VEX-Bench: Benchmarking Verification Complexity of LLM-Generated Misinformation

AI summary

Overview

• Research area: LLM safety evaluation, misinformation generation, and fact-checking/journalism practice.
• Technical level: Intermediate — the paper assumes familiarity with benchmark design, LLM-as-judge evaluation, and ordinal inter-annotator reliability statistics, but the core idea (measuring how costly misinformation is to check, not just how easy it is to produce) is accessible.
• Scope: The paper introduces VEX-Bench, a benchmark that scores LLM-generated misinformation along five verification-complexity dimensions and combines them into a single "VEX" score, evaluated over 7 frontier LLMs, 7 generation methods, 6 domains, 60 topics, and 5,880 articles.

What This Paper Is About

Most evaluations of LLM-generated misinformation stop at the moment of generation: can harmful content be elicited, and how often? That leaves a practical question unanswered — once misinformation exists, how much scarce fact-checking capacity will it consume? This paper builds a benchmark that measures the verification complexity of generated misinformation as it would be perceived during screening, and shows that generation is dramatically cheaper than verification.

Key Contributions

1. A unified benchmark, VEX-Bench. It evaluates verification complexity across models and elicitation methods and is designed as a reusable framework for scoring future misinformation attacks and defenses by their downstream verification burden.
2. A formalization of verification complexity as its own evaluation axis. Grounded in content-analysis methodology, with measurement validated using ordinal Krippendorff's α across both human and LLM evaluators.
3. A multi-dimensional scoring protocol. Five dimensions (checkability, harm significance, source credibility, imposter legitimacy, verification cost), each on a 1–5 scale, aggregated into a VEX score over all 31 non-empty subsets of dimensions, plus complementary fact-checking outputs (Claim Support and Entity Integrity).
4. Empirical findings from 5,880 articles. Verification complexity varies substantially across frontier LLMs; no single elicitation method dominates all five dimensions; and the highest-VEX content is not consistently produced by the most effective method or the highest-risk model.

Main Findings

• No single method dominates. Method-level rankings differ across the five dimensions, which the authors say justifies multi-dimensional rather than single-score evaluation.
• Success-based metrics underestimate risk. In the fabrication task, ISC (SR 99.5, NR 99.5), DisinfoCap (SR 96.0, NR 93.8), and MisinfoQA (SR 99.3, NR 70.2) all achieve near-perfect elicitation success (SR ≥ 95%) yet produce substantially different verification-complexity profiles. PAP shows the opposite pattern: lower NR (47.1 in fabrication) but its successful outputs reach the highest D1 (99.2) and D5 (79.2) scores in that task.
• Tasks induce distinct risk profiles. In rewrite, outputs inherit institutional references and surface cues from real source articles, giving higher D3 and D4 than fabrication, with smaller degradation in claim support and entity integrity. ISC shows the smallest degradation in rewrite (claim support 78.7, −17.4 relative to the source; entity integrity 72.2, −27.9), while PAP shows the largest (claim support 24.9, −71.0; entity integrity 20.7, −79.2). In fabrication, the absence of a source shifts risk toward D5.
• Integrated risk is method-, model-, and interaction-dependent. Across all 31 dimension combinations and both tasks (62 instances), ISC poses the highest risk at the method level regardless of LLM, and DeepSeek-V4-Pro exhibits the highest risk at the model level regardless of method. At the interaction level, DisinfoCap applied to Grok-4.1 produces the highest-risk content on average, ranking first in 11 of 62 instances, while PoisonedRAG achieves 15 top-ranked instances.
• Cost asymmetry is severe. Generation costs 3× to 169× less than agent-based verification. Overall, generation averages 1.45 US cents per article versus 17.86 cents to fact-check (a 12.4× ratio). Qwen3.5-Flash costs about 0.14 cents per generation versus 20.67 cents to verify (147.2×), and Grok-4.1-Fast costs 0.13 versus 21.60 cents (169.0×). Web search accounts for roughly two-thirds of fact-checking cost.
• Judge validation supports the protocol. Ordinal Krippendorff's α across human–human, human–LLM, and LLM–LLM comparisons shows consistent agreement. The strongest agreement is for D3, where both human–human and primary-judge–human comparisons exceed the reliable threshold (α ≥ 0.800). Uncalibrated judge models show slightly lower agreement, approaching the tentative threshold (α ≥ 0.667).
• VEX dimensions are distinct from an existing misinformation judge. Spearman correlations with JailNewsBench are weak-to-moderate, with no pair strong enough to suggest redundancy. D3 has no direct JNB counterpart and shows negligible correlation; D4 shows a moderate negative correlation with JNB subjectivity and agitiveness, which the authors attribute to JNB conflating tone with stylistic quality.
• Perceived scores align with downstream verification signals. D3 correlates positively with entity integrity, and D5 correlates positively with the proportion of claims with insufficient evidence. D3 is largely independent of claim support, and D5 shows no relationship with entity integrity — the judge captures perceived credibility and cost without itself performing fact-checking.
• Fabrication mixes real institutions with fabricated individuals. Real entities are dominated by institutions, including government agencies and organizations such as the Federal Reserve; fabricated entities concentrate in attribution roles such as persons and contacts. Most fabricated names are unique, but each model reuses a small subset of expert-like names, which the authors suggest may act as a fingerprint of training data.

