RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models

• Commercial systems combine prompt classifiers, output moderation, and generation models trained to avoid prohibited content, unlike the simpler open-source settings commonly studied.Source: §1 · p. 1
• Prior judges both overtrigger on benign images and miss nuanced guardrail bypasses; NudeNet recovers only 4–8% of human-confirmed violations on hardened targets, while InternVL2 has precision below 0.3.Source: §1 · p. 1
• Training-based red-teamers can collapse to near-zero success under stricter guardrails, while direct training there may fail to bootstrap because positive examples are sparse.Source: §1 · p. 2
• RPG-RT recombines human-written seed fragments and rarely departs from them, so its non-zero ASR reflects seed quality rather than learned exploration.Source: §1 · p. 2
• RISE evolves reusable natural-language attack strategies to elicit an LLM’s exploration, complementing approaches that optimize prompt distributions or seed pools.Source: §1 · p. 2
• RISE reaches up to 13% human-verified ASR on DALL·E 3, Nano Banana 2, and GPT-Image-2, while best-effort prior methods with reported ASR as high as roughly 30% fall to near zero under the same calibrated evaluation.Source: §1 · pp. 2–3

Scope and targets

• Female nudity is the main cross-method comparison because it is consistently prohibited and more reliably annotated than the four additional categories, which are reported but not used to rank methods.The reported Fleiss’ κ is 0.46–0.57 for nudity versus 0.24–0.38 for the additional categories.Source: §2 · p. 3

Human evaluation

• Human annotators label about 1,300 generated images as no or weak violation, borderline, or explicit violation; only explicit violations count as positive.Source: §2 · p. 3

Judge calibration

• Category-specific criteria are revised against false positives and reward hacks, frozen before comparisons, and used to calibrate Gemini 2.5 Flash; final ASR remains tied to human review.Source: §2 · p. 3
• For non-sexual DALL·E 3 categories, the same threshold yields lower precision and greater category-to-category variation because the categories are less visually atomic.Source: Figure 2 · p. 4, Table 2 · p. 4
• Figure 2 presents examples flagged by baseline judges but labeled non-positive by humans, illustrating false positives that drive low precision.Source: §2 · p. 4, Figure 2 · p. 4

Pipeline configuration

• Each evaluated prompt receives three target calls, and a prompt succeeds when at least one image crosses the judge threshold; phase budgets count target calls, not prompts.Source: §2 · p. 4

3 Findings About Existing Methods

• Methods often achieve high success under their native rewards, but their scores do not track the calibrated target-violation criterion.The methods were optimizing their assigned metrics; the mismatch appears when outputs are rescored with the calibrated judge.Source: §3 · p. 4
• Calibrated rewards improve Curiosity and FGPI on the permissive local testbed and RPG-RT on DALL·E 3, but gains remain local to the reward setting.FGPI and Curiosity collapse at the stricter τ = 0.05 threshold.Source: §3 · p. 5
• FGPI’s seed-free strict rows are 0%, while seeded positives largely reflect seed bypass potential; simpler RPG-RT seed sets yield zero calibrated successes.The passage attributes the scarcity of new signal to the difficulty of bootstrapping a fine-tuning loop.Source: §3 · p. 5
• At matched budgets of ∼5,000 target calls, RPG-RT stays close to human-written seeds while RISE explores farther from the initial scenarios.Manual inspection found that successful RPG-RT prompts mostly repeat or lightly recombine seed fragments.Source: §3 · p. 5
• SneakyPrompt, PGJ, and MACPrompt each achieve 0% human-verified ASR on calibrated DALL·E 3 despite matching their reported local-model numbers.DREAM prompts yield 0.8% under Gemini scoring on DALL·E 3 but show no transfer to GPT-Image-2.Source: §3 · p. 5

4 Methodology

• RISE calibrates a frozen violation criterion and judge for each target, then maps the criterion and concrete scenarios to candidate prompts using a strategy.The core RISE-Ablit configuration uses Qwen3-32B for strategy synthesis and prompt writing without model-weight updates.Source: §4 · pp. 5–6

