How automated compromise mapping and manufactured evidence could turn ambiguity into coercion, and what institutions can do about it.
Public debate about AI and geopolitics has centered on the visible surface of the problem: fabricated videos, cloned voices, bot networks. These are real harms, but they mostly target publics, and publics have always been easy to confuse. A more consequential question is whether the same tools can be aimed at the institutions that decide things: courts, arbitration panels, sanctions authorities, regulators, parliamentary committees, and newsrooms.
I argue that two capabilities, usually discussed separately, are converging. The first is the automated mapping of where a person or institution is vulnerable. The second is the generative production of documents, audio, and data that make a vulnerability look like proof of wrongdoing. I call the combination Synthetic Leverage Architectures. Its core mechanism is anchored forgery: a fabricated artifact built on a real and innocuous anomaly, so that the target faces not an invention from nothing but an ambiguity dressed up as a documented fact.
This is a threat-model essay, not a report on a fielded system. The public record shows the component technologies and the incentives. It does not show a mature, integrated doctrine, and I do not claim that any particular state operates one. The claim is narrower: the economics of a very old tactic are changing, and institutions that depend on documents are the ones most exposed.
Forgery Is Old; the Economics Are New
Manufactured evidence is not a twenty-first-century invention. In the 1890s, a French army officer forged a document to reinforce the case against Alfred Dreyfus, and the fabrication helped keep a miscarriage of justice alive for years before it was exposed.¹ In 1924, the Zinoviev letter, a forged communication purporting to come from the Comintern, reached the British press days before a general election. Its authenticity remained contested for decades, although subsequent historical research concluded that it was a forgery.² In 2002 and 2003, forged documents alleging an Iraqi uranium purchase from Niger found their way into a major policy debate.³
These cases teach two lessons. Forgery works when it fits a narrative that its audience is already inclined to believe, and when it arrives at a moment of institutional pressure. It fails when it is crude and checkable: the Niger documents contained errors that international inspectors identified within weeks of examining them.
Labor has historically limited the tactic. A convincing forgery often required a skilled forger, an intelligence officer who understood the target, and an untraceable delivery channel. That kept bespoke kompromat expensive and generally limited its use to high-value targets. Generative AI can change three things at once: the cost and skill needed to produce format-accurate artifacts, the precision with which an operator can choose which ambiguity to exploit, and the volume that can be produced. The Niger forgeries failed on quality. A future campaign could be designed to fail less often.
The Architecture
The pipeline has four stages, and the concept lies in how they interact.
Ingestion. Systems cross-reference large, disparate datasets: corporate registries, procurement records, travel and logistics data, social graphs, commercially licensed broker data, leaked material, and open-source disclosures. Their legal status varies, which matters because it determines who can tolerate the exposure and how easily the activity can be attributed. The growing intelligence-community use of commercially available information demonstrates that this is not simply a theoretical data environment.⁴
Anomaly mapping. The system flags latent ambiguities: a gap in a corporate filing, an inconsistency in a travel record, an unexplained payment, a pattern of meetings that can be read more than one way. Almost all of these are innocent. They are useful because they provide a credible opening. The output is a map of compromise, a ranked list of decision-makers, journalists, regulators, and intermediaries, paired with the specific ambiguity that could be used against each. This is the first pillar, automated leverage mapping, and it moves statecraft from stealing secrets to surveying vulnerability.
Synthesis. The second pillar is the weaponization of synthetic evidence. Rather than spending months searching for proof of a worst case, an operator could generate the missing link: a document in a plausible institutional format, an audio clip, an altered record. The artifact does not need to be perfect. It needs to be plausible enough to survive the time and expertise that the receiving institution can spare. Because it attaches to something real, it may inherit a measure of credibility that a wholesale fabrication would lack. The effectiveness of this approach would depend on access to contextual information, examples of authentic records, and sufficient domain knowledge. It is not simply a matter of asking a general-purpose model to produce convincing evidence.
Delivery. The package is matched to a target and a moment: a pending arbitration, a sanctions review, a licensing decision, a parliamentary inquiry, a journalist’s deadline. It travels through deniable channels such as anonymous tips, cutouts, compromised accounts, or sympathetic outlets.
No single stage is new. What is new is the closed loop. Mapping tells the operator where an artifact would be most believable and most damaging, synthesis supplies the evidence, and delivery exploits the target’s institutional calendar. The architecture is a socio-technical pipeline, not a tool.
Two Threat Models, Not One
Analysis of this problem often blurs two distinct goals, and the defenses differ.
