected into prompt
→ LLM has learned from its past without any weight updatesHybrid Policy — The Novel Contribution
Dynamic alpha-weighted blend: rules dominate early, LLM earns trust through wins and reflections
A dynamic α-weighted blend of a deterministic rule engine and the LLM. α represents trust in the LLM — starts at 0.20 (rules dominate), climbs as the LLM wins consistently and accumulates reflections, capped per task to prevent the LLM from overriding correct high-confidence rule decisions.
Alpha progression: rule-dominated early training → LLM earns authority through wins
Rule Confidence Levels
| Situation | Rule Action | Confidence |
|---|---|---|
| Steps remaining = 0 | SUBMIT | 1.00 |
| Uninspected SUSPECT accounts exist | INSPECT suspects[0] | 0.95 |
fake_risk ≥ 0.85 | FLAG that account | 0.95 |
fake_risk in [threshold, 0.85) | FLAG that account | 0.70 – 0.94 |
| 10 flags placed | SUBMIT | 0.85 |
| Steps remaining ≤ 3 | SUBMIT | 0.90 |
| Uninspected accounts available | INSPECT top candidate | 0.30 |
When rule_confidence ≥ alpha the rule engine overrides. At easy cap (0.50), the LLM controls only exploratory INSPECT decisions. At hard cap (0.85), the LLM controls most decisions except forced submits and suspect cascade.