Algorithmic Tradecraft: How AI and Machine Learning Are Reshaping the Intelligence Community
A technical treatment — with math, code, and citations.
For most of the post–Cold War era, the bottleneck in U.S. intelligence was not collection but triage. NGA has projected a potential tripling of GEOINT data over the next 5–10 years as government and commercial satellite constellations reach full operational capability. SIGINT faces the same wall — adversary waveforms, encrypted protocols, and ephemeral communications mutate faster than tasked analysts can characterize them.
Machine learning is the only realistic answer to that scale problem, and the U.S. intelligence community (IC) has spent roughly a decade operationalizing it. This article walks discipline by discipline through how — with the equations, architectures, and code that underpin each layer — and ends with where the math breaks.
Notation: signals are complex baseband s(t) = sᵢ(t) + j·s_q(t); vectors are bold lowercase x; matrices are bold uppercase W; learnable parameters carry a θ subscript where ambiguity matters.
1. GEOINT: Object Detection at the Scale of Conflict
Project Maven, the DoD’s “Algorithmic Warfare Cross-Functional Team” (2017), transferred GEOINT operational control to NGA in 2023. The training corpus included at least four million images of military objects labeled by humans, drawn from photographs, satellite imagery, geolocation data from communications intercepts, infrared sensors, and synthetic-aperture radar; in November 2025 NGA awarded a $708M IDIQ ceiling to Enabled Intelligence for further labeling.
1.1 The detection objective
Modern overhead-imagery detectors are descendants of the YOLO family. Given an input image I of shape H×W×3, the network divides it into an S×S grid; each cell predicts B bounding boxes and C class probabilities. Each box prediction is a 5-tuple (x, y, w, h, p_obj). The total loss has three components:
L_YOLO = λ_coord · L_loc + L_obj + λ_cls · L_cls
Localization loss penalizes box-position error, using square-root width/height so small-box deviation matters more than large-box deviation (a key choice for overhead imagery, where targets occupy tens of pixels):
S² B
L_loc = Σ Σ 1ᵢⱼ_obj · [ (xᵢ − x̂ᵢ)² + (yᵢ − ŷᵢ)²
i=0 j=0
+ (√wᵢ − √ŵᵢ)² + (√hᵢ − √ĥᵢ)² ]Objectness loss uses BCE on p_obj; classification uses softmax cross-entropy. Standard balancing constants are λ_coord = 5, λ_noobj = 0.5.
Boxes are pruned with Non-Maximum Suppression over Intersection-over-Union:
IoU(B₁, B₂) = |B₁ ∩ B₂| / |B₁ ∪ B₂|
1.2 Why overhead imagery breaks vanilla object detectors
Three properties of satellite imagery require algorithmic accommodation. None of these are theoretical:
- Small spatial extent. Targets typically occupy 10–50 pixels; ImageNet-pretrained features collapse them. Modern systems use FPN/BiFPN multi-scale fusion or Gaussian-Wasserstein-Distance loss to make the gradient sensitive to small-box position error.
- Rotational invariance. Aircraft, ships, and vehicles appear at arbitrary orientations. Detectors are either trained with rotation augmentation or output a fifth coordinate, θ, for the box angle.
- Tile size. A 16,000×16,000 SAR or commercial-EO tile cannot fit in a network’s input. Tiling with overlap and re-stitching detections via NMS-across-tiles is the standard production pattern.
