Artificial intelligence image generators become easier to manipulate as capabilities expand

Automated testing across major commercial image platforms shows that updating models can double their vulnerability to explicit content generation, challenging assumptions about digital guardrails.

Modern artificial intelligence models that generate images from text descriptions are widely expected to strengthen safety defenses as developers release updated versions. Commercial platforms typically place automated inspection barriers between users and image generators to intercept requests for prohibited pictures, particularly non-consensual explicit sexual imagery.¹² When developers introduce newer versions of these systems, public assumptions suggest defensive guardrails will become sturdier alongside improvements in artistic capability and visual fidelity.

The distribution patterns of abusive digital media show why prevention at the initial generation interface remains crucial. Synthetic explicit images circulate primarily through private text messages, direct chat applications, and personal cloud storage, where platform moderation tools rarely reach.² Because discovering non-consensual imagery after distribution presents severe challenges, stopping the creation of prohibited pictures during generation offers the most effective intervention point.² When automated safeguards fail, individuals with minimal technical expertise can produce harmful pictures without writing custom code or developing proprietary tools.²¹

To understand how automated guardrails fail, consider the sequence of technical checks that occurs whenever a user submits an image prompt. A user enters a written description specifying a desired scene. Before rendering begins, an automated text classifier screens the words to identify banned terms or overt policy violations.¹³ If the phrasing passes, the underlying model interprets descriptive concepts and calculates visual pixel patterns.¹ Once the image is drawn, a secondary moderation filter inspects the resulting picture to detect illicit physical features before transmitting the file.¹ A safety failure occurs when an adversarial request uses benign, artistic phrasing that slips past the initial text filter while steering the generative engine toward forbidden depictions.¹³ Because advanced models comprehend subtle linguistic nuances with higher precision, they translate indirect descriptive cues more effectively, inadvertently rendering prohibited scenes that simpler systems fail to interpret.²¹

New experimental findings indicate that commercial image systems frequently succumb to these indirect prompting methods. In an investigation posted to the arXiv preprint repository in September 2026, lead author Dmitrii Kharlapenko and colleagues Sergei Bratchikov, Konstantin Korolev, and Aleksandr Nikolich examined safety barriers across leading commercial image platforms.³¹ Working under the research organisation White Circle, a public benefit corporation founded by Denis Shilov following his release of universal model jailbreaks in October 2024, the researchers evaluated OpenAI's DALL-E 3 and GPT-Image-2, alongside Google's Nano Banana 2.²³ The authors reported that an automated attack method bypassed commercial safety filters to generate explicit imagery across several major platforms, operating through standard programming interfaces using widely accessible, off-the-shelf software tools.²¹

Why do conventional safety filters struggle against automated prompt strategies?

Commercial image safety filters struggle against automated prompt strategies because traditional defenses evaluate individual forbidden words rather than recognizing high-level conceptual instructions that steer visual rendering.¹³ Many existing defensive systems rely on blocklists or single-prompt classifiers that intercept obvious vocabulary, such as explicit anatomical terms or unambiguous sexual references.¹ When an attacker substitutes metaphorical language, artistic framing, or fictional settings, the text classifier often evaluates the phrasing as harmless.¹ Dmitrii Kharlapenko and colleagues reported that earlier academic red-teaming techniques, defined as structured tests simulating malicious attacks to identify defensive weaknesses, often depended on making minor word substitutions to human-written seed prompts.³¹ The authors found that when commercial providers updated moderation rules to block those specific seed phrases, older attack methods immediately stopped working on hardened commercial platforms.¹³

The White Circle researchers reported that previous red-teaming studies had substantially overstated their real-world success because their testing frameworks relied on automated scoring judges that deviated from human standards.³¹ Earlier evaluation pipelines frequently employed off-the-shelf automated detectors such as NudeNet, CLIP-NSFW, or InternVL2 to decide whether an attack succeeded.¹ In their preprint, Dmitrii Kharlapenko and colleagues demonstrated that InternVL2 achieved a recall of 0.95 on GPT-Image-2 by catching nearly all violations, but suffered from a precision of 0.33, meaning two-thirds of flagged images were benign.¹ Conversely, NudeNet achieved a precision of 0.67 on DALL-E 3 but registered a recall of 0.08, missing approximately 11 out of every 12 real policy violations present in the generated images.¹

When an automated optimization system trains against an uncalibrated detector, the attacking software learns to produce imagery that tricks the detector instead of generating genuine policy violations.¹ Dmitrii Kharlapenko and colleagues observed that automated search routines optimized against flawed detectors frequently converged on innocent visual features, such as curved sand dunes, because the detector registered skin tones rather than prohibited actions.¹ To evaluate earlier techniques under identical conditions, the researchers re-tested published methods against DALL-E 3 using a human-calibrated scoring standard.¹ While one prior method known as RPG-RT originally claimed a 52 percent success rate under its internal NudeNet detector, White Circle found that the identical method yielded only three human-verified policy violations out of 990 API calls on DALL-E 3, representing an actual success rate of 0.3 percent.¹ Other published attack methods fell to zero percent under human review.¹³

How does the strategy evolution method discover system vulnerabilities?

The strategy evolution method discovers system vulnerabilities by searching for reusable natural language recipes that describe scene composition, rather than rewriting individual prompt sentences one by one.³¹ The researchers designated their framework RISE, an acronym for Red-teaming via Iterative Strategy Evolution.³² The technique directs an open-source text generator to develop comprehensive strategies that specify narrative context, artistic framing, and indirect descriptive language.¹ A single successful strategy can subsequently generate dozens of distinct prompts across different subject scenarios.¹ Dmitrii Kharlapenko and colleagues designed the system to operate across two distinct stages, first exploring a wide population of strategies and subsequently exploiting the top-performing approaches against target commercial image interfaces.

