pith. sign in

arxiv: 2606.09754 · v1 · pith:TSJSZ7SAnew · submitted 2026-06-08 · 💻 cs.CY · cs.CR· cs.SI

Human-Centred Risk Mitigation for AI-Mediated Information Manipulation: A SOCMINT Framework Based on Information Manipulation Sets

Antonio Scala This is my paper

Pith reviewed 2026-06-27 14:45 UTC · model grok-4.3

classification 💻 cs.CY cs.CRcs.SI
keywords Information Manipulation SetsSOCMINTAI-mediated manipulationcounter-FIMIrisk mitigationdisinformation campaignshuman-centred securitysocial cyber attacks
0
0 comments X

The pith

Treating AI-mediated manipulation campaigns as coherent Information Manipulation Sets enables structured mitigation before attribution.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Current defensive approaches either split campaigns into weak individual incidents or postpone action until responsibility is assigned. The paper proposes a SOCMINT framework that treats manipulation as a single process captured in Information Manipulation Sets, which bundle narratives, accounts, infrastructures, temporal patterns, cross-platform activity, amplification, and targeting. A pipeline then moves from detection and triage through hypothesis construction, confidence and severity assessment, mitigation choice, and updates. This keeps human reasoning central while aiming for auditable and proportionate responses that avoid securitising legitimate dissent.

Core claim

The paper proposes a SOCMINT framework based on Information Manipulation Sets as an intermediate operational unit between individual incidents and strategic attribution. Manipulation is treated as a coherent process involving narratives, accounts, infrastructures, temporal patterns, cross-platform migration, synthetic amplification, and cognitive targeting. The pipeline proceeds from signal detection and diagnostic triage to IMS hypothesis construction, confidence and severity assessment, mitigation selection, and iterative update, illustrated by a compact scenario and supported by a tabletop evaluation protocol for decision quality, calibration, and proportionality.

What carries the argument

Information Manipulation Sets (IMS), an operational unit that groups elements of a manipulation campaign into a coherent process for analysis and response.

If this is right

  • Mitigation actions can be selected and executed before full attribution is established.
  • Campaign-level patterns involving multiple platforms and temporal sequences become visible that content-level or incident analysis misses.
  • Structured reasoning under uncertainty supports explicit confidence and severity scoring.
  • Tabletop protocols can be used to test whether responses remain proportionate.
  • Built-in safeguards can reduce the risk of securitising legitimate dissent.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Agencies already applying IMS concepts in counter-FIMI work could extend them into the full detection-to-mitigation pipeline.
  • The same set-based unit might be adapted for analysing other coordinated online influence activities beyond state-linked campaigns.
  • Automation could assist hypothesis construction and pattern matching inside the IMS framework to handle higher volumes of signals.
  • Neighbouring fields such as cyber threat intelligence may benefit from analogous process-oriented rather than incident-oriented units.

Load-bearing premise

That treating manipulation campaigns as coherent processes captured by Information Manipulation Sets will produce better mitigation outcomes than incident-level or attribution-first approaches.

What would settle it

Results from the proposed tabletop evaluation protocol in which teams using the IMS pipeline are compared against teams using incident-level or attribution-first methods on identical simulated campaigns, measuring differences in decision quality, confidence calibration, mitigation proportionality, and incidence of over-securitisation.