A reference inference pipeline (PyTorch + ultralytics for brevity; the operational version uses domain-specific weights, sensor calibration, and a coordinate system tied to the imagery metadata):
import numpy as np, torch, rasterio
from ultralytics import YOLO
def tile(image, tile=1024, overlap=128):
h, w, _ = image.shape
stride = tile - overlap
for y in range(0, h - overlap, stride):
for x in range(0, w - overlap, stride):
yield x, y, image[y:y+tile, x:x+tile]
def nms_global(boxes, scores, iou_thresh=0.5):
# boxes: (N,4) in xyxy global coords
idxs = scores.argsort(descending=True)
keep = []
while len(idxs) > 0:
i = idxs[0]; keep.append(i.item())
if len(idxs) == 1: break
ious = box_iou(boxes[i:i+1], boxes[idxs[1:]])[0]
idxs = idxs[1:][ious < iou_thresh]
return keep
def detect_geoint(geotiff_path, weights="maven_like.pt", conf=0.25):
model = YOLO(weights)
with rasterio.open(geotiff_path) as src:
img = src.read().transpose(1, 2, 0)
transform = src.transform # pixel -> geographic CRS
all_boxes, all_scores, all_cls = [], [], []
for x0, y0, patch in tile(img):
r = model.predict(patch, conf=conf, verbose=False)[0]
if r.boxes is None: continue
b = r.boxes.xyxy.cpu().clone()
b[:, [0, 2]] += x0; b[:, [1, 3]] += y0 # back to global pixels
all_boxes.append(b)
all_scores.append(r.boxes.conf.cpu())
all_cls.append(r.boxes.cls.cpu())
boxes = torch.cat(all_boxes); scores = torch.cat(all_scores)
cls = torch.cat(all_cls)
keep = nms_global(boxes, scores)
out = []
for i in keep:
x1, y1, x2, y2 = boxes[i].tolist()
lon1, lat1 = transform * (x1, y1)
lon2, lat2 = transform * (x2, y2)
out.append(dict(cls=int(cls[i]), conf=float(scores[i]),
bbox_geo=(lon1, lat1, lon2, lat2)))
return outOperational outputs feed the Maven Smart System, which presents yellow-outlined boxes for potential targets and blue-outlined boxes for friendly forces or no-strike zones. NGA reports that Maven has cut targeting timelines from hours to minutes, with claimed throughput of up to 1,000 targeting recommendations per hour and approximately 1,000 targets processed in the first 24 hours of Operation Epic Fury against Iran in early 2026.
1.3 The continual-learning problem
The Ukraine theater forced a model-retraining lesson: NGA had not typically trained on destroyed equipment, but Ukraine made that signal operationally relevant, so models were retrained for those scenarios. This is a generic continual-learning failure mode: a model trained on theater D₁ degrades silently on theater D₂ when class priors shift. Two standard mitigations:
λ
L_EWC(θ) = L_task(θ) + ─── · Σᵢ Fᵢ · (θᵢ − θᵢ*)²
2where Fᵢ is the diagonal Fisher-information weight for parameter i from the previous theater (elastic-weight consolidation, Kirkpatrick et al., 2017), preserving the parameters that mattered for what the model already knew. The alternative is domain-adversarial training with a gradient-reversal layer on a domain classifier.
1.4 Multimodal foundation models in the loop
Project Maven’s CTO Sean Batir has noted he is integrating open-source LLMs and that the future is multimodal models taking text and imagery, with workflow experimentation already underway. Late in 2024, Palantir integrated Anthropic’s Claude into its AI Platform for military data processing; Claude 3 and 3.5 models running on Palantir AIP on AWS received DISA IL6 accreditation, and Anthropic announced “Claude Gov” for classified environments in June 2025. The operational pattern is RAG-style query over a strict ontology so the model can answer queries like “every revetment built within 5 km of these coordinates over the last 90 days, ranked by similarity to known SAM-site templates” without inventing objects. We return to RAG mechanics in §4.
2. SIGINT: Cognitive Radio and Deep Modulation Classification
The pre-AI SIGINT processing-exploitation-dissemination cycle required 12–18 person-hours to isolate a single Signal of Interest, classify it, and route it — functionally useless when hypersonic missiles cross theaters in minutes. The DoD and NSA inspectors general jointly announced an evaluation of NSA’s integration of AI into signals intelligence operations in 2021 to assess compliance with IC AI guidance.
2.1 The signal model
A received complex baseband signal under noise and channel impairment:
r(t) = h(t) * s(t; φ) · exp(j·(2π·Δf·t + θ₀)) + n(t)
where s(t; φ) is the transmitted waveform parameterized by modulation φ (BPSK, QPSK, 16-QAM, FM, etc.), h(t) is the multipath channel, Δf and θ₀ are carrier-frequency offset and phase, n(t) is AWGN, and * denotes convolution.
After sampling at rate f_s, the I/Q stream is r[n] = rᵢ[n] + j·r_q[n]. Classical maximum-likelihood AMC computes, for each candidate modulation m with symbol alphabet A_m:
N
m̂_ML = arg max Π (1/|A_m|) · Σ exp(−|r[n] − a|² / σ²)
m n=1 a∈A_mThis is optimal under known channel and noise parameters, but in non-cooperative SIGINT those parameters are themselves unknown — exactly the regime where ML-based AMC dominates.
