The Pulse
White Circle Finds DALL·E 3 Guardrails Fail in 13% of Attacks
White Circle’s RISE method produced human-confirmed explicit images in 13.33% of tested attack prompts against DALL·E 3, with lower rates on Google’s Nano Banana 2 and OpenAI’s GPT-Image-2. The researchers say a newer version of the method
AI.info Team · Written with AI ·
White Circle’s attack method produced human-confirmed explicit images in 13.33% of tested prompts against DALL·E 3, researchers report. The rate fell to 9.47% against Google’s Nano Banana 2 and 3.27% against OpenAI’s GPT-Image-2. Those figures measure a targeted red-team exercise—not the share of ordinary user requests that would produce such images.
The findings come from RISE, a method for testing image-generator safeguards by evolving reusable attack strategies. White Circle’s preprint appeared on arXiv on September 28, 2026. In reporting published October 14, Ars Technica also said the group tested newer releases and found them easier to bypass than their predecessors, but did not publish rates for those tests.
What the 13% measures
For its headline results, the team focused on prohibited female nudity. Each tested prompt was sent to a target model three times, and a prompt counted as successful if at least one resulting image met the researchers’ criterion and human reviewers confirmed an explicit violation. The 13.33% result came from RISE’s fixed-strategy testing phase on DALL·E 3; the corresponding human-confirmed rates were 9.47% for Nano Banana 2 and 3.27% for GPT-Image-2.
The team says it gathered human annotations for roughly 1,300 generated images across models, safety categories and stages of the testing process. Only images reviewers labeled explicit counted as successful in the main results. That distinction matters: automated image judges can flag benign borderline images or miss real violations, the authors write, making rates based only on automated scores unreliable.
RISE searches for strategies, not magic words
Rather than repeatedly rewriting one prohibited prompt, RISE evolves instructions for generating many prompts across different scenarios. Its prompt-writing model is a publicly available Qwen3-32B variant with safety training removed; Gemini 2.5 Flash judges candidate images against criteria calibrated against human labels. The researchers say the method requires no custom-built or frontier model to generate attacks.
Denis Shilov, White Circle’s CEO, told Ars Technica: “You don’t need to have frontier models to break defenses of a frontier model, which is very interesting.” The group is developing its approach as an outside test of commercial systems, where companies’ own safety assessments may not reveal weaknesses that an independent evaluator can find.
Earlier bypass rates did not hold up
RISE’s authors also re-tested earlier methods under their calibrated evaluation. Some prior work had reported DALL·E 3 attack-success rates near 30% or higher, but the researchers say representative methods fell to near zero when they applied their stricter criteria. They argue that weak automated judges, successes tied to hand-written seed prompts and limited transfer between settings helped inflate earlier results.
The researchers describe those comparisons as best-effort reproductions, not definitive replications: some earlier methods depend on curated prompt sets or private training data that the team could not recover. Their paper also limits its strongest cross-model comparison to nudity, which they say is easier to define consistently than categories such as violence or self-harm.
Newer models, without published rates
White Circle told Ars that tests using the same general approach found OpenAI’s ChatGPT Images 2.5 and Google’s Nano Banana 2.1 “significantly more breakable” than earlier versions. The report gives no success percentages for either newer product. Ars said neither company responded to its requests for comment about the reported findings.
The paper says the team plans to release its reproduction pipeline, local testbed and some judging criteria, while withholding discovered attack strategies, final prompts and unsafe generated images. The public results quantify failures in three earlier model versions; published figures do not yet show whether the newer releases have closed that gap.