Home / Research / State Actors and LLM Narrative Control

State Actors and LLM Narrative Control: How Nations Are Shaping Generative AI Answers

Nation-states are attempting to influence what large language models say by seeding training data with high-volume propaganda, operating coordinated inauthentic content networks, and exploiting retrieval-augmented generation pipelines. Documented operations span multiple actors and represent a new dimension of information warfare with direct implications for brands, government agencies, and platform operators.

Editorial note: This paper treats all nation-state actors analytically and symmetrically. Claims are scoped strictly to documented, sourced operations. No partisan framing is intended or appropriate. The purpose of this analysis is to help brands, agencies, and communicators understand and defend against LLM narrative manipulation, regardless of its origin.

Author: Oliyad Deyasa, CTO & Co-Founder, LivingStoneSolution Technologies, Washington, D.C.  · Published: May 27, 2026  · Category: AI Security / Information Operations / GEO

Abstract

Generative AI answer engines are not neutral information synthesizers. They are shaped by the corpus they train on and the web they retrieve from — and both are subject to deliberate manipulation by state-affiliated actors. This paper documents the strategic rationale for state-actor LLM influence, catalogs operations documented by NewsGuard, Microsoft’s Threat Analysis Center (MTAC), EU DisinfoLab, the Bulletin of the Atomic Scientists, and the AI Incident Database; maps the technical attack vectors through the MITRE ATLAS adversarial AI framework; analyzes detection and attribution challenges including a methodological dispute between NewsGuard and Harvard Kennedy School researchers; and closes with defensive postures for non-state organizations operating in this environment.

1. The Strategic Surface: Why LLM Answers Matter to State Actors

Traditional information operations targeted mass media: newspapers, television, social media platforms. The objective was to place narratives into channels that large audiences consumed. This required either control of the channel (state broadcasting) or manipulation of its content-selection mechanisms (algorithmic amplification, coordinated sharing).

Generative AI introduces a qualitatively different surface. When a citizen asks ChatGPT about a geopolitical conflict, they receive a synthesized paragraph that the model has constructed from its training data and any retrieved context. There is no editorial team, no byline, no source attribution in the traditional sense. The citizen receives what reads as a neutral factual summary. If that summary reflects the framing, omissions, and narrative choices embedded in the training corpus, the influence is structural rather than incidental.

Stanford HAI research on AI propaganda susceptibility found that AI-generated content can shape public perception, with some research suggesting AI-generated propaganda may be more effective than human-written propaganda in certain experimental conditions. The combination of scale, low marginal cost, and the apparent neutrality of AI-synthesized answers creates a strategically attractive influence surface for any actor capable of shaping the training and retrieval corpus.

The key strategic insight is volume. An individual article or social media post competes for attention. Content that saturates a topic area across thousands of web domains shapes the statistical distribution of that topic in AI training data. As the Bulletin of the Atomic Scientists has documented, Russian-affiliated networks are specifically flooding the internet with propaganda with the documented aim of corrupting AI chatbot outputs.

2. Documented Operations

The following documented operations are presented analytically. The inclusion of an actor reflects the state of public documentation at the time of writing, not a judgment about relative culpability.

2.1 Russia: The Pravda Network and Corpus Saturation

The most extensively documented operation targeting AI training and retrieval corpora is the Pravda network, investigated and named by NewsGuard. According to NewsGuard’s special report, the network is a Moscow-based collection of websites aggregating pro-Kremlin content — a modern successor to earlier coordinated networks — that published an estimated 3.6 million articles in 2024 across a wide network of apparently independent web properties.

The strategic logic is corpus saturation: by publishing high volumes of content on specific topics across many domains, the network increases the statistical weight of its preferred framing in AI training data and web-retrieval indexes. When an AI model encounters a topic heavily represented by one type of content, its synthesized output tends to reflect that representation.

NewsGuard’s audit of 10 leading AI platforms found that those systems repeated false narratives from the Pravda network approximately 33 percent of the time when prompted on relevant topics. The AI Incident Database has classified this as a documented incident (#968) under the taxonomy of AI systems reproducing propaganda.