2.2 CNN-based AMC
Standard input is the raw I/Q tensor reshaped as x of shape (2, N): rows = I and Q components; columns = N samples. A reference architecture close to O’Shea’s published baselines:
import torch, torch.nn as nn
class AMCNet(nn.Module):
"""Deep AMC over raw IQ. Input: (B, 2, N). Output: logits over M classes."""
def __init__(self, n_classes=11, N=1024):
super().__init__()
self.features = nn.Sequential(
nn.Conv1d(2, 64, kernel_size=7, padding=3), nn.ReLU(),
nn.Conv1d(64, 64, kernel_size=5, padding=2), nn.ReLU(),
nn.MaxPool1d(2),
nn.Conv1d(64, 128, kernel_size=5, padding=2), nn.ReLU(),
nn.Conv1d(128, 128, kernel_size=3, padding=1), nn.ReLU(),
nn.MaxPool1d(2),
nn.Conv1d(128, 256, kernel_size=3, padding=1), nn.ReLU(),
nn.AdaptiveAvgPool1d(1),
)
self.head = nn.Sequential(
nn.Flatten(),
nn.Linear(256, 128), nn.ReLU(), nn.Dropout(0.3),
nn.Linear(128, n_classes),
)
def forward(self, x): return self.head(self.features(x))
def train_step(model, x, y, opt):
logits = model(x)
loss = nn.functional.cross_entropy(logits, y)
opt.zero_grad(); loss.backward(); opt.step()
return loss.item()Published results on the RadioML 2016.10a benchmark with a comparable robust CNN achieve 86.1% accuracy at −2 dB SNR, 96.5% at 0 dB, and 99.8% at 10 dB across nine modulations, with strong intra-family discrimination (16-QAM vs 64-QAM) — a regime classical cumulant-based feature engineering struggles with.
2.3 Specific Emitter Identification
SEI exploits hardware imperfections — oscillator phase noise, PA nonlinearity, DAC asymmetry — that make every individual transmitter physically unique even when nominally identical. Features are typically higher-order statistical or cyclostationary signatures, or a learned embedding from a Siamese network optimized with a triplet loss:
L_triplet = max( 0, ||f(xᵃ) − f(xᵖ)||² − ||f(xᵃ) − f(xⁿ)||² + α )
with anchor/positive/negative samples drawn from same and different emitters, and α a margin hyperparameter. The trained embedding f(·) becomes the fingerprint; new captures are matched against a gallery by nearest-neighbor.
2.4 Encrypted traffic — the metadata channel
A standard public misconception is that ML “breaks” encryption. It mostly does not. What ML does is make the metadata around encrypted traffic far more revealing.
For a TCP/TLS flow, define the side-channel feature vector:
z = [ ℓ̄, σ_ℓ, Δt̄, σ_Δt, p_up, p_down, H(ℓ), JA3, JA4, … ]
— packet-size mean and variance, inter-arrival times, directionality, the size-distribution entropy H(ℓ), and TLS client/server fingerprints (JA3/JA4 hashes). A gradient-boosted tree (XGBoost) or 1-D CNN over the packet-size time series classifies the application or operator behind the ciphertext without touching plaintext. The net effect: “going dark” is much less dark than the policy debate of the late 2010s assumed.
import numpy as np, xgboost as xgb
def flow_features(packets):
sizes = np.array([p.size for p in packets])
times = np.array([p.ts for p in packets])
dt = np.diff(times)
up = sizes[[p.up for p in packets]]
down = sizes[[not p.up for p in packets]]
p, _ = np.histogram(sizes, bins=32, density=True)
h = -np.sum(p[p>0] * np.log(p[p>0])) # size-distribution entropy
return np.array([
sizes.mean(), sizes.std(),
dt.mean() if len(dt) else 0.0,
dt.std() if len(dt) else 0.0,
up.size/len(sizes), down.size/len(sizes), h,
# JA3/JA4 fingerprints hashed to ints in a real pipeline
])
clf = xgb.XGBClassifier(n_estimators=400, max_depth=8, learning_rate=0.05)
# clf.fit(X_train, y_train); preds = clf.predict(X_test)3. OSINT: Knowledge Graphs and Graph Neural Networks
Open-source intelligence is the IC’s largest growth area. CIA’s deputy director for digital innovation Juliane Gallina has emphasized that CIA serves as the functional manager for OSINT for the intelligence community. The architectural pattern is consistent across vendors: ingestion → NER → entity resolution → graph construction → reasoning.
