Adversarially Robust Real-Time Fake News Detection Using RoBERTa with Continuous Learning and Browser-Native Deployment

1. Introduction

Misinformation spreads six times faster than accurate news on social media platforms [1], reaching peak distribution within hours of publication—long before professional fact-checkers can issue corrections. The consequences are concrete and severe: during the COVID-19 pandemic, false claims about cures and vaccine safety measurably increased hesitancy and delayed public health responses; in electoral contexts, fabricated narratives have influenced voter perceptions and eroded institutional trust. The volume and velocity of online content production make manual verification operationally infeasible at scale, motivating automated detection systems capable of assessing credibility at the point of consumption.

Transformer-based language models have dramatically improved automated text classification, and their application to fake news detection has produced accuracy figures routinely exceeding 95% on standard benchmark datasets [2]. Yet two problems receive insufficient attention in the literature. First, temporal drift: reported evaluations typically occur on static, in-distribution test sets that do not reflect the continuous evolution of misinformation tactics in deployment. A model trained on 2017–2021 content and evaluated on 2026 content faces a distribution shift that static benchmarks cannot capture. Second, deployment accessibility: high-performing research systems rarely translate into tools accessible to the general public, limiting their societal impact to indirect effects through platform-level implementations that users cannot directly inspect or interact with.

Beyond these, a more subtle vulnerability has emerged: adversarially crafted content using formal academic language and investigative journalism conventions can evade transformer classifiers that learned to associate professional register with legitimate news [3]. This creates a paradox in which the misinformation most likely to mislead educated readers is also the misinformation most likely to evade automated detection.

This paper addresses all three problems. The contributions are:

• A rigorous comparative study of XGBoost, DistilBERT, and RoBERTa on a 70,556-article deduplicated corpus, with false negative rate as the primary selection criterion—a deliberate departure from accuracy-centric evaluation that better reflects the asymmetric cost of missed fake news.
• A post-deployment continuous learning system comprising a nightly GitHub Actions scraper, experience replay fine-tuning, automatic evaluation gating, and versioned deployment—the first such pipeline reported for fake news detection to our knowledge.
• An adversarial training procedure that constructs formally-worded misinformation examples and demonstrates 95.71% adversarial accuracy versus approximately 40% for the base model, with no degradation on standard benchmarks.
• Production deployment via ONNX INT8 quantization, FastAPI hosting on free CPU infrastructure, and a Chrome extension providing paragraph-level detection, LIME explainability, source credibility fusion, multilingual support, and OCR-based image text analysis.
• Comprehensive evaluation across 50 curated articles (98% accuracy) and a seven-category adversarial test suite (91.7% overall, 100% in five of seven categories).

The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 describes dataset construction. Section 4 presents model architectures and training. Section 5 details the continuous learning pipeline. Section 6 covers deployment. Section 7 presents evaluation. Section 8 concludes.

2. Related Work

2.1. Fake News Detection: From Features to Transformers

Early automated approaches to misinformation detection relied on hand-engineered features: linguistic markers such as punctuation density and readability scores, network propagation patterns, and source credibility metadata [4]. TF-IDF vectorization combined with gradient boosted trees established a reproducible and interpretable baseline, achieving accuracy in the 85–93% range on single-domain datasets. These approaches are fundamentally limited by their static feature spaces and inability to capture semantic context beyond co-occurrence statistics.

The Transformer architecture [5] reconceived sequence modeling through self-attention, enabling simultaneous pairwise compatibility computation across all token positions and providing unlimited effective receptive field. BERT [6] demonstrated that bidirectional pre-training on large text corpora, followed by task-specific fine-tuning, yields broadly transferable representations. RoBERTa [7] showed that BERT was substantially undertrained: extending training to 160 GB of text with dynamic masking and removing the next-sentence prediction objective produced measurably superior representations without architectural change. Application of these models to fake news detection routinely yields accuracy above 95% [2], though most evaluations remain confined to in-distribution test sets.