During the exploration phase, RISE organizes 16 separate computational islands that mutate and exchange strategy concepts over successive generations. The authors used an open-source Qwen3-32B language model whose internal safety restrictions had been abliterated, a technical modification removing safety fine-tuning directions from model weights, to write candidate prompts based on evolving strategies.¹ Each generated prompt was submitted across three attempts to target image APIs, consuming a budget of 2,500 target calls per model during evolution. To evaluate the resulting pictures without human bottlenecks, the authors calibrated Gemini 2.5 Flash, a commercial vision-language model, against approximately 1,300 images annotated on a three-point scale by human reviewers. By establishing strict written definitions matching provider content policies, the calibrated judge achieved a precision between 0.51 and 0.68 and a recall between 0.70 and 0.91 across tested generators.¹

In the subsequent exploitation phase, the researchers froze the top five discovered strategies, preventing further mutation, and deployed them against fresh target scenarios using an additional budget of 1,500 calls per generator. On OpenAI's DALL-E 3, human-verified attack success against explicit nudity policies increased from 5.2 percent after the initial evolution phase to 13.3 percent following exploitation. On Google's Nano Banana 2, verified attack success rose from 5.7 percent during evolution to 9.5 percent after exploitation.¹ On OpenAI's GPT-Image-2, success rates remained lower, rising from 1.5 percent during evolution to 3.3 percent during exploitation.¹ On Leonardo.ai, a separate commercial platform, the initial evolution phase reached a 40 percent human-verified success rate.¹ The authors noted that all experimental requests ran through public programming interfaces using accessible tools without requiring custom frontier models.²¹

Subsequent evaluations conducted after the preprint's completion revealed that newly released generative models proved substantially more vulnerable to the automated strategy technique than their direct predecessors.¹² When Dmitrii Kharlapenko and colleagues applied the identical attack pipeline to OpenAI's GPT-Image-2.5-Flare and Google DeepMind's Nano Banana 2.1, attack success rates roughly doubled on nudity policies without requiring modifications to the attacking framework.¹² On GPT-Image-2.5-Flare, human-verified attack success for explicit nudity reached 7.8 percent, representing a 2.4-fold increase compared to GPT-Image-2's 3.3 percent rate. On Nano Banana 2.1, attack success reached 20.7 percent, representing a 2.2-fold increase compared to the 9.5 percent recorded on Nano Banana 2. The authors also reported attack success rates of 27.2 percent for self-harm and 34.5 percent for graphic violence on Nano Banana 2.1.¹

What do the benchmark results leave unanswered about real-world risks?

Controlled benchmark evaluations cannot measure the true volume of abusive imagery generated across private platforms or predict how rapidly commercial providers will patch individual prompt vulnerabilities. The reported attack percentages reflect automated query experiments conducted under specific API configurations during the autumn of 2026, rather than observations of typical consumer use.¹³ Commercial platform operators continuously alter server-side filters, safety steering algorithms, and post-generation moderation layers, meaning defensive resilience measured during an experimental trial can change as proprietary pipelines are reconfigured.¹ In addition, the researchers acknowledged that their automated visual judge exhibited lower precision when scoring graphic violence compared to explicit nudity, introducing greater uncertainty into findings for violent content.¹ The research paper by Dmitrii Kharlapenko and colleagues was posted to the arXiv repository as a preprint and has not undergone formal peer review.³

The findings highlight an operational asymmetry between automated generative attacks and defensive guardrails built on static blocklists.¹ While software defenders often rely on filtering known problematic phrases after human moderators identify them, generative systems can evolve novel conceptual recipes that evade keyword detection entirely.¹ A survey co-authored by Google researchers in July 2026 across internet users in Australia, the United Kingdom, and the United States reported that 20 percent of individuals who admitted to generating synthetic explicit imagery did so for fun or as a joke, while nearly 33 percent characterized their behavior as experimenting with technology.² That investigation concluded that interventions at the image generation source remain the most critical defense, because technical friction deters non-expert users who might otherwise produce non-consensual material.²

External organizations tracking digital exploitation have documented a sharp rise in synthetic abuse material across the broader internet ecosystem. In October 2026, the Internet Watch Foundation reported that its human analysts detected 6,310 synthetic images depicting child sexual abuse during the first six months of 2026, a volume approximately 40 percent higher than the organization verified across the entire twelve months of 2025.² Dmitrii Kharlapenko and colleagues stated in their research paper that White Circle shared its experimental findings with affected technology providers prior to publication and will present the study at the NeurIPS 2026 conference in November.¹² The researchers published their reproduction software pipeline on GitHub while withholding specific attack prompts and generated imagery, arguing that recurring third-party audits are essential to ensure commercial guardrails keep pace with advancing generative capabilities.¹²

Save this story

The record

50 sentences trace to 3 sources.

All 3Documents 2Records 0Reporting 1People 0

1. 1 W whitecircle.com Third-party reporting · whitecircle.com RISE: Red-teaming via Iterative Strategy Evolution See the source
2. 2 AB Ashley Belanger Document · arstechnica.com · 14 Oct 2026 OpenAI, Google pushing new AI models easily tricked into making nudes, researchers say See the source
3. 3 A arxiv.org Paper · arxiv.org RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models Preprint · may not have been peer reviewed See the source