RISE tests image-model defenses with jailbreaks

Its attacking model generates jailbreak attempts, while a judge model checks whether the resulting images contain banned content.[3] White Circle says the method uses publicly available tools and does not require specialized models.[1] Ars Technica reported that the attacker was an open-source Qwen3-32B model with its safety training removed, and that Gemini 2.5 Flash served as the judge.[3] White Circle calibrated the judge against human labels on about 1,300 generated images.[4]

White Circle tested RISE on OpenAI’s DALL·E 3 and GPT-Image-2, and Google’s Nano Banana 2.[1] It reported human-verified attack success rates of about 13% for DALL·E 3, below 10% for Nano Banana 2, and about 3% for GPT-Image-2.[3] Those figures use a specific measure: a prompt counted as successful when at least one of three generated images was confirmed by a human to violate the rules.[4] White Circle also reported that prior methods with success rates around 30% fell to near zero under its calibrated, human-reviewed evaluation.[2]

After submitting its paper, White Circle ran additional tests on newer model variants, saying it used RISE without changing the method.[1] White Circle said its explicit-nudity success rate more than doubled compared with the models the newer models replaced.[1] The supplied results describe these tests; they do not establish performance across every image model or use case.

White Circle reported using 2,500 target calls during RISE’s evolution phase and 1,500 during its exploitation phase for each target.[4] It did not test Midjourney because it lacked a public API suitable for controlled benchmarking.[3] White Circle plans to open-source the RISE pipeline while keeping its attack prompts, discovered strategies, and generated images private.[1] The group said it would present RISE at NeurIPS 2026.[1] Ars Technica reported that neither OpenAI nor Google responded to its request for comment about the vulnerabilities.[3]