read the original abstract

AI-mediated information manipulation increasingly takes the form of social cyber attacks that target trust, attention, credibility, reputation, and decision-making rather than only technical infrastructures or isolated false contents. Existing defensive approaches often oscillate between incident-level analysis, which fragments campaigns into weak signals, and attribution-first analysis, which may delay mitigation until responsibility is established. This paper proposes a SOCMINT framework based on Information Manipulation Sets (IMS) as an intermediate operational unit between individual incidents and strategic attribution. Building on the VIGINUM/EEAS use of IMS in counter-FIMI analysis, the framework treats manipulation as a coherent process involving narratives, accounts, infrastructures, temporal patterns, cross-platform migration, synthetic amplification, and cognitive targeting. The proposed pipeline moves from signal detection and diagnostic triage to IMS hypothesis construction, confidence/severity assessment, mitigation selection, and iterative update. A compact scenario illustrates how IMS-based analysis captures what content-level and attribution-first approaches miss. The paper also proposes a tabletop evaluation protocol to assess decision quality, confidence calibration, and mitigation proportionality. The main implication is that human-centred risk mitigation requires not only better detection, but also structured reasoning under uncertainty, auditable decision-making, and safeguards against over-securitising legitimate dissent.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper claims that incident-level and attribution-first approaches to AI-mediated information manipulation fragment campaigns or delay action, and proposes a SOCMINT framework that uses Information Manipulation Sets (IMS) as an intermediate unit. The framework includes a pipeline of signal detection, IMS hypothesis construction, confidence/severity assessment, mitigation selection, and iterative update; it is illustrated by one compact scenario and accompanied by a proposed (but unexecuted) tabletop evaluation protocol. The main implication is that human-centred mitigation requires structured reasoning under uncertainty, auditable decisions, and safeguards against over-securitising dissent.

Significance. If the untested premise that IMS-based analysis produces superior mitigation outcomes holds, the work could contribute a practical intermediate operational layer that integrates narrative, infrastructural, and temporal signals while preserving proportionality. The proposal builds explicitly on prior VIGINUM/EEAS IMS usage and introduces an evaluation protocol that could, if implemented, support falsifiable assessment of decision quality.

major comments (2)
  1. [Abstract] Abstract and the paragraph on existing defensive approaches: the claim that IMS 'captures what content-level and attribution-first approaches miss' is asserted without any quantitative comparison, error bounds, or real-world case evaluation; the single compact scenario is illustrative only and does not test whether IMS construction improves mitigation proportionality or decision quality over baselines.
  2. [The proposed pipeline] Section describing the proposed pipeline and tabletop protocol: the central premise that treating manipulation campaigns as coherent IMS processes enables better human-centred outcomes rests on an unvalidated assumption; the manuscript neither executes the tabletop protocol nor provides any empirical data on confidence calibration or mitigation selection, leaving the load-bearing claim as an assertion rather than a demonstrated result.
minor comments (2)
  1. Clarify the precise definition and construction rules for an Information Manipulation Set at the first point of use, including how cross-platform migration and synthetic amplification are operationalised.
  2. The manuscript would benefit from explicit discussion of how the proposed framework differs from or extends existing FIMI/SOCMINT taxonomies already in the literature.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive and detailed comments. The manuscript is a conceptual proposal for an IMS-based SOCMINT framework that builds on existing VIGINUM/EEAS practices; it does not present new empirical data or execute the proposed evaluation protocol. We address each major comment below and will revise the manuscript to clarify its scope as a framework proposal.

read point-by-point responses

  1. Referee: [Abstract] Abstract and the paragraph on existing defensive approaches: the claim that IMS 'captures what content-level and attribution-first approaches miss' is asserted without any quantitative comparison, error bounds, or real-world case evaluation; the single compact scenario is illustrative only and does not test whether IMS construction improves mitigation proportionality or decision quality over baselines.

    Authors: We agree that the manuscript provides no quantitative comparisons, error bounds, or real-world evaluations, as its contribution is the description of a proposed framework and pipeline rather than an empirical study. The compact scenario is presented explicitly as illustrative of the conceptual logic. We will revise the abstract and the paragraph on existing approaches to remove any implication of demonstrated superiority, instead framing the IMS unit as an intermediate operational layer whose potential advantages are hypothesized from the integration of narrative, infrastructural, and temporal signals. revision: yes

  2. Referee: [The proposed pipeline] Section describing the proposed pipeline and tabletop protocol: the central premise that treating manipulation campaigns as coherent IMS processes enables better human-centred outcomes rests on an unvalidated assumption; the manuscript neither executes the tabletop protocol nor provides any empirical data on confidence calibration or mitigation selection, leaving the load-bearing claim as an assertion rather than a demonstrated result.

