White Circle breaks Nano Banana 2.1 in 20.7% of nudity attacks
White Circle’s own research page carries two numbers that the coverage of its nudity jailbreak study left out. Running its attack against Google’s Nano Banana 2.1 produced human-verified nudity violations on 20.7% of prompts, and against OpenAI’s GPT-Image-2.5-Flare on 7.8%. Both figures sit outside the preprint, which White Circle submitted on 28 September, before either model shipped.
That matters because the figure everyone printed was 13%. Ars Technica reported on 14 October that White Circle said testing the two newest releases showed “both are significantly more breakable than their previous versions”, with no rate attached. The research page attaches one. It puts the rise at “more than twofold” and gives the per-model table.
| Target | After evolution | After exploitation |
|---|---|---|
| DALL·E 3 | 5.2% | 13.3% |
| Nano Banana 2 | 5.7% | 9.5% |
| GPT-Image-2 | 1.5% | 3.3% |
| GPT-Image-2.5-Flare | 4.1% | 7.8% |
| Nano Banana 2.1 | 13.2% | 20.7% |
By White Circle’s arithmetic the nudity rate rose 2.4 times on the new OpenAI model and 2.2 times on the new Google one. But results elsewhere were messier. Self-harm held roughly flat on the OpenAI release, and graphic violence actually fell on Nano Banana 2.1, from 47.0% to 34.5%. The researchers say their judge is least precise on graphic violence, which is why they weight those two cells lower themselves.
The OpenAI model tested is the cheaper of two
Here’s the caveat none of the write-ups carried. OpenAI didn’t ship one model ID with Images 2.5, it shipped two, and we covered that split when the model launched in September. Sunburst is positioned for editing precision and Flare for fast everyday generation. White Circle tested Flare, which is the one positioned on speed.
The authors don’t claim to know why the newer models gave way more easily. The regression “may come from the model itself, from a lighter moderation configuration on a cheaper variant, or from both”, the research page says, and it adds that they can’t attribute it from outside. Ars quoted a narrower pair of explanations from the company: wider capability, or safety deprioritised for capability. The variant reading is the one that’s testable, and it’s missing from the coverage.
Safety is not monotonic across model releases.
White Circle, RISE research page
The paper’s main finding is about other papers
Read the preprint and the nudity rates aren’t really its argument. Its argument is that published red-teaming scores are inflated, and that’s because nobody calibrated the automated judge against human labels. Re-scored under one standard, SneakyPrompt, PGJ and MACPrompt all reach 0% on DALL·E 3, against the 96% to 100% they reported on open models. RPG-RT, which reported 31.3%, produced 3 flagged images in 990 calls.
The mechanism behind that gap is reward hacking. An optimiser scored by a skin detector learns to generate anything skin-coloured with curves, and the research page’s example is a close-up of sand dunes. White Circle collected about 1,300 human labels on a three-point scale, then froze written criteria for a Gemini 2.5 Flash judge before running any comparison. Off-the-shelf NudeNet caught roughly one real violation in twelve on DALL·E 3, at a recall of 0.08.
Still, nothing in the attack pipeline was private. The attacker is a public Qwen3-32B with its safety training stripped, no model was trained, and the budget was 2,500 calls to evolve strategies plus 1,500 to exploit them per target. “You don’t need to have frontier models to break defenses of a frontier model, which is very interesting,” CEO Denis Shilov told Ars. On Leonardo.ai, a smaller commercial service, the evolution phase alone hit 40.1%.
Whether any of this gets independently checked turns on access, which is the fight external evaluators are already having with the labs. White Circle told Ars it wouldn’t sign a restrictive non-disclosure agreement, so an embedded role at Anthropic probably isn’t happening if Anthropic requires one. The reproduction pipeline is public under Apache-2.0, though the prompts, the discovered strategies and the generated images are held back. The paper goes to NeurIPS 2026 in November.
Get the daily rundown
One email each weekday with the AI news that matters, every claim linked to its primary source.
Free, one email each weekday, unsubscribe in one click. We never sell or share your address.