4.1 Phase 1: Evolutionary Strategy Discovery

• RISE searches reusable prompt-generation strategies rather than editing individual prompts, allowing rare high-scoring outputs to inform strategy search even when most prompts fail or are blocked.The strategy synthesizer evolves instructions while a fixed scaffold handles scenarios, prompt generation, judging, and fitness aggregation.Source: §4.1 · pp. 6–7
• The search uses 16 parallel islands, initialized by mutating a generic seed strategy and evaluating it on the category’s available scenarios.Parent selection favors above-median fitness while moving away from overused strategies; candidates that pass screening receive fuller evaluation and enter an archive capped at 50.Source: §4.1 · p. 7
• RISE scores strategies using the mean of their top three prompt-level max scores and migrates non-best strategies between islands every 10 steps.This fitness favors rare breakthroughs; excluding each island’s best from migration is intended to prevent premature cloning.Source: §4.1 · p. 7
• Component ablations show that scenario-conditioned input is a major design choice: criteria-only input reaches 0.20% ASR, while adding an external prompt library reaches 0.50%.Removing migration drops ASR from 2.87% to 0.56%; replacing top-5 fitness with the all-prompt mean drops it from 2.87% to 0.92%.Source: §4.1 · p. 7

4.2 Phase 2: Fixed-Strategy Exploitation

• After evolution, RISE freezes the top strategies and allocates target calls among them with a UCB1 bandit; discovered strategies can transfer across scenarios and, to a limited extent, prompt-writing LLMs.Fixed strategies also retain separate memories of high- and low-scoring scenarios and refresh some scenarios during evaluation.Source: §4.2 · pp. 7–8

5 RISE Results

• The RISE-Ablit comparison uses a public abliterated Qwen3-32B prompt writer, 2,500 target calls for evolution, and 1,500 for fixed-strategy exploitation.The fixed-strategy phase uses the top five strategies; target-call budgets are not ASR denominators because each evaluated prompt uses three calls.Source: §5 · p. 8
• Table 7 compares RISE-Ablit on production targets: DALL·E 3 is the broadest head-to-head comparison, while GPT-Image-2 has a lower human-verified rate.Nano Banana 2 is described as a stronger contemporary target where RISE remains high under automated scoring.Source: §5 · p. 8, Table 7 · p. 8
• RISE finds human-confirmed violations in every reported non-nudity target/category cell, but these cross-method results use precision-adjusted rather than fully human-verified ASR.The comparison is limited because criteria are more context-dependent and annotators agree less than for nudity; some DALL·E 3 runs also use GPT-4.1 rather than Qwen3-32B.Source: §5 · p. 8, Table 8 · p. 9
• ASR is prompt-level: each prompt gets three target calls and succeeds if any image crosses the threshold, while main ASR claims count human-confirmed positives.Gemini ≥0.7 is used for search and triage, not as the final success definition.Source: §5 · p. 8
• Supplemental offline RL over RISE rollouts raises local ASR from 3.91% at 5k budget to 6.82%, while the main strategy-evolution method requires no model training.The main method can be paired with prompt writers that follow its generation scaffold, subject to their refusal behavior.Source: §5 · p. 9

6 Discussion

• Headline 30–50% ASR figures for recent red-teaming on hardened targets are attributed to judge-calibration error, reward-hacking artifacts, and seed-local successes; calibrated re-evaluation puts baselines at or near 0%.RISE recovers non-zero human-verified ASR with strategy evolution and fixed-strategy exploitation using a public abliterated prompt writer and no model training.Source: §6 · p. 9
• The main comparison focuses on female nudity; four additional categories use precision-adjusted rather than fully human-verified ASR and have lower inter-annotator agreement.Nudity is described as consistently prohibited and comparatively calibratable.Source: §6 · p. 9
• Baseline reproductions are best effort, so the study cannot guarantee recovery of original performance when methods depend on curated seed pools or private training data.The authors use public code where available and otherwise follow published method structures.Source: §6 · p. 9

