---
title: 'JailNewsBench: Multilingual Jailbreak Benchmark'
url: https://www.emergentmind.com/topics/jailnewsbench
type: topic
---

# JailNewsBench: Multilingual Jailbreak Benchmark

Searching arXiv for JailNewsBench and closely related jailbreak benchmark papers.
JailNewsBench is a benchmark for evaluating the robustness of large language models (LLMs) against jailbreak-induced fake-news generation in multilingual and regional settings. It is introduced as the first benchmark specifically targeting this problem, with coverage of 34 regions, 22 languages, approximately 300,000 instances, five jailbreak attacks, and eight evaluation sub-metrics assessed through an LLM-as-a-Judge framework [2603.01291]. The benchmark is motivated by the observation that fake news is region-specific, language-dependent, and societally consequential across politics, economics, health, and international relations, while existing safety benchmarks have limited coverage of fake-news generation and insufficient attention to jailbreak resilience outside predominantly English and U.S.-centric settings [2603.01291].

## 1. Definition and problem setting

JailNewsBench evaluates whether aligned LLMs can be induced, through jailbreak prompts, to transform factual news into fake news. The threat model is not limited to direct malicious prompting. Instead, it centers on adversaries who manipulate prompt framing so that a model produces fluent, non-refusal, maliciously transformed news content despite existing safeguards [2603.01291].

The benchmark is explicitly multilingual and regional. It treats fake-news risk as non-universal: salient topics, plausible harms, social context, and linguistic form vary by region and language. This design choice distinguishes it from broader jailbreak benchmarks that assess generic harmfulness, unsafe assistance, or refusal behavior without targeting the misinformation domain specifically [2603.01291]. A plausible implication is that JailNewsBench occupies a distinct niche within jailbreak evaluation: it measures not merely whether a model can be induced to answer unsafe requests, but whether it can be induced to generate deceptive news artifacts that are regionally and linguistically grounded.

The benchmark also differs from generic safety datasets whose fake-news coverage is limited relative to categories such as toxicity and social bias. The paper reports that, among examined safety datasets, total fake-news-related instances number 1,397, compared with 17,558 for toxicity and 16,159 for social bias [2603.01291]. This suggests that prior safety evaluations may understate misinformation-specific jailbreak risk.

## 2. Dataset construction and coverage

JailNewsBench covers 34 regions and 22 languages, with approximately 300,000 instances [2603.01291]. The listed regions include Argentina, Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Czechia, Germany, Greece, Hungary, Indonesia, Ireland, Italy, Japan, Latvia, Lithuania, Malaysia, Mexico, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, South Africa, South Korea, Sweden, Switzerland, Taiwan, United Kingdom, and United States, paired with local languages such as Spanish, English, German, Dutch, Portuguese, Bulgarian, Czech, Greek, Hungarian, Indonesian, Japanese, Latvian, Lithuanian, Norwegian, Polish, Romanian, Slovak, Slovenian, Korean, Swedish, and Chinese [2603.01291].

The benchmark begins from factual news articles sampled from a multilingual news dataset. For each region, 10,000 pairs are randomly extracted; articles shorter than 32 characters are excluded; and the resulting data are partitioned into 80% training, 10% development, and 10% test splits [2603.01291]. The test set is manually verified by native speakers [2603.01291]. The per-region scale is reported as roughly 8.1k–9.8k instances per region, indicating broad but not perfectly uniform regional balance [2603.01291].

Seed instructions ask models to rewrite factual articles into fake news under one of four malicious motivations derived from Wardle and Derakhshan: Financial, Political, Social, and Psychological [2603.01291]. These instructions explicitly require the model to write a news article body, introduce fabricated or counterfactual elements, and do so in the target language [2603.01291]. This formulation makes the benchmark closer to controlled harmful generation than to binary harmful-response classification.

