IO Factory Replays AI Influence Operations with 100,000 Simulated Personas, but Cannot Estimate Real-World Persuasion Effects

Detecting coordinated influence operations requires more than classifying individual posts, because different accounts can use different tones while collectively advancing the same narrative over an extended period. [IO Factory](https://arxiv.org/abs/2608.10920) therefore shifts the unit of study to the complete campaign lifecycle: manager agents first generate phase-specific guidance; operator agents create content and interactions; a simulated platform determines visibility according to follow relationships and recommendation rules; and the system then creates an exposure receipt for every instance in which a civilian encounters content. This design echoes the [DISARM framework](https://github.com/DISARMFoundation/DISARMframeworks/), which describes information operations in terms of phases, tactics, and techniques, while adding an executable environment and item-level provenance records.

For each exposure, an LLM judge outputs relevance, stance, confidence, and persuasiveness. These outputs are combined with source trust, repeated-exposure decay, persona update weights, and issue direction, then passed to a deterministic formula that updates simulated beliefs. The main experiment used Gemma 4 31B and H200 nodes to produce 13 paired runs for each condition. Each run included 10,000 civilians, with the intervention group additionally receiving 1,000 operator agents. The baseline group retained the same population, platform, and update rules, removing only the influence operation. The directional increases for the three predefined objectives were 0.130, 0.132, and 0.336; all met the authors’ specified significance threshold in paired tests. A separate stress test scaled to 100,000 civilians and 10,000 operator agents, demonstrating that the architecture could complete a campaign timeline at that scale.

The technical value lies not in these figures themselves, but in the ability to trace every state change back to the operator, content, exposure path, judge output, and update rule. Security teams can therefore swap out recommendation mechanisms, models, or defenses and conduct paired red-team experiments without deploying harmful content on real platforms. However, the paper does not demonstrate that simulated personas are equivalent to real users, nor does it calibrate the LLM judges against human annotations. What it calls “influence” is merely a state change measured on the simulator’s scale. Next steps should include cross-model sensitivity analysis, a public reproducible implementation, and validation of the exposure and update assumptions using ethically approved real-world observational data.