White Circle’s RISE jailbreak produced prohibited explicit images in about 13% of tests, researchers say

White Circle, a public benefit corporation whose backers include senior leaders and researchers from Anthropic, DeepMind, Hugging Face and OpenAI, reported that its jailbreak pipeline called RISE produced prohibited explicit images in roughly 13% of test attempts against major image-generation models.

The group said it ran RISE against OpenAI’s DALL·E 3 and GPT-Image-2 and Google’s Nano Banana 2, then applied the same method to newer releases—ChatGPT Images 2.5 and Nano Banana 2.1—and found the newer models “significantly more breakable” than their predecessors.

White Circle described RISE as an iterative technique that uses one model to generate attack prompts and another to judge outputs, and the organisation told reporters the pipeline does not require a custom frontier model or deep AI expertise, only generalized prompt strategies.

White Circle reported that on DALL·E 3 about 13% of its attack prompts produced images human reviewers confirmed as explicit. The group reported a confirmed explicit-image rate under 10% on Nano Banana 2 and about 3% on GPT-Image-2; those per-model figures come from White Circle’s testing and human-review confirmation, as described to Ars Technica.

White Circle also said that its 13% overall figure reflects the group’s test setup and should not be read as a typical user success rate, according to one account of the findings. The RISE method, as described in the available reporting, pairs AI-generated attack attempts with automated or model-based judgement to iterate on prompts that evade explicit-content filters.

White Circle published a preprint and press release outlining the approach and told reporters it plans to open-source the RISE pipeline and present the method publicly. Ars Technica reported the group’s findings on Oct. 14, and other outlets covering the disclosure echoed White Circle’s claim that newer model versions were easier to bypass.

Reporting in this package gives model-by-model results only as White Circle presented them; independent verification beyond the group’s human-review process is not documented in the available texts.

One cited study that appears separately in the coverage—coauthored by Google and cited by Ars Technica—found large volumes of non-consensual AI-generated explicit content circulating in private messages and clouds and argued the “most critical intervention point” is the harmful tools used to create fake sexual images.

That study does not test RISE directly but frames the policy concern White Circle’s findings address. White Circle links the problem to the practical accessibility of prompt-based attacks: the organisation said RISE runs on off-the-shelf jailbreak tools and standard API calls and therefore can be executed without specialized modelling expertise.

The group’s account notes that newer image models, despite additional safety work, exhibited higher susceptibility in White Circle’s tests—an outcome the organisation emphasised in conversations with reporters.

The reporting does not include statements from OpenAI or Google in the supplied texts nor independent audits of the RISE outputs; the available material is White Circle’s preprint, its press release, and journalism reporting on those documents.

The pieces also note that White Circle’s test parameters shape the measured success rate, and they stop short of claiming that the average user could replicate the same yield outside the controlled experiments.