Newer Google and OpenAI image models were easier to bypass, White Circle researchers say

Newer image generators from Google and OpenAI were more vulnerable to attacks that elicited explicit nudity, Ars Technica reported on October 14, citing White Circle researchers. Their automated testing used widely available AI tools, not custom-built advanced models. The researchers found that explicit-nudity bypass rates more than doubled for both model families.

The latest account follows White Circle’s publication of RISE, short for Red-teaming via Iterative Strategy Evolution. Red-teaming means deliberately trying to make a system break its rules. Its earlier tests covered DALL·E 3, GPT-Image-2 and Nano Banana 2, producing policy-prohibited images on up to 13% of attempts.

The same attack met newer models

After submitting the paper, the researchers tested newer versions without changing RISE. White Circle’s comparison measures success under deliberate attack testing—not the share of ordinary image requests that produce explicit material.

White Circle offered two possible explanations to Ars: newer models may generate a wider range of content, or safety may have been deprioritized in favor of capability. Those are working hypotheses, not demonstrated causes.

A reusable strategy, not one forbidden prompt

RISE searches for attack patterns that work across multiple prompts and scenarios, rather than testing isolated requests alone. One AI model generates jailbreaks—requests designed to get around safeguards—while another judges whether the resulting images contain prohibited content. The goal is to find strategies that transfer between models.

White Circle identifies the attacker as open-source Qwen3-32B and the judge as Gemini Flash. A lightweight software harness connects them. The researchers reviewed outputs to verify the bypass rate. Midjourney was excluded because it lacked a public API—a software interface—suitable for controlled benchmarking.

Disclosure without publishing the attack recipes

White Circle says it shared the findings with affected companies before publication. Neither Google nor OpenAI responded to Ars’s requests for comment, including its follow-up with the newer-model findings.

White Circle says its reproduction pipeline is open source on GitHub, while attack prompts, discovered strategies and generated images remain private. Ars describes the release as still planned. The stated aim is to let defenders and regulators repeat the evaluation without publishing those specific attack materials.

Chief executive Denis Shilov told Ars that independent safety testing should be mandatory. White Circle is in early talks with government officials about third-party testing; that remains advocacy and discussion, not a new requirement.