Interrupting the Chain: Human Perception of AI-Generated Disinformation Through a Kill Chain Lens

Generative AI has transformed disinformation from isolated incidents into systematic cognitive attacks that threaten trust in online information ecosystems [LKP24]. Large language models enable malicious actors to produce culturally nuanced, plausible narratives at scale—a process we have elsewhere termed industrialized deception [LKP26d], and refer to throughout this paper as AI-generated misinformation—creating a fundamental asymmetry: falsehoods are produced faster than they can be debunked [Fe24, CS23].

Current defenses—fact-checking, content moderation, debunking—operate after cognitive exploitation has occurred. A proactive framework is needed that identifies intervention points before impact. We adapt the cybersecurity kill chain concept [NH23] as a taxonomy for intervention: a conceptual scaffold that organizes empirical signals into actionable defense layers, without claiming that disinformation campaigns literally proceed through discrete sequential phases. Our five-stage model (Figure 1) comprises Reconnaissance (profiling targets), Weaponization (creating AI content), Delivery (dissemination), Exploitation (cognitive effects), and Post-Exploitation (evading attribution).

Contribution. We present a quantitative assessment of human perception data ($n{=}504$ participants, $n{=}2{,}438$ judgments) collected via JudgeGPT [LKP24] and organize findings through this kill chain lens to characterize stage-specific vulnerabilities and candidate intervention points. This work complements our prior analyses of causal susceptibility factors [LKP26b], expert perceptions of the verification crisis [LKP26e, Lo26b, LKP26c], dual-axis human perception of LLM-generated news [LKP26], the cognitive indistinguishability threshold [Lo26], and cryptographic provenance countermeasures [Lo26a].

Kill chain frameworks have been proposed for disinformation [NH23, Se21, Sc19], and human AI-text detection has been studied in isolation [Cl21, JHN23]. Existing conceptual models of influence operations differ in granularity and intent: Nimmo and Hollowood’s “breakout scale” [NH23] tracks the spread of a campaign across platforms; the DISARM/AMITT framework and Sedova et al. [Se21] decompose operations into tactics and techniques analogous to MITRE ATT&CK; and Schneier [Sc19] frames information operations as attacks on democratic cognition. These frameworks primarily describe operator behavior. Our contribution is complementary and distinct: we retain a compact five-stage lifecycle but anchor each stage in measured human-perception data, shifting the unit of analysis from what attackers do to where human targets are cognitively vulnerable.

Why a kill chain, and where the analogy holds. The cybersecurity kill chain is useful here because it makes intervention points explicit: a defender does not need to block every stage, only to interrupt one. The analogy holds for the intervention logic (stage-specific, layered defense) and for the notion that early disruption is cheaper than late remediation. It holds less well as a causal or strictly sequential process model: disinformation stages overlap, iterate, and run in parallel, and a target may be exploited without a preceding tailored reconnaissance step. We therefore use the kill chain explicitly as a taxonomy for intervention, not as a claim that campaigns proceed through discrete, ordered phases.

However, prior kill-chain treatments of disinformation—whether framed around campaign spread, operator TTPs, or, more recently, narrative-sequencing of AI-generated content [EU23, Se25]—remain grounded in operator behavior or content analysis. To our knowledge, none has mapped large-scale human perception data onto the attack lifecycle to identify stage-specific cognitive vulnerabilities. Our work bridges these threads by providing empirical grounding for a kill chain taxonomy using real perception data. While validated instruments like the Misinformation Susceptibility Test (MIST) [Ma24] measure veracity judgment at the headline level, JudgeGPT adds a second dimension—origin (human vs. machine)—and evaluates full-text fragments, capturing richer cues relevant to the generative AI era.

RogueGPT generates news fragments using seven LLMs (GPT-3.5-turbo, GPT-4o, Llama-2-13b, Gemma-7b, Phi-3-mini, Mistral-7b) with systematic prompt variation across four languages (English, French, German, Spanish), three styles, and three formats. Human-written content from legitimate outlets and verified fake-news databases supplements the corpus. The generation pipeline and its implications for industrialized disinformation are detailed in [LKP26d].

JudgeGPT collected evaluations from $n{=}504$ participants who provided demographics and then evaluated randomly sampled fragments using three 0–1 sliders: HumanMachineScore (origin), LegitFakeScore (veracity), and TopicKnowledgeScore (familiarity). Accuracy was coded as correct when $\text{Score}\geq 0.5$ matched ground truth. Analysis comprised Pearson correlations, independent t-tests, temporal fatigue analysis, and LLM performance comparison. A causal analysis of the susceptibility factors is presented in [LKP26b].

