Source-linked AI summary
VEX-Bench: Benchmarking Verification Complexity of LLM-Generated Misinformation
Hanxun Huang, Yutao Wu, Qizhou Wang, Silvia Montaña-Niño, Yige Li, Xiang Zheng, Elif Buse Doyuran, Phoebe Matich, Xiao Liu, Xingjun Ma, Sarah Erfani, Christopher Leckie
TL;DR
Existing evaluations of LLM-generated misinformation do not capture how it consumes scarce verification capacity. VEX-Bench measures perceived verification complexity across multiple dimensions and combines it with elicitation yield. Its findings show that no single method dominates across dimensions, while verification can cost 3 to 169× more than generation.
Problem
Existing evaluations focus on generation-time risks and content characteristics rather than how LLM-generated misinformation consumes scarce verification capacity during real-world triage.
Source: §1 · pp. 1–2Method
VEX-Bench evaluates perceived verification complexity across five journalism-derived dimensions and combines it with elicitation yield in an integrated VEX score.
Source: §1 · p. 2, §5 · p. 10Results
No elicitation method dominates across all five dimensions, and highest-VEX content does not consistently come from the most effective methods; verification is 3 to 169× more costly than generation.
Source: §1 · p. 2Takeaways & Limitations
VEX-Bench offers a reusable framework for comparing misinformation attack and defense strategies by their impact on downstream verification burden.
Source: §1 · p. 2The dimensions require interpretive judgments without single ground-truth labels, and large-scale human annotation is infeasible, motivating LLM judges that introduce systematic biases.
Source: Broader Impact and Limitations · p. 19
Abstract
from arXiv · showhide
Large language models (LLMs) have made misinformation inexpensive to produce but not to verify, creating a growing asymmetry in the information ecosystem. Under tight time, labor, and budget constraints, media organizations, platforms, and fact-checkers rely on screening to prioritize which content to verify. We introduce VEX-Bench, a unified benchmark for evaluating the verification complexity of LLM-generated misinformation, as perceived during screening, across models and generation methods. Verification complexity is assessed along multiple dimensions derived from journalistic and fact-checking practices, capturing checkability, harm potential, source credibility signals, imposter legitimacy, and expected verification effort. We define the VEX score as an integrated measure combining elicitation yield and verification complexity to quantify how generated content consumes limited verification capacity. We construct a benchmark spanning two misinformation categories, 6 high-stakes domains, and 60 real-world topics, and evaluate 7 frontier LLMs and 7 generation methods, yielding 5{,}880 articles. We employ an LLM-as-judge for scalable evaluation and validate it using content-analysis methodology, including ordinal Krippendorff $\alpha$ for inter-annotator reliability, complemented by fact-checking agents for verification. Our findings show that no single method dominates all dimensions, underscoring the need for multi-dimensional evaluation. LLMs can generate high-VEX misinformation at 3$\times$ to 169$\times$ lower cost than agent-based verification. Such content is often prioritized during screening, consuming scarce verification resources and introducing a systematic risk of misallocation in resource-constrained verification systems. The code is publicly available in our \href{https://github.com/HanxunH/VEX-Bench}{GitHub repository}.
1 Introduction
Existing evaluations of LLM-generated misinformation focus on generation-time risks, while real-world verification requires triage under scarce resources. VEX-Bench evaluates perceived verification complexity and finds that elicitation success does not predict which outputs impose the greatest verification burden.
1 Introduction
- Verification is a resource-constrained triage process, yet existing evaluations do not account for how generated misinformation consumes scarce verification capacity.Adjudicating a claim can require evidence retrieval, cross-source comparison, temporal grounding, and domain expertise.Source: §1 · p. 2
- VEX-Bench evaluates perceived verification complexity across models and elicitation methods using checkability, harm significance, source credibility, imposter legitimacy, and verification cost.It integrates these dimensions in a VEX score and grounds them in journalism and fact-checking practices.Source: §1 · p. 2
- Comparable elicitation success rates can yield markedly different verification complexity, while verification is 3 to 169× more costly than generation.High-VEX content can be prioritized during screening despite negligible marginal generation cost.Source: §1 · p. 2
- VEX-Bench provides a reusable framework for benchmarking misinformation attack and defense strategies by their impact on downstream verification burden.The existing evaluation paradigms focus on detecting generated content, audience plausibility, or model susceptibility rather than downstream verification consequences.Source: §1 · pp. 1–2
- The benchmark formalizes verification complexity as a distinct risk-evaluation axis and uses ordinal Krippendorff α to assess agreement across human and LLM evaluators.Fact-checking agents provide an additional validation signal.Source: §1 · p. 2
- No single elicitation method dominates across all five dimensions, and the highest-VEX content is not consistently produced by the most effective methods or highest-risk models.These findings support evaluating misinformation risk across multiple dimensions.Source: §1 · p. 2
2 Related Works
Prior work evaluates misinformation detection and elicitation success, while fact-checking research studies verification and triage. VEX-Bench combines these verification-centered perspectives with multidimensional screening judgments assessed using LLM judges and content-analysis methods.
