An Agentic Operationalization of DISARM for FIMI Investigation on Social Media

TL;DR

The paper tackles the challenge of scalable, interoperable FIMI analysis by introducing an agentic, DISARM-aligned pipeline that operates across social media datasets. It blends agentic AI with a structured, technique-guided workflow to identify manipulative behaviors and map them to DISARM TTPs, validated on real-world Chinese and Moldovan datasets. Key contributions include a technique-guided, verifiable atomic-evidence framework, and a detailed assessment of integration, performance, and military applicability, demonstrated by a 50% technique-pass rate across 14 autonomous iterations and discovery of previously undetected bot activity. The study highlights the potential of autonomous agents to augment situational awareness and cross-partner interoperability in high-tempo hybrid environments, while acknowledging the essential role of human oversight for intent assessment and context-aware decision-making.

Abstract

The interoperability of data and intelligence across allied partners and their respective end-user groups is considered a foundational enabler to the collective defense capability--both conventional and hybrid--of NATO countries. Foreign Information Manipulation and Interference (FIMI) and related hybrid activities are conducted across various societal dimensions and infospheres, posing an ever greater challenge to the characterization of threats, sustaining situational awareness, and response coordination. Recent advances in AI have further led to the decreasing cost of AI-augmented trolling and interference activities, such as through the generation and amplification of manipulative content. Despite the introduction of the DISARM framework as a standardized metadata and analytical framework for FIMI, operationalizing it at the scale of social media remains a challenge. We propose a framework-agnostic agent-based operationalization of DISARM to investigate FIMI on social media. We develop a multi-agent pipeline in which specialized agentic AI components collaboratively (1) detect candidate manipulative behaviors, and (2) map these behaviors onto standard DISARM taxonomies in a transparent manner. We evaluated the approach on two real-world datasets annotated by domain practitioners. We demonstrate that our approach is effective in scaling the predominantly manual and heavily interpretive work of FIMI analysis, providing a direct contribution to enhancing the situational awareness and data interoperability in the context of operating in media and information-rich settings.

Figures (1)

• Figure 1: Workflow of the proposed agentic investigation and evidence assessment. The workflow consists of two sequential stages. In the investigation planning and execution stage (upper panel), planning proposes the hypotheses, which are subsequently examined using exploratory data analysis (EDA) and TTPs sampling over social media data and framework-based taxonomies. Planning, hypothesis-driven analysis, and evidence gathering are connected through an iterative loop, producing structured findings summaries across iterations. In the evidence assessment stage (lower panel), findings are decomposed into atomic evidence units, evaluated through automated machine verification (when labels are available), and followed by a final human evaluation.