3.1 Entity resolution as a learned similarity problem
Given two record mentions xᵢ, xⱼ (a person, organization, vessel, account), entity resolution learns a scoring function φ_θ(xᵢ, xⱼ) ∈ [0,1] that predicts whether they refer to the same real-world entity. A standard contrastive objective:
L_ER = − Σ log φ_θ(xᵢ, xⱼ) − Σ log(1 − φ_θ(xᵢ, x_k))
(i,j)∈P (i,k)∈Nwith positives P from known coreference (e.g., the same passport across leaked data) and negatives N sampled either uniformly or, more effectively, via hard negative mining (nearest neighbors that are not actually the same entity). Industry practice is to take all publicly and commercially available information, use AI for entity resolution, relationship extraction, and risk labeling, then build a knowledge graph that maps which entities to trust.
3.2 Graph neural networks for multi-hop reasoning
Once entities are resolved, the resulting graph G = (V, E) is the substrate. Each node v carries features h_v⁽⁰⁾ ∈ ℝᵈ. GraphSAGE (Hamilton, Ying, & Leskovec, 2017) propagates information across k hops:
h_v⁽ᵏ⁾ = σ( W⁽ᵏ⁾ · CONCAT( h_v⁽ᵏ⁻¹⁾, AGG({ h_u⁽ᵏ⁻¹⁾ : u ∈ N(v) }) ) )where AGG is a permutation-invariant aggregator (mean, max, or attention-weighted) and N(v) is v’s neighborhood. For risk scoring or link prediction, the score of a candidate edge (u, v) is:
ŷ_uv = σ( h_u⁽ᴷ⁾ᵀ · W_r · h_v⁽ᴷ⁾ )
trained with binary cross-entropy against known true/false links. GNNs consistently outperform feature-engineered baselines on real transaction-network and AML datasets.
A reference link-prediction pipeline in PyTorch Geometric:
import torch, torch.nn as nn, torch.nn.functional as F
from torch_geometric.nn import SAGEConv
from torch_geometric.utils import negative_sampling
class OSINTGraph(nn.Module):
"""Two-layer GraphSAGE encoder + dot-product link decoder."""
def __init__(self, in_dim, hid=128, out=64):
super().__init__()
self.c1 = SAGEConv(in_dim, hid)
self.c2 = SAGEConv(hid, out)
def encode(self, x, edge_index):
h = F.relu(self.c1(x, edge_index))
h = F.dropout(h, p=0.3, training=self.training)
return self.c2(h, edge_index)
def decode(self, z, edge_pairs): # (2, E)
return (z[edge_pairs[0]] * z[edge_pairs[1]]).sum(dim=-1)
def train_link_pred(model, data, opt):
model.train(); opt.zero_grad()
z = model.encode(data.x, data.edge_index)
neg = negative_sampling(data.edge_index, num_nodes=data.num_nodes,
num_neg_samples=data.edge_index.size(1))
pos_logits = model.decode(z, data.edge_index)
neg_logits = model.decode(z, neg)
logits = torch.cat([pos_logits, neg_logits])
labels = torch.cat([torch.ones_like(pos_logits),
torch.zeros_like(neg_logits)])
loss = F.binary_cross_entropy_with_logits(logits, labels)
loss.backward(); opt.step()
return loss.item()Operationally, this is run over graphs populated with people, organizations, vessels, accounts, addresses, and IPs. Multi-hop queries — “find all corporate vehicles linked within three hops to OFAC-sanctioned entity X, weighted by transaction recency” — become learned-embedding nearest-neighbor lookups, sometimes orders of magnitude faster than explicit BFS over hundreds of millions of edges.
4. The Analytic Co-Pilot: RAG Over Classified Corpora
CIA Deputy Director Michael Ellis has outlined a plan to embed AI tools — described as “AI co-workers” — across all analytic platforms to help draft assessments and identify patterns while leaving final judgment to human officers; the agency has produced its first autonomous intelligence report generated with AI assistance. CIA Chief AI Officer Lakshmi Raman has reported measurable productivity increases from these workflows while stressing that humans decide oversight, risk, and whether to continue.
The technical pattern is Retrieval-Augmented Generation (RAG) over compartmented corpora.