We organize our key findings by kill chain stage. Table 1 provides an overview. We focus on the four stages with empirical grounding; Post-Exploitation is discussed briefly as it relies on indirect evidence.

Our findings support three takeaways for research on AI-generated disinformation. We first restate the empirical observations, then our interpretation. Empirically, we observe (i) a perception-accuracy gap, (ii) below-chance origin detection for high-quality and truthful AI text, and (iii) a descriptive asymmetric decline in fake-news detection under sustained exposure. Interpreting these through the kill chain: first, the perception-accuracy gap challenges the assumption that awareness campaigns alone improve resilience—metacognitive calibration may be as important as factual inoculation. Second, the asymmetric fatigue pattern is consistent with volume-based attacks being strategically rational, targeting the cognitive process (content evaluation) that degrades under load while leaving origin attribution unaffected; we frame this as a hypothesis motivated by our data rather than a demonstrated attack. Third, the kill chain taxonomy, while not a causal model, provides a useful organizational framework for mapping heterogeneous empirical signals onto distinct defensive opportunities. Expert interviews with disinformation specialists corroborate these concerns, highlighting systemic risks of “epistemic fragmentation” and skepticism toward purely technical detection [LKP26e].

Who can intervene, and how. Table 1 maps findings to stages; here we make the interventions concrete and assign them to stakeholders, while keeping claims modest.

• •

  Platform operators can add friction at Delivery—lightweight interstitials or brief dwell-time prompts before resharing—to nudge users from fast System 1 toward deliberate System 2 evaluation, and can pace exposure to counter fatigue (e.g., rate-limiting dense misinformation feeds).

• •

  AI developers and standards bodies can strengthen provenance at Weaponization/Post-Exploitation—machine-readable content credentials (e.g., C2PA) and watermarking—so that low human detectability of synthetic text is backstopped by verifiable signals [Lo26a]. Domain-level credibility priors such as CRED-1 [LKP26a] offer a complementary, on-device signal for pre-bunking at the Delivery stage.

• •

  Educators can target the perception-accuracy gap at Reconnaissance with cognitive scaffolding: calibration exercises and prebunking that teach when to distrust one’s own confidence, not only what is false.

• •

  Policymakers can require provenance disclosure and support independent evaluation, complementing platform- and education-level measures.

We present these as plausible, testable directions rather than validated countermeasures; each requires dedicated evaluation.

Limitations. The study was conducted in a controlled environment lacking the social dynamics of real platforms (limited ecological validity); reshare pressure, social endorsement cues, and algorithmic amplification are absent. The sample is primarily European/North American, and although RogueGPT produces multilingual stimuli, cross-language perception effects were not analyzed in this short paper. Content was text-only, excluding multimodal (image/video/audio) disinformation and social-network propagation, both of which likely alter detectability. Findings are tied to the specific foundation models tested; rapidly evolving models may shift the reported detection rates, so absolute numbers should be read as a snapshot. Finally, the kill chain mapping is interpretive rather than experimentally validated per stage, and the speed and fatigue results are descriptive/exploratory pending repeated-measures analysis.

Data availability. The JudgeGPT perception dataset (DOI: 10.5281/zenodo.18703385) and RogueGPT stimulus corpus (DOI: 10.5281/zenodo.18703138) are archived on Zenodo under restricted access with a data use agreement. Complementary datasets from our broader research program are likewise openly archived: the expert-survey data analyzed in [Lo26b, LKP26c] (DOI: 10.5281/zenodo.18703601) and the CRED-1 domain-credibility dataset [LKP26a] (DOI: 10.5281/zenodo.18769460). Source code is available at github.com/aloth/RogueGPT (RogueGPT) and github.com/aloth/JudgeGPT (JudgeGPT).

Future work should strengthen the framework-data linkage through integrative modeling (e.g., mixed-effects and multivariate regression across stages that account for per-participant nesting), add cross-language analysis, compare human performance against automated detectors, extend the framework to multimodal content (image, video, audio) and social-network propagation dynamics, and empirically test the Delivery and Post-Exploitation stages through ecological and longitudinal designs.

This paper presented empirical evidence from a human-subject study ($n{=}504$, $n{=}2{,}438$ judgments) organized through an adapted cybersecurity kill chain. The perception-accuracy gap, LLM weapon efficacy, and asymmetric cognitive fatigue effect collectively argue for a shift from reactive fact-checking to proactive, stage-specific defense. Understanding where humans become vulnerable is as important as understanding how AI generates misinformation: by mapping perception onto the attack lifecycle, we can identify where—and in whom—to interrupt it. As generative models continue to erase the artifacts that once betrayed synthetic text, the decisive line of defense shifts from detecting the machine to fortifying the mind.