Coercion of a target. Here the operator does not need anyone to believe the artifact. The target, an official, executive, or editor, may know it is fake but fear that others will accept it, or fear the cost of disproving it. The artifact functions as a threat, and the payoff is private: a changed vote, a withdrawn story, a quiet concession. The defense is largely about the target’s options. Can they disclose early, and do they have somewhere to take the approach?
Deception of an institution. Here the artifact is meant to be accepted as real by a body that will act on it: to trigger a designation, taint a witness, shift a ruling, or launch a story. The payoff is public. The defense is about the institution’s evidentiary procedures.
The two can be combined, and a coercive approach can be backed by a credible threat to go public. But treating them as one produces muddled remedies. Provenance standards help against the second and do little for a lone official who receives a private threat.
Where Institutions Are Weak and Where They Are Strong
The phrase “institutional-grade evidence” can overstate the problem if it implies that all institutions are equally vulnerable. They are not.
Courts and arbitral tribunals have real defenses. They rely on custodians, disclosure obligations, witness examination, and rules of authentication. A memorandum from a regional bank with no custodial chain and no witness willing to sponsor it is weak evidence in an adversarial proceeding, and a party who offers it risks sanctions. The risk is not zero, since proceedings are slow and resources are uneven, but it is lower than commonly assumed.
Exposure rises as evidentiary thresholds fall and as time pressure grows. Journalism works under deadlines and competition. Sanctions designations, administrative reviews, and regulatory inquiries may rely on different evidentiary standards, including information that cannot be fully tested in the open. The applicable standards vary by jurisdiction and type of proceeding; no single evidentiary threshold is shared across these institutions. Public opinion has no standard. Intermediaries such as compliance teams, banks, and platforms make fast decisions on documentary records. A realistic threat model should rank forums by their evidentiary rigor, their tempo, and the cost of a wrong decision, and should focus defenses where the first two are weak and the third is high.
Why Now
Several developments make the architecture more plausible than it was a decade ago, though none demonstrates that it exists.
First, generative models are getting better at contextually specific outputs. The relevant advance is not general fluency but the ability to adapt to narrow conventions: the formatting of a particular institution’s correspondence, the style of a particular official, the metadata habits of a particular platform. Access to authentic examples and specialized contextual information could make such adaptation more convincing. The more closely an artifact follows those conventions, the harder it may be to distinguish from an authentic record under time pressure. This does not mean that current models can reliably reproduce every institutional format or evade forensic examination.
Second, the data environment is richer and more accessible. Brokers, open-source intelligence platforms, public registries, and leaked datasets have made large-scale cross-referencing increasingly practical. Government recognition of commercially available information as an important intelligence resource reflects the extent to which information about individuals and organizations can now be acquired outside traditional intelligence collection.⁴ The precise cost advantage of assembling a targeting package will vary, but the barriers to gathering and correlating information are lower than they once were.
Third, verification remains slow and expensive. Chains of custody, forensic analysis, document authentication, and independent corroboration can take weeks or months, particularly when records cross jurisdictions or involve multiple institutions. Producing a plausible artifact may take considerably less time. The defender can end up bearing the practical burden of proving something is false in a forum that may not allow time to do so. This asymmetry is the strategic opening, although it is not universal: some institutions can authenticate records quickly, and some fabricated material can be exposed almost immediately.
There are also visible precursors. Model developers and platform companies have published threat reports describing state-linked actors using AI tools for research, translation, coding, and content generation. OpenAI and Microsoft, for example, documented several state-affiliated actors using their services in support of malicious activities, while also noting that the capabilities provided were generally limited and incremental.⁵ Russia-linked operations have cloned the look of legitimate news sites to lend borrowed authority to false stories. The campaign commonly called Doppelganger is a documented example; the U.S. Department of Justice announced the seizure of 32 related internet domains in September 2024.⁶ In 2024, a multinational’s Hong Kong office, later identified as Arup, lost approximately HK$200 million (US$25.6 million) after an employee was deceived by a phishing message and a video conference involving synthetic representations of colleagues.⁷ The incident demonstrates that synthetic audiovisual impersonation can defeat a human verification step inside an organization, although the deception depended on several elements working together, not on the video technology alone.
None of this is the full pipeline described here. It shows that the parts are being exercised.
Consequences
The liar’s dividend. Robert Chesney and Danielle Citron identified the dynamic in their work on deepfakes: once convincing synthetic evidence is known to exist, authentic evidence can be dismissed as synthetic.⁸ This is the best-supported consequence, because it requires no successful forgery at all. The mere possibility of forgery gives wrongdoers a standing excuse, and it erodes the shared evidentiary baseline that diplomacy, journalism, and international law depend on.