This finding is contested. Researchers at the Harvard Kennedy School Misinformation Review published an independent analysis arguing that LLM references to Kremlin disinformation reflect information gaps rather than active manipulation, finding false claim rates closer to approximately 5 percent under their methodology. The methodological dispute is unresolved in the literature. Both findings are cited here because the gap (5% to 33%) is large enough to affect threat-assessment conclusions, and practitioners should be aware that measurement methodology materially affects the claimed impact of these operations.

A related Russia-affiliated operation, documented by EU DisinfoLab as “Operation Overload” (first documented June 2024), specifically targeted fact-checkers, media outlets, and international audiences using AI tools to amplify Kremlin-aligned content.

2.2 China: AI-Augmented Election Influence

Microsoft’s Threat Analysis Center documented what it assessed as the first instance of a nation-state actor using AI-generated content to influence a foreign election. In Taiwan’s January 2024 presidential election, CCP-affiliated actors (tracked as Storm-1376) deployed AI-generated deepfake audio, synthetic news anchors, and AI-enhanced memes. One documented example involved fabricated audio attributed to a Taiwanese business figure endorsing a candidate — audio that person never recorded.

MTAC’s assessment at the time of the report noted “little evidence these efforts were successful in swaying opinion,” while projecting that continued AI-augmented content experimentation “may prove more effective down the line.” In the months preceding the 2024 U.S. election, MTAC documented Chinese actors using social media probes to test divisive domestic U.S. issues — a reconnaissance function rather than direct LLM manipulation, but one that informs content targeting.

2.3 Iran: AI-Assisted Influence During Elections

Microsoft MTAC documented Iranian actors using AI tools alongside fake news sites and cyber operations during the 2024 U.S. election cycle. Documented tactics included AI-generated content amplifying divisive social issues and targeted messaging designed to suppress voter turnout in specific communities. Iranian operations, as documented by MTAC, tend to layer AI-assisted content creation over traditional social engineering techniques rather than pursuing the high-volume corpus-saturation approach attributed to Russian networks.

3. Attack Vectors: Training-Data Manipulation, RAG Corpus Pollution, and Content Farms

The MITRE ATLAS framework (v5.1.0, November 2025) provides the most comprehensive publicly available taxonomy of adversarial ML techniques. Three attack vectors are most directly relevant to LLM narrative control:

3.1 Training-Data Poisoning

Training-data poisoning (cataloged in MITRE ATLAS under ML Attack Staging) is the deliberate introduction of adversarially crafted content into the corpus from which a model trains. For a large-scale language model trained on web data, this means publishing content on the open web at sufficient volume to shift the statistical distribution of a target topic. The Pravda network exemplifies this approach: 3.6 million articles on specific topics, distributed across many apparently independent domains, creates a web environment in which those topics are heavily weighted toward a particular framing.

Training-data poisoning is most effective when executed before training cutoff and when the target topic has low competing coverage from authoritative sources. Topics with sparse Wikipedia coverage, few peer-reviewed publications, and limited Tier-1 news coverage are disproportionately vulnerable because the adversarial content represents a larger share of the available training signal.

3.2 RAG Corpus Pollution

Retrieval-Augmented Generation (RAG) supplements model responses with content retrieved at inference time from a web index or document store. RAG corpus pollution targets this retrieval layer: if the web sources returned by the retrieval system for a given query are predominantly adversarial, the model’s synthesized answer will reflect that adversarial content even if the base model is not poisoned.

The key difference from training-data poisoning is recency: RAG retrieval draws from current web content, so corpus pollution can be executed and updated continuously rather than requiring access to the training pipeline. A content network that maintains active publication on target topics can sustain RAG corpus influence across model versions and training updates. This is a significant escalation from traditional influence operations because it does not require a one-time infiltration — it requires ongoing presence.

