# Best AI for Financial advice and safety (November 2026)

The leader on each benchmark in this use case, never combined. Data refreshed 2 Nov 2026.

## Picks

- FinTrust: o4-mini: 1 safety harmfulness score (1-10, GPT-4.1 mini judge) (Paper Table 7 (App. A.2), 17 Oct 2025), https://benchmarks.finance/leaderboards/fintrust/
- FinSafetyBench: LLaMA-3: 32.3 attack success rate % (financial crimes, English) (Paper Table 2, 1 May 2026), https://benchmarks.finance/leaderboards/finsafetybench/

## FinTrust: safety harmfulness score (1-10, GPT-4.1 mini judge) (lower is better, 11 models)

| Rank | Model | Maker | Score | Metric | Setting | Reported by | Source | URL | Date |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | o4-mini | OpenAI | 1 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 2 | XuanYuan-Fin-X1-Preview | Not stated | 5.8 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 3 | Gemini 2.5 Flash | Google | 6.2 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 4 | DianJin-R1 | Not stated | 7.3 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 5 | GPT-4.1 | OpenAI | 7.4 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 6 | GPT-4.1-mini | OpenAI | 7.4 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 7 | Fin-R1 | Not stated | 7.6 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 8 | Llama-4-Maverick-17B-128E-Instruct-FP8 | Meta | 7.6 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 9 | Qwen3-235B-A22B-FP8 | Qwen | 8.5 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 10 | DeepSeek-R1 | DeepSeek | 8.6 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |
| 11 | DeepSeek-V3 | DeepSeek | 9.0 | safety harmfulness score (1-10, GPT-4.1 mini judge) | genetic-algorithm jailbreak | Reported by the authors | Paper Table 7 (App. A.2) | https://arxiv.org/html/2510.15232v1 | 17 Oct 2025 |

## FinSafetyBench: attack success rate % (financial crimes, English) (lower is better, 6 models)

| Rank | Model | Maker | Score | Metric | Setting | Reported by | Source | URL | Date |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | LLaMA-3 | Meta | 32.3 | attack success rate % (financial crimes, English) | Meta-Llama-3-8B-Instruct; average of PAIR, ReNeLLM, FlipAttack | Reported by the authors | Paper Table 2 | https://arxiv.org/html/2605.00706v1 | 1 May 2026 |
| 2 | XuanYuan | Not stated | 57.5 | attack success rate % (financial crimes, English) | XuanYuan-13B-Chat; average of PAIR, ReNeLLM, FlipAttack | Reported by the authors | Paper Table 2 | https://arxiv.org/html/2605.00706v1 | 1 May 2026 |
| 3 | InternLM3 | Not stated | 72.2 | attack success rate % (financial crimes, English) | InternLM3-8B-Instruct; average of PAIR, ReNeLLM, FlipAttack | Reported by the authors | Paper Table 2 | https://arxiv.org/html/2605.00706v1 | 1 May 2026 |
| 4 | GLM-4 | Zhipu AI | 72.3 | attack success rate % (financial crimes, English) | GLM-4-9B-0414; average of PAIR, ReNeLLM, FlipAttack | Reported by the authors | Paper Table 2 | https://arxiv.org/html/2605.00706v1 | 1 May 2026 |
| 5 | Qwen2.5 | Qwen | 88.2 | attack success rate % (financial crimes, English) | Qwen2.5-32B-Instruct; average of PAIR, ReNeLLM, FlipAttack | Reported by the authors | Paper Table 2 | https://arxiv.org/html/2605.00706v1 | 1 May 2026 |
| 6 | Mistral | Mistral AI | 93.5 | attack success rate % (financial crimes, English) | Mistral-Small-24B-Instruct-2501; average of PAIR, ReNeLLM, FlipAttack | Reported by the authors | Paper Table 2 | https://arxiv.org/html/2605.00706v1 | 1 May 2026 |

## Also in this use case (no dated scores yet)

- Moneda AdviceBench (Moneda): https://benchmarks.finance/benchmarks/moneda-advicebench/
- PRBench Finance (Scale AI): https://benchmarks.finance/benchmarks/scale-prbench-finance/

Source: https://benchmarks.finance/best/advice-and-safety/

Created and maintained by Moneda.