Cognitive warfare: what DARPA’s SocialSim programme can (and cannot) simulate

What is cognitive warfare in the age of social media?

Digital influence is often understood through easily isolatable elements, such as an account, a coordinated campaign, a viral video, a strategic framing or a volume of engagement. This approach captures the actors and the flows, but fails to fully capture the continuity of the symbolic forms that organise reception.

However, to fully grasp the scale of the phenomenon of digital influence, it is necessary to identify the interpretative architecture within which these digital objects become legible. This shift explains the renewed interest in the concepts of narrative, framing, seriality, architext and interpretative community. They shed light on several properties that circulation metrics alone fail to capture adequately: the persistence of motifs, the immediate recognition of a structure, the reactivation of old content, the affective coherence of statements that are nonetheless contradictory, or the stabilisation of certain regimes of plausibility. Digital spaces appear less as mere dissemination infrastructures than as semiotic environments. They select, prioritise and reactivate available forms for audiences that are already socially and culturally situated.

Thus, cognitive warfare in the age of social media does not consist solely of disseminating false content or manipulating public opinion on an ad hoc basis. More broadly, it refers to the whole range of actions that seek to influence the way in which individuals, groups or organisations perceive a situation, prioritise the available information and transform that information into decisions.

This note is the second part of a two-part series on digital influence. The first part, entitled ‘The Battle of Narratives’, focused on the broader issues surrounding digital influence. This second note aims to extend our analysis through a case study of DARPA and its SocialSim programme.

SocialSim: what DARPA actually set out to simulate

DARPA (Defence Advanced Research Projects Agency¹ ), the advanced research agency of the US Department of Defence, funds exploratory programmes designed to overcome scientific or technical barriers. As part of its work, the agency completed SocialSim (Social Simulation for Evaluating Online Messaging Campaigns² ) in 2021, with the aim of creating computer simulation tools capable of modelling the spread and evolution of information on social media. This programme addressed a specific question: is it possible to replicate and predict the behaviour of very large populations on digital platforms without reducing all users to the same behaviour? It should be noted that its objective focused on the spread and evolution of information online, not on the complete reconstruction of a society, human consciousness or a chain of command.

Simulating the circulation of information: cascades, volumes, virality

The term ‘simulation’ here refers to an executable model, that is to say, a set of entities, states and rules that the computer causes to evolve. In a multi-agent model, the entities are agents equipped with local rules: to post, reply, share, remain inactive or react to an external event. The collective phenomenon results from their interactions. A ‘cascade’ is the tree formed by an initial post and the shares, replies or contributions that stem from it. Its size reflects the number of events; its depth measures the length of the chains; its width indicates how many branches appear at the same level; its duration tracks its development over time. These properties describe a flow. They do not convey the meaning that people attribute to the content.

A simulation necessarily involves selection. This implies that it is not a scaled-down copy of reality, but a construct that selects certain entities, certain states, certain relationships and certain rules of transformation. Anything that does not fit this definition simply remains outside the scope of the experiment. Computing power then enable to explore the consequences of the chosen hypotheses on a large scale; it does not, in itself, alter their scientific status.

Take, for example, a post shared a thousand times. The record is straightforward: a thousand sharing events have been logged. But these shares may express agreement, outrage, mockery, verification, a desire to raise the alarm, the work of a bot, or a coordinated response from an institution. The same visible action encompasses contradictory meanings. A cascade describes how content circulates; it does not automatically reveal what participants have understood from it or what they will do next.

Where the simulation ends: from visible action to human interpretation

A simulation such as SocialSim can effectively model how content is published, shared, commented on, reposted or incorporated into a chain of sharing. It can also measure the speed of dissemination, the depth of a chain of sharing, the size of a network or the temporal proximity to an external event. But these operations primarily describe observable traces. They indicate that an action has taken place; they do not yet reveal what that action means to the person who carried it out, nor what changes it brings about within an organisation.

Thus, a share does not necessarily imply endorsement. Between the recorded trace and the organisational decision, six layers must be distinguished: the existence of a signal, its circulation, its reception, its interpretation, its transformation into decision-making communication, and finally its incorporation into a chain of decisions.