2 Related Works
- Misinformation and safety evaluations assess detectability, audience plausibility, refusal behavior, attack success, or harmfulness, but success-centric metrics can conflate elicitation with downstream risk.VEX-Bench shifts attention to perceived verification complexity at screening time.Source: §2 · p. 3
- Fact-checking studies model verification as a resource-intensive retrieve–decompose–verify process, while check-worthiness commonly prioritizes claims using a binary or scalar signal.LLM-assisted decomposition, retrieval-augmented systems, and verification frameworks have not removed the resource burden.Source: §2 · p. 3
- Organizational studies characterize verification as triage shaped by source-credibility cues and human-in-the-loop workflows; VEX-Bench scores content across multiple practice-derived dimensions.Its perspective builds on journalism and fact-checking practice.Source: §2 · p. 3
- LLM judges scale interpretive evaluation through comparisons or rubric scoring, but documented biases motivate validating them with content-analysis methodology.The cited concerns include position, consistency, self-preference, and fairness biases.Source: §2 · p. 3
3 VEX-Bench
VEX-Bench standardizes comparisons of misinformation generation and evaluates articles using screening-oriented verification-complexity judgments. Its protocol combines five dimensions with elicitation yield and validates judge ratings against human annotations.
3.1 Benchmark Settings and Structured Outputs
- VEX-Bench fixes each task, domain, and topic across model–method pairs to compare elicitation success, complexity scores, and factual-verification outcomes.It covers fabrication and rewriting, six high-stakes domains, and 60 neutral topics; structured article outputs preserve credibility cues and isolate the central claim.Source: §3.1 · pp. 3–4
3.2 Proposed Evaluation Protocol
- Articles receive five 1–5 screening judgments: checkability, harm significance, source credibility, imposter legitimacy, and verification cost.Complementary claim-support and entity-integrity outputs assess factual support and whether named entities and attributions correspond to real-world entities.Source: §3.2 · pp. 4–5
- The VEX score combines normalized elicitation success, non-refusal rate, and verification-complexity dimensions, with equal weighting within each selected subset.The default aggregates all dimensions; the authors describe this simple aggregation as illustrative and note organizations may use alternative weightings.Source: §3.2 · p. 5
- Human validation uses two independent, metadata-blind annotators to score a 100-article held-out set for appearance-level complexity, then adjudicates disagreements.Annotators use article text alone, without external search or fact-checking tools.Source: §3.2 · p. 5
3.3 Judge Validation Metrics
- Judge validation compares evaluators pairwise at the dimension level using Spearman’s ρ for rank-order consistency and ordinal Krippendorff’s α for ordered-score agreement.The protocol also examines human–human, human–LLM, and LLM–LLM agreement and compares its judges with existing judges.Source: §3.3 · pp. 5–6
4 Experiments
The experiments evaluate seven frontier LLMs and seven generation methods across fabrication and rewrite, using LLM judges validated against human annotations and fact-checking signals. Results show distinct risk profiles across methods, models, and tasks, alongside a large generation–verification cost gap.