4.1 Dense retrieval mechanics
Documents and queries are embedded into a shared vector space with a bi-encoder f_θ. Similarity is cosine:
sim(q, d) = (f_θ(q) · f_θ(d)) / (||f_θ(q)|| · ||f_θ(d)||)
For top-k retrieval over N documents, FAISS or HNSW indices give sub-linear search. The retriever is trained with InfoNCE:
exp( sim(q, d⁺) / τ )
L_InfoNCE = − log ─────────────────────────────────────────
exp( sim(q, d⁺)/τ ) + Σ exp( sim(q, d⁻)/τ )
d⁻∈Nwith τ a temperature and d⁺ the gold document for query q.
4.2 A grounded co-pilot, end to end
import faiss, numpy as np
from sentence_transformers import SentenceTransformer
class IntelligenceRAG:
"""Retrieval-grounded analyst co-pilot. Compartment-aware."""
def __init__(self, embed_model="all-mpnet-base-v2"):
self.enc = SentenceTransformer(embed_model)
self.dim = self.enc.get_sentence_embedding_dimension()
self.index = faiss.IndexFlatIP(self.dim) # cosine via normalized vectors
self.docs, self.meta = [], []
def ingest(self, doc_text, classification, originator, caveats):
v = self.enc.encode([doc_text], normalize_embeddings=True)
self.index.add(v.astype(np.float32))
self.docs.append(doc_text)
self.meta.append(dict(cls=classification, orig=originator, caveats=caveats))
def retrieve(self, query, user_clearance, k=8):
q = self.enc.encode([query], normalize_embeddings=True).astype(np.float32)
scores, idxs = self.index.search(q, k * 4) # over-retrieve for filtering
hits = []
for s, i in zip(scores[0], idxs[0]):
m = self.meta[i]
# ORCON / minimization / compartment enforcement
if not user_clearance.permits(m["cls"], m["orig"], m["caveats"]):
continue
hits.append((s, self.docs[i], m))
if len(hits) == k: break
return hits
def answer(self, query, user_clearance, llm_call):
hits = self.retrieve(query, user_clearance)
context = "\n\n".join(
f"[doc {i} | {m['cls']} | {m['orig']}]\n{d}"
for i, (s, d, m) in enumerate(hits)
)
prompt = (
"You are an intelligence analyst co-pilot. Answer ONLY using the documents "
"below. Cite the doc index for every claim. If the documents do not support "
"an answer, say so explicitly.\n\n"
f"Documents:\n{context}\n\nQuestion: {query}\n\nAnswer:"
)
return llm_call(prompt), hitsThree things in this sketch are not optional in a real deployment:
- Citation enforcement. The model output must be re-checked against the retrieved context. Hallucinated citations are an active failure mode (see §7).
- Clearance/compartment filtering at retrieval time — not at presentation. Filtering after generation has already leaked.
- Provenance metadata travels with the document. Originator-control, FISA minimization, and caveat enforcement all hinge on this.
CIA’s AI chief has flagged that pulling from multiple databases creates legal and data-compliance challenges that require extra compliance checks. Agentic systems amplify the audit problem; every cross-database read by an agent must respect the caveats attached to each source.
5. Covert Action and Synthetic Media
This is where AI crosses into operations rather than analysis. AI-enabled military deception remains a topic of great concern given the many ways the technology could be leveraged — creating fictitious events to skew intelligence, impersonating personnel to falsify orders, or manufacturing noise to mask actions or overwhelm adversaries. The synthetic Zelensky surrender video circulated in 2022 is the most-cited public example.
5.1 Deepfake generation in one paragraph
Modern face/voice synthesis uses a generator G_θ trained adversarially against a discriminator D_φ:
min max E_{x~p_data} [log D_φ(x)] + E_{z~p_z} [log(1 − D_φ(G_θ(z)))]
θ φor — more commonly now — a diffusion model trained to denoise:
L_diff = E_{x₀, t, ε} [ || ε − ε_θ(x_t, t, c) ||² ]where c is the conditioning (a target identity, a text prompt, a reference clip). Voice cloning has collapsed to three-second sample requirements. Deepfake audio recordings of Secretary of State Marco Rubio reportedly deceived at least five government officials and three foreign ministers, with the State Department cable also referencing a Russia-linked actor posing as a fictitious department official.
