SWORD Benchmark Exposes Hidden Vulnerabilities in LLM Cross-Lingual Fact-Checking

Introduction: The Illusion of Multilingual Competence

Modern large language models (LLMs) have demonstrated impressive performance on multilingual tasks, with scores climbing steadily across various leaderboards. Yet a long-overlooked question remains: do these models truly "understand" facts, or are they simply adept at picking the right answer from a set of options?

A study called SWORD (Systematic Wikidata-based Object-Relation Distortion) offers a thought-provoking answer. The research team argues that standard benchmarks primarily reward a model's ability to "select the correct answer" without truly evaluating how deeply it understands facts. When we flip the perspective—testing whether models can consistently reject false statements—a series of hidden flaws come to light.

The SWORD Benchmark: A Reverse Approach to Fact-Check Evaluation

Core Idea: From "Selecting Right" to "Rejecting Wrong"

Traditional benchmarks ask models "what is correct," while SWORD takes the opposite approach, examining whether models can identify and reject "what is wrong." This reverse evaluation method more closely reflects real-world requirements for model reliability—a trustworthy AI system must not only provide correct answers but also firmly reject false information. This approach aligns with the growing emphasis on Adversarial Evaluation methodologies in the AI safety field. The core idea behind adversarial evaluation originates from adversarial example research: exposing model vulnerabilities through carefully crafted edge cases. Unlike traditional evaluation, which measures "what the model can do," adversarial evaluation focuses on "where the model will fail." In the context of fact-checking, this means testing not only whether a model can find the right answer, but whether it can maintain its judgment when confronted with carefully designed misinformation. In recent years, Red Teaming has become a standard part of the pre-release process for large models, and SWORD can be viewed as a systematic red-teaming framework specifically targeting multilingual factual consistency.

Data Construction: Controlled Perturbations Based on Wikidata

SWORD builds on structured knowledge from Wikidata triples (i.e., "subject-relation-object" structures), applying controlled perturbations to generate statements that are grammatically fluent but factually incorrect.

It's worth introducing Wikidata as a key piece of infrastructure here. Wikidata is a free and open knowledge base operated by the Wikimedia Foundation, storing hundreds of millions of facts as structured triples—for example, (Paris, capital of, France). It is one of the world's largest open knowledge graphs, supporting multilingual labels in over 300 languages, making it an ideal data source for cross-lingual fact verification research. SWORD leverages precisely this multilingual structured nature of Wikidata to systematically apply controlled perturbations to the same facts across different languages, ensuring fairness in cross-lingual comparisons.

Based on this data source, SWORD's perturbations span multiple levels of difficulty:

Random entity replacement: Replacing the original object with an unrelated entity to generate obviously absurd false statements;
Attribute-based semantically plausible replacement: Selecting replacements that appear semantically reasonable but are still factually incorrect, making errors more deceptive.

The benchmark covers eight widely used languages, enabling systematic examination of models' fact-checking consistency across different linguistic environments.

Two Counterintuitive Findings

Finding 1: Models Rely on Statistical Familiarity Rather Than Factual Verification

The study reached its first counterintuitive conclusion: models achieved higher accuracy on semantically plausible distortions than on nonsensical random replacements.

At first glance, this seems to defy common sense—absurd errors should be easier to identify. But the researchers' interpretation reveals a deeper issue: this phenomenon suggests that models likely rely on distributional familiarity rather than genuine factual verification mechanisms.

To understand this, we need to return to the fundamental training mechanism of LLMs. The core training objective of LLMs is to predict the probability distribution of the next token, meaning models essentially learn statistical patterns of word co-occurrence in their training corpus rather than explicit fact storage. When a model encounters a statement, it's actually evaluating the likelihood of that sequence within its training distribution—if a false statement happens to be composed of frequently co-occurring words, the model may assign it high confidence. This fundamentally differs from how humans verify facts: humans logically compare statements against known facts, while models tend to make judgments based on surface-level statistical features.

Therefore, when a false statement "looks familiar" in terms of textual distribution, the model may make judgments based on statistical patterns rather than genuinely verifying factual accuracy. Meanwhile, absurd statements cobbled together from random entities, whose token sequences are extremely rare in training corpora, leave the model "at a loss," exposing its lack of genuine factual reasoning ability. This means models' "fact-checking capabilities" are largely a surface-level phenomenon—relying on pattern matching within training corpora rather than a robust grasp of world knowledge.