4.1 Judge Validation Results
- All primary-judge–human pairs fall within the tentative-to-reliable agreement range, and D3 agreement exceeds α ≥0.800 for human–human and primary-judge–human pairs.Uncalibrated additional judges show slightly lower agreement, approaching the tentative threshold.Source: §4.1 · p. 6, Figure 2 · p. 7
- VEX-Bench dimensions remain weakly to moderately associated with JNB, with no pair indicating redundancy.D3 has no direct JNB counterpart; D5 captures the quantity and difficulty of verification, whereas JNB verifiability focuses on the hardest claim. D4’s moderate negative associations with JNB subjectivity and agitiveness reflect stylistic properties of polished yet inflammatory outputs.Source: §4.1 · p. 7, Figure 3 · p. 7
- D3 correlates positively with entity integrity, while D5 correlates positively with insufficient-claim proportion; D3 is largely independent of claim support, and D5 is unrelated to entity integrity.These patterns support interpreting D3 as perceived credibility and D5 as verification cost without treating the judge as performing factual verification.Source: Figure 4 · p. 8, §4.1 · p. 8
4.2 Benchmark Results
- Rewrite inherits source credibility cues, while fabrication makes verification cost more salient; elicitation success does not reliably predict verification complexity.In fabrication, ISC, DisinfoCap, and MisinfoQA achieve SR ≥95% yet have different profiles, while PAP’s successful outputs score highest on D1 and D5 despite lower NR.Source: §4.2 · pp. 8–9
- ISC ranks highest among methods, DeepSeek-V4 among models, and DisinfoCap with Grok-4.1 has the highest-risk interaction average, ranking first in 11 of 62 instances.PoisonRAG has 15 top-ranked instances across the 62 configurations.Source: Figure 5 · p. 9, §4.2 · p. 9
- Fabrication mixes recognizable real institutions with fabricated persons and contacts, and models reuse small subsets of expert-like names.The authors suggest that model-specific name reuse may offer a direction for model attribution.Source: Figure 6 · p. 9, §4.2 · p. 9
4.3 Cost Estimation
- Web searches account for roughly two-thirds of fact-checking cost, and cheap generators costing about 0.1 cents per article can cost over 20 cents to verify.For Qwen3.5-Flash and Grok-4.1-Fast, the verification-to-generation cost ratios exceed 100×.Source: §4.3 · pp. 9–10, Table 2 · p. 10
5 Conclusion
VEX-Bench combines elicitation yield with multidimensional verification complexity to evaluate the verification burden of LLM-generated misinformation. Across 5,880 articles, risk varies across models, methods, and their interactions, with no consistent relationship between elicitation effectiveness and highest-VEX outputs.
5 Conclusion
- VEX-Bench evaluates verification complexity as perceived during screening and combines it with elicitation yield across 5,880 articles from seven frontier LLMs and seven generation methods.The benchmark examines variation across models, methods, and their interactions.Source: §5 · p. 10
- Verification complexity varies substantially across models, methods, and their interactions, with no consistent relationship between elicitation effectiveness and the highest-VEX outputs.The conclusion calls for multidimensional evaluation beyond success-based safety metrics.Source: §5 · p. 10
- The conclusion argues that safety evaluation should quantify effects on real-world verification systems, not only whether harmful content can be produced.The stated scope includes domains affecting public health, financial systems, and civic trust.Source: §5 · p. 10
Broader Impact and Limitations
The paper frames its contribution as risk evaluation rather than attack development and describes safeguards for presenting and releasing benchmark artifacts. It also identifies limits in agent-based verification and interpretive judging.
Broader Impact and Limitations
- The benchmark studies existing misinformation-generation and jailbreak methods under controlled conditions, with evaluation artifacts released in controlled form to reduce misuse risk.Contact information is de-identified in benchmark presentation and release materials.Source: Broader Impact and Limitations · p. 19
- All annotations were performed by the authors on synthetic generated content, and the annotation procedure collected no human-subject, user, or identifiable private data.The human review was conducted under the stated University of Melbourne and Deakin University ethics approvals.Source: Broader Impact and Limitations · p. 19
- The fact-checking agent assumes web retrieval is not adversarially manipulated and treats agent outputs as verification signals rather than ground-truth labels.Web retrieval cannot guarantee source accuracy, and the pipeline inherits typical access and time constraints.Source: Broader Impact and Limitations · p. 19
- Verification-complexity judgments are subjective, and LLM judges can retain systematic biases despite validation through inter-annotator reliability.The protocol uses ordinal Krippendorff α and validated agreement across human and LLM judges as its reliability criterion.Source: Broader Impact and Limitations · p. 19
A Benchmark
The appendix specifies the benchmark and its topics. Topics abstract recent high-salience issues while avoiding references to specific people, institutions, or countries.
A Benchmark
- The appendix provides the complete topic list, the five-dimension scoring rubric, the LLM-judge calibration process, and a conceptual comparison with JNB.The topic grid abstracts recurring news coverage into neutral labels to target semantic consistency rather than recall of specific events.Source: A Benchmark · p. 20, §A.1 · p. 20
A.1 Topics
- The benchmark covers 60 topics across six domains, with 10 benchmark-neutral topics per domain derived from news events from January 2025 to March 2026.The topic labels abstract real-world issues without editorial framing or references to specific persons, institutions, or countries.Source: Table 3 · p. 20, §A.1 · p. 20
A.2 Evaluation Protocols
The appendix supplies the full five-point scoring rubric, describes human–judge alignment procedures, and distinguishes VEX-Bench dimensions from related JNB measures. These sections clarify both how ratings are assigned and how their constructs differ.
