iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. In human-reviewed tests reported by Ars Technica on October 14, 2026, White Circle’s reusable RISE attack produced explicit images from several OpenAI and Google image models. The results measure one red-team method under a specific benchmark—not the chance that an ordinary request will succeed—but they show that stronger image capabilities do not automatically produce stronger refusal behavior.
What White Circle tested
RISE searches for reusable attack strategies
White Circle calls its method RISE, short for “Red-teaming via Iterative Strategy Evolution.” Instead of rewriting one prohibited request repeatedly, an attacking model generates and improves strategies across many prompts and scenarios. A separate judge model classifies the resulting images, allowing the process to keep searching for patterns that defeat a model’s refusal behavior.
The pipeline used readily downloadable tools and ordinary API calls. White Circle used a publicly available Qwen3-32B model with its safety training removed as the attacker and Gemini 2.5 Flash as the judge. It did not require a custom frontier model. As White Circle’s Denis Shilov put it: “You don’t need frontier models or proprietary tech to break these systems; you just need a free download and the ability to make API calls.”
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Reported results
White Circle then had people verify whether flagged outputs were explicit. Its reported rates were:
#1 Best Overall
| Image model | Explicit outputs in the test | How to interpret the figure |
|---|---|---|
| DALL·E 3 | About 13% of attack prompts | Human-reviewed White Circle result from 2026 |
| Google Nano Banana 2 | Under 10% of attack prompts | Human-reviewed White Circle result from 2026 |
| GPT-Image-2 | About 3% of attack prompts | Human-reviewed White Circle result from 2026 |
These are success rates for this attack pipeline and its prompt set, not universal probabilities for every user, account, region, safety setting or request. They also do not mean that every successful image depicted a real person or was produced without any policy violation. Ars described the rates as the highest White Circle had recorded under the same standard, while noting that image-model red-teaming still lacks widely accepted calibration and testing norms.
Midjourney was not included because it did not offer a public API suitable for controlled benchmarking.
Why the newer versions raise a warning
Ars reported that White Circle found newer ChatGPT Images 2.5 and Nano Banana 2.1 “significantly more breakable” than their predecessors when subjected to the same method. OpenAI and Google did not respond to Ars’ requests about the findings.
White Circle’s explanation remains a hypothesis, not an established cause: newer systems may generate a wider range of content, or safety work may have been given less weight while capabilities expanded. The test demonstrates a change in observed refusal robustness, but it does not prove why that change occurred or establish that a model is broadly less safe in every setting.
Why bypasses matter beyond a single image
Non-consensual imagery can move through private channels
Google-coauthored research cited by Ars found that people who admitted making AI nudes often described the activity as experimentation. Twenty percent said they did it “for fun” or “as a joke,” and nearly one-third said they were experimenting with technology. The same reporting says non-consensual synthetic sexual imagery is frequently shared in direct messages or private cloud storage, where automated detection and public reporting are harder.
That is why controls at the point of generation matter even when a service later adds watermarking or removes reported copies. The Google research states: “A burden of responsibility also falls on developers to implement robust, model-level guardrails, and provenance indicators to prevent the initial generation and subsequent distribution of synthetic sexual imagery.”
Rank #3
Adult explicit imagery is not the same as child sexual abuse material
The White Circle results concern attempts to generate explicit images. They should not be conflated with child sexual abuse material (CSAM), which is illegal and involves a distinct category of harm and enforcement. The Internet Watch Foundation reported finding 6,310 AI images meeting the legal definition of CSAM in the first six months of 2026, about 40% higher than its total findings in the comparable prior-year period. An IWF spokesperson said: “Our analysts have seen how advances in AI enable the generation of abusive child sexual abuse imagery with minimal effort, removing the need for technical expertise and significantly lowering barriers to entry.”
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The IWF also said: “Safety must be baked into new technology by design—this includes testing models before they are released to market to make sure they cannot be used to create nude or sexual imagery of children.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How image-model safety should be judged
A single refusal-rate headline cannot establish whether a system is safe. A meaningful evaluation should examine several dimensions at once:
1. Robustness against reusable attacks
Testing should include iterative, cross-prompt methods such as RISE rather than only one manually written prohibited request. Evaluators should publish the attack scope, sampling method, judge criteria and human-review process so that results can be reproduced and compared.
2. Pre-release red-teaming and independent evaluation
Developers should test new checkpoints before release and invite independent reviewers to probe failure modes. Results need clear calibration because image red-teaming has no universally accepted benchmark standard.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Provenance and content credentials
Provenance indicators can help downstream services identify synthetic media and trace how it was created. They are a complement to generation-time blocking, not a substitute for it: a label does not undo the harm caused when an identifiable person is depicted in non-consensual sexual imagery.
4. Reporting, takedown and monitoring
Services need usable reporting routes, timely removal processes and monitoring for repeated abuse. Private-message and private-cloud distribution makes these pathways particularly important because public search and moderation signals may never appear.
5. Transparent policy and edge-case documentation
Google’s developer guidance says its Play policies prohibit facilitating, creating or distributing non-consensual sexual content and recommends documenting safety prompts and edge cases. Publishing those boundaries helps evaluators distinguish an intentional policy decision from an unintended refusal failure.
NIST’s AI-safety overview covers authentication and tracking of provenance, watermarking and labeling, detection, prevention of AI-generated CSAM and non-consensual intimate imagery, testing and auditing. A 2026 paper in the Proceedings of Machine Learning Research adds an important limitation: synthetic-content labeling alone does not remove the harm to people depicted in AI-generated non-consensual intimate imagery.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
What the findings do—and do not—show
- They show that an off-the-shelf attacker, combined with API access and an automated judge, can find repeatable failure patterns in tested image systems.
- They do not show that a random user will obtain an explicit image on a fixed percentage of attempts.
- They do not establish that every model release is becoming less safe, or prove that capability improvements caused the observed differences.
- They do show why safety claims should include adversarial testing, human verification, independent review and the exact benchmark conditions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
