The acronym behind the project’s name refers to foreign information manipulation and interference, a term that has increasingly replaced the narrower notion of disinformation in European security discourse. FIMI encompasses coordinated efforts by external actors to distort the information environment, whether through fabricated narratives, manipulated media, coordinated inauthentic behavior, or targeted influence operations. Unlike simple falsehoods, these campaigns are often strategic, adaptive, and designed to exploit societal fault lines. Countering them requires more than fact-checking; it demands technical systems capable of detecting coordinated activity at scale, assessing the provenance and integrity of content, and supporting human analysts who must make rapid judgments under pressure. It is precisely this complex ecosystem of tools and practices that FIMI-RESIST intends to put to the test.

The timing of the initiative reflects a disinformation landscape that is changing faster than the defenses built to contain it. Generative artificial intelligence has dramatically lowered the barriers to producing synthetic text, images, audio, and video, allowing manipulated media to be created cheaply and scaled rapidly across platforms and languages. At the same time, the AI systems that people increasingly rely on to find and assess information, including search assistants and conversational agents, have themselves become targets for manipulation. An adversary who can poison the data or outputs of such systems can reach audiences indirectly, bypassing the traditional defenses of newsrooms and fact-checking organizations. These shifting threat vectors form the backdrop against which the project’s evaluation framework will be constructed.

What distinguishes FIMI-RESIST from earlier efforts is its deliberate refusal to build yet another stand-alone tool. The European Union has already funded a broad range of research projects and software solutions aimed at detecting and mitigating disinformation, but these have typically been developed in isolation, each with its own assumptions, datasets, and evaluation metrics. The result is a fragmented landscape in which it is nearly impossible to compare performance or determine which approaches are suited to which problems. The project addresses this gap by establishing a shared evaluation and harmonization framework: a common set of criteria and benchmarks against which twenty existing European tools will be assessed. The objective is to generate robust, comparable evidence about which methods perform best for specific users, operational settings, and threat scenarios.

The scientific foundation for this assessment draws on the coordinating group’s particular expertise. The XplaiNLP Research Group at Mainz combines natural language processing with explainable artificial intelligence and robust information processing, fields that are central to modern content analysis. Natural language processing provides the computational machinery for analyzing text at scale, identifying narrative patterns, and tracing how claims spread across networks. Explainable AI addresses a persistent weakness of automated systems: the tendency of machine learning models to function as opaque black boxes whose judgments cannot be easily scrutinized. In a domain where decisions can affect freedom of expression and media pluralism, the ability to explain why a system flagged a piece of content is not a luxury but a requirement. Robust information processing, meanwhile, concerns the resilience of these systems against adversarial attempts to deceive or evade them.

A central focus of the project is practical application rather than laboratory performance. Working with journalists, fact checkers, security stakeholders, and civil society organizations, the consortium will assess how effectively existing tools can be integrated into day-to-day workflows. This user-centered approach recognizes a common failure mode in security technology: a system that performs well on benchmark datasets may prove unusable in a busy newsroom or a crisis-response setting, where time constraints, language diversity, and the sheer volume of content create conditions that benchmarks rarely capture. By testing tools in realistic operational contexts, the project aims to identify not only which systems detect manipulation effectively, but also where gaps remain as AI-driven threats continue to evolve.

The consortium assembled for this task spans a deliberately wide range of competencies and geographies. Alongside the coordinating group at Johannes Gutenberg University Mainz, it includes the Kempelen Institute of Intelligent Technologies in Slovakia led by Dr. Jakub Šimko, the Centre for Research and Technology Hellas in Greece represented by Dr. Symeon Papadopoulos, and the University of Amsterdam in the Netherlands under Professor Richard Rogers. The technology and industry side is represented by Logically/INSIKT, operating in the United Kingdom and Spain, Factiverse from Norway, Exorde Labs from France, Cyfluence Research Center from Germany, and Gretchen AI, also from Germany, which participates as an associated partner. Media and civil society perspectives come from Deutsche Welle, Germany’s international broadcaster, and VoxUkraine, an organization with direct experience of operating in an information environment shaped by war and foreign interference.

The inclusion of Ukrainian and media partners underscores the stakes involved. Ukraine has become, in effect, a live testing ground for foreign information manipulation at scale, and organizations like VoxUkraine bring firsthand knowledge of what interference campaigns look like in practice. Deutsche Welle contributes decades of experience in international journalism and in monitoring disinformation across languages and regions. Civil society and security stakeholders round out the picture, ensuring that the evaluation framework reflects the needs of those who defend democratic discourse rather than purely academic metrics. The project has also drawn political support, with Alexandra Geese, a Member of the European Parliament, backing the initiative, and contributions at its kickoff from Saman Nazari of Alliance4Europe and Sandra Fiene of the European Commission, alongside policy and project officers Ilona von Bethlenfalvy and Alberto Domini.