A.2 Evaluation Protocols
- The five-point rubric spans claim checkability, harm significance, source credibility signals, imposter legitimacy, and verification cost.The scales range from opinion or unverifiable rhetoric to densely falsifiable claims, from no plausible harm to severe large-scale harm, and from quick checks to expert verification.Source: §A.2 · p. 21
A.3 Human–Judge Reliability Alignment
- GPT-5.2 is calibrated as the primary judge against human annotations using 100 articles, with five difficult cases as calibration anchors and a 50-sample held-out agreement test.Prompt optimization monitors Krippendorff’s α on 50 training samples before evaluation on the remaining 50.Source: §A.3 · p. 21
- Robustness checks reveal model-specific scoring tendencies, so brief bias-correction notes are added to non-primary judge prompts without changing the dimension definitions or calibration examples.Examples include Claude under-scoring D2 for protective framing and D5 for specialist rewrites, and Gemini over-crediting institutional citations on D3.Source: §A.3 · pp. 21–22
A.4 Conceptual Relationship to JNB
- Unlike JNB Verifiability’s focus on the least verifiable claim, D1 measures whether an article contains specific falsifiable claims, while D5 captures article-level verification burden.D2 adds a plausible belief-to-action harm pathway rather than measuring audience breadth or rhetorical intensity alone.Source: §A.4 · p. 22
- D3 isolates institutional authority cues, which JNB does not score as a separate dimension, and the judge results show no meaningful empirical correlation.JNB’s closest tangential reference is expert citations as an indicator of professional style.Source: §A.4 · p. 22
- D4 extends beyond JNB Formality by evaluating whether an article convincingly imitates its claimed format, separately from tone.The formats include news articles, official statements, expert commentary, opinion writing, editorials, and social-media posts.Source: §A.4 · p. 22
B Additional Experimental Results
The appendix adds judge-validation comparisons with JNB and StrongREJECT. The supplied figures describe pooled and task-specific correlations, while the StrongREJECT comparison shows weaker overlap than the JNB comparison.
B.1 Judge-validation comparisons
- Figure 7 reports pooled VEX-Bench–JNB correlations, with the broad pattern stable across Spearman rank-based and Pearson linear-association views.The appendix describes overall overlap as weak to moderate, with D4 aligning most clearly with tone-related dimensions, D5 showing moderate overlap with verifiability, D2 partly overlapping with scope, and D3 comparatively independent.Source: Figure 7 · p. 23
- Figure 8 shows task-specific Pearson correlations, with fabrication driving more overlap on impact- and verifiability-related dimensions and rewrite exposing dimensions JNB captures weakly or indirectly.The task split distinguishes where the frameworks overlap across the two tasks.Source: Figure 8 · p. 23
- Figure 9 compares VEX-Bench dimensions with StrongREJECT scores and shows weaker overlap than the JNB-based comparison.The comparison is presented as an additional check against a generic safety-oriented evaluation signal.Source: Figure 9 · p. 23
B.1 Judge Validation Results
VEX-Bench shows selective overlap with existing evaluation frameworks: some dimensions align with related constructs, while others remain distinct.
B.1 Judge Validation Results
- VEX-Bench overlaps selectively with JNB and StrongREJECT; neither baseline captures all of its verification-complexity constructs.JNB overlap is clearest for D4 tone-related dimensions, moderate for D5 verifiability, and partial for D2 scope; D3 is comparatively independent.Source: §B.1 · p. 23
- Fabrication drives more of the D2 and D5 overlap with JNB, while rewrite strengthens D4’s negative association with tone-related dimensions.Source: §B.1 · p. 23
- Across pooled tasks, overlap with JNB is weak to moderate in both Spearman and Pearson analyses.Source: §B.1 · p. 23
B.2 Analysis
Entity realism varies by type and domain: institutional anchors are often retained, while attribution-bearing entities are less reliable. Verification-complexity profiles and elicitation success also vary across domains.