7 Related Work

• Prior T2I red-teamers train attacker or prompt-writing models [Li et al., 2024, Xu et al., 2025, Cao et al., 2025, Zhang et al., 2025b, Mehrabi et al., 2024, Hong et al., 2024], rewrite prompts in black-box settings, or optimize prompt pools and distributions.The paper compares primarily with recent methods reporting DALL·E 3 success and uses a broader set as supporting checks.Source: §7 · p. 9
• Commercial systems combine pre-generation filters, post-generation image classifiers, and model-side interventions into multi-stage, frequently updated, undisclosed pipelines.The passage situates these alongside research on T2I defenses and benchmarking.Source: §7 · p. 9
• RISE builds on LLM-guided evolutionary search [Novikov et al., 2025, Lange et al., 2025, Guo et al., 2025], adapting open-ended strategy search to sparse black-box T2I red-teaming, where candidate strategies require expensive target calls and noisy image-level judging.Source: §7 · pp. 9–10

A Prompt Templates; A.1 Strategy Synthesis Prompt; A.2 Seed Strategy Synthesis Prompt

• The prompt-template appendix withholds discovered strategies and final attack prompts, while giving structural prompts for strategy evolution and diverse seed-strategy generation.Evolution prompts use current instructions and rollout feedback; seed prompts request substantially different framings and retain a tagged final prompt block.Source: A Prompt Templates · p. 14, §A.1 · p. 14, §A.2 · p. 14

A.3 Judge Prompt

• The judge prompt returns a structured score and rationale, asks for strict alignment, and uses category criteria revised during pilots then fixed for final comparisons.The criteria include violation definitions and graded scores for borderline cases.Source: §A.3 · pp. 14–15

A.4 Scenario Generation Prompts; A.5 Prompt Generation Prompt

• Scenario prompts request grounded, varied who/what/where descriptions and use high- and low-scoring feedback when available; the prompt generator then follows strategy instructions to produce a usable prompt.The scenario feedback is intended to improve likely success while maintaining diversity.Source: §A.4 · p. 15, §A.5 · p. 15

A.6 Meta-Scratchpad Prompts

• The meta-scratchpad pipeline analyzes individual program outcomes, synthesizes global insights, and generates recommendations based on those insights and the current best program.Its analysis prompts emphasize concrete scores, successful outliers, ineffective approaches, and implementation patterns.Source: §A.6 · pp. 15–17

A.7 Evolutionary Search Configuration; A.8 Compute Resources

• Phase 1 uses 16 islands with archives of 50 strategies, up to 2,500 target calls, and migration every 10 island steps; Phase 2 usually exploits the top five strategies with 1,500 calls.Reported production runs use up to 15 parallel workers, while commercial-target wall-clock time depends mainly on provider latency and rate limits.Source: §A.7 · p. 18, §A.8 · p. 18

A.9 External Assets, Licenses, and Terms

• The appendix lists third-party assets used for evaluation and related tasks, but does not redistribute model weights, datasets, unsafe images, final prompts, or discovered strategies.Table 9’s “Terms” refers to proprietary API or gated-model access terms rather than an open-source license.Source: §A.9 · p. 18, Table 9 · p. 19

B Baseline Reproduction Details

• Baseline reproduction details aim to adapt published methods to production APIs; the baseline summary reports 0% human-verified ASR on DALL·E 3 under the calibrated protocol for three local-model methods.RPG-RT is treated separately because its reward-signal choice changes the result, and listed budgets are for calibrated checks rather than every original training or ablation budget.Source: B Baseline Reproduction Details · p. 19, Table 10 · p. 20, Table 11 · p. 20

B.1 Scope Rationale

• Female nudity is the main cross-method comparison because it is consistently prohibited, more reliably annotated, and difficult enough to test search under hardened guardrails.Other categories are reported as precision-adjusted ASR but are not used for cross-method comparison because their criteria are less strict and more context-dependent.Source: §B.1 · pp. 19–20