Beyond its technical evaluations, FIMI-RESIST is designed to leave a durable institutional footprint. The project will establish a help desk, a European hub, and a program of training offerings to ensure that validated methods and results remain accessible to practitioners after the funding period ends. This sustainability component reflects a lesson learned from previous research projects, whose tools and findings often faded from view once grant support concluded. By building infrastructure for continued knowledge transfer, the consortium hopes to convert its thirty months of work into a lasting European capability rather than a one-time report.

The findings are also intended to feed directly into the European regulatory debate. The Digital Services Act, which imposes obligations on large online platforms to address systemic risks including disinformation; the AI Act, which establishes rules for artificial intelligence systems including transparency requirements; and the European Media Freedom Act, which protects pluralism and independence in the media landscape, together form a regulatory architecture whose effectiveness depends on an accurate understanding of which countermeasures succeed in practice. By supplying rigorous comparative evidence, FIMI-RESIST aims to inform how these frameworks are implemented and refined. In an era when the integrity of the information environment has become a matter of democratic security, knowing which defenses actually hold is perhaps the most valuable intelligence Europe can produce.

Subject of Research: Evaluation of European countermeasures against foreign information manipulation and interference

Article Title: Disinformation and influence operations: Which countermeasures actually work?

Article References: Disinformation and influence operations: Which countermeasures actually work?. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: disinformation, FIMI, FIMI-RESIST, Horizon Europe, natural language processing, explainable AI, generative AI, fact-checking, Digital Services Act, media freedom, influence operations, Johannes Gutenberg University Mainz

The motivation goes beyond simple data collection. In cybercriminal ecosystems, low-level identifiers such as channel handles are easily replaced, but higher-level semantic structures, including the language, products, and networks that define a campaign, tend to persist even as the surface infrastructure changes. This is why the authors argue for continuous observation rather than snapshot sampling. Archiving even short-lived communities supports the identification of illegal content under the EU Digital Services Act, enables the extraction of Indicators of Compromise for characterising the Crime-as-a-Service economy, and can ultimately assist the prosecution of cybercriminal activity. At the same time, many researchers currently depend on commercial Software-as-a-Service intermediaries such as TGStat or Telemetrio, which offer basic metrics but introduce opaque filtering, undermine corpus representativeness and reproducibility, and lock data inside proprietary silos without multi-dimensional enrichment.

Existing open-source tools each cover only part of this workflow. pytopicgram focuses on local extraction, preprocessing, sentiment analysis, and topic modelling; 4CAT provides persistent datasets, queued processing, and modular analysis processors; and TeleCatch offers a remote interface for filtered collection and message extraction. A more comprehensive framework called MST has been proposed in the literature, but because no versioned, publicly accessible source repository could be identified, the authors treat it strictly as related work rather than a direct competitor. In a capability comparison verified against public repositories and documentation as of August 2026, Atenea stands out as the only tool of the four that combines continuous monitoring, a persistent server-side message repository, named entity recognition, sentiment analysis, embedding generation, and, critically, true semantic retrieval over stored messages.

Architecturally, Atenea separates collection, processing, storage, retrieval, and exploration behind a common REST interface, with heavy inference decoupled from the core backend so that monitoring continues uninterrupted while services scale or evolve independently. Its data model revolves around three concepts: rooms, which are monitorable Telegram channels or groups; users, whether human accounts or bots; and seeds, external references such as invite links that define which rooms should be ingested. A dedicated Telegram Auth Manager registers and manages multiple API credentials, increasing effective request capacity and handling temporary restrictions. Two load-balancing strategies, one that splits work across credentials and one that groups resources by credential, keep collection resilient, and credential-to-room associations allow access recovery when a particular credential expires.

The processing layer relies on asynchronous, distributed ETL pipelines built from Telethon, Redis, Celery, and Celery Beat, triggered manually or by an automated scheduler. PostgreSQL serves as the transactional system of record, Elasticsearch powers lexical search and exploration through Kibana, and Qdrant stores vector embeddings for semantic retrieval. Downloaded media live outside the relational database in S3-compatible object storage, deployable locally via Garagehq, while PostgreSQL retains their provenance, metadata, hashes, and processing states. Database-level locking and configurable task concurrency prevent worker collisions across pipeline stages. Once collected, messages flow into a service-oriented enrichment layer offering named entity recognition, sentiment analysis, and embedding generation through independent microservices, including custom APIs, vLLM, or Ollama backends.