Methodology in Plain English

Each benchmark setting is a fixed triple of task, domain, and topic, so every model–method pair is asked to target the same thing. Two task categories are used: fabrication (generate a plausible but false article from a topic) and rewrite (transform a real article into a misleading variant that keeps its surface plausibility). Topics are built by clustering real news coverage from January 2025 to March 2026 and abstracting each cluster into a neutral label, which avoids pinning the benchmark to a particular outlet's wording.

Models produce structured JSON articles with fields for topic, headline, body, format, source, contact, date, and the central claim (rewrite outputs also include a record of changes). This lets the pipeline separate refusals or invalid JSON from usable articles. Each article is then scored 1–5 on five dimensions by an LLM judge, a protocol validated against a held-out set of 100 articles scored independently by two human annotators who saw only the text, with disagreements discussed to produce adjudicated reference annotations. Reliability is measured with Spearman correlation and ordinal Krippendorff's α. A separate fact-checking agent (using web search) produces Claim Support and Entity Integrity signals, and API/agent transcripts are used to compute dollar costs.

Why This Matters

Impact on research. The paper argues that success-centric safety metrics — refusal rates, attack success rates, harmfulness scores — conflate elicitation with downstream risk. VEX-Bench offers a different evaluation axis: the burden generated content places on verification systems. This reframes what a "successful" attack means and gives safety researchers a way to compare interventions by their effect on downstream verification load rather than by generation-time refusal alone.

Real-world applications:

• Newsroom triage. Fact-checkers and journalists screen far more content than they can verify; scoring incoming content by verification complexity supports the prioritization decisions described in the check-worthiness literature.
• Platform moderation. Moderation queues face the same resource constraint; VEX-style scores could flag content that looks authoritative and would be expensive to resolve.
• Model and vendor evaluation. Labs and procurement teams can compare frontier LLMs by the verification burden their outputs create, not only by whether the outputs can be elicited.
• Verification budgeting. The cost tables give concrete per-article generation-versus-verification figures, which supports planning for fact-checking capacity.

Industry relevance. The findings speak directly to media organizations, social platforms, fact-checking organizations, and AI developers. The specific structural point — that content can cite real institutions while remaining unverifiable without expert consultation or non-public data — describes a failure mode that existing automated verification pipelines are not equipped to absorb.

Future Directions

• Calibrating additional judge models. The paper notes that judge models applied without calibration show lower agreement with humans and that additional calibration can reduce this gap, leaving open how broadly the protocol can be transferred across judge models.
• Model attribution from fabricated entity reuse. Each model was found to reuse a small subset of expert-like names, which the authors propose as a potential fingerprint of training data and a possible direction for attributing generated misinformation to its source model.
• Alternative dimension weightings. The VEX score uses equal weighting within each subset for simplicity, but the authors note that different fact-checking organizations and platforms may apply weightings based on their own priorities — an open design question.
• Evaluating safety interventions by verification burden. The paper positions VEX-Bench as a way to test defenses and interventions based on their impact on downstream verification cost, a use it identifies but does not itself carry out.

Target Audience

Researchers and practitioners in LLM safety and misinformation evaluation; fact-checking and journalism researchers studying verification triage and check-worthiness; platform trust-and-safety and content-moderation teams; and AI developers or procurement teams who need to compare models and generation methods by the real-world verification burden their outputs create. Readers should be comfortable with benchmark methodology and reliability statistics such as Krippendorff's α.

Note on completeness: the provided paper text is truncated. It ends at a "Broader Impact and Limitations" heading with no content beneath it, so the authors' stated limitations are not reported here. Appendix contents (topic list, rubric details, judge prompts, fact-checking agent specification, and per-model breakdowns) are referenced in the text but not included in the material available.

Authors’ abstract

Large language models (LLMs) have made misinformation inexpensive to produce but not to verify, creating a growing asymmetry in the information ecosystem. Under tight time, labor, and budget constraints, media organizations, platforms, and fact-checkers rely on screening to prioritize which content to verify. We introduce VEX-Bench, a unified benchmark for evaluating the verification complexity of LLM-generated misinformation, as perceived during screening, across models and generation methods. Verification complexity is assessed along multiple dimensions derived from journalistic and fact-checking practices, capturing checkability, harm potential, source credibility signals, imposter legitimacy, and expected verification effort. We define the VEX score as an integrated measure combining elicitation yield and verification complexity to quantify how generated content consumes limited verification capacity. We construct a benchmark spanning two misinformation categories, 6 high-stakes domains, and 60 real-world topics, and evaluate 7 frontier LLMs and 7 generation methods, yielding 5{,}880 articles. We employ an LLM-as-judge for scalable evaluation and validate it using content-analysis methodology, including ordinal Krippendorff $α$ for inter-annotator reliability, complemented by fact-checking agents for verification. Our findings show that no single method dominates all dimensions, underscoring the need for multi-dimensional evaluation. LLMs can generate high-VEX misinformation at 3$\times$ to 169$\times$ lower cost than agent-based verification. Such content is often prioritized during screening, consuming scarce verification resources and introducing a systematic risk of misallocation in resource-constrained verification systems. The code is publicly available in our \href{https://github.com/HanxunH/VEX-Bench}{GitHub repository}.