Cognitive warfare: what DARPA’s SocialSim programme can (and cannot) simulate

What is cognitive warfare in the age of social media?

Digital influence is often understood through easily isolatable elements, such as an account, a coordinated campaign, a viral video, a strategic framing or a volume of engagement. This approach captures the actors and the flows, but fails to fully capture the continuity of the symbolic forms that organise reception.

However, to fully grasp the scale of the phenomenon of digital influence, it is necessary to identify the interpretative architecture within which these digital objects become legible. This shift explains the renewed interest in the concepts of narrative, framing, seriality, architext and interpretative community. They shed light on several properties that circulation metrics alone fail to capture adequately: the persistence of motifs, the immediate recognition of a structure, the reactivation of old content, the affective coherence of statements that are nonetheless contradictory, or the stabilisation of certain regimes of plausibility. Digital spaces appear less as mere dissemination infrastructures than as semiotic environments. They select, prioritise and reactivate available forms for audiences that are already socially and culturally situated.

Thus, cognitive warfare in the age of social media does not consist solely of disseminating false content or manipulating public opinion on an ad hoc basis. More broadly, it refers to the whole range of actions that seek to influence the way in which individuals, groups or organisations perceive a situation, prioritise the available information and transform that information into decisions.

This note is the second part of a two-part series on digital influence. The first part, entitled ‘The Battle of Narratives’, focused on the broader issues surrounding digital influence. This second note aims to extend our analysis through a case study of DARPA and its SocialSim programme.

SocialSim: what DARPA actually set out to simulate

DARPA (Defence Advanced Research Projects Agency¹), the advanced research agency of the US Department of Defence, funds exploratory programmes designed to overcome scientific or technical barriers. As part of its work, the agency completed SocialSim (Social Simulation for Evaluating Online Messaging Campaigns²) in 2021, with the aim of creating computer simulation tools capable of modelling the spread and evolution of information on social media. This programme addressed a specific question: is it possible to replicate and predict the behaviour of very large populations on digital platforms without reducing all users to the same behaviour? It should be noted that its objective focused on the spread and evolution of information online, not on the complete reconstruction of a society, human consciousness or a chain of command.

Simulating the circulation of information: cascades, volumes, virality

The term ‘simulation’ here refers to an executable model, that is, a set of entities, states, and rules that the computer evolves. In a multi-agent model, the entities are agents equipped with local rules, including publishing, responding, sharing, remaining inactive, or reacting to an external event. Thus, the collective phenomenon resulting from their interactions becomes a “cascade,” that is, the tree formed by an initial publication and the shares, responses, or contributions that follow from it. Its size counts the number of events, its depth measures the length of the chains, its width shows how many branches appear at the same level, and its duration tracks its development over time. All these properties describe a circulation that does not convey the meaning that people attribute to the content.

A simulation necessarily proceeds by selection, so it’s not a scaled-down copy of reality, but a construction that picks certain entities, certain states, certain relationships, and certain transformation rules. What doesn’t fit into this definition simply stays outside the scope of the experiment. Computing power then allows exploring the consequences of the adopted assumptions on a large scale, but it doesn’t, by itself, change their scientific status.

Take, for example, a post shared a thousand times. The record is straightforward: a thousand sharing events have been logged. But these shares may express agreement, outrage, mockery, verification, a desire to raise the alarm, the work of a bot, or a coordinated response from an institution. The same visible action encompasses contradictory meanings. A cascade describes how content circulates; it does not automatically reveal what participants have understood from it or what they will do next.

Where the simulation ends: from visible action to human interpretation

A simulation like SocialSim can very well model the fact that content is published, shared, commented on, reposted, or integrated into a cascade. It can also measure the speed of spread, the depth of a transfer, the size of a network, or the time proximity of an external event. However, these operations first describe observable traces that show an action has taken place, yet they do not explain what that action means for the person who did it or what it changes within an organization.

Thus, a share does not necessarily imply endorsement. Between the recorded trace and the organisational decision, six layers must be distinguished: the existence of a signal, its circulation, its reception, its interpretation, its transformation into decision-making communication, and finally its incorporation into a chain of decisions.