Target paralysis. Disproving a well-constructed forgery can be expensive, and the target must spend legal, diplomatic, and reputational resources even if they ultimately prevail. In some cases, the operator may win simply by forcing that expenditure, or by making the target hesitate during a decision window.
Scalable coercion. Bespoke kompromat could become more readily mass-producible. An operator might prepare tailored packages for dozens of mid-level officials, regulators, or reporters in several countries at once, producing a swarm of local crises that strains the response capacity of any single institution. The feasibility of doing this convincingly at scale remains an open question. The targeting, contextual research, quality control, and delivery requirements would still impose costs.
Scalability cuts both ways, however. Mass production can produce implausible noise, and a high volume of weak artifacts invites skepticism and may expose the campaign through its own patterns. The architecture’s value to an attacker depends on quality control, precise targeting, and avoiding signatures that reveal a common origin. Those are hard constraints, and they are also places where defenders can act.
Limits and Counterarguments
Three caveats bound the argument.
First, capability is not deployment. I am describing a plausible extension of existing technologies and incentives, and I cannot point to a documented, fully integrated operation. Readers should treat the analysis as a model to be tested against evidence, not as a finding.
Second, high-quality contextual forgery still requires access, domain knowledge, tuning, and a way to deliver the product. Cost is falling in some areas, but not to zero. Delivery creates exposure, because every artifact has to travel through something, and the target’s response creates openings for counterintelligence.
Third, institutions adapt. Courts already apply authentication rules and are actively considering how existing evidentiary procedures should address AI-generated and potentially fabricated material. Newsrooms have also built verification operations in response to earlier waves of manipulated media.⁹ A skeptical, well-resourced institution is a harder target than the model assumes. The risk is concentrated in under-resourced institutions, fast-moving forums, and the long tail of mid-level decision-makers who lack security support.
An Agenda for Verification and Epistemic Security
Provenance infrastructure, with realistic expectations. Courts, governments, and newsrooms should adopt cryptographic capture, secure metadata, and chain-of-custody systems so authenticity can be established at the point of capture rather than reconstructed afterward. But provenance has limits. Standards such as the C2PA Content Credentials specification are broader than images, audio, and video; the current specification explicitly addresses PDF documents and describes an ambition to support common media types, including documents. The challenge is less that institutional records are categorically outside the standard than that adoption and implementation across office documents, spreadsheets, databases, and financial-record workflows remain uneven.ⁱ⁰ More fundamentally, provenance can establish information about a record’s origin and subsequent handling. It cannot establish that the information in the record is true. An authentic document can contain false information, and a forged document can enter a system that otherwise maintains excellent provenance. A missing provenance record is not evidence of forgery, and a system that treated it as such would hand the liar’s dividend to anyone who can afford secure capture. Provenance should raise confidence, never serve as a gate.
Corroboration and triage standards. Institutions should require independent corroboration before acting on documents of uncertain origin, especially anonymous deliveries timed to a pending decision. They need rapid-response verification capacity and a vocabulary that separates unverified from false, and they should explain their uncertainty openly rather than defaulting to either belief or dismissal.
Red-teaming evidentiary processes. Institutions should routinely ask how an adversary would build an artifact that survives their review, which anomalies in their own records could be exploited, and which delivery channels would reach them. The answers should drive procedural change before an incident forces it.
Playbooks for individual targets. Most defenses discussed in the literature address institutions. The people who actually receive the approach are individuals. They need clear guidance: report it early to counsel and to the relevant institutional or security authority, do not negotiate privately with the sender, preserve the delivery trail, and prepare for the possibility that the artifact will be released. Early disclosure and pre-emptive explanation, sometimes called prebunking, can substantially reduce the coercive value of the approach. They do not eliminate the risk, but they make secrecy and the threat of exposure less useful to the attacker.
Attribution and deterrence. Attribution is difficult but not impossible, and it matters. Governments and platforms that share indicators of coordinated artifact campaigns, and that are willing to name sponsors when the evidence supports doing so, raise the cost of a tactic whose appeal rests on deniability.
Scrutiny of the data supply chain. Automated mapping depends on commercially available data. Policymakers should examine broker practices, not because analytics is inherently illegitimate but because commercial data combined with generative tools opens new routes to coercion. This is a long-term lever with real trade-offs, and it should be pursued alongside the others and not in place of them.
