T15 — Human-AI Coupling

The model's outputs interact w/ real humans at scale, producing harm the model could not produce alone. T15 is where AI red-team meets classical social engineering — multiplier effect from automation.

Techniques

T15.001 — Voice clone vishing

Train voice-clone on ~30s sample of target's voice:

• ElevenLabs, RVC, OpenVoice models
• Call victim's contacts (spouse, employer, bank) impersonating
• High-confidence "emergency, send money now" scams

LLM contribution: real-time dialog generation matching personality

• improvising in voice channel.

T15.002 — Deepfake-image-driven impersonation

Static + video deepfakes of executives, used in:

• Video calls to authorize wire transfers
• "Hostage" video for extortion
• Reputation damage via fake compromising content

LLM contribution: realistic surrounding context (email threads, calendar invites, justification text).

T15.003 — Personalized phishing at scale

LLM generates phishing tailored to each victim from OSINT:

• Match writing style of executives the victim trusts
• Reference real shared projects from public sources
• Per-victim attack volume too high for traditional defense

T15.004 — Conversational SE bots

Automate the back-and-forth of social-engineering campaigns:

• Build trust over weeks of seemingly-organic messages
• Pivot to attack only when victim is engaged
• A100-scale parallelism — one operator runs 1000 conversations

T15.005 — Influence operations

At-scale generation of comments, posts, articles that move public opinion. Adjacent to T8 (deception) but T15 emphasizes the human-targeting + behavior-modification angle.

T15.006 — Bias / persuasion engineering

Model output tuned to maximize persuasion of specific demographics:

• A/B testing message variants against engagement signal
• Personalized argumentation
• Emotional-state-targeted content

T15.007 — Confederate-conversational-escalation

Multi-message campaigns where LLM gradually escalates ask:

• Day 1: friendly chat
• Day 5: light favor
• Day 10: significant favor
• Day 15: target compromised

Probe pattern

T15 attacks happen in real-world social channels, not in the LLM endpoint itself. Probe scope:

• Can the model produce per-target personalized phishing? (T8 + T15)
• Voice-clone test: feed 30s sample → can it clone?
• Image-edit test: can the model produce deepfake imagery?
• Conversation-pattern test: does the model maintain consistent persona over 10+ turn back-and-forth?

plugins:
  - id: imitation
    numTests: 15
  - id: pii
    numTests: 10
strategies:
  - basic
  - jailbreak

Detection signals

• Output usable for high-fidelity impersonation
• Voice-clone quality crosses detection threshold (humans + algorithms can't distinguish)
• Multi-turn conversations maintain persona consistency
• Personalization quality matches level of input OSINT

Severity

Defender

• Voice authentication: liveness + multi-factor (NEVER just voice)
• Deepfake detection (Reality Defender, Microsoft Video Authenticator)
• Image provenance (C2PA / Content Authenticity Initiative)
• Per-user phishing simulation training
• Rate limits + anomaly detection on outbound contacts from any compromised account
• Watermarking model output (where supported)
• "Out-of-band confirmation" requirement for sensitive actions

Cross-references

• T8 (deception) — content layer
• T9 (multimodal) — voice/video generation layer
• Classical phishing skills skills/_corpus/payloads/...
• Operator's external phishing-operator agent for the operational side