5.2 Deepfake detection — spectral artifacts
Diffusion- and GAN-generated images leave detectable fingerprints in the high-frequency spectrum even when imperceptible to humans. A common detector takes the 2-D FFT magnitude of an image and feeds the radial spectrum to a small classifier:
import numpy as np, torch
import torch.nn as nn
def radial_spectrum(img_gray):
# img_gray: (H, W) float in [0,1]
F = np.fft.fftshift(np.fft.fft2(img_gray))
mag = np.log1p(np.abs(F))
h, w = mag.shape; cy, cx = h//2, w//2
y, x = np.indices(mag.shape)
r = np.sqrt((x-cx)**2 + (y-cy)**2).astype(int)
n_bins = min(cy, cx)
radial = np.bincount(r.ravel(), mag.ravel(), minlength=n_bins+1)[:n_bins]
counts = np.bincount(r.ravel(), minlength=n_bins+1)[:n_bins]
return radial / np.maximum(counts, 1)
class SpectralFakeDetector(nn.Module):
def __init__(self, n_bins=256):
super().__init__()
self.net = nn.Sequential(
nn.Linear(n_bins, 256), nn.ReLU(), nn.Dropout(0.3),
nn.Linear(256, 128), nn.ReLU(),
nn.Linear(128, 2),
)
def forward(self, x): return self.net(x)Generators are catching up: adversarial training against detectors closes the gap each cycle, which is why operational counter-disinfo programs combine spectral, provenance (C2PA-style cryptographic signing), and behavioral (account-graph) signals rather than relying on any one detector.
5.3 Bot networks and AI persona detection
Researchers at Vanderbilt’s Institute of National Security have reported that a Chinese company, GoLaxy, used AI to build psychological profiles of individuals including 117 members of Congress and 2,000 American thought leaders, allowing tailored, targeted propaganda. The 2024 Romanian presidential election demonstrated operational scale: a Russia-linked campaign artificially boosted a far-right candidate using deepfakes, tens of thousands of AI-powered bot accounts, and influencer payments; the Constitutional Court annulled the result and forced a revote.
A persona-network detector typically combines text-based stylometry (perplexity under a small reference LM, burstiness, sentence-length entropy) with graph-based behavior (posting rhythm, retweet co-occurrence, follower graph anomalies). A graph-attention layer over the co-engagement graph identifies clusters whose joint behavior would be vanishingly improbable under any baseline of independent human users.
6. Counterintelligence and Adversarial ML
The same toolkit is defensive. ML-driven user-and-entity behavior analytics (UEBA) on classified networks now flag exfiltration patterns long before traditional DLP would, using unsupervised models on login times, file-access graphs, query semantics, and printing behavior.
6.1 Insider-threat anomaly detection
For a user-day feature vector x_u⁽ᵗ⁾ (file reads, query specificity, off-hours activity, lateral movement counts), an autoencoder g_θ trained on benign baselines flags:
s_u⁽ᵗ⁾ = || x_u⁽ᵗ⁾ − g_θ(x_u⁽ᵗ⁾) ||²
with anomaly threshold set at the 99.5th percentile of the benign reconstruction-error distribution. Sequential models (LSTM autoencoders, masked-transformer reconstruction) replace the static autoencoder where temporal pattern matters.
6.2 Adversarial perturbations against IC models
A model f_θ that classifies a clean input x correctly can be flipped by an imperceptibly small perturbation δ satisfying ||δ||_p ≤ ε. The Fast Gradient Sign Method (Goodfellow, Shlens, Szegedy, ICLR 2015) is the canonical single-step attack:
δ = ε · sign( ∇_x L( f_θ(x), y ) )
Projected Gradient Descent (Madry et al., ICLR 2018) iterates this and re-projects onto the L∞ ball:
x⁽ᵗ⁺¹⁾ = Π_{B_ε(x₀)} ( x⁽ᵗ⁾ + α · sign( ∇_x L( f_θ(x⁽ᵗ⁾), y ) ) )
def pgd_attack(model, x, y, eps=8/255, alpha=2/255, steps=10):
x_adv = x.clone().detach() + (torch.rand_like(x) * 2 - 1) * eps
x_adv = x_adv.clamp(0, 1)
for _ in range(steps):
x_adv.requires_grad_(True)
loss = torch.nn.functional.cross_entropy(model(x_adv), y)
grad = torch.autograd.grad(loss, x_adv)[0]
x_adv = x_adv.detach() + alpha * grad.sign()
x_adv = torch.max(torch.min(x_adv, x + eps), x - eps).clamp(0, 1)
return x_advFor overhead-imagery detectors, the attack surface is real: physically realizable adversarial patches on vehicles, infrastructure, or camouflage can collapse YOLO confidence on a target class. Defenses are limited — adversarial training (training on PGD examples), randomized smoothing for certified robustness, and input-transformation defenses — all with measurable but bounded efficacy.
