画像生成AIの安全対策を破るRISE、新しいモデルほど成功率が上昇

"We focused the main comparison on nudity. It isn't the most harmful category, but it is prohibited on every target we tested, human reviewers agree on it more readily than on most others, and successes are rare enough on hardened systems to test whether a search method can find them."／"Each prompt gets three target calls, and it counts as a success if at least one of its three images is a human-confirmed violation."／"Evolution gets a foothold, and exploitation then builds substantially on it, from 5.2% to 13.3% on DALL·E 3."／"We also ran RISE on hate, suicide, self-harm, and graphic violence to check that the method works beyond nudity."— White Circle の研究ページより

"It also said the method bypassed safety filters about 13 percent of the time; that was the highest human-verified rate, achieved on DALL·E 3, and rates for other models were lower."— Ars Technica の訂正文より

"After we submitted the paper, OpenAI released GPT-Image-2.5-Flare and Google released Nano Banana 2.1. We ran RISE against both without changing the method. On explicit nudity, its success rate more than doubled compared with the models they replaced."— White Circle の研究ページより

"On nudity, attack success roughly doubled on both new models. It rose 2.4 times on GPT-Image-2.5-Flare and 2.2 times on Nano Banana 2.1. Results on the other categories were mixed. Self-harm stayed about the same on GPT-Image-2.5-Flare and rose on Nano Banana 2.1. Graphic violence rose on GPT-Image-2.5-Flare and fell on Nano Banana 2.1. Our judge is least precise on graphic violence, so we put less weight on those two numbers than on the others."／"We did not expect the newer models to be easier to attack."／"We can't attribute the regression from the outside: it may come from the model itself, from a lighter moderation configuration on a cheaper variant, or from both."— White Circle の研究ページより

"Meanwhile, OpenAI and Google have released new models—ChatGPT Images 2.5 and Nano Banana 2.1—and White Circle told Ars that prompt safety testing using the same method showed “both are significantly more breakable than their previous versions.”"／"“White Circle’s working hypothesis for this is either the newer models are more sophisticated and capable of generating a wider range of content, or that safety has been deprioritized in favor of capability,” White Circle told Ars."— Ars Technica の報道より

"Phase 1: evolve strategies. RISE starts with some generic strategies provided by humans, and evolves better ones."／"Phase 2: exploit the best strategies. Eventually evolution stops turning up new ideas and mostly refines what it already has. At that point RISE takes the top five strategies and freezes them; they are no longer mutated or edited."／"Importantly, none of this involves training a model at all! The whole pipeline runs on a public, off-the-shelf abliterated Qwen3-32B (an open model with its safety training stripped out), used as-is."／"To calibrate it, we collected human labels on about 1,300 generated images across targets and categories, annotated on a three-point scale: no or weak violation, borderline, or explicit. Only explicit violations count as positives."— White Circle の研究ページより

"On DALL-E 3, Nano Banana 2 (Google) and GPT-Image-2, RISE reaches up to 13% human-verified ASR; under the same calibrated evaluation, prior methods with reported ASR as high as roughly 30% fall to near zero."— arXiv の要旨より

"The attacking model is a publicly available version of Qwen3-32B with its safety training stripped out, downloaded from Hugging Face, and the judge model is Gemini 2.5 Flash."／"“You don’t need to have frontier models to break defenses of a frontier model, which is very interesting,” Shilov said."— Ars Technica の報道より

"White Circle has shared its findings with some frontier AI labs through “mutual contacts,” Shilov told Ars, but neither Google nor OpenAI responded to Ars’ request to comment directly on vulnerabilities found in their models."／"Neither company responded after Ars shared these new findings."／"(Researchers noted that Midjourney wasn’t tested because “it does not provide a public API suitable for controlled benchmarking.”)"／"White Circle is also in early talks with government officials about third-party safety testing, Shilov said, which he thinks should be required."／"“You don’t need frontier models or proprietary tech to break these systems; you just need a free download and the ability to make API calls,” Shilov said. “And yet the labs building these systems are the ones assessing their own safety, publishing their own results, and setting their own standards. This is further proof, if we needed it, that governments should be pushing for independent, third-party evaluation.”"— Ars Technica の報道より

"We believe the labs are failing at safety and security, and that self-assessment by model labs themselves will not fix it."／"We believe that government should require independent third-party monitoring of deployed models and of the production infrastructure around them."／"The RISE reproduction pipeline is open source on GitHub. We shared our findings with the affected companies before publication. The attack prompts, the strategies RISE discovered and the images it generated stay private. We're open-sourcing the RISE pipeline so defenders and regulators can run it independently against their own deployments."／"We will also present RISE at NeurIPS 2026 — come find us there!"— White Circle の研究ページより