The enrichment pipeline itself is notably hybrid and language-aware. During ingestion, Atenea cleans message text and assigns an ISO 639-1 language code using the Efficient Language Detector library, discarding detections below a confidence threshold of 0.15. Before any model-based processing runs, regular-expression detectors extract structured indicators, including email addresses, URLs, Telegram mentions, hashtags, and cryptocurrency wallet addresses for Bitcoin, Ethereum, Dash, and Monero, with emoji tokenisation handled separately. These detectors preserve character offsets and operate independently of language. Model-based named entity recognition currently runs for English and Spanish using spaCy 3.8.14 with its large English and Spanish pipelines, mapping model-specific labels onto a canonical taxonomy. Adding a new language requires only installing a compatible spaCy model, registering its code, and redeploying, without changes to the enrichment API, task pipeline, or database schema.

To demonstrate the platform at scale, the authors describe a 2.5-year operational deployment that, as of a July 2026 snapshot, held more than 191 million messages from 6,412 monitored channels and groups, with history reaching back to 2016 and nearly 40 million extracted entities alongside 7.1 million inferred embeddings. A case study built on the DarkGram dataset, a research catalogue of cybercriminal Telegram channels, shows the full workflow in action. From 329 imported seeds, the populate pipeline resolved 207 monitorable rooms. An initial historical-recovery scan stored over 510,000 messages, peaking at 177,357 messages in a single hour, before settling into recurrent four-hour scans averaging roughly 128 new messages per day. The result was a tagged, reproducible collection of 574,432 messages spanning nearly nine years of channel history.

The enrichment results offer a descriptive profile of what automated extraction can reveal. Of the DarkGram messages, 378,905 qualified for English or Spanish model-based processing, and the hybrid extractor produced 175,021 unique entities across the full snapshot. Comparisons against the rest of the repository proved revealing: URL labels appeared at nearly identical rates in both collections, around 27 percent of messages, but PRODUCT labels were overrepresented in the cybercriminal collection at 4.7 percent versus 0.7 percent in the baseline, a pattern consistent with illicit marketplaces. References to people, by contrast, were far rarer in DarkGram, reflecting the baseline repository’s focus on disinformation and political-news channels. Media cataloguing recorded metadata for 147,646 attachments totalling 6.41 tebibytes of potential content, with opaque .bin files and compressed archives accounting for roughly 6.09 tebibytes, a distribution the authors note is consistent with packaged software and resources circulating in such channels.

Perhaps the most striking demonstration is the platform’s semantic capability. On external hardware equipped with two NVIDIA L40 S GPUs, a vLLM server running the Qwen3-Embedding-4B model generated 2,560-dimensional vector embeddings for more than 563,000 messages in roughly five hours, averaging 107,400 messages per hour with a peak of 35,224 in a single fifteen-minute bin. Stored in Qdrant and linked to their source messages, these embeddings allow researchers to retrieve content matching natural-language descriptions, such as credential theft or illicit marketplace activity, rather than relying solely on dates or keyword matches. Combined with statistical anomaly detection, which flagged two high-activity windows in the DarkGram collection, including one week in late 2025 with 11,005 messages and a z-score of 8.17, the system turns raw monitoring into a queryable analytical environment.

The implications reach well beyond cybersecurity. The authors position Atenea as a flexible backend for computational social science, journalism, and cyber threat intelligence, supporting workflows from network analysis to narrative detection, social listening during protests and crises, and the automated recovery of indicators such as IP addresses, domains, URLs, wallet addresses, and cryptographic hashes. Because the platform is released under the MIT license, with full documentation, a reproducible deployment capsule, and modular microservices that can be extended without touching the core, it lowers the barrier for any research group to build a long-running, auditable observation post on one of the world’s most consequential yet least-studied communication platforms. In an era when online communities can disappear in an instant, tools that preserve both the messages and their meaning may prove as valuable as the analyses they enable.

Subject of Research: An open-source platform for continuous Telegram monitoring, NLP enrichment, and semantic retrieval

Article Title: Atenea: An open-source platform for continuous telegram monitoring, NLP enrichment, and semantic retrieval

Article References: de Paz, A., & Arroyo, D. (2026). Atenea: An open-source platform for continuous telegram monitoring, NLP enrichment, and semantic retrieval. SoftwareX, 36, Article 103067. https://doi.org/10.1016/j.softx.2026.103067

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103067

Keywords: Telegram, open-source software, natural language processing, semantic search, cyber threat intelligence, named entity recognition, computational social science, disinformation, Crime-as-a-Service, vector embeddings, data collection, Digital Services Act