Safety researchers at White Circle used an automated prompt-evolution system to bypass explicit-image safeguards in models from OpenAI and Google. The work targets the point of generation, where stronger filters could add friction before nonconsensual intimate images are created and shared privately.
The method, called Red-teaming via Iterative Strategy Evolution, uses one model to generate candidate jailbreaks and another to judge whether the resulting image violates policy. It relies on publicly available tools: an altered Qwen3-32B served as the attacker and Gemini 2.5 Flash as the judge. Human reviewers then checked the outputs.
About 13 percent of attack prompts against DALL-E 3 produced confirmed explicit images. The rate was below 10 percent for Nano Banana 2 and about 3 percent for GPT-Image-2. White Circle says the same approach made the newer ChatGPT Images 2.5 and Nano Banana 2.1 significantly easier to break than their predecessors, although it did not publish comparable rates for those models in the report.
The findings are in a preprint scheduled for presentation at NeurIPS, not a completed independent audit. Google and OpenAI did not respond to the publication’s questions. White Circle plans to release the testing pipeline, arguing that repeatable external evaluations can reveal transferable attack patterns more effectively than testing isolated prompts. Disclosure will also make the technique available beyond defenders, reinforcing the need for models to be retested after each release.