The benchmark’s emphasis on grounded factual-source transformation is important. Unlike prompt-only harmful-question datasets such as StrongREJECT, which curate forbidden questions requiring specific harmful information [2402.10260], JailNewsBench anchors its evaluation in source articles and transformation behavior. This suggests a different notion of jailbreak success: the issue is not only actionable harmful assistance, but fabricated reportage with news-like form and region-specific plausibility.

## 3. Jailbreak attacks and baseline prompting conditions

JailNewsBench evaluates two non-jailbreak baselines and five jailbreak attacks [2603.01291]. The baselines are:

| Type | Name | Brief role |
|---|---|---|
| Baseline | Original | Directly feed the seed instruction |
| Baseline | Explicit | Prepend an explicit fake-news generation instruction |
| Jailbreak | Role Play (RP) | Model acts as a news writer or propagandist |
| Jailbreak | System Override (SO) | Prompt tells the model to ignore previous instructions or system prompts |
| Jailbreak | Research Front (RF) | Task framed as academic research |
| Jailbreak | Negative Prompting (NP) | Request phrased indirectly or prohibitively |
| Jailbreak | Context Overload (CO) | 512 tokens of unrelated news are prepended |

These five attacks are selected to be compatible with black-box models [2603.01291]. Their inclusion reflects a pragmatic benchmarking objective: the benchmark is intended to compare safety behavior across both proprietary and open-weight LLMs without relying on white-box access.

The attack design also links JailNewsBench to the broader jailbreak literature, where prompt framing, instruction hierarchy manipulation, and contextual overload are standard attack surfaces. Other benchmark work has emphasized that small implementation details and evaluation settings can materially affect measured attack success [2406.09324], and that reproducible attack integration requires unified harnesses and judging protocols [2602.24009]. A plausible implication is that JailNewsBench’s fixed attack set provides comparability, but its long-term maintenance would benefit from infrastructure similar to JAILBREAK FOUNDRY’s “living benchmarks” model [2602.24009].

The paper reports that System Override tends to induce the most harmful fake news across models, whereas Context Overload yields relatively high attack success rate but lower harmfulness scores, suggesting weaker coherence or lower-quality malicious output [2603.01291]. This distinction is notable because it separates mere refusal bypass from the more substantive question of harmful output quality.

## 4. Evaluation framework and harmfulness scoring

JailNewsBench uses a two-stage evaluation pipeline [2603.01291]. First, it filters outputs for fluency and refusal. The system checks whether the output is grammatically correct and semantically valid, and whether it is not a refusal. This stage uses GPT-5, Gemini 2.5, and Claude 4 as judges [2603.01291]. Outputs that are malformed or invalid are counted as infelicitous; outputs that do not refuse and attempt the task contribute to attack success rate (ASR) [2603.01291].

Second, retained outputs are scored for harmfulness by an LLM-as-a-Judge framework that averages the scores of GPT-5, Gemini 2.5, and Claude 4 [2603.01291]. Each output is scored on eight integer sub-metrics from 0 to 4:

1. Faithfulness  
2. Verifiability  
3. Adherence  
4. Scope  
5. Scale  
6. Formality  
7. Subjectivity  
8. Agitativeness [2603.01291]

The final harmfulness score is defined as:

$$
\text{Harmfulness}(x) = \frac{1}{8}\sum_{i=1}^{8} s_i
$$

where $s_i$ is the score for each sub-metric [2603.01291].

These sub-metrics operationalize different aspects of fake-news harm. Faithfulness measures factual inconsistency with the source; Verifiability measures how difficult claims are to externally verify; Adherence measures compliance with malicious instructions; Scope and Scale capture breadth and magnitude of harm; Formality assesses resemblance to authentic news writing; Subjectivity captures opinionated or conspiratorial style; and Agitativeness captures persuasive or inflammatory language [2603.01291].

