Tests conducted by White Circle, a company specializing in AI safety evaluation, revealed weaknesses in the guardrails preventing explicit content in image-generation models from OpenAI and Google. Using tools available for download, public models, and requests through application programming interfaces, the researchers were able to bypass the filters and produce images that human reviewers classified as explicit.
The highest success rate was approximately 13% with DALL·E 3, while the rate was below 10% with Google Nano Banana 2 and approximately 3% with GPT-Image-2. White Circle says these were the highest rates among the methods tested under the same standard, while emphasizing that the attacks did not require frontier models or custom tools.
Newer Releases and More Concerning Tests
White Circle told Ars Technica that preliminary tests using the same method found that ChatGPT Images 2.5 and Nano Banana 2.1, newer releases from OpenAI and Google, were “significantly more breakable” than the previous two releases. Neither company responded to requests for comment or to the findings that the site shared with them.
These findings alone do not prove that the new models are weaker in every use case, but they raise a practical question about the trade-off between expanding generation capabilities and tightening protective restrictions. White Circle suggests two possibilities: that the newer models have become more capable of producing a broader range of content, or that safety has declined in priority relative to capabilities.
How Does the RISE Attack Work?
White Circle named its method “Red-teaming through Iterative Strategy Evolution” (RISE). Instead of trying a single harmful prompt each time, the method uses an attacker model to generate multiple jailbreak attempts and a judge model to verify the production of prohibited content, with the aim of finding patterns that can be reused and transferred between different models.
The system relied on a publicly available version of Qwen3-32B with its safety training removed as the attacker model, and on Gemini 2.5 Flash as the judge model. The company says this architecture means that testing the defenses of a frontier model does not require a frontier model or proprietary technology; rather, it requires free tools and the ability to send requests to the API.
Why Does This Matter?
The issue is becoming more significant because non-consensual synthetic sexual content may be produced or distributed outside monitoring systems, through direct messages or private cloud storage. Research involving Google showed that 20% of users who admitted to generating nude images with AI did so “for fun” or “as a joke,” while approximately one-third said they were experimenting with the technology, making technical friction within models a factor that could deter some users.
The Internet Watch Foundation also warned that it found 6,310 AI-generated images that legally fall under child sexual abuse material during the first six months of 2026, an increase of approximately 40% over the total found in the previous year. The foundation is calling for models to be tested before release and for guardrails to be designed to prevent the production of this type of material from the outset.
Independent Testing Under Discussion
White Circle intends to make the entire attack pipeline available as open source and also plans to present the research at the NeurIPS 2026 conference in November. The company believes the method could help laboratories detect more varied bypass attempts, not only in explicit images but also in violent or self-harm content.
White Circle is also pushing for mandatory independent audits and third-party monitoring, arguing that companies’ evaluation of their own systems may not reveal the full extent of the risks. Important questions remain open, including how to calibrate explicit-content tests, how to protect researchers from nondisclosure agreements that may prevent the publication of findings, and how to turn test results into verifiable fixes rather than merely relying on companies’ reports.