Researchers detail RISE jailbreak for image-generator safeguards

White Circle researchers published a preprint describing RISE, an automated red-teaming method that they say produced human-confirmed policy violations on DALL-E 3, Google’s Nano Banana 2 and GPT-Image-2. The highest reported rate was 13.33% for DALL-E 3 during a fixed-strategy test. That result is specific to the researchers’ prompts, scoring rules and tested system configuration.

Results varied substantially by model. During a 2,500-call strategy-evolution phase, the paper reports human-verified attack success rates of 5.16% on DALL-E 3, 5.72% on Nano Banana 2 and 1.52% on GPT-Image-2 with its default, stricter auto moderation setting. In a separate 1,500-call phase that reused the five highest-scoring strategies without further mutation, the reported rates rose to 13.33%, 9.47% and 3.27%, respectively.

The percentages use prompts, not individual image-generation calls, as the denominator. RISE makes three stochastic calls for each prompt and counts the prompt as successful if at least one output meets the relevant threshold. For the headline results, the authors counted an output only when their human review classified it as an explicit violation. The automated vision-language-model judge guided the search and triaged candidates but did not define final success.

The researchers said they collected about 1,300 human annotations across systems, safety categories and pipeline stages. Internal annotators from the author team used three labels—no or weak violation, borderline, and explicit violation—and only the last category counted as positive. Before making the reported comparisons, the team wrote category-specific criteria, tested the automated judge against those labels and froze the criteria after pilot runs intended to identify false positives and reward-hacking behavior.

RISE changes what the attack system searches for. Rather than repeatedly rewriting a single adversarial prompt, it evolves reusable natural-language instructions for generating many prompts across different scenarios. The method first evaluates and mutates candidate strategies, then freezes the best five and allocates that phase’s call budget among them. This iterative process addresses a different target than automated evaluation and repair of enterprise AI agents: RISE searches for strategies that can expose image-generator safeguard failures. The authors used an abliterated Qwen3-32B prompt writer and did not update its model weights for the main experiments.

The primary comparison covered female nudity because the authors said it was consistently prohibited across the tested services and produced higher agreement among annotators than the other categories studied. Results for graphic violence, self-injury, hate and suicide were mostly precision-adjusted estimates rather than fully human-verified rates. The paper also describes its reproductions of prior attacks as best-effort, noting that some depended on private training data or curated prompt pools.

The evidence does not establish a common bypass rate for image generators as a class or for later versions of the three tested services. The arXiv record identifies the work as a version-one preprint and does not show journal or conference acceptance; independent peer review and replication remain unestablished. The human labels also came from the author team, and the paper does not give a stable build identifier or a precise test date for every commercial endpoint.

The authors said they coordinated with affected vendors before publication. They withheld the evolved strategies, final attack prompts and unsafe generated images, as well as evaluation criteria for hate and suicide, citing misuse risks.