White Circle says two newer image models are more vulnerable than their predecessors

White Circle said ChatGPT Images 2.5 and Nano Banana 2.1 were significantly more vulnerable to safety-filter bypass than their previous versions, according to an Ars Technica report published October 14. That qualitative claim is separate from the RISE preprint’s numerical result: up to 13% human-verified attack success in tests involving DALL·E 3, Nano Banana 2, and GPT-Image-2.

What RISE’s 13% measures

RISE stands for “Red-teaming via Iterative Strategy Evolution.” Its authors report an attack success rate (ASR)—the share of evaluated attacks counted as successful—of up to 13% for tests involving DALL·E 3, Nano Banana 2, and GPT-Image-2. The preprint abstract describes this as human-verified ASR and says the researchers used strict success criteria tailored to each content category.

“Up to” is an upper bound, not a rate for each model or an average across the three. The abstract does not break the result down by individual model. The preprint was submitted to arXiv on September 28, 2026.

That distinction matters for the newer systems named in the October report. White Circle told Ars that ChatGPT Images 2.5 and Nano Banana 2.1 were significantly more breakable than their predecessors, but the report gives no numerical rate for either. The 13% figure belongs to the three systems named in the preprint abstract; it does not quantify White Circle’s separate comparison of the newer versions.

How the researchers evaluated the results

RISE evolves reusable red-team strategies to generate prompts for new scenarios, rather than relying on a single prompt at a time. The researchers say they used category-specific success criteria and calibrated vision-language-model judges against human labels.

Ars Technica reported that the pipeline used a Qwen model to generate attacks and Gemini 3.8 Flash as a judge. The judge assessed whether an output met the criteria for prohibited content. White Circle did not include Midjourney in the controlled benchmark because it lacked a public API suited to that testing, Ars reported.

How the earlier-method comparison fits

The RISE authors also say that earlier methods with previously reported ASRs as high as roughly 30% fell to near zero when assessed with their calibrated evaluation. Those figures describe different evaluation contexts: roughly 30% was the high end of earlier reported rates, while near zero was the result for those methods under the RISE authors’ evaluation.

The abstract’s central result, meanwhile, remains an upper bound for tests involving DALL·E 3, Nano Banana 2, and GPT-Image-2. White Circle’s comparison of ChatGPT Images 2.5 and Nano Banana 2.1 is a separate qualitative finding.

On October 14, Ars Technica reported that White Circle planned to open-source the pipeline and present the research at NeurIPS 2026 in November.