---

Implications

Domain-specific threat patterns suggest tailored interventions

Our respondents perceived distinct threat profiles in each domain: text dominated in health, audio in finance, and video in politics. Current governance instruments are not organized along those lines. The EU AI Act (European Parliament, 2024) and the Digital Services Act impose horizontal obligations – transparency labeling, risk assessment, systemic-risk audits – that apply identically whether the content is a fabricated medical claim or a cloned voice in a payment fraud. In the United States, oversight is fragmented across sectoral agencies, with the FDA covering health claims and the FTC covering deceptive commercial practices, and no federal AI statute in place (Bommasani et al., 2024). Neither the horizontal EU approach nor the sectoral U.S. patchwork tracks the domain-by-modality threat structure our respondents described.

In the political domain, where video deepfakes received the highest average threat ratings, respondents frequently identified detection and provenance standards as priority areas for future investment. As Giovanni Spitale (University of Zurich) stated, “My biggest concern is electoral interference and more in general interference in democratic processes, because once you break that you can break each and every other element of democratic societies.” The Coalition for Content Provenance and Authenticity (C2PA) standard responds to exactly this concern: it attaches cryptographically signed capture and edit history to a media file, so a viewer can check whether a video originated from a real camera or from a generative model. Its effectiveness depends on broad adoption by camera manufacturers and platforms, and it can be defeated by re-recording or by stripping metadata (Corsi et al., 2024).

In the health domain, where AI-generated text received the highest threat ratings of the four modalities (M = 5.80), respondents suggested greater regulatory attention toward labeling AI-generated health content and improving medical fact-checking infrastructure (De Angelis et al., 2023). The World Health Organization’s infodemic-management framework (World Health Organization, 2020) offers an operational template: it pairs active listening for circulating health claims with rapid authoritative rebuttal and amplification through trusted local messengers. It was developed before current large language models, but because it targets the circulation of false health claims rather than their means of production, it transfers to AI-generated text with little modification. Experts gave audio deepfakes the highest average threat ratings in the financial domain (M = 5.65), aligning with growing evidence on voice-cloning fraud. In 2024, a Hong Kong finance worker was deceived into transferring $25 million through a deepfake video call (Chen & Magramo, 2024). The U.S. Treasury’s Financial Crimes Enforcement Network has since issued a sector-wide alert on deepfake-enabled fraud against financial institutions (FinCEN, 2024)—an early example of the type of domain-specific guidance highlighted by many respondents. The expert responses suggest that voice-authentication standards for high-value transactions deserve increased attention, and they raise questions about the adequacy of existing know-your-customer (KYC) protocols in an environment where a live voice or video is no longer reliable evidence of identity (Chesney & Citron, 2019).

A contested, not polarized, mitigation landscape

Respondents rated five mitigation strategies: government regulation, digital watermarking, media literacy, platform enforcement, and technical detection. Likert effectiveness ratings for all five strategies are right-skewed and unimodal: the share of respondents rating a strategy 5 or higher on the 7-point scale ranged from 63% (technical detection) to 74% (government regulation), with no bimodal distribution. The two question formats point in different directions. On the Likert ratings, every strategy is broadly endorsed. On the forced-choice ranking, no strategy commands a majority and the same strategy can appear at both ends: government regulation drew 30% of “most effective” votes but also 15% of “least effective” votes, and media literacy 26% against 24%. Experts agree that each strategy can contribute; they disagree on which should come first. The landscape is contested rather than polarized, mirroring a recent HKS Misinformation Review survey on generative AI in Europe (Weikmann et al., 2026).

Psychological inoculation deserves a more prominent place in this priority debate than our respondents gave it; it was not among the five strategies we asked about, and no respondent volunteered it. Pre-exposing audiences to weakened forms of misinformation techniques builds resistance that persists across topics and time horizons (van der Linden, 2023), and game-based inoculation has shown durable real-world effects at scale (Roozenbeek & van der Linden, 2024). Detection tools face a perpetual arms race with generative AI models (Hoq et al., 2025; Murphy et al., 2023; Rana et al., 2022). Direct quotations below are attributed by name only to the 13 respondents who explicitly consented to such attribution; all other respondents are described generically. One respondent, the researcher and digital artist publishing as Merzmensch, captured the urgency: “Literacy! Literacy! Literacy! From the first classes in school.” Another respondent, technology professional Alberto Lobato Diogo, underscored the layered character of any realistic response: “GenAI based on LLMs are mathematically impossible to have full-proof mitigation systems, so we need a combination of all of the above.”

Public-awareness tools reach the wrong audiences

Experts rated public-awareness tools as moderately effective (M = 4.43), and one third identified the same central limitation: these tools reach mainly audiences that are already technically confident. Guo et al. (2025) report the same asymmetry from a different angle, finding that the populations most vulnerable to AI-generated disinformation are also the least likely to adopt technical countermeasures. Our respondents’ assessment therefore suggests that effective mitigation may need to extend beyond tool development to distribution, accessibility, and integration into platforms where vulnerable users already consume information. One respondent, Katerina Sedova of the Atlantic Council, warned: “As chatbots become ubiquitous, get intertwined with human lives, and even invite real emotional connection and dependence from humans, it will be critical to ensure that these mediums are not weaponized.”