SocialSim is effective at representing the first layers (traces, circulation, and sometimes technical reception), but the subsequent layers require additional evidence such as minutes, deliberations or internal records of decision-making. In other words, SocialSim illustrates very well how a signal circulates, but it does not demonstrate how that signal is understood, taken up, transformed and converted into a decision.

What the scientific audit verified

SocialSim is not a single piece of software. Several teams have developed different models and tools as part of the programme. Our audit focuses on the four public repositories associated with Deep Agent, a project at the University of Central Florida. For the sake of clarity, we note that a repository is a version-controlled archive of code: it stores the files, their history and, where available, the instructions needed to reproduce an experiment. The four repositories examined (MACM, RHPC_SMPLE, GDELT_GA_SEARCH and socialsim_package) cover four complementary al functions: generating actions, modelling platform-specific rules, searching for external events and comparing simulations with observed data.

The four repositories draw on three technical domains. MACM uses Python, a common language in data science, and CUDA, an NVIDIA technology that performs calculations on a graphics card. RHPC_SMPLE is based on C++, MPI – a standard enabling multiple computers or processors to communicate during a calculation – and Repast HPC, a distributed multi-agent simulation framework. GDELT_GA_SEARCH is written in Java. SocialSim_package uses Python and libraries such as NumPy and Pandas to manipulate data tables. These details are important because a model may remain scientifically interesting even when its historical context has become difficult to reconstruct.

The overall result highlights four complementary achievements: SocialSim represents heterogeneous actions, simulates on a large scale, integrates multiple sources of dynamics and compares its outputs with future data. The publicly available artefacts examined were designed for this purpose. Extending them to capture the coherence of an organisation would require another level of representation, which was not the focus of the programme.

MACM offers the most fruitful idea: a visible action can be produced by network pressure, an external shock or spontaneous activity. This decomposition avoids automatically attributing all activity to propagation. Its public implementation reflects an outdated research environment: partial dependencies, a minimal scenario reliant on external data, direct selection of a CUDA device, Pandas operations that have become obsolete, and the interpretation of certain text inputs by `eval`, a function that executes text as code. The inspection also identified several paths warranting isolated verification: a shock variable apparently confused with that of endogenous influence, an empty loop with default values, and a possible out-of-bounds access during memory mixing. These observations do not call into question the published scientific results; they delineate what can be re-executed directly from the public repository. The breakdown between network, shock and internal activity remains clearly identifiable and constitutes a key contribution.

RHPC_SMPLE provides the most comprehensive description of platforms as distinct environments. It separates users, content, actions, selection strategies and visibility flows. This distinction is crucial: posting on Twitter, replying on Reddit, editing on GitHub or commenting on YouTube does not create the same trace or the same temporality. The C++ engine is based on a distributed computing stack combining MPI, Repast HPC, NetCDF and Boost. Its build image is based on Ubuntu 16.04 and its public documentation leaves certain sections open; reconstruction therefore requires recreating a specific historical environment. A few rules regarding selection and memory management also require isolated testing. The conceptual contribution remains clear: the platform is not merely a graph, but an environment that shapes what actors see and are able to do.

GDELT_GA_SEARCH provides an essential methodological reminder: a surge in activity may be linked to an external event rather than to internal contagion. The repository uses a genetic algorithm to search for GDELT queries whose time series correlate with social activity. As with any exploration of a large number of queries, this method carries a risk of overfitting: the pattern that best fits the past is not necessarily the one that will persist in the future. The use of a random generator without a controlled seed, absolute local paths and certain peculiarities of temporal processing make exact replication more challenging. The repository firmly establishes the relevance of an exogenous context; causal attribution is the subject of a complementary protocol.

Socialsim_package is the component most directly reusable for scientific purposes. It calculates the size, depth, breadth, duration and virality of cascades, as well as activity concentration, network components, modularity – the degree to which a network divides into subgroups –, persistent groups, bursts and various metrics comparing simulation and reality. Its original Python environment requires some adaptations to accommodate recent versions of the libraries. The aim of the audit is therefore to verify that the modern port retains the original definitions exactly.

