InfoOps Bench tests how easily AI turns into propaganda

What this is about

InfoOps Bench is a new safety benchmark for language models. The study, submitted on July 30, 2026, does not ask whether a model knows general facts. It asks whether the model can be recruited for state-backed information operations.

The researchers use more than 2,100 observed information operations from a live pipeline that tracks Russian, Chinese, and Iranian state-backed media and influence assets. The benchmark is meant to update continuously so models cannot simply memorize it.

What InfoOps Bench actually does

The benchmark tests 17 models from 8 providers across four prompt framings. It measures whether a model refuses requests, checks facts, defuses propaganda claims, or makes them worse.

The spread is large: integrity scores, defined as the share of refused problematic requests, range from 8.8 to 94.5 percent. According to the study, the differences are not explained simply by model size. Some models fabricate extra details and make the output more harmful than the source material. Others answer while softening the content or adding fact checks.

Why it matters

Disinformation is no longer only a problem of individual posts. If AI systems can generate texts, comments, scripts, or campaign variants at scale, the cost of influence operations falls sharply. For platforms, media organizations, political parties, and public agencies, it becomes crucial to know how well models detect these requests.

The live approach is especially important. Many classic benchmarks age quickly: once training data, model providers, or prompt templates are known, they become less meaningful. InfoOps Bench tries to avoid that by using current claims and weekly updates.

In plain language

Imagine a fire drill in a building. An old test checks the same smoke alarm with the same fog every time. A live test changes the room, smoke source, and timing. That is what InfoOps Bench tries to do for AI propaganda: it does not only test an old list of examples, but new patterns from real information operations.

A practical example

A newsroom runs an AI tool that sorts 5,000 tips, social media posts, and reader questions every day. Without safeguards, a coordinated actor could send 300 slightly varied propaganda claims and ask the system to turn them into seemingly neutral summaries.

With an InfoOps-style test, the newsroom could check in advance how often its model refuses problematic requests, when it adds fact checks, and when it accidentally amplifies claims. If a model suddenly reacts differently to China-critical or Russia-related claims than to matched benign questions, that would be a clear warning signal for selection and configuration.

Scope and limits

First, the benchmark mainly measures reactions to prompt scenarios. By itself, it does not prove how a full product workflow with moderation, logging, and human review behaves in practice.

Second, refusal is not always the best answer. A model that blocks too much can make legitimate analysis, journalism, or research harder.

Third, it remains unclear how durable the results are. Vendors often change models, system prompts, and safety filters. That is exactly why the live design matters, but it also makes the benchmark more demanding to maintain.

SEO & GEO keywords

InfoOps Bench, AI disinformation, information operations, AI safety benchmark, propaganda, model integrity, frontier models, Pattrn AI, AI governance, media literacy