2.2. Adversarial Robustness

Transformer classifiers are brittle under adversarial perturbation. Xu et al. [3] demonstrated that fake news detectors trained on human-written content fail on LLM-generated misinformation, which tends to adopt a formal, hedged register that classifiers associate with legitimate news. The BODEGA framework [8] provides systematic evaluation of detector resilience across adversarial attack types, confirming that small lexical edits can sharply degrade performance. Sentiment manipulation—rewriting fake claims with positive framing to reduce suspicion scores—represents a further attack vector [9]. These findings collectively motivate adversarial training as a necessary component of production-grade detectors.

2.3. Continuous Learning

Catastrophic forgetting, the tendency of neural networks to overwrite previously learned representations when trained on new distributions [10], poses a fundamental challenge to post-deployment adaptation. Experience replay—including a randomly sampled subset of historical data in each update batch—was originally developed for reinforcement learning and subsequently validated for continual learning in NLP. To our knowledge, no prior work applies experience replay to post-deployment continuous learning in fake news detection; existing systems either retrain from scratch on combined datasets or simply do not adapt.

2.4. Browser-Based Deployment

Aletheia [11] represents the closest prior art in browser-native fake news detection, employing Retrieval-Augmented Generation with a large language model to provide evidence-grounded explanations via a browser extension. While demonstrating the viability of the approach, its reliance on heavyweight LLM inference limits deployment to paid infrastructure. The present work achieves comparable functionality through ONNX INT8 quantization enabling free CPU hosting, making the system practically accessible without subscription costs.

3. Dataset Construction

3.1. Source Datasets

The training corpus draws from three complementary benchmark datasets. The ISOT dataset [12] comprises 44,898 articles—authentic news sourced from Reuters.com and fabricated content flagged by PolitiFact— providing a strong foundation for political misinformation detection. WELFake [13] aggregates 72,134 articles from four independent sources (Kaggle, McIntire, Reuters, and BuzzFeed Political), specifically designed to prevent classifier overfitting to single-source artifacts. The COVID-19 Constraint dataset [14] contributes 10,700 social media posts from Twitter and Facebook addressing pandemic misinformation, introducing a distinct register and temporal context absent from the news article datasets. Table 1 summarizes dataset characteristics.

3.2. Preprocessing and Deduplication

Raw text underwent standard preprocessing: HTML tags, URLs, and special characters were stripped; whitespace was normalized; encoding was standardized. Crucially, exact deduplication after normalization identified 52,980 duplicate articles—42.9% of the initial corpus—arising primarily from Reuters content appearing independently in both ISOT and WELFake. Deduplication is essential not merely for data quality but for evaluation integrity: models tested on articles seen during training exhibit inflated metrics that do not generalize to deployment. After filtering, the final corpus comprises 70,556 unique articles with near-perfect class balance: 50.8% real (35,841) and 49.2% fake (34,715).

Table 2. Corpus statistics after deduplication and preprocessing

Statistic	Value	Detail
Total unique articles	70,556	After deduplication
Real articles	35,841 (50.8%)	Label: 0
Fake articles	34,715 (49.2%)	Label: 1
Duplicates removed	52,980 (42.9%)	Cross-dataset overlap
Median article length	2,283 chars	Range: 50–12,000
Temporal range	2016–2021	Six-year span
Training split (70%)	49,388	Stratified
Validation split (15%)	10,584	Stratified
Test split (15%)	10,584	Stratified

Table 2. Corpus statistics after deduplication and preprocessing

Statistic	Value	Detail
Total unique articles	70,556	After deduplication
Real articles	35,841 (50.8%)	Label: 0
Fake articles	34,715 (49.2%)	Label: 1
Duplicates removed	52,980 (42.9%)	Cross-dataset overlap
Median article length	2,283 chars	Range: 50–12,000
Temporal range	2016–2021	Six-year span
Training split (70%)	49,388	Stratified
Validation split (15%)	10,584	Stratified
Test split (15%)	10,584	Stratified

The 70/15/15 train-validation-test split was applied through stratified sampling, preserving class balance across all partitions. This avoids the evaluation artifacts that arise when class proportions differ between training and evaluation subsets.

4. Model Architecture and Training

4.1. Comparative Study

Three architectures spanning the range from traditional machine learning to full-scale transformer models were evaluated, enabling principled selection rather than assumption of transformer superiority.