3.3 Content Farm SEO for LLM Crawlers

Content farms feeding LLM scrapers represent a third vector. AI pretraining datasets and RAG systems both rely on web crawlers that index publicly accessible content. Content farms — networks of domains publishing high volumes of SEO-optimized text — have long been a challenge for traditional search engines. They represent an even more tractable attack surface for LLM influence because the volume thresholds for shifting model behavior on a specific topic may be lower than those required to rank in competitive traditional search.

The Lawfare Media analysis of AI and data voids highlights that propaganda exploits information gaps: topics with low legitimate-source coverage are most vulnerable to corpus manipulation because the adversarial content meets no substantial competing signal.

4. Detection and Attribution Challenges

Detecting LLM narrative manipulation is methodologically difficult. Several challenges are specific to this domain:

4.1 The Measurement Problem

As the NewsGuard / Harvard Kennedy School dispute illustrates, the measured impact of LLM narrative manipulation depends heavily on methodology: which prompts are tested, how “false claim” is defined, which AI systems are included, and what threshold is used for classification. The 33 percent figure and the 5 percent figure for the same underlying phenomenon represent a 6x measurement gap. This gap matters for threat assessment: a 33 percent repetition rate implies a serious operational influence capability; a 5 percent rate may be within the baseline confabulation noise floor of current AI systems.

Practitioners should treat any single measurement of LLM narrative manipulation impact with significant uncertainty and seek methodology replication before drawing strategic conclusions.

4.2 The Attribution Problem

Attribution in LLM narrative manipulation is structurally harder than attribution in traditional cyber operations. A training-data poisoning campaign requires only publicly accessible content publication — there is no network intrusion, no malware signature, no command-and-control infrastructure to trace. Attribution relies on content analysis, entity linking, and the kind of network forensics that organizations like Graphika, the Stanford Internet Observatory, and EU DisinfoLab have developed for social media influence operations. These methods are transferable but not yet systematically applied to LLM-specific corpus manipulation.

4.3 The Data-Void Problem vs. Deliberate Manipulation

The Harvard Kennedy School researchers make an important distinction: LLM outputs that echo adversarial narratives may reflect genuine information voids — topics where authoritative English-language coverage is sparse — rather than successful deliberate manipulation. This distinction has operational implications. Closing an information void (by creating authoritative, well-cited content) addresses both the organic accuracy problem and the adversarial manipulation vulnerability simultaneously. Defensive GEO and authoritative content investment is thus a dual-use countermeasure.

5. Implications for Brands, Agencies, and Governments

The implications of state-actor LLM narrative influence extend well beyond the geopolitical topics that dominate documented operations. Any organization that operates in a domain that state actors have an interest in influencing — defense contractors, pharmaceutical companies, energy firms, financial institutions, government agencies, news organizations, academic institutions — is a potential indirect target.

A defense contractor whose AI representation is shaped by corpus-poisoned content about its contracts or technologies faces reputational and operational risks distinct from traditional reputation management. A government agency whose programs are described inaccurately in AI answers because adversarial content has shaped the retrieval corpus faces citizen-trust erosion that it did not cause and may not detect. An academic institution cited in AI answers alongside adversarially crafted research faces credibility risks from association.

The OECD AI Policy Observatory’s 2024 AI Principles update explicitly added AI-amplified misinformation as a governance concern to be addressed at the policy level. This elevates LLM narrative manipulation from an operational security problem to a governance and regulatory domain.

6. Defensive Postures

Defensive postures against LLM narrative manipulation operate at three levels: content, infrastructure, and monitoring.

6.1 Content-Level Defense: Close Data Voids

The single most effective defensive posture against both organic inaccuracy and adversarial manipulation is the creation and maintenance of authoritative, well-cited, machine-readable content on topics the organization is associated with. A Wikipedia article with accurate citations, a Wikidata entity with complete properties, a .gov or organizational website with server-rendered JSON-LD schema, and Tier-1 earned media coverage that corroborates key facts — these create a high-quality authoritative signal that competes directly with adversarially crafted content in AI training and retrieval.

