Everything material is stated plainly: what we measure, how we measure it, what is open, what is held proprietary, and how each claim on this site stands up to scrutiny.
The methodology is aligned with the DISARM Foundation taxonomy and documented for academic review; the full brief is available to verified buyers under NDA.
Rigor is not our tagline — it is our name. Every figure we publish carries its probabilities. Every claim we make can be reproduced.
Opening principle
Retelnist's resolution follows the discipline. This page documents the public layer. The methodology brief documents the NDA layer.
Public
Documented hereUnder NDA
Verified buyersLayer A — Detection
Taxonomy
Retelnist uses the DISARM Red Framework v2 — community-governed taxonomy for adversarial information operations. DISARM is the de-facto standard adopted by the EEAS, NATO StratCom CoE, the FIMI ISAC, and the broader transatlantic counter-disinformation community.
Retelnist rule-tags against 40 priority techniques drawn from the DISARM Red v2 set, prioritized by observed frequency in EU/UA/MENA operational data.
Tag governance
Every tag in Retelnist carries:
Coverage
Coordination signals
Temporal synchronization
Accounts posting variants of the same content within statistically improbable time windows, validated against baseline posting distributions.
Content cloning
Near-duplicate detection at sentence and paragraph level, with edit-distance thresholds calibrated to language and platform.
URL co-amplification
Same URLs surfaced across account clusters at rates above organic baseline.
Bot velocity
Posting-frequency outliers relative to account-age and account-history baselines.
Layer B — The V-Engine
What is measured
Retelnist models the target audience's decision-space as a finite set of propositions. Examples of belief statements that adversarial retellings are designed to shift from active deployments:
"Mobilization is unjust — rich buy out, poor die."
"Western support is weakening."
"Sanctions hurt us more than Russia."
"The negotiations track is the only rational path."
Baseline construction
Every V(x,t) is computed against an organic baseline — the level of natural discussion the proposition would generate. Baselines are constructed from longitudinal pre-incident data and re-estimated quarterly.
The baseline is what makes "is this a 2.3σ shift" a meaningful claim rather than a vibe. Without baseline, you have noise. With baseline, you have signal.
The V(x,t) score
5 components · weighted aggregateFrequency
Surface volume of content referencing the proposition across the monitored information environment, normalized to baseline volume for that environment.
Sentiment polarity
Directional sentiment of content referencing the proposition (supports / contests / amplifies / mocks), measured via fine-tuned language models trained on annotated cognitive-warfare corpora.
Identity coupling
Co-occurrence of the proposition with identity, in-group, or emotional markers known to lower critical evaluation in the target population.
Amplification asymmetry
Gap between organic discussion volume and coordinated amplification volume, derived from Layer A signals.
Rate of change
First derivative of the above against the proposition's organic baseline.
On proprietary weighting
Component weights are proprietary. The decision to keep weighting under NDA is deliberate — published weights would allow adversarial calibration. Weights are documented in full in the methodology brief, shared with verified buyers under NDA, and revised periodically based on validation against ground-truth events.
The coupling layer — CWPI
Detection tells you a coordinated retelling is happening. Effect tells you belief is shifting. Neither alone tells you whether the retelling caused the shift. That requires coupling.
Coupling test outputs
CWPI — the single verdict number
The Cognitive Warfare Presence Index combines Layer A density, Layer B shift magnitude, and coupling significance into a single per-proposition or per-operation index, reported with 95% confidence intervals.
CWPI exists for one reason: decision-makers need a single number that tells them whether to act. Analysts get the full breakdown. Directors get CWPI.
NB
Coupling is correlation, not causation. A confirmed coupling tells you that observed behavior and observed belief-shift co-occur with a consistent lag at statistically improbable levels. It does not, by itself, prove the retelling caused the shift.
In every operational report, coupling claims are paired with:
The endogeneity caveat
Layer B is measured through the same information environment Layer A monitors. Retelnist addresses this in two ways:
Validation & audit
Audit trail
Every tag, component score, coupling result, and report is logged with: timestamp, source (model version or analyst ID), confidence, evidence pointers, and review history. Exportable per deployment.
Reproducibility
Given access to the same input data and the same model version, every output Retelnist produces is deterministic and reproducible. Model versions are pinned per report.
Ground-truth dataset
Each deployment builds a per-environment annotated dataset of confirmed and rejected operations, used for ongoing model calibration and as a defensibility resource for the client.
Validation against external events
Where confirmed operations are later disclosed by other channels (government attribution, platform takedown announcements, peer-published research), Retelnist retrospectively validates CWPI against ground truth.
Methodology peer review
A methodology paper covering the V-engine validity, coupling design, and validation results is in preparation. Until publication, the NDA methodology brief is the authoritative document.
Data sovereignty & infrastructure
Hosting
EU-region only. Hetzner (Helsinki) and Scaleway (Paris). No data leaves EU jurisdiction.
On-premises
Available for sovereign government clients with full instance deployment, including model weights, on client infrastructure.
Data segregation
Strict multi-tenant isolation. No cross-client data sharing. No model fine-tuning on client data without explicit consent.
Access control
Role-based access within client organization; full audit log of all queries, exports, and report generations.
GDPR & DSA alignment
GDPR Article 6 lawful-basis documentation per deployment; DSA Article 40 alignment for in-scope clients.
Adversarial robustness
Specific measures documented in the NDA methodology brief.
Interoperability
STIX 2.1
Full export of detected retellings as STIX bundles for ingestion into FIMI ISAC, G7 RRM, or organizational threat intelligence platforms.
EEAS-FIMI report format
Weekly threat briefs structured to match the EEAS FIMI report template, exportable as PDF or Markdown.
DISARM tag export
Per-operation tag manifests for cross-validation with peer organizations.
API access
REST API for organizations integrating CWPI signals into their own dashboards or alerting systems. Rate-limited per deployment.
xAPI / SCORM
For the Training module — scenarios deploy as standard learning objects with full xAPI behavioral telemetry.
Bibliography
DISARM Foundation. DISARM Red Framework v2. Open governance, community-maintained.
EEAS. FIMI Threat Methodology and Reporting Framework.
NATO Allied Command Transformation. Cognitive Warfare Concept.
McGuire (1961); van der Linden & Roozenbeek (2020); broader inoculation-at-scale literature 2017–2024.
Efron & Tibshirani, An Introduction to the Bootstrap (1993); Good, Permutation, Parametric, and Bootstrap Tests of Hypotheses (2005).
Methodology brief, in preparation for peer-reviewed publication.
Request the full methodology brief
Available to verified buyers under NDA. The same verification process used for platform briefings.
PGP key available on request.
Full brief covers