Jailbreak robustness has become central to safety evaluation of large language models, yet prevailing methods rely mainly on refusal behavior, semantic similarity, and intent‑matching heuristics, emphasizing linguistic plausibility over answer correctness. We identify a key limitation: many jailbreak intents focus on instructional validity rather than epistemic factuality, allowing superficially plausible replies to be marked as successful even when factually or procedurally wrong. To fill this gap, we propose Sequential Epistemic and Action‑Level Validation (SEAV), a verification‑centric jailbreak evaluation framework. SEAV decomposes model outputs into ordered steps and assesses both validity and correctness. The framework combines LLM‑as‑judge for semantic interpretation with retrieval‑grounded verification using external knowledge sources, checking whether generated content is factually accurate, structurally consistent, and operationally capable of advancing harmful objectives. Empirically, SEAV reduces the false‑positive rate on SD‑A (a curated strategic‑dishonesty diagnostic) by $14.9\text{pp}$ compared to the strongest baseline, and reclassifies $22.1\%$–$51.0\%$ of previously labeled successes as invalid across three of four public benchmarks. These results show that enforcing correctness substantially reshapes measured robustness: many cases formerly marked as jailbreak successes are re‑identified as invalid, and the findings remain stable across different search backends and evaluator models. Code and data are released at https://github.com/Ardor-Wu/SEAV.
Review: By incorporating factual and operational validation, SEAV markedly cuts false positives and offers a more trustworthy benchmark for LLM safety assessment.