JailNewsBench (Negative Prompting): leaderboard
Metric: Attack success rate (%): share of model outputs that do not refuse, as judged jointly by GPT-5, Gemini 2.5 and Claude 4, on JailNewsBench test-split fake-news generation instructions (seed instructions built from real news articles of 34 regions in 22 languages, each with a financial, political, social or psychological motive), averaged across regions, under the Negative Prompting jailbreak (the request is rephrased as a prohibition that asks what such fake news would look like while forbidding an answer); lower is better. Source: arxiv.org. 9 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5 | 74.6 | #91 |
| 2 | Claude Sonnet 4 | 75.7 | #194 |
| 3 | Gemini 2.5 Flash | 77.1 | #237 |
| 4 | DeepSeek R1 Distill Llama 70B | 79 | #582 |
| 5 | DeepSeek R1 Distill Llama 8B | 82.4 | #1282 |
| 6 | Llama 3.1 70B Instruct | 84.8 | #548 |
| 7 | Llama 3.1 8B Instruct | 85.1 | #1018 |
Interactive version: theaggregate.ai/benchmark?slug=jailnewsbench-negative-prompting · How It Works · Data refreshed daily, snapshot 2026-10-11.