Finding 2: Significant Fact-Checking Degradation for East Asian Languages

The second finding is even more concerning. The study showed that some models achieved nearly comparable baseline accuracy across languages—they treated all languages equally on standard correct-answer selection tasks.

However, when confronted with distorted statements, this balance collapsed: models exhibited significant performance degradation for East Asian languages (such as Chinese, Japanese, and Korean). Cross-lingual performance gaps reached up to 28 percentage points, with relative drops as high as 49%.

This phenomenon is closely tied to the unique technical challenges that East Asian languages pose for natural language processing. First is the tokenization problem: Chinese, Japanese, and Korean lack natural whitespace delimiters, requiring tokenizers to handle more complex segmentation strategies. Current mainstream BPE (Byte Pair Encoding) tokenizers are far less efficient for these languages than for English—the same content may require 2 to 3 times more tokens, meaning models consume significantly more context window resources to process equivalent information. Second is training data imbalance: although the total volume of Chinese internet content is enormous, English still holds an overwhelming advantage in high-quality, fact-dense corpora (such as encyclopedias and academic literature). Additionally, these languages differ significantly from English in grammatical structure—Japanese SOV (Subject-Object-Verb) word order and Korean's agglutinative morphology may exacerbate the difficulty of cross-lingual knowledge transfer, making it hard for models to seamlessly transfer fact-verification capabilities learned in English to these languages.

This means a model that can robustly reject misinformation in English may see its fact-checking capability cut nearly in half when switched to Chinese, Japanese, or Korean. This asymmetry poses a significant safety risk for non-English users.

Why Aggregate Metrics Mask the Real Problems

These two findings together reveal a core issue: multilingual factual reasoning involves asymmetric capabilities, and aggregate accuracy metrics systematically obscure this asymmetry.

Current mainstream evaluation approaches often summarize a model's multilingual capabilities with a single average score. But as SWORD demonstrates, massive cross-lingual gaps may lurk beneath that average. A model performing well in overall accuracy doesn't mean it's equally reliable across every language, much less that it possesses genuine fact-verification capability. This phenomenon represents a manifestation of Simpson's Paradox in statistics—where overall trends and subgroup trends can point in completely opposite directions.

This raises three new requirements for LLM evaluation systems:

Go beyond multiple-choice paradigms: Testing only whether models "select the correct answer" is insufficient for measuring genuine factual understanding; adversarial evaluation that tests "rejection of errors" must be incorporated.
Fine-grained per-language analysis: Aggregate metrics are not enough; each language must be examined individually, with particular attention to low-resource languages and those with significant structural differences.
Distinguish memorization from verification: Tests should be designed to differentiate "pattern matching" from "genuine fact-checking," avoiding being deceived by the illusion created by distributional familiarity.

Practical Implications for AI Product Deployment

SWORD's findings carry important warnings for deployed AI systems. As LLMs are widely applied in question answering, content moderation, fact-checking, and other scenarios, their cross-lingual reliability directly affects the user experience and information security of global users.

For products serving East Asian markets, this research deserves special attention: even if a model performs excellently on standard benchmarks, its ability to identify false information in languages like Chinese may still have significant gaps. Considering that the Chinese internet has over 1 billion users, and that the Japanese and Korean markets are equally important in the digital economy, these fact-checking capability gaps mean hundreds of millions of users may be exposed to AI-generated misinformation. This reminds developers that when deploying multilingual AI systems, targeted adversarial testing is essential—they cannot simply rely on vendors' published aggregate scores. Specific practical recommendations include: building dedicated factual distortion test sets for target languages, introducing multi-layered fact-verification pipelines in products (such as cross-validation with knowledge graphs), and setting differentiated confidence thresholds for different languages.

Conclusion

The value of the SWORD benchmark lies in its clever "reverse" perspective, peeling back the glossy surface of LLMs' multilingual capabilities to expose the cracks beneath. Models may not truly "understand" facts but instead rely on statistical familiarity for pattern matching; model reliability is far from equal across all languages, with performance gaps approaching nearly half.

This research reminds the entire industry: truly multilingual factual intelligence still has a long way to go. And more rigorous, fine-grained, and adversarial evaluation methods will be essential tools on the path toward that goal.