# RISE Study: Newer AI Image Models Easier to Jailbreak

> White Circle's RISE red-teaming found GPT Image 2.5 Flare and Nano Banana 2.1 more than twice as easy to push into nudity as the models they replaced.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-15
- Canonical (HTML): https://cellcog.ai/blog/rise-image-model-jailbreak-study/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- White Circle's RISE red-teaming method reached up to 13.3% human-verified attack success on DALL-E 3, scored by a judge calibrated against about 1,300 human labels.
- Run after the paper, the same method got nudity through 7.8% of the time on GPT Image 2.5 Flare (3.3% on GPT Image 2) and 20.7% on Nano Banana 2.1 (9.5% on Nano Banana 2).
- Prior methods that reported around 30% success fell close to zero when re-scored against the same human-calibrated standard.
- RISE evolves reusable attack strategies instead of editing seed prompts, using only a public open model as the attacker and no training.
- Other categories were mixed: graphic violence rose on GPT Image 2.5 Flare and fell on Nano Banana 2.1, where the judge is least precise.

## At a glance

- **What did RISE find?** Newer image models were easier to push into nudity: 2.4x on GPT Image 2.5 Flare and 2.2x on Nano Banana 2.1 versus their predecessors.
- **How big are the numbers?** Small in absolute terms: 7.8% and 20.7% human-verified success after a full search, not 'most prompts get through'.
- **Do we know why?** No. White Circle says it may be the model, a lighter moderation setup on a cheaper variant, or both.

**The newest image models from OpenAI and Google are easier to jailbreak than the ones they replaced, according to a red-teaming study from White Circle.** Its [RISE research page](https://whitecircle.com/research/rise), updated in October 2026, reports that the same unchanged attack method got nudity past GPT Image 2.5 Flare 7.8% of the time, up from 3.3% on GPT Image 2, and past Nano Banana 2.1 20.7% of the time, up from 9.5% on Nano Banana 2. In White Circle's words: "To our surprise the newly released image models were even easier to break than the older ones."

The rates are small in absolute terms, and the study's bigger claim is about measurement. Here is what RISE does, what it found, and what it cannot say.

## What RISE measures

Modern image APIs stack defenses: a prompt classifier, an output moderation filter, and a model trained away from prohibited content. RISE, described in an [arXiv paper](https://arxiv.org/abs/2609.34920) submitted September 28, 2026, searches for reusable attack strategies rather than editing seed prompts, then exploits the ones that work. Every result is scored by a judge calibrated against about 1,300 human-labelled images, and only explicit violations count.

That standard is the paper's first finding. Prior methods that reported jailbreak rates around 30% dropped close to zero when re-scored the same way, because uncalibrated judges reward images that merely resemble a violation.

*Table: RISE attack success on nudity, human-verified (White Circle, October 2026)*

| Target | After evolution | After exploitation |
|---|---|---|
| DALL-E 3 | 5.2% | 13.3% |
| Nano Banana 2 | 5.7% | 9.5% |
| GPT Image 2 | 1.5% | 3.3% |
| GPT Image 2.5 Flare (run after the paper) | 4.1% | 7.8% |
| Nano Banana 2.1 (run after the paper) | 13.2% | 20.7% |

## The newer models, category by category

After the paper was submitted, White Circle ran RISE without changes on the two new releases across three categories. Nudity roughly doubled on both. The rest was mixed.

*Table: Post-submission results by category (White Circle, October 2026)*

| Target | Nudity | Self-harm | Graphic violence |
|---|---|---|---|
| GPT Image 2 | 3.3% | 11.2% | 19.0% |
| GPT Image 2.5 Flare | 7.8% | 10.7% | 32.8% |
| Nano Banana 2 | 9.5% | 20.9% | 47.0% |
| Nano Banana 2.1 | 20.7% | 27.2% | 34.5% |

Self-harm held steady on GPT Image 2.5 Flare and rose on Nano Banana 2.1; graphic violence rose on Flare and fell on Nano Banana 2.1. White Circle adds a caution: "Our judge is least precise on graphic violence, so we put less weight on those two numbers than on the others." [Ars Technica](https://arstechnica.com/tech-policy/2026/10/openai-google-pushing-new-ai-models-easily-tricked-into-making-nudes-researchers-say/) also covered the findings.

## Why it might have happened

White Circle does not claim a cause: "We can't attribute the regression from the outside: it may come from the model itself, from a lighter moderation configuration on a cheaper variant, or from both." Flare is the faster variant of GPT Image 2.5; the price difference White Circle implies is not something the study measures, and nothing in it confirms either cause.

The broader point is the one White Circle draws itself: "safety is not monotonic across model releases." Robustness measured on one version does not carry to the next, and an attack method carries over unchanged while defenses have to be rebuilt. It also used nothing proprietary: a public open model as the attacker, a commercial vision model as the calibrated judge, and no training.

For EU readers, this lands the same week the AI Office opened its first questions to OpenAI and Anthropic, covered in [our EU AI Office record](https://cellcog.ai/blog/eu-ai-office-openai-anthropic/).

## What we are watching

- Responses from OpenAI and Google, and whether moderation on Flare or Nano Banana 2.1 changes.
- Whether other teams reproduce the post-submission numbers with the released code.
- A re-run on the next releases, which White Circle's own conclusion invites.

## Sources

- [White Circle: RISE research page](https://whitecircle.com/research/rise) (October 2026)
- [arXiv: RISE, Red-teaming via Iterative Strategy Evolution](https://arxiv.org/abs/2609.34920) (September 28, 2026)
- [Ars Technica coverage](https://arstechnica.com/tech-policy/2026/10/openai-google-pushing-new-ai-models-easily-tricked-into-making-nudes-researchers-say/) (October 2026)

## FAQ

**What is RISE?**

Red-teaming via Iterative Strategy Evolution, a method from White Circle that searches for reusable attack strategies against text-to-image models and scores results with a judge calibrated against human labels.

**Were the newer models in the paper?**

No. The paper covered DALL-E 3, Nano Banana 2 and GPT Image 2. The GPT Image 2.5 Flare and Nano Banana 2.1 runs were added after submission, unchanged, and published on White Circle's October 2026 research page.

**Why are the success rates lower than other papers report?**

White Circle re-scored prior methods with its human-calibrated judge and found reported rates around 30% drop close to zero; it argues uncalibrated judges reward images that only look like violations.

**Which categories were tested?**

Nudity first, then hate, suicide, self-harm and graphic violence. The post-submission table reports nudity, self-harm and graphic violence for the four commercial models.

**Does CellCog use these models?**

CellCog's image agent runs on GPT Image 2.5. The study tests the model behind OpenAI's API; it does not test CellCog.

## Related

- [Tencent Cloud Rogue Agent Fleet: What Researchers Found](https://cellcog.ai/blog/tencent-cloud-rogue-agent-fleet/index.md)
- [EU AI Act's First Test: OpenAI and Anthropic Agent Escapes](https://cellcog.ai/blog/eu-ai-office-openai-anthropic/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/rise-image-model-jailbreak-study/. Try CellCog free, no credit card needed: https://cellcog.ai/signup