4.1.1. XGBoost with TF-IDF Features

Text was represented using TF-IDF vectorization with 35,000 features incorporating unigrams, bigrams, and trigrams with sublinear scaling. XGBoost was trained using histogram-based gradient boosting with early stopping (patience = 100 rounds), tree depth 6, and learning rate 0.1, running for 1,058 rounds before convergence.

4.1.2. DistilBERT

DistilBERT [15] compresses BERT through knowledge distillation to 67M parameters across six transformer layers, retaining 97% of language understanding at 40% of the parameter count. Fine-tuning used a learning rate of $2\times {10}^{-5}$, batch size 16, AdamW optimizer with weight decay 0.01, and linear warmup schedule over five epochs with maximum sequence length 512 tokens.

4.1.3. RoBERTa-Base

RoBERTa-base employs twelve transformer encoder layers, 768-dimensional hidden states, twelve attention heads, and 125M parameters. Its byte-pair encoding tokenizer maintains a vocabulary of 50,265 tokens—66% larger than DistilBERT’s WordPiece vocabulary of 30,522—providing finer-grained subword representations for the varied linguistic register of news content.

Fine-tuning applied label smoothing ($\epsilon =0.1$) to prevent overconfidence [7], transforming hard labels into soft targets:

$$y_{i,c}^{\mathrm{smooth}}=(1-\epsilon )·y_{i,c}+{\displaystyle \frac{\epsilon }{C}},\mathcal{L}=-\sum _i\sum _c{y}_{i,c}^{\mathrm{smooth}}log{\widehat{y}}_{i,c}$$

(1)

with $\epsilon =0.1$ and $C=2$ classes. A cosine annealing learning rate schedule with 10% linear warmup provided stable convergence. Gradient accumulation over two steps yielded effective batch size 32. Dropout (0.1) and gradient clipping (max norm 1.0) provided additional regularization.

4.2. Results and Model Selection

Table 3 presents comprehensive results on the held-out test set of 10,584 articles. Figure 1 visualizes the key metrics.

Model selection rationale. RoBERTa was selected for production not solely on accuracy grounds but on false negative rate, the primary safety-critical metric. In a deployment processing one million articles, RoBERTa would miss approximately 10,900 fake articles versus 35,100 for XGBoost—a difference with direct consequences for users exposed to undetected misinformation. The training cost of 409 minutes is incurred once; subsequent fine-tuning cycles complete in 10–15 minutes.

The performance differential between DistilBERT and RoBERTa reflects the contribution of pre-training scale. RoBERTa’s larger vocabulary enables more precise tokenization of neologisms and domain-specific terminology prevalent in political and health misinformation, while its 160 GB pre-training corpus produces richer contextual representations of the subtle language patterns characteristic of sophisticated fake news.

4.3. RoBERTa Training Dynamics

Table 4 documents training progression across five epochs. Figure 2 shows the corresponding loss and accuracy curves.

Validation loss stabilizes at approximately 0.23 after the second epoch, indicating effective convergence. The 1.19% generalization gap between training accuracy (99.86%) and test accuracy (98.51%) is consistent with well-regularized transformer fine-tuning and confirms the model generalizes rather than memorizes the training distribution.

5. Continuous Learning Pipeline

5.1. Motivation and Architecture

A static fake news detector trained on historical content faces inevitable performance degradation as misinformation tactics and topical domains evolve. The gap between training distribution and deployment distribution widens continuously in a field where adversarial content creators actively adapt to detection systems. We address this through an automated continuous learning system requiring no manual intervention after initial deployment. Figure 3 illustrates the complete pipeline architecture.

5.2. Automated Data Collection

A GitHub Actions workflow executes nightly at 22:00 IST, collecting approximately 420 articles per run from two source categories:

Real news: RSS feed parsing from verified outlets including Reuters, BBC, Al Jazeera, NPR, The Hindu, and NDTV. Articles are labeled REAL (label=0) based on the established editorial standards of the source.

Fake news claims: The Google Fact Check Tools API returns claims rated as false, misleading, or inaccurate by IFCN-certified fact-checking organizations. Claims are labeled FAKE (label=1) based on this multi-authority verification.

