# Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure

DevFeed: [Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure](<https://devfeed.tech/articles/social-humint-an-llm-augmented-unified-framework-for-measuring-social-media-exposure-96612.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2610.31573>)

Author: Pellegrino Casoria, Simon Pietro Romano

Published: 2026-10-23T04:00:00Z

Content type: article

Language: en

Sources: [arXiv: Artificial Intelligence](<https://devfeed.tech/sources/arxiv-artificial-intelligence.md>), [arXiv: Cryptography and Security](<https://devfeed.tech/sources/arxiv-cryptography-and-security.md>)

Topics: [ai security](<https://devfeed.tech/topics/ai-security.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [LLM security](<https://devfeed.tech/topics/llm-security.md>)

Tags: [adversary](<https://devfeed.tech/tags/adversary.md>), [agent](<https://devfeed.tech/tags/agent.md>), [analysts](<https://devfeed.tech/tags/analysts.md>), [api](<https://devfeed.tech/tags/api.md>), [assessment](<https://devfeed.tech/tags/assessment.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [automated](<https://devfeed.tech/tags/automated.md>), [capabilities](<https://devfeed.tech/tags/capabilities.md>), [cs-ai](<https://devfeed.tech/tags/cs-ai.md>), [cs-cr](<https://devfeed.tech/tags/cs-cr.md>), [cs-si](<https://devfeed.tech/tags/cs-si.md>), [cyber](<https://devfeed.tech/tags/cyber.md>), [cyber-threat-intelligence](<https://devfeed.tech/tags/cyber-threat-intelligence.md>), [engagement](<https://devfeed.tech/tags/engagement.md>), [experts](<https://devfeed.tech/tags/experts.md>), [framework](<https://devfeed.tech/tags/framework.md>), [gauge](<https://devfeed.tech/tags/gauge.md>), [inference](<https://devfeed.tech/tags/inference.md>), [intelligence](<https://devfeed.tech/tags/intelligence.md>), [llm](<https://devfeed.tech/tags/llm.md>), [measuring](<https://devfeed.tech/tags/measuring.md>), [social](<https://devfeed.tech/tags/social.md>), [social-media](<https://devfeed.tech/tags/social-media.md>)

## AI overview

Social-HUMINT measures social-media exposure by connecting how accurately a person can be profiled with how well that profile supports personalized social-engineering engagement. It unifies SOCMINT and Cyber-HUMINT in a taxonomy of 38 capabilities across the Cyber Threat Intelligence lifecycle, validated by domain experts (Fleiss' κ = 0.92). Its LLM-augmented multi-agent pipeline extracts information, infers undisclosed attributes, and indirectly assesses susceptibility by predicting participants' rankings of personalized engagement options. On real participants' public data, extraction reached F1 97.3%, and inferred attributes scored 4.73/5, both reported as far above rule-based and NER baselines at negligible cost. The authors frame it as support for security analysts, enabling defenders to assess exposure; the abstract does not describe direct testing of successful attacks.

## Source excerpt

arXiv:2610.31573v1 Announce Type: new Abstract: In the post-API landscape, social-media profiling has become inexpensive and automated: Large Language Models (LLMs) can extract structured information from unstructured content and deduce attributes users never disclosed. A person's true exposure is not what they post but what can be inferred from it. As these practices become routine, exposure to social engineering attacks becomes an operational certainty, demanding a shared framework for assessment and mitigation. We make this exposure measurable by quantifying how accurately a target can be profiled, and how far that profile enables social engineering attacks. Because no existing model fully spans this continuum, we unify Social Media Intelligence (SOCMINT) and Cyber Human Intelligence (Cyber-HUMINT), two individual-focused disciplines that evolved separately, into a single doctrine-grounded taxonomy of 38 capabilities across the Cyber Threat Intelligence lifecycle, where user profiling bridges passive collection and active engagement. Domain experts validated the taxonomy (Fleiss' $\kappa$ = 0.92). We operationalize its core path (extraction, inference, and susceptibility assessment) as an LLM-augmented multi-agent pipeline, evaluated on real participants' public data. Susceptibility is assessed indirectly: the pipeline predicts how each target would rank personalized engagement options, matching their actual choices significantly above chance. This ranking capacity captures the personalization on which tailored attacks depend. The underlying profiles are accurate: extraction reaches F1 = 97.3%, and inferred attributes score 4.73/5, both far above rule-based and NER-based baselines at negligible cost. The framework augments security analysts' tradecraft rather than replacing it and enables defenders to gauge their own exposure before an adversary does.