IARPA’s TROJAI program (2015–) explicitly targets the related problem of detecting Trojans in trained models — backdoors implanted at training time by data poisoning, where a specific trigger pattern causes targeted misclassification while clean-input accuracy is preserved. The threat model is realistic for any IC system that consumes externally trained foundation models.
7. Where the Math Actually Breaks
7.1 Hallucination is provably inevitable
A formal result from Xu, Jain, and Kankanhalli (2024) shows that hallucination is inevitable for any computable LLM, regardless of architecture, learning algorithm, prompting, or training data. The core argument: define an LLM as a computable function f: Σ* → Σ* and ground truth as a computable function g: Σ* → Σ*; the set of all computable g is countable but no enumerable family of f’s can match every g on every input. Since the formal world is part of the much more complicated real world, hallucinations are also inevitable for real-world LLMs.
Empirically: a clinical-decision-support adversarial study found hallucination rates of 50–82% across models and prompting methods, falling from a 66% mean to 44% under prompt-based mitigation. Intelligence applications face structurally similar adversarial conditions. The implication is not that LLMs are useless — they obviously aren’t — but that they cannot be deployed as authorities. They are drafting tools and retrieval interfaces that must terminate at evidence under analyst review.
7.2 Calibration and the threshold problem
When a Maven instance generates up to 1,000 targeting recommendations per hour, the operational question is not “is the model accurate” but “is its calibration trustworthy enough to set a decision threshold?” A model’s calibration is measured by Expected Calibration Error:
M
ECE = Σ ( |B_m| / n ) · | acc(B_m) − conf(B_m) |
m=1where B_m is the m-th confidence bin. Deep networks are systematically over-confident (Guo et al., ICML 2017); temperature scaling — dividing logits by a learned scalar T before softmax — corrects ECE without retraining. For human-in-the-loop systems at intelligence scale, calibration is what makes the loop bandwidth tractable: analysts can triage the high-confidence tail and audit the rest.
7.3 Distribution shift
The Ukraine retraining episode is a positive example. The negative version is silent degradation: a model trained on theater D₁ confidently produces wrong outputs on theater D₂, with the failure invisible until the wrong outputs propagate. Detection requires unsupervised drift monitors over the input distribution — domain classifier scores, density ratios, or maximum mean discrepancy:
MMD²(P, Q) = || E_{x~P}[φ(x)] − E_{y~Q}[φ(y)] ||²_Hin some kernel feature space H. These are tractable but rarely deployed at the throughput the IC needs.
7.4 The supply-chain problem
The training corpora for foundation models are uncontrolled from an IC threat-model standpoint. Training data scraped from the open web is trivially poisonable by adversaries who anticipate scraping. Even fine-tuning on classified data downstream of a poisoned base does not necessarily remove the trigger.
8. Adversary Use
The asymmetry in public reporting — thin on U.S. operations, thick on adversaries — is itself informative.
China. The PLA defines AI-driven cognitive warfare as the systematic use of AI, big-data analytics, and psychological operations to manipulate enemy perceptions, degrade decision-making capabilities, and control information flows before and during conflict. CSET’s review of PLA RFPs found explicit requests for facial and gait recognition, digital surveillance tools capable of recovering deleted data, and technologies for both generating and detecting deepfakes — pointing to AI-enabled psychological-warfare and cognitive-targeting tools, with specificity that suggests intent to procure from non-traditional commercial vendors outside the traditional defense industrial base. A June 2025 Recorded Future / Insikt Group report found the PLA and China’s defense industry are integrating domestic and foreign LLMs to develop generative AI tools for military and intelligence use, and that Chinese covert influence networks have used generative AI to carry out online influence operations — capabilities have moved from experimental to operational.
Russia. Russian use has tilted toward “shallow” AI augmentation of traditional information-operations tradecraft rather than full deepfake replacement. Microsoft’s Threat Analysis Center has assessed that fears of sophisticated AI deepfake videos succeeding in voter manipulation have not yet been borne out, and that simpler “shallow” AI-enhanced and AI audio fake content will likely have more success, with MTAC tracking at least 70 Russian actors engaged in Ukraine-focused disinformation across covert and overt campaigns.
Iran. The New York Times has identified more than 110 unique deepfakes conveying pro-Iran messages through battlefield images, missile-strike depictions, and general war footage, while AI agents that can act without human oversight have made the creation of synthetic disinformation easier than ever, enabling scalable psychological operations against domestic and international audiences.