SocialSim is effective at representing the first layers (traces, circulation, and sometimes technical reception), but the subsequent layers require additional evidence such as minutes, deliberations or internal records of decision-making. In other words, SocialSim illustrates very well how a signal circulates, but it does not demonstrate how that signal is understood, taken up, transformed and converted into a decision.

What the scientific audit verified

SocialSim is not a single piece of software. Several teams have developed different models and tools as part of the programme. Our audit focuses on the four public repositories associated with Deep Agent, a project at the University of Central Florida. For the sake of clarity, we note that a repository is a version-controlled archive of code: it stores the files, their history and, where available, the instructions needed to reproduce an experiment. The four repositories examined (MACM, RHPC_SMPLE, GDELT_GA_SEARCH and socialsim_package) cover four complementary al functions: generating actions, modelling platform-specific rules, searching for external events and comparing simulations with observed data.

The four repositories draw on three technical domains. MACM uses Python, a common language in data science, and CUDA, an NVIDIA technology that performs calculations on a graphics card. RHPC_SMPLE is based on C++, MPI – a standard enabling multiple computers or processors to communicate during a calculation – and Repast HPC, a distributed multi-agent simulation framework. GDELT_GA_SEARCH is written in Java. SocialSim_package uses Python and libraries such as NumPy and Pandas to manipulate data tables. These details are important because a model may remain scientifically interesting even when its historical context has become difficult to reconstruct.

The overall result highlights four complementary achievements: SocialSim represents heterogeneous actions, simulates on a large scale, integrates multiple sources of dynamics and compares its outputs with future data. The publicly available artefacts examined were designed for this purpose. Extending them to capture the coherence of an organisation would require another level of representation, which was not the focus of the programme.

MACM offers the most fruitful idea: a visible action can be produced by network pressure, an external shock or spontaneous activity. This decomposition avoids automatically attributing all activity to propagation. Its public implementation reflects an outdated research environment: partial dependencies, a minimal scenario reliant on external data, direct selection of a CUDA device, Pandas operations that have become obsolete, and the interpretation of certain text inputs by `eval`, a function that executes text as code. The inspection also identified several paths warranting isolated verification: a shock variable apparently confused with that of endogenous influence, an empty loop with default values, and a possible out-of-bounds access during memory mixing. These observations do not call into question the published scientific results; they delineate what can be re-executed directly from the public repository. The breakdown between network, shock and internal activity remains clearly identifiable and constitutes a key contribution.

RHPC_SMPLE provides the most comprehensive description of platforms as distinct environments. It separates users, content, actions, selection strategies and visibility flows. This distinction is crucial: posting on Twitter, replying on Reddit, editing on GitHub or commenting on YouTube does not create the same trace or the same temporality. The C++ engine is based on a distributed computing stack combining MPI, Repast HPC, NetCDF and Boost. Its build image is based on Ubuntu 16.04 and its public documentation leaves certain sections open; reconstruction therefore requires recreating a specific historical environment. A few rules regarding selection and memory management also require isolated testing. The conceptual contribution remains clear: the platform is not merely a graph, but an environment that shapes what actors see and are able to do.

GDELT_GA_SEARCH provides an essential methodological reminder: a surge in activity may be linked to an external event rather than to internal contagion. The repository uses a genetic algorithm to search for GDELT queries whose time series correlate with social activity. As with any exploration of a large number of queries, this method carries a risk of overfitting: the pattern that best fits the past is not necessarily the one that will persist in the future. The use of a random generator without a controlled seed, absolute local paths and certain peculiarities of temporal processing make exact replication more challenging. The repository firmly establishes the relevance of an exogenous context; causal attribution is the subject of a complementary protocol.

Socialsim_package is the component most directly reusable for scientific purposes. It calculates the size, depth, breadth, duration and virality of cascades, as well as activity concentration, network components, modularity – the degree to which a network divides into subgroups –, persistent groups, bursts and various metrics comparing simulation and reality. Its original Python environment requires some adaptations to accommodate recent versions of the libraries. The aim of the audit is therefore to verify that the modern port retains the original definitions exactly.