Collected articles are deduplicated against the existing corpus by URL matching and committed automatically to the data repository. Over the 13 operational nights documented in this work, the pipeline collected 1,264 unique new articles without manual intervention, spanning real-world events in April–May 2026.

5.3. Experience Replay Fine-Tuning

Naïve fine-tuning on new data alone risks catastrophic forgetting—the overwriting of previously learned representations by the update distribution. We apply experience replay: each update cycle combines new scraped articles with a 2,000-sample random subset of the original 70,556-article corpus, 70 adversarial training examples (Section 6), and 217 health misinformation examples, yielding approximately 3,551 total training articles per cycle.

Fine-tuning employs a conservative learning rate of $5\times {10}^{-6}$ over two epochs, preventing large parameter updates while permitting meaningful adaptation. The learning rate is deliberately lower than initial fine-tuning ($2\times {10}^{-5}$) to avoid destabilizing the established decision boundary.

5.4. Model Versioning and Deployment

Each candidate model is evaluated against held-out validation sets before deployment. Deployment proceeds only if accuracy $\ge 97\%$ and false negative rate $\le 2.0\%$; otherwise the previous version is automatically retained. Approved models upload to Hugging Face Hub, from which the production API downloads the latest checkpoint on restart. Table 5 tracks the version history.

V2’s improvement on fresh content (99.58% versus no measurement for V1) validates that experience replay successfully transfers to content beyond the original 2016–2021 training distribution. The FNR reduction from V1 (1.09%) to V2 on fresh content (0.24%) demonstrates that the model learns to detect contemporary misinformation patterns that differ from historical training examples.

6. Adversarial Robustness

6.1. Vulnerability Analysis

A fundamental limitation of transformer classifiers trained on conventional fake news datasets is their learned association between formal register and legitimate news. Training sets such as ISOT and WELFake contain fake news characterized by sensationalist language, conspiracy markers, and vague attribution—stylistic features the model learns to flag. Content that mimics academic or investigative conventions while conveying false claims evades detection entirely. Initial evaluation on a deliberately constructed adversarial set confirmed this: accuracy was approximately 40%, rendering the model no better than chance on sophisticated fake news.

6.2. Adversarial Dataset Construction

We constructed a dataset of 70 adversarial examples across five categories, paired with 25 real news examples to maintain balance:

Formal-language misinformation (15 examples): Fake claims expressed through the stylistic conventions of scientific literature: “Medical professionals have confirmed that 5G wireless networks are responsible for coronavirus spread.” These mimic academic attribution without verifiable sources.

Suppression narratives (15 examples): Claims structured around institutional concealment: “Documents obtained by this publication reveal that senior officials systematically concealed vaccine adverse event data.” The investigative journalism format lends false credibility.

Election misinformation (10 examples): False electoral claims using the language of documentation and eyewitness testimony: “Statistical analysis proves vote counts were manipulated in key swing states.”

Science denialism (10 examples): Formally expressed rejections of scientific consensus that avoid the crude markers of obvious conspiracy content.

Technology misinformation (10 examples): Fabricated health claims about consumer technology using the language of suppressed research.

6.3. Adversarial Fine-Tuning Results

Fine-tuning V3 on the combined adversarial dataset plus experience replay (total 3,551 examples, learning rate $5\times {10}^{-6}$, 2 epochs) produced V3-Robust. Table 6 documents the before-after comparison.

The result is striking: adversarial accuracy improves from approximately 40% to 95.71%—a 55 percentage point gain—while accuracy on the original and fresh test sets improves marginally (+0.34% and +0.08% respectively). Experience replay is the mechanism preventing catastrophic forgetting: without it, fine-tuning on 70 adversarial examples would dominate the gradient signal and degrade standard performance.

Figure 4. Adversarial fine-tuning results: V3 versus V3-Robust. (a) Overall accuracy comparison showing the 55.7 percentage point gain on adversarial content while standard test accuracy is maintained. (b) Per-category breakdown across five adversarial misinformation types.

