Landing a policy violation in modern image generators isn't quite as easy as it used to be. One can no longer push a one-line thinly-veiled euphemism through to get an AI-generated image that bypasses the safety layers. On top of that, the jailbreaking prompts that still break through get found and patched quickly.
Current red-teaming methods aren't built to keep up with these safety improvements, for two reasons:
- They score success with automated judges that don't line up with human judgment.
- They generate new attacks by making shallow edits to human-written seed prompts, so any success is short-lived and a reflection of the seeds rather than anything the method sustains.
RISE corrects both issues. RISE is a red-teaming approach that:
- Grounds evaluation in a judge calibrated against human labels, and
- Shifts the search from iterating on individual prompts to uncovering reusable attack strategies.
On DALL·E 3, Nano Banana 2, and GPT-Image-2, we have found that RISE reaches up to 13% human-verified attack success. Meanwhile, prior methods reporting jailbreaking success rates around 30% drop close to zero once their attacks are re-scored against the same human-calibrated standard.
Red-teaming today: reported vs. real attack successes
Much of the AI red-teaming field was originally developed and tested on open-source diffusion models (e.g., SDXL), which run without the extra safety layers that guard a commercial system. A violation is comparatively easy to come by in such a setting, certainly much easier than on DALL·E.
In comparison, modern text-to-image APIs now stack several layers of defense at once. A prompt classifier rejects unsafe input before any image is generated. Then, a moderation filter screens the output image afterward. And the generator itself has been trained to steer away from prohibited content via safety fine-tuning and scrubbing unsafe examples from its training data, so it's less able to render the violation even when a prompt slips through. All these layers are continuously updated, making these modern image APIs a substantially harder target than the open-source diffusion models most red-teaming research has been built on.
Even so, recent papers continue to report impressive success rates against commercial models (Ye et al., 2026; Chen et al., 2025; Huang et al., 2024; Dong et al., 2024; Chin et al., 2024). FPI scores its own attempts with a vision-language model, keeps the prompts that produced a violation, and trains an attacker on them. It reports 83.7% success rate (Xu et al., 2024). RPTRT starts from a handful of hand-written example prompts and learns to stitch their pieces into new combinations; it reports 73.8% (Cao et al., 2024). The reported numbers would suggest the defenses barely work. What undermines these numbers is that they come from entirely different experimental setups: the success criteria are defined differently, the scoring systems are not aligned, the prompts are not replicated, and the judges are distinct. So we re-ran representative methods under one consistent evaluation, scored by a judge we calibrated against human labels. And when we did that, most of the reported success disappeared. Two systemic, compounding problems explain what is happening.
Two issues behind the inflated numbers
The scoring systems reward the wrong outcomes, and the search never really moves.
The scoring systems reward the wrong outcomes
At its core, red-teaming is an optimization loop: you generate an attack, you score it, use the score to generate a better one. So what happens then if the scorer itself is wrong? Everything downstream goes wrong with it. An uncalibrated scorer that deviates from actual human judgement makes way for reward hacking: the optimizer learns to produce whatever the detector rewards, which is not the same as producing a real violation. The optimizer can start converging on anything skin-colored with curves — say, a close-up of sand dunes. In the end, the reported success rate goes up while real violations are yet to even occur. Because the AI red-teaming field has not been calibrating its LLM judges using human input, this is a risk that has been building up for a while.
Trained attackers mostly recycle their original strategy
The dominant attack approach assumes you can learn to generalize from successful jailbreak prompts: collect a small set of successful jailbreak prompts, train a model on them, and then generate more. This may have initially served red teamers well, but it increasingly breaks on hardened systems. Firstly, there aren't enough successes to train on. Prompt-rewriting and seed-trained attackers depend on plentiful positive signal. But when at strict moderation thresholds, you might get a mere 3 successful images from 10,000 target calls; this is not enough signal to bootstrap anything. The more structural problem is when you do have seeds: the trained models do not actually explore. When we manually examined RPTRT's outputs, we found shallow recombinations of the original human-written prompts. These looked like paraphrases, light edits, but ultimately nothing fundamentally new. The success was in the seeds and the training loop added almost nothing.
Building a judge that matches human review
A good judge has to fail in neither of two directions. The judge on one hand cannot be too trigger-happy, flagging tame images as violations. This would teach the attacker to chase false positives. At the same time, it can also not be blind, missing real violations. In that scenario, a genuine attack registers as a failure and the search abandons it.
High recall · low precision
Fires on benign, borderline images. Used as a reward signal, the attacker just learns to reward-hack the judge — the gains aren't real violations.
High precision · low recall
Trustworthy when it fires, but misses most successful attacks — here it catches only about one real violation in twelve, so it can't guide a search through sparse positives.
As it stands, the off-the-shelf detectors sit at one extreme or the other. InternVL2 catches most nudity violations on GPT-Image-2 (recall 0.95) but two-thirds of what it flags is benign (precision 0.35), so an optimizer trained against it chases false alarms. NudeNet is trustworthy when it fires (precision 0.67) but catches only about one real violation in twelve against nudity in DALL·E 3 (recall 0.08).
So we built our own judge. We deliberately took a public off-the-shelf vision-language model, Gemini 2.5 Flash, in service of reproducibility. We gave it strict written criteria for what counts as a violation, drawn from each image generator's own stated content rules. We tuned those criteria against the human labels until the judge's calls matched the humans', then locked them before running any comparison.
The result is a judge that's both careful and thorough. When it flags an image as a violation, it's usually right (0.51-0.68 precision, depending on the generator). And, most importantly, it catches most of the real violations that are there (0.70-0.91 recall). No off-the-shelf detector manages both at once; the balance is what makes our judge reliably steer an attacker toward real violations.