We therefore wrote an independent core limited to five basic metrics: size, depth, maximum width, duration and structural virality. Structural virality describes how it spreads, by calculating the average distance between the nodes of a cascade. Before any interpretation, we calculated the expected results for simple cases: empty cascade, single node, chain of four nodes, star of five nodes, and balanced binary tree with seven nodes. Five additional tests check the order of inputs and the rejection of invalid structures, and all ten tests were successful. This result is intentionally limited, showing that five calculations are correct within a certain scope. However, it does not validate either an agent’s psychology, the effect of information, or a decision-making architecture.

The deliberately narrow scope of this test makes it an intelligible proof. The historical implementation and the independent implementation can be compared on the same micro-cascade, making divergence localizable. This result does not extend to MACM mechanisms, states assigned to agents, or the effects of an external shock, as it verifies a family of calculations rather than a theory of behavior. It thus demonstrates that this separation between local analytical proof and general validity constitutes one of the most important findings of the audit.

The limitations observed can thus be divided into three categories. The first concerns the immediate reproducibility of public repositories: legacy dependencies, inconsistent documentation, historical environments and partial test coverage. The second concerns the scope of the verification: the ten independent tests consolidate five cascade metrics, not the full range of behavioural mechanisms. The third relates to the scope of inference: traces and correlations provide a powerful description of digital activity, but do not, on their own, establish human interpretation, the causality of an intervention or collective decision-making. These limitations are real, but they do not constitute a case against SocialSim. The first is largely due to the nature of an archived research code, while the other two depend on the standard rules of the test and the domain of the program itself. SocialSim remains a leading contribution to the modelling of observable events and their circulation, with a rare ambition for large-scale comparison. Its specifications, metrics, causal distinctions and reference cases retain lasting significance.

Measuring an ‘effect’: why a decline in volume does not prove influence

The main challenge is that an effect can never be quantified by looking at a change that occurs after an action. It is insufficient to prove that a communication was the cause of a decline in message volume just because it was published. The platform may have changed the content’s visibility, the momentum may already have been declining, another event may have diverted attention, or the most engaged users may have relocated. Therefore, chronological sequence is insufficient to prove causation.

To speak of an effect, one must have a counterfactual – that is, a credible estimate of what would have happened in the absence of the action under study. The question is not merely: ‘What happened after the message?’, but: ‘What would have happened without this message, or with a different message?’. Without this comparison, the observed decline remains ambiguous. It may reflect a genuine influence, but it may also be due to a natural trend, attention fatigue, a shift in current affairs, or a reorganisation of interactions.

Randomised trials provide the most robust evidence, as they allow for a controlled comparison between exposed and unexposed groups. However, in real-world situations (political crises, military operations, public communications, online controversies), such a design is often impossible or contrary to ethical and operational constraints. We must therefore construct more cautious comparisons: similar periods, comparable groups, offset time windows, simulated scenarios, synthetic controls or sensitivity tests. These methods do not perfectly recreate the world without intervention, but they reduce the risk of confusing simple temporal evolution with a causal effect.

In the case of SocialSim, this means that the programme can help to formulate scenarios and compare circulation trajectories, but that it is not, on its own, sufficient to prove the influence of an organisational intervention. It can show that a volume decreases, that a cascade shortens, that a network fragments, or that content circulates more slowly. However, to conclude that this change is the result of a specific action, an additional causal protocol is required: a precise definition of the intervention, identification of the exposed population, comparison with an alternative trajectory, and consideration of external factors. In other words, a decrease in volume is an indication, not proof.

What this means for decision-makers: intelligence, crisis management, strategic communication

SocialSim provides a clearer picture of how a signal circulates. However, it must not be used as a tool for automatically drawing conclusions about intent, endorsement or strategic impact. For decision-makers, its value therefore lies not in replacing human judgement, but in helping to identify what is circulating, through which channels, at what speed, via which intermediaries and in what forms of cascade. It is then up to human analysis to determine what these circulations mean, how they are interpreted and whether they alter a decision-making process.

The note is availble below

---

1. Home | DARPA. (2026). darpa.mil. https://www.darpa.mil/ ↩︎
2. Computational Simulation of Online Social Behaviour. (2026). https://www.darpa.mil/research/programs/computational-simulation-of-online-social-behavior ↩︎