    Authors: We acknowledge that the manuscript does not execute the tabletop protocol or supply empirical data on calibration or mitigation outcomes. The paper's scope is to propose the pipeline and the evaluation protocol itself as a contribution for subsequent falsifiable assessment. In revision we will add explicit language in the pipeline and discussion sections stating that the human-centred benefits are posited on the basis of structured reasoning under uncertainty and existing IMS usage, without claiming empirical validation in the current work. revision: yes

Circularity Check

0 steps flagged

No circularity: conceptual framework proposal is self-contained

full rationale

The paper advances a SOCMINT framework that treats manipulation campaigns as coherent processes via Information Manipulation Sets, explicitly building on external VIGINUM/EEAS usage rather than any author prior result. No equations, fitted parameters, or predictions appear; the pipeline (detection to mitigation) and tabletop protocol are described at the conceptual level without any reduction of outputs to inputs by construction. Central claims about structured reasoning under uncertainty and safeguards against over-securitisation rest on the proposed structure itself, not on self-citation chains or renamed known results. This is a standard non-circular proposal of an operational unit and evaluation method.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim rests on the domain assumption that IMS constitutes an effective intermediate operational unit; no free parameters or new invented entities with independent evidence are introduced, as IMS is referenced as already used by VIGINUM/EEAS.

axioms (1)
  • domain assumption Information Manipulation Sets serve as an effective intermediate operational unit between individual incidents and strategic attribution
    Invoked in the abstract when describing the framework as bridging incident-level and attribution-first approaches.
invented entities (1)
  • SOCMINT pipeline with IMS hypothesis construction, confidence/severity assessment, and tabletop evaluation protocol no independent evidence
    purpose: To structure analysis and mitigation decisions for manipulation campaigns
    Proposed in the abstract as the operational structure; no independent evidence outside the proposal is supplied.

pith-pipeline@v0.9.1-grok · 5754 in / 1379 out tokens · 27558 ms · 2026-06-27T14:45:30.762171+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

17 extracted references · 7 canonical work pages

  1. [1]

    PLOS ONE10(2), e0118093 (2015)

    Bessi, A., Coletto, M., Davidescu, G.A., Scala, A., Caldarelli, G., Quattrociocchi, W.: Science vs conspiracy: Collective narratives in the age of misinformation. PLOS ONE10(2), e0118093 (2015). https://doi.org/10.1371/journal.pone.0118093

    work page doi:10.1371/journal.pone.0118093 2015

  2. [2]

    Bontcheva, K., et al.: Generative ai and disinformation: Recent advances, challenges, and opportunities. Tech. rep., European Digital Media Observatory (2023),https: //edmo.eu/edmo-news/new-white-paper-on-generative-ai-and-disinformat ion-recent-advances-challenges-and-opportunities/, accessed 2026-06-08

    2023

  3. [3]

    Proceedings of the National Academy of Sciences118(9), e2023301118 (2021)

    Cinelli, M., De Francisci Morales, G., Galeazzi, A., Quattrociocchi, W., Starnini, M.: The echo chamber effect on social media. Proceedings of the National Academy of Sciences118(9), e2023301118 (2021). https://doi.org/10.1073/pnas.20233 01118

    work page doi:10.1073/pnas.20233 2021

  4. [4]

    Scientific Reports10(16598) (2020).https://doi.org/10.1038/s41598-020-73510-5

    Cinelli, M., Quattrociocchi, W., Galeazzi, A., Valensise, C.M., Brugnoli, E., Schmidt, A.L., Zola, P., Zollo, F., Scala, A.: The covid-19 social media infodemic. Scientific Reports10(16598) (2020).https://doi.org/10.1038/s41598-020-73510-5

    work page doi:10.1038/s41598-020-73510-5 2020

  5. [5]

    Proceedings of the National Academy of Sciences113(3), 554–559 (2016).https://doi.org/10.1 073/pnas.1517441113

    Del Vicario, M., Bessi, A., Zollo, F., Petroni, F., Scala, A., Caldarelli, G., Stanley, H.E., Quattrociocchi, W.: The spreading of misinformation online. Proceedings of the National Academy of Sciences113(3), 554–559 (2016).https://doi.org/10.1 073/pnas.1517441113

