Social-HUMINT measures how well LLMs profile people for social engineering
Original title: Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure
Experts validated a 38-capability taxonomy, and an LLM pipeline matched real participants' engagement rankings above chance.
A paper unifies SOCMINT and Cyber-HUMINT into a doctrine-grounded taxonomy of 38 capabilities across the Cyber Threat Intelligence lifecycle, with user profiling bridging passive collection and active engagement. Domain experts validated it at Fleiss' κ = 0.92. An LLM multi-agent pipeline extracts and infers attributes from participants' public data and indirectly scores susceptibility by predicting how each target would rank personalized engagement options. Extraction reached F1 = 97.3% and inferred attributes scored 4.73/5, both above rule-based and NER baselines.
Unconfirmed: Evaluation is on real participants' public data; the paper does not report use against live targets by adversaries.
- The taxonomy covers 38 capabilities across the Cyber Threat Intelligence lifecycle.
- Domain-expert validation produced Fleiss' κ = 0.92.
- Extraction F1 was 97.3%; inferred attributes scored 4.73 out of 5.
- Susceptibility is inferred from predicted rankings of personalized engagement options.
- The authors say the pipeline augments analysts rather than replacing them.
From the original article
1 min read at arxiv.orgIn the post-API landscape, social-media profiling has become inexpensive and automated: Large Language Models (LLMs) can extract structured information from unstructured content and deduce attributes users never disclosed. A person's true exposure is not what they post but what can be inferred from it.
By Pellegrino Casoria · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.