White Circle told Ars Technica that ChatGPT Images 2.5 and Nano Banana 2.1 were more breakable than their predecessors under its testing method. In a report published October 14, 2026, Ashley Belanger also described three earlier-model results: the share of attack prompts that produced images human reviewers confirmed as explicit. (Ars Technica)
White Circle’s newer-model finding is qualitative
The reported comparison covers ChatGPT Images 2.5 and Nano Banana 2.1 against their respective predecessors. Ars published no numerical rates for either newer model, so the finding is qualitative.
How the RISE test works
White Circle calls its method RISE, short for Red-teaming via Iterative Strategy Evolution. It uses an attacking model to generate jailbreak prompts, an image generator to produce an output, and a judge model to check whether that output contains prohibited content. The attacking model was Qwen3-32B with its safety training removed; Gemini 2.5 Flash served as the judge.
Three earlier-model rates measure attack prompts
White Circle’s reported percentages count attack prompts that led to images human reviewers confirmed as explicit. The same measure was reported for all three models:
| Image model | Attack prompts producing a human-confirmed explicit image |
| DALL·E 3 | About 13% |
| Nano Banana 2 | Under 10% |
| GPT-Image-2 | About 3% |
These are results from adversarial prompts designed to challenge safeguards, not a measure of how often an ordinary image request produces such an image. The percentages also do not provide a general safety ranking across image generators.
What the comparison covers
RISE sought reusable attack strategies that could generate varied prompts across scenarios. Ars reported that Midjourney was excluded because, according to the researchers, it lacked a public API suitable for controlled benchmarking. The three percentages therefore describe results for the models tested with this method, rather than a comparison of every image generator.