Toward a layered, domain-weighted response

Because no single strategy commands consensus while each is broadly seen as workable, the responses point toward combination rather than selection. Grouping the five rated strategies by the mechanism through which they act yields four pillars: provenance (digital watermarking and technical detection, which act on the artifact), audience-side literacy (media literacy, which acts on the recipient), statutory regulation (government regulation, which acts on the producer), and platform enforcement (which acts on distribution). The number four here is coincidental and carries no relation to the four modalities or the four domains.

The pillars are not weighted equally across domains. Our respondents’ domain-by-modality ratings suggest different entry points: provenance first for political video, where authenticity of the artifact is the contested question; labeling and medical fact-checking for health text, where the claim rather than the medium carries the harm; voice authentication and KYC modernization for financial audio, where the attack targets an identity check; and accessibility-first literacy for the social domain, where harm is diffuse and no single chokepoint exists. Appendix Table C4 sets out this priority matrix. It is a starting point derived from perceptions, not a validated framework, and we present it as a hypothesis for testing.

Findings

Finding 1: Experts rate video deepfakes as the most threatening modality overall. 

Throughout the Findings, ratings use a 7-point scale (1 = not threatening; 7 = extremely threatening) MSD. Across all domains, video deepfakes received the highest average threat rating (M = 6.19, SD = 1.19), followed by audio (M = 5.91,SD = 1.25), images (M = 5.74, SD = 1.13), and text (M = 5.57, SD = 1.36). This pattern is broadly consistent with previous work suggesting that synthetic content in higher-fidelity modalities carries greater persuasive force, and that untrained observers find fabricated video and audio harder to identify as synthetic than fabricated text (Corsi et al., 2024; Guo et al., 2025).

Finding 2: Perceived modality threats vary systematically across domains. 

Within this sample, the political domain received the highest average threat ratings, with deepfake video peaking at M = 6.31 (SD = 1.15). The confidence intervals political-domain video and audio overlap, however. In plain terms: with 54 respondents, the difference between these two ratings is small enough that it could plausibly be a product of who happened to answer the survey rather than a real difference in expert opinion. The ordering should be read as suggestive, not established.

The social domain followed a similar pattern (video M = 6.00; images M = 5.76). The health domain showed a different pattern: text was rated as the most threatening (M = 5.80, SD = 1.32), while images (M = 5.13), audio (M = 5.02), and video (M = 5.13) clustered lower. However, confidence intervals overlap across all four health-domain modalities, so this pattern should be treated as suggestive rather than definitive. One possible explanation is that health misinformation reaches audiences mainly in written form, from fabricated studies to AI-generated health advice, so experts see text as the more likely route to harm in this domain (De Angelis et al., 2023).

In the financial domain, audio received the highest mean rating (M = 5.65, SD = 1.62), though confidence intervals do not clearly separate it from video or text.

Finding 3: Experts identify voice-cloning fraud as the most urgent risk. 

Election interference via deepfake video was identified as the most urgent risk by 78% of respondents, consistent with widespread public concern documented in recent surveys of U.S. voters (Yan et al., 2025). The next tier comprised cyberattacks (46%) and non-consensual deepfake imagery (46%), though Wilson confidence intervals for these proportions are wide (approximately 33%–60%), indicating substantial uncertainty in the precise ranking below election interference.

Finding 4: Experts view no single mitigation strategy as universally effective. 

On a 7-point effectiveness scale, government regulation received the highest mean rating (M = 5.24, SD = 1.65), followed by digital watermarking (M = 5.20), media literacy (M = 5.07), platform enforcement (M = 4.91), and technical detection (M = 4.57). Bootstrap confidence intervals overlap for the top four strategies, indicating that the differences among them are not statistically distinguishable; only technical detection falls somewhat below the others. All five distributions are right-skewed and unimodal (63–74% of respondents at ≥ 5; see Appendix Table C2). In a separate item, respondents ranked the same five strategies from 1 (most effective) to 5 (least effective). Mean ranks fell in a narrow band from 2.98 to 3.28, close to the midpoint of 3 that would result from no agreement at all. This aligns with prior expert survey research showing persistent disagreement about optimal responses to misinformation (Altay et al., 2023).

Methods

This study is exploratory. We did not pre-register hypotheses; we sought a broad descriptive map of expert threat assessments across modalities, domains, and mitigation strategies. The present manuscript reports preliminary findings from this dataset.