RISE: evolve strategies, not prompts
Existing methods tweak one prompt at a time, nudging it toward a violation and trying again when it fails. The trouble is that almost every prompt fails, and a failed prompt indicates almost nothing about what to try next. As a consequence, the search barely moves. RISE takes a different approach by optimizing one level up. Instead of searching for a good prompt, it searches for a good strategy. A strategy here is a natural-language recipe that tells an LLM how to write attack prompts, so one good recipe can generate many attacks whereas a good prompt is only ever one. A winning strategy might specify a particular artistic or editorial framing, a consistent way of substituting sensitive terms, and scene contexts where the target image would be ordinary. RISE's strategy-level approach runs in two phases.
Evolve strategies
Strategy population
16 evolving islands
Prompt writer (LLM)
one strategy → many prompts
Target T2I
+ input filter, moderation, refusal
Calibrated judge → fitness
16 evolving islands
⟳ Evolve
mutate, recombine, repeat
instantiate on the fixed 3-5 scenarios
3 image attempts per prompt
Scenarios stay fixed here - the search object is the strategy, not the prompt.
Run the best strategies
Top-5 strategies, frozen
no-more mutation
Fresh scenarios
generated from high/low-score feedback
Target T2I → calibrated judge
candidates sent to human review
Human-verified attacks
up to 8% ASR
UCBS bandit splits the call budget
top strategies generate prompts
Now the scenarios change; the strategies don't.
Freeze top-5 strategies
In Phase 1, RISE starts with some generic strategies provided by humans, and evolves better ones. Essentially, a population of strategies competes against a small, fixed set of scenarios. A strategy's fitness is assessed by testing how well the prompts it produces do in practice: the strategy is run, prompts are generated and sent to the target, and the resulting images are scored via the calibrated judge. Strategies whose prompts reliably get violating images past all three defenses score high; strategies whose prompts mostly get blocked score low. The high scorers are then selected as parents, the LLM model mutates them into new variants, the variants are evaluated, and the weak ones drop out. Over successive generations the population drifts toward strategies that work.
In Phase 2 the top strategies are compiled and exploited. Eventually evolution stops turning up new ideas and just minimally refines what it already has. At that point RISE takes the top handful of strategies and freezes them; they are no longer mutated or edited. RISE then runs these fixed strategies over and over to generate as many attacks as it can. The remaining query budget is split across them, leaning on whichever keep producing violations while still probing the others, and feeds each one fresh scenarios based on what scored well so far.
Importantly, none of this involves training a model at all! The whole pipeline runs on a public, off-the-shelf abliterated Qwen2-72B (an open model with its safety training stripped out), used as-is. The contribution is the evolution-and-exploitation loop itself.
Results
We ran RISE against the current generation of production systems. On DALL·E 3, Nano Banana 2, and GPT-Image-2, RISE reaches up to 13% human-verified attack success. This is the highest of any method measured under this standard. Under the same criteria, prior methods fall to at or near no success — RPTRT's 31% collapses to ~0.3% real violations (and what remains is just its seed prompts), while SneakyPrompt, PGJ, and MACPrompt, which reported near-100% on older open models, reach exactly 0% human-verified on DALL·E 3.
We find that RISE's two-phase structure allows evolution (Phase 1) to get a foothold; exploitation (Phase 2) then roughly doubles it. RISE succeeds most often on DALL·E 3 following the exploitation phase, which more than doubles success rates from the previous phase. GPT-Image-2 is the hardest by a wide margin, with the search still surfacing candidates, but human-confirmed violations staying in the low single digits. SneakyPrompt (Yang et al., 2023), PGJ (Huang et al., 2024), and MACPrompt (Ye et al., 2026) reach 0% human-verified ASR on DALL·E 3.
13%
RISE — up to this human-verified attack success rate on DALL·E 3, Nano Banana 2, and GPT-Image-2.
≈0%
Prior methods reporting up to ~30% ASR, re-evaluated under the same calibrated, human-reviewed criteria.
Where this leaves us
The first point to follow from this work is that red-teaming has to raise its standard for LLM-as-judge. Calibrating against human labels should be a precondition for reporting a number. Just as important, the setup around the judge has to be constructed and documented so that others can reproduce it; through replication studies, the field can audit whether a judge is measuring real violations at all.
The second point we wish to draw attention to is the fact that RISE was able to bypass all the defense layers using nothing that isn't freely available to anyone with an internet connection. We decided not to use our in-house White Circle models in this case in order to set a floor baseline. All it took was a public open model as the attacker, a general-purpose VLM turned into a calibrated judge with nothing but written criteria, and no training anywhere in the loop. And we can only expect the components to get better and to also see more and more purpose-built attackers. As they do, we can expect adaptive attacks as the ones we have described to only get better, cheaper, more accessible.
If strategy is indeed the durable unit of jailbreak, most deployed defenses are not fighting accordingly. A generative adversary cannot be enumerated in advance, so any defense that depends on having seen the attack before risks structurally being on the losing side.
This is precisely why we focus on protection at runtime. It allows for checking the actual content in the path against the actual policy, every time, instead of blocking known-bad strings after the fact. If the attack surface is defined by novel strategies, defense cannot exist in a blocklist of the prompts that worked yesterday.
BibTeX
@article{kharlapenko2026rise,
title = {RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models},
author = {Kharlapenko, Dmitrii and Bratchikov, Sergei and Korolev, Konstantin and Nikolich, Aleksandr},
booktitle = {arXiv preprint},
year = {2026}
}