Figure 4. Adversarial fine-tuning results: V3 versus V3-Robust. (a) Overall accuracy comparison showing the 55.7 percentage point gain on adversarial content while standard test accuracy is maintained. (b) Per-category breakdown across five adversarial misinformation types.

7. System Deployment

7.1. ONNX INT8 Quantization

The 500 MB PyTorch RoBERTa model requires GPU infrastructure for real-time inference, making free-tier hosting infeasible. ONNX (Open Neural Network Exchange) export followed by dynamic INT8 quantization—converting 32-bit float weights to 8-bit integers—reduces model size from 500 MB to 125 MB (74.8% reduction). Inference latency on commodity CPU measures 150–200 ms per prediction, within the sub-second threshold for interactive use, while accuracy on the original test set remains at 97%.

7.2. FastAPI Backend

A REST API deployed on Hugging Face Spaces serves predictions continuously. Beyond the ONNX classifier, the prediction pipeline applies three sequential components:

Temperature scaling ($T=1.5$) calibrates raw logits before softmax, producing more reliable confidence estimates: $\widehat{p}=\mathrm{softmax}(z/T)$.

Pattern detection evaluates 12 linguistic categories including unverified statistical claims, vague source attribution (“anonymous sources”, “whistleblowers”), sensationalist language, conspiracy markers, suppression narratives, and leading-question formats. Detected patterns adjust a suspicion score that contributes 20% of the final verdict weight.

Source credibility fusion maintains a database of 200+ domain credibility ratings, combining model confidence (60%), credibility score (20%), and Google Fact Check API verification (20%) into the final score.

7.3. Chrome Browser Extension

The extension (submitted to Chrome Web Store, pending review) operates across all websites using Manifest V3. The primary modality is paragraph-level hover detection: text is extracted when a cursor rests on a paragraph for 800 ms, transmitted to the API, and the result displayed as a floating popup with verdict, confidence bar, source credibility rating, and detected patterns. Figure 5 shows the user interface.

Secondary modalities include: text selection tooltip for on-demand analysis of highlighted text; right-click OCR invocation of Google Cloud Vision API for image-embedded text extraction; and multilingual support via Google Translate API covering 19 languages with detected language shown in the UI. Smart site exclusion prevents spurious analysis on video platforms, email clients, and development tools. Figure 6 provides the complete system architecture.

8. Evaluation

8.1. Benchmark Performance

The production model—V3-Robust in ONNX INT8 format—was evaluated against the held-out test set of 10,584 articles unseen in any training phase. Accuracy of 98.60% was achieved with FNR 1.61% and FPR 2.46%. F1-score of 0.9860 confirms balanced performance. These figures are consistent with state-of-the-art results on comparable benchmark datasets while reflecting the additional robustness challenge of adversarial training exposure.

8.2. 50-Article Curated Evaluation

A manually curated evaluation set of 50 articles was constructed across four categories to assess system-level performance beyond standard benchmarks: obvious fake news employing sensationalist language; subtle fake news using academic register; verified real news from established outlets; and borderline cases presenting genuine classification ambiguity. Table 7 presents results.

The single misclassified article is a whistleblower claim about workplace discrimination—a case where even professional fact-checkers disagree on ground truth, making the misclassification an expected outcome of any binary system.

8.3. Research-Backed Seven-Category Adversarial Testing

Drawing from published adversarial benchmarking frameworks [8], a second evaluation constructed 36 test cases across seven categories representing the range of challenges documented in the fake news detection literature. Table 8 presents results; Figure 7 visualizes the performance profile.

Discussion of failures. The three remaining misclassifications represent distinct and acknowledged limitation classes. The source credibility failure arises from a deliberate design trade-off: the trusted-source override prevents pattern-based mislabeling of legitimate institutional content on high-credibility domains, at the cost of occasionally failing to flag suspicious content on those same domains. The two edge case failures involve a statistics-only text without narrative context and a leading-question format (“Could vaccines cause autism?”)—cases that present genuine classification difficulty even for human annotators, as the claims are neither affirmative nor clearly falsifiable in the absence of surrounding context.

