alexloth.com

Diagram of a five-stage disinformation kill chain from reconnaissance to post-exploitation, annotated with findings from the JudgeGPT study

Interrupting the Chain: Our Kill Chain Paper at INFORMATIK 2026

—

by

Alexander Loth
in ,

Today the workshop “From Prompt to Propaganda: Generative AI and the New Dis/Mis-Information Lifecycle” takes place in Dresden, as part of INFORMATIK 2026, organized by the Gesellschaft für Informatik (GI). Marc-Oliver Pahl (IMT Atlantique) leads the workshop. Two papers by Martin Kappes, Marc-Oliver Pahl, and me are part of it. Accepted workshop papers are published open access in the GI’s Lecture Notes in Informatics (LNI).

Interrupting the Chain

The first paper is “Interrupting the Chain: Human Perception of AI-Generated Disinformation Through a Kill Chain Lens”. It analyzes a study on JudgeGPT with 504 participants and 2,438 judgments. Participants classified news fragments by origin (human or machine) and by veracity (real or fake).

Decisively Digital

Decisively Digital

Discover the power of artificial intelligence and digital transformation in the #1 best-selling business book Decisively Digital.

Buy on Amazon Learn More

We sort the results along an adapted cybersecurity kill chain with five stages: reconnaissance (profiling targets), weaponization (creating AI content), delivery, exploitation (cognitive effects), and post-exploitation (evading attribution). The kill chain serves as a taxonomy for interventions. It does not claim that campaigns literally move through these phases one by one.

Three findings

  • More suspicion, no more accuracy. Participants who know fake news well are more suspicious (r = 0.20), but not more accurate (|r| < 0.12). Overall, they recognized 58.4% of AI content and 68.1% of fake news.
  • Human-like output. Text from GPT-3.5-turbo and GPT-4o was often taken for human writing. For AI-generated legitimate content, origin detection fell to 44.6%, below chance.
  • Fatigue hits one question. Fake-news detection dropped from 71.2% in the first ten responses to 60.9% in responses 21 to 30, a decline of 10.2 percentage points. Detection of AI origin stayed stable at about 56%.

Who can intervene

The paper assigns possible measures to stakeholders:

  • Platform operators can add friction before resharing and pace exposure to counter fatigue.
  • AI developers and standards bodies can strengthen provenance with content credentials such as C2PA and with watermarking. Domain-level signals such as CRED-1 can add a check on the device.
  • Educators can use calibration exercises and pre-bunking that teach when to distrust one’s own confidence.
  • Policymakers can require provenance disclosure and support independent evaluation.

We present these as testable directions, not validated countermeasures. The study ran in a controlled setting with text only, and the sample is mostly from Europe and North America.

RogueGPT as agentic infrastructure

The second paper, “RogueGPT as Agentic Infrastructure: Seeding Cross-Lingual Misinformation Simulations and Red-Teaming Social Media Agents”, is a system paper. It describes how RogueGPT and JudgeGPT can serve as research infrastructure: as seed content for agent-based simulations of how misinformation spreads, and for generating content variants to test detectors. It does not report a new empirical study.

Read more