Targeted Harassment Content

Targeted harassment uses LLMs to industrialize abuse against a specific individual: discrediting posts, fabricated allegations, rumor campaigns, doxxing templates, defamatory articles, coordinated message floods, and review-bombing scripts. The technique works because harassment's impact scales with volume, persistence, and apparent multiplicity of accusers — and LLMs supply all three cheaply, generating endless on-message variations that read as distinct human voices. The asymmetry is between a single operator producing thousands of unique-seeming attacks and a lone target who must see, absorb, and try to counter each one.

• Coordination/pile-on detection: Identify many accounts targeting one entity in a narrow window with shared phrasing or link sets
• Cross-post stylometric clustering: Detect that "independent" attackers share a single generative fingerprint
• Account-age and velocity heuristics: New/burner accounts converging on a target indicate a manufactured campaign
• PII-exposure scanning (doxxing detection): Flag posts aggregating home addresses, phone numbers, or workplace details

Targeted harassment frequently sits inside larger operations: it weaponizes identity fabrication (T8-AT-015) to create the sock puppets that carry the abuse, synthetic evidence (T8-AT-002) to back fabricated allegations, and psychological-manipulation content (T8-AT-013) to maximize harm to the target. It chains with T9 synthetic media when fabricated or non-consensual imagery is attached, and with disinformation infrastructure (T8-AT-007) to coordinate the pile-on.