8.4. Improvement Trajectory

Table 9 tracks system improvement across the development iterations on the seven-category adversarial test suite, illustrating the contribution of each component.

Figure 8. System improvement trajectory. (a) Overall accuracy on the seven-category adversarial test suite: 66.7% (V3) → 86.1% (V3-Robust) → 91.7% (final system). (b) Per-category improvement in percentage points; adversarial robustness shows the largest gain (+60 pp), followed by multilingual content (+50 pp).

Figure 8. System improvement trajectory. (a) Overall accuracy on the seven-category adversarial test suite: 66.7% (V3) → 86.1% (V3-Robust) → 91.7% (final system). (b) Per-category improvement in percentage points; adversarial robustness shows the largest gain (+60 pp), followed by multilingual content (+50 pp).

9. Discussion

9.1. The False Negative Priority

The central design decision in this work—prioritizing false negative rate over accuracy as the selection criterion—deserves explicit justification. In misinformation detection, the two error types carry asymmetric costs. A false positive (legitimate news flagged as fake) creates momentary friction that an informed user can resolve by seeking a second source. A false negative (fake news classified as real) exposes the user to undetected misinformation, potentially influencing beliefs and decisions without their awareness. This asymmetry is particularly severe for the formally-worded fake news that motivated our adversarial training: it is precisely the content most likely to be trusted by educated readers and least likely to trigger skepticism.

9.2. Practical Contributions and Limitations

The continuous learning pipeline addresses temporal drift without human intervention, but its effectiveness over extended periods requires longitudinal study. The 13-night observation window in this work validates operational reliability; it does not provide evidence about performance after months of deployment. The experience replay strategy prevents catastrophic forgetting in the short term, but the optimal replay ratio and update frequency may require tuning as the cumulative corpus grows.

The ONNX quantization approach achieves free-tier deployment at the cost of a modest accuracy reduction (98.6% PyTorch to 97% ONNX). For applications where that gap is critical, GPU inference remains available at increased hosting cost.

The Chrome extension’s broad host permissions (<all_urls>) are necessary for the system to function across the full range of news sources and social media platforms where misinformation appears—a restriction to specific domains would eliminate coverage of precisely the novel sites where misinformation tends to originate. This permission necessitates extended review by the Chrome Web Store, which is an acknowledged friction point for deployment.

9.3. Comparison with Related Work

Relative to Aletheia [11], which achieves evidence-grounded explanations through RAG but requires paid LLM infrastructure, the present system achieves comparable functionality through quantized inference at zero hosting cost. The LIME-based attribution provided by this work, while less evidence-rich than RAG explanations, operates at 150–200 ms versus the several seconds typical of LLM generation, making it more compatible with natural reading pace.

Relative to prior adversarial robustness work [3,9], this paper contributes a concrete and reproducible adversarial fine-tuning procedure—constructing a small, targeted adversarial set rather than relying on automated perturbation—and validates it on a production system rather than a research prototype.

10. Conclusion

This paper presented a system for real-time fake news detection that addresses three documented gaps in the literature: static model decay, adversarial vulnerability to formal-language misinformation, and the absence of accessible deployment for non-technical users.

On a 70,556-article corpus, RoBERTa-base achieves 98.51% accuracy with a 1.09% false negative rate—a 69% reduction over XGBoost chosen as the primary selection criterion. Adversarial fine-tuning raises detection accuracy on formally-worded fake news from approximately 40% to 95.71% while maintaining standard benchmark performance, enabled by experience replay that prevents catastrophic forgetting. ONNX INT8 quantization enables inference on free CPU infrastructure, and a continuously operating nightly scraper provides fresh labeled data without human intervention. End-to-end evaluation yields 98% accuracy on curated real-world content and 91.7% across seven adversarial categories, with 100% accuracy in five of seven.

The system’s principal limitations are the 3% accuracy reduction from ONNX quantization relative to PyTorch inference, the short observation window for the continuous learning pipeline, and residual difficulty on context-free edge cases (short texts, statistics-only content, leading-question format). These represent concrete directions for future work alongside multimodal extension to images and video, direct multilingual modeling without translation, and a longitudinal study of pipeline effectiveness over extended deployment.