Conclusion
The core danger is the conversion of ambiguity into leverage. A small anomaly is found, a synthetic artifact supplies the missing link, and a deniable channel delivers it to a target or institution that has little time to respond. Even if such campaigns remain rare or clumsy, their possibility corrodes trust in genuine evidence.
The response should not be to distrust all documents. It should be to build institutions that treat authenticity as a process rather than a property: that verify how a record came to exist, triage evidence under time pressure, tell the unverified from the false, and protect the individuals most likely to be approached. The tactic is old. The window to prepare for its cheaper, faster, and more targeted version is open now, and it will not stay open once the cost of verification has outrun the institutions that depend on it.
Notes
¹ In 1896, Major Hubert-Joseph Henry of the French army’s Statistics Section, its counter-intelligence office, fabricated a document to bolster the case against Alfred Dreyfus. He confessed in August 1898 and died by suicide the next day. Separately, the 1894 court-martial was shown a secret dossier that the defense never saw. See Michael Burns, France and the Dreyfus Affair: A Documentary History (Bedford/St. Martin’s, 1999), and Britannica, “Dreyfus affair”.
² The Daily Mail published the letter on 25 October 1924, four days before the general election. A 1999 Foreign Office historical review by Gill Bennett concluded it was a forgery; the forger’s identity remains uncertain. See Gill Bennett, A Most Extraordinary and Mysterious Business: The Zinoviev Letter of 1924 (Foreign and Commonwealth Office, 1999), and The Zinoviev Letter: The Conspiracy That Never Dies (Oxford University Press, 2018). The University of Warwick’s Zinoviev Letter archive also provides contemporary documents and correspondence.
³ The International Atomic Energy Agency concluded that the documents were not authentic. Director General Mohamed ElBaradei told the UN Security Council so on 7 March 2003, citing inconsistencies in the documents’ names, dates, and signatures. See ElBaradei, “The Status of Nuclear Inspections in Iraq: An Update” (statement to the Security Council, 7 March 2003), and the Arms Control Association’s chronology of the Iraq–Niger uranium claim.
⁴ See the U.S. Intelligence Community, Commercially Available Information, including its 2024 policy framework and September 2026 report. The framework defines commercially available information and describes its use by intelligence agencies, while acknowledging the privacy and civil-liberties risks associated with it.
⁵ See OpenAI, “Disrupting Malicious Uses of AI by State-Affiliated Threat Actors” (14 February 2024), produced in collaboration with Microsoft Threat Intelligence; and Microsoft’s Digital Defense Report 2024, particularly its discussion of nation-state threat actors using AI in influence operations. Both reports describe actual activity while qualifying the extent of the capabilities gained.
⁶ The U.S. Department of Justice, “Justice Department Disrupts Covert Russian Government-Sponsored Foreign Malign Influence Operation Targeting Audiences in the United States and Elsewhere” (September 4, 2024), documents the seizure of 32 domains associated with the Russian government-directed Doppelganger operation. See also EU DisinfoLab, “Doppelganger – Media clones serving Russian propaganda” (September 27, 2022), the original investigation that named and documented the campaign.
⁷ Hong Kong police reported the fraud in February 2024. Arup subsequently confirmed that it was the company involved. Police described an initial phishing message followed by a video conference involving synthetic representations of company personnel. See the South China Morning Post, “UK multinational Arup confirmed as victim of HK$200 million deepfake scam” (17 May 2024).
⁸ Robert Chesney and Danielle Citron, “Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security”, California Law Review 107 (2019): 1753–1820.
⁹ On courts, see the U.S. Judicial Conference’s Advisory Committee on Evidence Rules, October 15, 2026 meeting agenda and materials. The agenda book lists TAB II: Deepfakes and the Federal Rules on Authenticity and TAB III: Artificial Intelligence and Proposed Rule 707. The Committee has prepared, but not finally approved, a new Rule 901(c) that would require the opponent to provide evidence sufficient to support a finding that a challenged item was a deepfake; if that happens, the proponent would then have to show that the item is more likely than not authentic. It also withdrew the original proposed Rule 707 on machine-generated evidence following public comment — a proposal approved for public comment at the Spring 2025 meeting that received more than 70 comments — and sent a modified proposal for further study. On newsrooms, see the BBC‘s BBC Verify — also available internationally at BBC.com — its dedicated verification operation introduced in 2023.
¹⁰ Coalition for Content Provenance and Authenticity, C2PA Content Credentials Technical Specification, version 2.5. The specification describes cryptographically verifiable provenance assertions, includes provisions for PDF files, and identifies support for common media types, including documents, as a design goal. It establishes provenance and tamper-evidence under its trust model, not the truth of the underlying content.