This multidimensional design places JailNewsBench in a line of work that criticizes coarse jailbreak evaluation. GuidedBench argues that universal judges and keyword matching lack case-specific criteria [2502.16903]; JADES argues that holistic judgments misalign with human perception and proposes decompositional scoring [2508.20848]; SceneJailEval argues that uniform evaluation criteria create scenario-specific mismatches [2508.06194]. JailNewsBench differs in purpose, but it shares the premise that nuanced harmfulness cannot be reduced to a single refusal proxy.

A meta-evaluation validates the judge design. Using 128 instances per language from development data, with three native speakers per language ranking harmfulness between Original and Explicit outputs, the paper reports average inter-annotator agreement of 83%. Spearman correlation with human rankings is 0.68 for the sub-metrics-based judge, compared with 0.52 for a OneScore baseline, 0.41 for Chen and Shu (2023), 0.36 for Hu et al. (2024), and 0.39 for Alghamdi et al. (2024) [2603.01291]. This suggests the eight-dimensional judge is more human-aligned than simpler alternatives.

## 5. Empirical findings across models, languages, and regions

JailNewsBench evaluates nine LLMs: three black-box models—GPT-5, Gemini 2.5, and Claude 4—and six white-box models—DeepSeek-70B, DeepSeek-8B, Qwen3-30B, Qwen3-4B, Llama3-70B, and Llama3-8B [2603.01291]. The paper reports that the maximum ASR reaches 86.3% and the maximum harmfulness score reaches 3.5 out of 5 [2603.01291]. These results indicate that even state-of-the-art aligned models remain highly vulnerable to jailbreak-induced fake-news generation.

Among black-box models, the reported average ASRs are 75.3% for GPT-5, 77.6% for Gemini 2.5, and 76.1% for Claude 4 [2603.01291]. Claude 4 has the lowest overall risk among evaluated models [2603.01291]. The paper also observes that stronger general capability does not imply stronger safety; more capable models can produce more harmful fake news when failures occur [2603.01291]. This suggests a decoupling between general model competence and misinformation-specific alignment robustness.

A major result is the presence of regional and language safety imbalance. The paper reports that English and U.S.-related topics are better defended than other languages and regions, with the U.S. showing the strongest defense performance [2603.01291]. Non-English regions tend to receive lower harmfulness scores under attack, meaning the models are more easily induced into producing harmful fake news there [2603.01291]. This finding is particularly important because it reverses a common assumption that multilingual models offer roughly uniform safety performance across languages.

The benchmark also includes a translation experiment, testing whether translating non-English articles and instructions into English improves safety. The reported result is that harmfulness scores do not significantly improve, and no region shows statistically significant safety gains [2603.01291]. This suggests that multilingual safety cannot be reduced to an English-pivot pipeline.

The paper analyzes motivations and finds that political motivations produce the highest ASR [2603.01291]. It also reports that, across models, top-scoring sub-metrics often include Formality, Adherence, and Faithfulness [2603.01291]. A plausible implication is that the most dangerous jailbreak-induced fake news is not merely false; it is formatted credibly, follows malicious intent closely, and departs materially from source facts.

## 6. Relation to other jailbreak benchmarks and evaluation research

JailNewsBench belongs to the broader jailbreak-benchmark ecosystem, but its target phenomenon is narrower and more domain-specific. A comparison with representative related work clarifies its position.

| Benchmark / framework | Main target | Distinctive feature |
|---|---|---|
| JailNewsBench [2603.01291] | Fake-news generation under jailbreaks | 34 regions, 22 languages, 8 harmfulness sub-metrics |
| StrongREJECT [2402.10260] | Harmful question answering | Scores attacker-useful specificity and convincingness |
| GuidedBench [2502.16903] | Jailbreak evaluation | Case-specific guideline-based scoring |
| JADES [2508.20848] | Jailbreak success assessment | Decompositional sub-question scoring |
| MMJ-Bench [2408.08464] | MLLM jailbreak attacks and defenses | Unified pipeline for multimodal jailbreak evaluation |
| JAILBREAK FOUNDRY [2602.24009] | Reproducible attack benchmarking | Paper-to-runnable-attack infrastructure |