Going in, we held three loose expectations grounded in the existing literature: (a) higher-fidelity modalities (video, audio) would dominate threat ratings, with video especially salient in the political domain (Corsi et al., 2024); (b) audio threats would cluster in the financial domain, given the rise of voice-cloning fraud (Chen & Magramo, 2024); and (c) experts would split into recognizable camps along a tech-fix-versus-regulation axis (Altay et al., 2023). The data confirmed (a) and (b) but contradicted (c): rather than camp-formation, we observed broad agreement that each strategy can work alongside disagreement on which deserves priority. We treat this contrast between expectation and finding as a hypothesis source for confirmatory follow-up rather than as a tested claim.

We conducted a structured online survey between July 2025 and March 2026. Eligible participants were professionals or scholars with demonstrated recent activity on AI-driven disinformation; eligibility was operationalized by requiring respondents to provide a link to a recent publication, project, or public engagement on the topic. The link served as a soft validation; no formal post-response screening or exclusion was applied, and all 54 valid responses are retained in the analyses.

Recruitment combined targeted expert recruitment with snowball extension. We identified 516 candidates through systematic Google Scholar, LinkedIn, Mastodon, and Bluesky searches, supplemented by authors of recent publications cited in our broader research program. We directly contacted 454 candidates via individualized messages (email 47%, LinkedIn 21%, Mastodon DM 8%, Bluesky 4%, mixed/other 20%); recipients were invited to forward the survey to relevant colleagues. The questionnaire (54 items, mostly 1-to-7 rating scales) is reproduced in Appendix A; the recoding scheme for free-text role descriptions is documented in Appendix B.

We received 54 valid responses (response rate 11.9% from over 454 directly contacted; the absolute number of forwards via snowball is unknown). The equal number of items (54) and respondents (54) is coincidental. Recoding the open-text role field yielded seven coherent categories: AI/ML researchers and developers (39%); disinformation, fact-checking, journalism, or media research (26%); other practitioners and academics (13%); cybersecurity, defense, and threat-intelligence (6%); policymakers and regulators (6%); provenance, standards, and infrastructure professionals (6%); and ethics, legal, and governance (6%). Respondents had a median of 17 years of experience and high self-rated familiarity with both large language models (M = 4.89/7) and deepfake technology (M = 4.54/7). Respondents were distributed across five geographic areas: European Union (n = 23, 43%), North America (n = 19, 35%), non-EU Europe including the United Kingdom (n = 7, 13%), Asia-Pacific (n = 4, 7%, comprising East and Southeast Asia, South and Central Asia, and Oceania), and one respondent (2%) who selected “Global,” an option offered for experts whose work is not tied to a single region. No respondent was based in Africa or in Latin America, although both were available options. Sample characteristics by category appear in Appendix Table C1.

Participants chose one of three publication-handling preferences at the end of the survey: full anonymity (n = 27, 50.0%), name and affiliation in Acknowledgments (n = 14, 25.9%), or attribution of specific quotes by name in addition to acknowledgment (n = 13, 24.1%). All four respondents quoted by name in this manuscript fall in the third group; “Merzmensch” is a long-standing artistic identity under which the respondent has published creative and scholarly work and was supplied as the preferred attribution.

Quantitative data were analyzed descriptively (means, standard deviations, frequencies). Consequently, the reported differences should be interpreted as descriptive patterns rather than evidence of statistically significant differences between modalities or domains. Given the exploratory design and sample size, we report descriptive statistics rather than inferential tests. To convey estimation uncertainty, figures display 95% bootstrap confidence intervals (10,000 iterations with a fixed random seed for reproducibility) for mean ratings, and 95% Wilson score confidence intervals for binomial proportions.

Limitations

The sample (N = 54) is purposive, not representative, and skews toward Western, technically proficient experts: 91% of respondents are based in the European Union, North America, or non-EU Europe, with the Global South substantially underrepresented. Self-selection bias may inflate threat perceptions among respondents already concerned about AI-driven disinformation. The survey measures perceptions rather than observed impacts, and the rapidly evolving capabilities of generative AI may shift expert assessments substantially within months. Sub-domain comparisons are descriptive only and underpowered for inferential testing.

Because the sample contains a comparatively large proportion of AI researchers and disinformation specialists, the observed priorities likely reflect expert perspectives on AI-related risks rather than broader societal perceptions. This composition may have influenced which domains were viewed as most concerning.

All respondents were 18 or older and provided informed consent prior to participation. The consent form, displayed at the start of the survey, described the study purpose, voluntary nature of participation, anticipated time commitment, data-handling procedures, and the three publication-handling options described above. The survey did not collect special-category personal data and was conducted in accordance with the EU General Data Protection Regulation. The study protocol was reviewed against the data-minimization and lawful-basis requirements of the EU General Data Protection Regulation (consent under Art. 6(1)(a) GDPR). Direct quotations are attributed by name only for the 13 respondents who explicitly opted in to such attribution.

The post Experts disagree on how to fight AI disinformation, but agree that health and politics need different solutions first appeared on HKS Misinformation Review.