B.2 Analysis
- Institutions are the most reliably real entity type across models, while real-person rates are 5%–36%, publication rates are at most 24%, and contact realism is 2%–6%.Institution realism ranges from about 89–90% for Grok-4.1-Fast and Qwen3.5-Flash to 59% for Gemini 3.1 Pro and 52% for GPT-5.4.Source: §B.2 · p. 24, Figure 10 · p. 24
- Recognizable public figures and publicly retrievable institutional contacts can survive in otherwise unreliable attribution chains, strengthening surface plausibility.Real contacts are often official press desks, hotlines, or media-relations channels; cited people include Jerome Powell and Gavin Newsom.Source: §B.2 · p. 24, Figure 10 · p. 24
- Fabricated contacts often reuse 202-555 phone-number templates, with variation concentrated in formatting and the final four digits.The repeated 202 area code gives distinct outputs an institutional appearance without requiring distinct contact information.Source: §B.2 · p. 24, Figure 10 · p. 24
- Domain variation is concentrated in D2–D4: health is highest on D2 Harm Significance, finance on D3 and D4, while D1 stays high and D5 varies less.The reported differences chiefly concern which part of verification burden outputs emphasize, rather than whether they contain falsifiable claims.Source: §B.2 · p. 25, Figure 11 · p. 25
- Elicitation success varies by domain and model: Grok-4.1-Fast stays high, Qwen3.5-Flash stays low, and Claude Sonnet 4.5 drops sharply in several domains.Claude’s declines are reported for health, identity groups, politics, and public safety relative to finance and environment; GPT-5.4 varies less and Gemini 3.1 Pro is comparatively stable.Source: §B.2 · p. 25, Figure 11 · p. 25
- Across domains, institutions remain the most reliably real entity type and contacts the weakest; person realism is highest in politics and finance and especially low in public safety.Source: §B.2 · p. 25, Figure 11 · p. 25
B.3 Benchmark Results
Tables 4 and 5 provide per-model results for fabrication and rewrite, respectively, with average performance summarized across models.
B.3 Benchmark Results
- The per-model tables expose model-specific variation and are described as consistent with aggregate patterns summarized in Table 1.Source: §B.3 · p. 25, Table 4 · p. 26, Table 5 · p. 27
- Table 4 reports per-model fabrication results by generation method and target model, with average performance across models and percentages for values.Bold marks the highest average in each column; a dash denotes no valid non-refused outputs for that metric.Source: Table 4 · p. 26
- Table 5 reports per-model rewrite results by generation method and target model, with percentages and changes from the original source article in parentheses.Bold marks the highest average in each column; a dash denotes no valid non-refused outputs for that metric.Source: Table 5 · p. 27
C Qualitative Example
This section presents a generated economic-news example alongside its fact-check, and documents the prompts and agent instructions used to evaluate and produce benchmark articles. It describes baseline prompts for generating misinformation from scratch or altering one fact in an existing article, with outputs organized as structured JSON.
C Qualitative Example
- Only 1 of 5 claims was supported, although all 9 of 9 entities were real; the checker flagged misleading CPI attribution and fabricated voting and employment figures.It also found that Arthur Laffer was described with the wrong board title.Source: C Qualitative Example · pp. 28–29
D Prompt and Skill
- The appendix reports the full verification-complexity judge prompt and baseline elicitation prompts used to generate benchmark articles.The prompts are mapped to a shared JSON output schema, while their elicitation logic remains method-specific.Source: D Prompt and Skill · p. 29, §D.3 · p. 32
Verification-Complexity Judge Prompt
- The judge scores checkability, harm potential, source credibility, imposter legitimacy, and verification cost on five-point scales.Its notes distinguish source legitimacy from journalistic mimicry and operational checking cost, and make checkability a gateway criterion for verification cost.Source: §D.1 · pp. 29–30
D.2 Fact-Checking Agent Skill
- The fact-checking agent extracts claims and entities, verifies them with web evidence, and produces structured verdicts with evidence-traceability and effort signals.Constraints and gates require contact pre-scanning and explicit refuting evidence before assigning a refuted verdict.Source: §D.2 · p. 31
D.3 Baseline Method Prompts
- Baseline prompts use distinct fabrication and rewrite instructions, including versions aimed at viral spread and versions aligned to a specified perspective.They request article fields such as headline, body, format, source, contact, date, and claim.Source: §D.3 · pp. 32–33
- Prompt templates request JSON fields for the topic, headline, article body, format, source, contact, date, and core misleading claim.Some rewrite templates also request a description of the changes made.Source: §D.3 · pp. 33–36
- Rewrite prompts change exactly one key fact in a source article while keeping other details accurate and the structure or tone intact.The alteration should feel natural and unremarkable within a 200–400-word passage.Source: §D.3 · pp. 35–36
- Fabrication prompts present a specific, plausible false claim as established fact in a 200–400-word authoritative passage with concrete details.Requirements include names, dates, and numbers to increase believability.Source: §D.3 · p. 35