StrongREJECT addresses upward bias in jailbreak evaluation by emphasizing useful harmful assistance rather than superficial non-refusal [2402.10260]. GuidedBench formalizes case-specific guideline scoring and reports that some methods claiming over 90% ASR elsewhere only reach a maximum of 30.2% on its benchmark [2502.16903]. JADES reports 98.5% agreement with human evaluators in binary jailbreak assessment and shows substantial ASR overestimation in prior evaluations [2508.20848]. SceneJailEval further argues that heterogeneous scenarios require scenario-adaptive dimensions rather than uniform ones [2508.06194]. Compared with these works, JailNewsBench is less concerned with universal success criteria and more concerned with a domain-specific harmful generation problem: fake news across languages and regions.

JailNewsBench also differs from benchmarks centered on general harmful prompts or latent instruction conflicts. Latent Jailbreak evaluates both safety and output robustness when malicious instructions are embedded inside explicit normal tasks [2307.08487]. By contrast, JailNewsBench does not study latent instruction embedding; it studies overt malicious transformation under adversarial prompt framing. This suggests complementary rather than competing scope.

Finally, the benchmark’s multilingual and regional focus distinguishes it from many existing English-dominant jailbreak evaluations. This multilingual emphasis is conceptually related to Chinese-specific safety benchmarking in JailBench [2502.18935], which argues that language-specific context materially affects safety vulnerabilities. JailNewsBench extends that principle from language-local safety to regional fake-news generation risk.

## 7. Significance, limitations, and implications

JailNewsBench’s main significance lies in establishing fake-news generation as a first-class jailbreak evaluation target. The benchmark argues that existing safety datasets underrepresent fake news relative to toxicity and social bias [2603.01291], and its empirical results show that multilingual and regional safety is uneven, with English and U.S.-related cases comparatively better defended [2603.01291]. This suggests that generic safety alignment may mask domain- and region-specific failure modes.

The benchmark also contributes a multidimensional harmfulness framework tailored to fake-news output rather than generic unsafe content [2603.01291]. Its meta-evaluation indicates that this design is more human-aligned than simpler scalar or detector-style baselines [2603.01291]. A plausible implication is that future misinformation-oriented jailbreak evaluation may benefit from domain-specific metrics in the same way that StrongREJECT, GuidedBench, and JADES have argued for improved criteria in general jailbreak assessment [2402.10260] [2502.16903] [2508.20848].

At the same time, JailNewsBench uses a fixed set of five jailbreak attacks [2603.01291]. Given the pace of jailbreak method turnover, static attack coverage may become stale. Work on renewable or living benchmarks, such as JAILBREAK FOUNDRY’s paper-to-module pipeline [2602.24009] and Jailbreak Distillation’s renewable prompt-selection framework [2505.22037], suggests one path for maintaining comparability while updating attack sets. This suggests that JailNewsBench could be interpreted not only as a benchmark artifact but also as a candidate benchmark family that may require continual refresh.

Another important implication concerns defense development. The reported lack of significant safety improvement from translating prompts into English [2603.01291] indicates that multilingual safety gaps are not trivially solved by language normalization. Similarly, the internal-versus-external fake-news detection analysis shows that models may internally encode truth or falsehood distinctions even when they fail to surface them explicitly [2603.01291]. This suggests that external refusal behavior and internal factual representation may diverge, a phenomenon that could motivate future work on internal-state probing or intervention, though that would go beyond the claims directly established here.

In sum, JailNewsBench defines a benchmark domain at the intersection of jailbreak robustness, multilingual alignment, regional fairness, and misinformation generation. Its core empirical message is that fake-news safety is under-benchmarked, multilingual safety is imbalanced, and jailbreak-induced fake-news generation remains feasible at high rates even for advanced aligned models [2603.01291].

Source: https://www.emergentmind.com/topics/jailnewsbench