Schroeder et al. define 'malicious AI swarms' by five graded dimensions and a four-level capability ladder distinguishing them from botnets and synthetic-persona networks

disinformationai-swarmsmulti-agent-systemsinfluence-operationscomputational-propagandaarxivcs-cy

Building on the functional account in Schroeder et al.'s 2026 Science paper (not independently read this session), this arXiv preprint offers an operational definition of a malicious AI swarm: a coordinated system of multiple AI-enabled agents that maintain partially persistent identities or roles, act on shared information, adapt to feedback, and collectively pursue an influence objective with some degree of operational autonomy. The definition specifies five constitutive dimensions — multiplicity, coordination, persistence, adaptation, and collective agency — treated as graded rather than binary.

The paper pairs this with a four-level capability ladder meant to distinguish "swarms" from older forms of automated influence: (1) AI-assisted content production, where human operators use generative models to vary political messages; (2) coordinated synthetic personas, where multiple differentiated accounts distribute aligned content but remain substantially human-directed; (3) adaptive multi-agent campaigning, where agents respond to engagement signals and coordinate with reduced human supervision; and (4) goal-revising malicious swarms, where agents also modify their own intermediate objectives and sustain a campaign through recursive feedback loops. Per the paper's own stance, the authors hold that fourth rung at arm's length: they treat goal-revising swarms as a speculative upper end of the capability spectrum rather than an observed configuration, and describe fully autonomous swarms as primarily experimental rather than widely documented in operational influence campaigns. The paper does not assign a rung to either of its two case studies.