9. Governance and the Road Ahead
Two trajectories are clear. First, AI in the IC is moving from bolt-on tools to platform infrastructure: CIA has described a shift from democratizing AI access within the agency to commoditizing AI — making it constantly available so officers can seamlessly incorporate it into everyday workflows. Second, human-machine teaming is being elevated from slogan to operational doctrine. NGA officials have emphasized that the agency is not going to let AI take over and that AI is a force multiplier applied judiciously — for example, helping avoid using a multi-million-dollar missile to take down a cheap drone.
The hard governance question is whether human review can scale at the pace AI throughput demands. When a single platform generates a thousand targeting recommendations an hour, “human in the loop” becomes a question about loop bandwidth, not loop existence. The technical answers — calibrated confidences, drift monitors, adversarial-robustness audits, provenance that travels with documents through agent workflows — exist on paper. Operationalizing them at compartmented-network scale is the next decade’s engineering problem.
The IC is unlikely to publish detailed numbers. But the contracting record, the IG evaluations, the procurement RFPs of allies and adversaries, and the open scholarship on the underlying techniques together paint a sufficiently detailed picture: AI and ML are no longer experimental in the intelligence enterprise. They are the substrate. The tradecraft questions of the next decade will be less about whether to deploy them and more about how to make their outputs auditable, contestable, and survivable against an adversary doing the same thing in mirror image.
About the Author
Brian Curry is a Kansas City-based Data Scientist, AI expert, and founder of Vector1 Research, where he explores the frontier of Artificial Intelligence, Causal Inference, Agentic Systems, and Economic Modeling.
His work focuses on building intelligent systems that reveal the causal structures driving performance across marketing, content, and economics. He is the creator of PyCausalSim (causal discovery through simulation), Papilon (complex system optimization), Daedalus (causal and economic analysis), and Memory-Node Encapsulation (data structures for artificial episodic memory).
Selected Sources
- IARPA, “Research Programs” and April 2026 ETA AI program announcements (ARCADE, COSMIC, DECIPHER, LOCUS, MOVES); iarpa.gov
- NGA, “GEOINT Artificial Intelligence” (nga.mil); Maven program transfer and capabilities
- AFCEA Signal, “Building a Framework for AI in Intelligence Tradecraft,” 2024
- FedScoop, “The most exciting AI trend for the CIA? AI agents,” June 2025
- GovCIO Media, “CIA Adds Fourth Pillar to AI Strategy,” July 2025
- ExecutiveGov, “The CIA Is Using Digital Transformation Tools for HUMINT,” May 2025
- Techstrong.ai, “CIA Moves to Embed AI Across Intelligence Workflows,” April 2026
- SpaceNews, “Geospatial intelligence gets smart,” 2024
- MAG Aerospace, “What Is Signals Intelligence (SIGINT),” 2026
- Defense Daily, “DoD and NSA IGs to Evaluate NSA Use of AI/ML for SIGINT,” 2021
- Hamidi-Rad et al., “Deep Learning-Based Automatic Modulation Classification Using Robust CNN Architecture,” Sensors 23(23):9467, 2023
- Hamilton, Ying, & Leskovec, “Inductive Representation Learning on Large Graphs” (GraphSAGE), NeurIPS 2017
- Foreign Affairs, “AI Is Supercharging Disinformation Warfare,” December 2025; “China’s AI Arsenal,” March 2026
- CSIS, “Crossing the Deepfake Rubicon,” November 2024
- FDD, “Deepfakes on the Front Lines: Iran’s AI Disinformation Campaign,” March 2026
- CSET, “China’s Military AI Wish List,” 2026
- Recorded Future / Insikt Group, PLA generative-AI integration reports, 2025
- Microsoft Threat Analysis Center, election-interference reports
- Xu, Jain, Kankanhalli, “Hallucination is Inevitable: An Innate Limitation of Large Language Models,” arXiv:2401.11817, 2024
- Goodfellow, Shlens, Szegedy, “Explaining and Harnessing Adversarial Examples,” ICLR 2015
- Madry et al., “Towards Deep Learning Models Resistant to Adversarial Attacks,” ICLR 2018
- Guo et al., “On Calibration of Modern Neural Networks,” ICML 2017
- Kirkpatrick et al., “Overcoming catastrophic forgetting in neural networks” (EWC), PNAS 2017