We therefore wrote an independent core limited to five basic metrics: size, depth, maximum width, duration and structural virality. Structural virality does not measure the popularity of content; it describes the pattern of its propagation by calculating the average distance between the nodes in a cascade. Before any interpretation, we calculated the expected results for simple cases: an empty cascade, a single node, a chain of four nodes, a five-node star and a balanced binary tree with seven nodes. Five further tests verify the order of inputs and the rejection of invalid structures. All ten tests were successful. This result is deliberately limited in scope. It proves that five calculations are correct within a defined scope. It does not validate an agent’s psychology, the effect of a piece of information, or a decision-making architecture.

The deliberately narrow scope of this test makes it an intelligible proof. A historical implementation and an independent implementation can be compared on the same micro-cascades; any divergence can then be pinpointed. However, this result does not extend to MACM mechanisms, the states assigned to agents, or the effects of an external shock. It verifies a family of calculations, not a theory of behaviour. This distinction between local analytical proof and general validity constitutes one of the most significant findings of the audit.

The limitations observed can thus be divided into three categories. The first concerns the immediate reproducibility of public repositories: legacy dependencies, inconsistent documentation, historical environments and partial test coverage. The second concerns the scope of the verification: the ten independent tests consolidate five cascade metrics, not the full range of behavioural mechanisms. The third relates to the scope of inference: traces and correlations provide a powerful description of digital activity, but do not, on their own, establish human interpretation, the causality of an intervention or collective decision-making. These limitations are real, but they do not constitute a case against SocialSim. The first limitation stems largely from the nature of archived research code; the other two relate to standard rules of evidence and the very scope of the programme. SocialSim remains a leading contribution to the modelling of observable events and their circulation, with a rare ambition for large-scale comparison. Its specifications, metrics, causal distinctions and reference cases retain lasting significance.

Measuring an ‘effect’: why a decline in volume does not prove influence

The central difficulty lies in the fact that an effect is never measured solely by observing a change following an action. Simply stating that a communication was published, followed by a decrease in the volume of messages, is not sufficient to establish that this communication caused the decrease. The momentum may already have been waning; another event may have diverted attention; the platform may have altered the visibility of the content; or the most active users may have moved to another space. Chronological sequence is therefore not sufficient to demonstrate causality.

To speak of an effect, one must have a counterfactual – that is, a credible estimate of what would have happened in the absence of the action under study. The question is not merely: ‘What happened after the message?’, but: ‘What would have happened without this message, or with a different message?’. Without this comparison, the observed decline remains ambiguous. It may reflect a genuine influence, but it may also be due to a natural trend, attention fatigue, a shift in current affairs, or a reorganisation of interactions.

Randomised trials provide the most robust evidence, as they allow for a controlled comparison between exposed and unexposed groups. However, in real-world situations (political crises, military operations, public communications, online controversies), such a design is often impossible or contrary to ethical and operational constraints. We must therefore construct more cautious comparisons: similar periods, comparable groups, offset time windows, simulated scenarios, synthetic controls or sensitivity tests. These methods do not perfectly recreate the world without intervention, but they reduce the risk of confusing simple temporal evolution with a causal effect.

In the case of SocialSim, this means that the programme can help to formulate scenarios and compare circulation trajectories, but that it is not, on its own, sufficient to prove the influence of an organisational intervention. It can show that a volume decreases, that a cascade shortens, that a network fragments, or that content circulates more slowly. However, to conclude that this change is the result of a specific action, an additional causal protocol is required: a precise definition of the intervention, identification of the exposed population, comparison with an alternative trajectory, and consideration of external factors. In other words, a decrease in volume is an indication, not proof.

What this means for decision-makers: intelligence, crisis management, strategic communication

SocialSim provides a clearer picture of how a signal circulates. However, it must not be used as a tool for automatically drawing conclusions about intent, endorsement or strategic impact. For decision-makers, its value therefore lies not in replacing human judgement, but in helping to identify what is circulating, through which channels, at what speed, via which intermediaries and in what forms of cascade. It is then up to human analysis to determine what these circulations mean, how they are interpreted and whether they alter a decision-making process.

The note is availble below

---

1. Home | DARPA. (2026). darpa.mil. https://www.darpa.mil/ ↩︎
2. Computational Simulation of Online Social Behaviour. (2026). https://www.darpa.mil/research/programs/computational-simulation-of-online-social-behavior ↩︎