The Harvard Kennedy School data-void framework supports this approach: if LLM references to adversarial content partly reflect information gaps rather than deliberate manipulation, then filling those gaps with authoritative content is a tractable and scalable defense.

6.2 Infrastructure-Level Defense: MITRE ATLAS Threat Modeling

Organizations deploying AI systems for external communications should maintain an ATLAS-mapped threat model for those systems, covering training-data poisoning, RAG corpus pollution, and inference-time manipulation as documented attack surfaces. NIST AI 600-1’s Information Integrity and Information Security risk categories provide the governance framework; MITRE ATLAS provides the technical taxonomy. Together, they constitute a baseline threat model for any AI system handling information about a target organization.

6.3 Monitoring-Level Defense: AI Visibility Auditing

Regular AI visibility auditing — systematically querying AI engines with prompts about the organization and scoring the responses for accuracy, source quality, and narrative framing — provides early detection of narrative drift, whether from organic data aging or adversarial manipulation. Monitoring should include: tracking which sources AI engines cite when describing the organization; flagging adversarially crafted sources to AI platform providers and established fact-checking organizations (NewsGuard, EU DisinfoLab, AIID); and maintaining a content-correction register for third-party misrepresentations.

Conclusion

State-actor LLM narrative control is a documented phenomenon, not a hypothetical future threat. Operations by multiple actors, documented by multiple independent research organizations, have established that the technique is being actively pursued: high-volume content publication designed to enter AI training and retrieval corpora, AI-generated synthetic media targeted at specific electoral events, and AI-assisted amplification of existing propaganda networks.

The precise effectiveness of these operations remains contested. The methodological gap between the NewsGuard 33 percent finding and the Harvard Kennedy School 5 percent finding is wide enough to support significantly different threat assessments. What is not contested is the strategic logic: AI answer engines are a high-value influence surface, and the marginal cost of attempting to shape them through corpus manipulation is low relative to the potential influence gain.

For non-state organizations, the appropriate response is neither alarm nor indifference but systematic action: maintain authoritative content, build the off-site authority graph, monitor AI representation, and apply NIST/MITRE frameworks to AI system deployment. These are the same disciplines that GEO practice recommends for commercial visibility — which suggests that defensive information hygiene and commercial AI optimization are, at their foundation, the same work.

Frequently Asked Questions

What is LLM narrative control and why do state actors pursue it?

LLM narrative control refers to the deliberate shaping of what large language models say about geopolitical events, government policies, national identities, and military conflicts. State actors pursue it because AI answer engines are becoming a primary information surface for global populations.

What is the Pravda network and how does it target AI systems?

The Pravda network is a Moscow-based collection of websites documented by NewsGuard that published an estimated 3.6 million articles in 2024 specifically designed to enter AI training and retrieval corpora. NewsGuard found AI chatbots repeated false narratives approximately 33 percent of the time when tested; an independent Harvard Kennedy School study found approximately 5 percent, reflecting a methodological dispute that remains unresolved.

What is training-data poisoning in the context of AI narrative control?

Training-data poisoning is the deliberate introduction of false or biased content into the corpus from which an AI model learns. The MITRE ATLAS framework (v5.1.0) catalogs it as a documented adversarial ML technique. For narrative control, a state actor publishing large volumes of content on specific topics can shift the statistical distribution of that topic in training data.

How do organizations defend against LLM narrative manipulation?

Three levels: content-level defense (create and maintain authoritative, well-cited content to close data voids); infrastructure-level defense (MITRE ATLAS threat modeling for deployed AI systems, NIST AI 600-1 compliance); and monitoring-level defense (regular AI visibility audits to detect narrative drift early).

Is LLM narrative control the same as disinformation?

No. LLM narrative control is broader: it includes disinformation (deliberate false claims), framing manipulation (true facts in systematically biased context), omission campaigns (ensuring certain narratives are absent from training data), and corpus saturation (flooding topic areas with a particular perspective without necessarily stating falsehoods).

← Back to Research

Apply AI visibility defense to your brand or agency — book a GEO strategy call.