    2016

  6. [6]

    DISARM Foundation: Disarm red framework (2026),https://www.disarm.found ation/framework, accessed 2026-06-08

    2026

  7. [7]

    European Digital Media Observatory: An introduction to disarm framework on disinformation tactics, techniques and procedures (Oct 2023),https://edmo.eu/ training/an-introduction-to-disarm-framework-on-disinformation-tacti cs-techniques-and-procedures-first-session/, accessed 2026-06-08

    2023

  8. [8]

    European External Action Service: 2nd eeas report on foreign information manipu- lation and interference threats. Tech. rep., European External Action Service (Jan 2024), https://www.eeas.europa.eu/eeas/2nd-eeas-report-foreign-informa tion-manipulation-and-interference-threats_en, accessed 2026-06-08

    2024

  9. [9]

    European External Action Service: 4th eeas annual report on foreign information manipulation and interference threats. Tech. rep., European External Action Service (Mar 2026), https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-f oreign-information-manipulation-and-interference-threats_en , accessed 2026-06-08

    2026

  10. [10]

    European Union Agency for Cybersecurity: The enisa cybersecurity exercise method- ology. Tech. rep., ENISA (Feb 2026),https://www.enisa.europa.eu/publicatio ns/the-enisa-cybersecurity-exercise-methodology, accessed 2026-06-08

    2026

  11. [11]

    Goldstein, J.A., Sastry, G., Musser, M., DiResta, R., Gentzel, M., Sedova, K.: Generative language models and automated influence operations: Emerging threats and potential mitigations. Tech. rep., Georgetown Center for Security and Emerging Technology and OpenAI and Stanford Internet Observatory (2023),https://arxi v.org/abs/2301.04246

    work page arXiv 2023

  12. [12]

    Grance, T., Nolan, T., Burke, K., Dudley, R., White, G., Good, T.: Guide to test, training, and exercise programs for it plans and capabilities. Special Publication 800-84, National Institute of Standards and Technology (2006),https://csrc.nis t.gov/pubs/sp/800/84/final, accessed 2026-06-08 Human-Centred Risk Mitigation for AI-Mediated Information Manipulation 15

    2006

  13. [13]

    Guide to Cyber Threat Information Sharing,

    Johnson, C., Badger, L., Waltermire, D., Snyder, J., Skorupka, C.: Guide to cyber threat information sharing. Special Publication 800-150, National Institute of Standards and Technology (2016).https://doi.org/10.6028/NIST.SP.800-150, https://doi.org/10.6028/NIST.SP.800-150

    work page doi:10.6028/nist.sp.800-150 2016

  14. [14]

    National Institute of Standards and Technology: Nist unveils newly named human- centered cybersecurity program (Sep 2023),https://www.nist.gov/blogs/cyber security-insights/nist-unveils-newly-named-human-centered-cybersecuri ty-program, accessed 2026-06-08

    2023

  15. [15]

    OASIS Open: Introduction to stix (2026),https://oasis-open.github.io/cti-d ocumentation/stix/intro.html, accessed 2026-06-08

    2026

  16. [16]

    Pennec, P

    Pollini, A., Callari, T.C., Tedeschi, A., Ruscio, D., Save, L., Chiarugi, F., Guerri, D.: Leveraging human factors in cybersecurity: An integrated methodological approach. Cognition, Technology & Work24, 371–390 (2022).https://doi.org/10.1007/s1 0111-021-00683-y

    work page doi:10.1007/s1 2022

  17. [17]

    information manipula- tion set

    VIGINUM: Definitions and objectives of the concept of “information manipula- tion set” (ims). Tech. rep., Secretariat-General for National Defence and Security (SGDSN), France (Jan 2026),https://www.sgdsn.gouv.fr/files/files/Public ations/20260122_NP_TLP-CLEAR_SGDSN_VIGINUM_IMS_0.pdf, accessed 2026-06-08

    work page arXiv 2026