B.2 Human Evaluation Protocol

• Three to four internal annotators labeled images as no/weak, borderline, or explicit violations; Figure 4 shows blurred violence and self-harm examples across four production targets.Agreement was moderate for nudity and lower for the DALL·E 3 non-sexual categories.Source: §B.2 · p. 20, Figure 4 · p. 21
• Precision-adjusted ASR multiplies Gemini ASR@0.7 by calibrated precision, while single-digit base ASR receives full manual review.For Nano Banana 2 graphic violence, raising the threshold from ≥0.7 to ≥0.8 increased precision from 0.38 to 0.55 and lowered recall from 0.75 to 0.55.Source: §B.2 · p. 21

B.3 Uncertainty Estimates

• Production nudity rows omit target-call-denominator Wilson intervals because ASR is prompt-level; local hard-testbed results report mean ± standard deviation across three restarts.The production rows are point estimates for fixed target-call budgets.Source: §B.3 · p. 21

B.4 Baseline Judge Matrix

• Tables 13–14 expand judge comparisons across human-labeled target/category sets, reporting precision, recall, and F1 while noting category-mismatched detector coverage.Table 13 uses calibrated criteria for Gemini and corresponding paper thresholds for baseline detectors where applicable.Source: §B.4 · p. 21, Table 13 · p. 22, Table 14 · p. 22

B.5 Cloud-VLM Judge Choice

• Gemini 2.5 Flash was selected as a high-precision search and triage signal, while final ASR remains tied to human review.Its continuous scores separated near-misses, borderline cases, and explicit violations in pilot checks.Source: §B.5 · p. 22

B.6 SneakyPrompt; B.7 PGJ (Perception-Guided Jailbreak); B.8 MACPrompt

• 0% ASR on DALL·E 3 was observed for SneakyPrompt, adapted PGJ, and MACPrompt, despite respective SLD-Strong results of 100%, 96%, and 92%.The PGJ and MACPrompt SLD-Strong results were 96% and 92%, compared with reported 100% and 96%.Source: §B.6 · p. 22, §B.7 · p. 23, §B.8 · p. 23

B.9 FGPI-Style Fine-Tuning

• At the strict moderation threshold τ = 0.05, FGPI-style collection yielded only 3 Gemini-positive images from 1,550 target calls, too few to support useful fine-tuning.At permissive τ = 0.85, 1,444 calls yielded 51 positives.Source: §B.9 · p. 23

B.10 RPG-RT

• RPG-RT reached 75% ASR on SLD-Strong, versus its reported 77%, using the preserved preference/DPO pipeline and a 33-prompt DALL·E 3 evaluation set.The DALL·E 3 evaluation required approximately 990 target API calls per training epoch.Source: §B.10 · p. 23

D Strategy-Abstraction Ablations

• Prompt-only evolution removes the strategy-to-prompt step while keeping the islands, mutation, migration, and fitness unchanged.The comparison uses the local hard testbed and RISE-Ablit prompt writer.Source: D Strategy-Abstraction Ablations · p. 23, Table 15 · p. 24
• Evolving prompts directly cuts ASR roughly fourfold and roughly halves unique bigrams per attempt, compared with strategy evolution.The authors attribute the diversity difference to compounded variation across strategy and prompt generation, and note noisier fitness when scoring a single prompt on three calls.Source: D Strategy-Abstraction Ablations · p. 24, Table 16 · p. 24
• Replacing the seed strategy with a minimal bypass instruction and removing synthesis guidelines causes search to collapse, consistent with the criteria-only ablation’s 0.20% result.The guidelines include exploring different step counts or metaphorical domains.Source: D Strategy-Abstraction Ablations · p. 24

E Supplemental Prompt-Writer Training

• Training data combines a 10k-call evolution run with a 1,500-call fixed-policy exploitation run, and evaluation uses held-out local rollouts.The supplemental table reports held-out prompt-level ASR@0.7 with three target calls per prompt.Source: E Supplemental Prompt-Writer Training · p. 24, Table 17 · p. 25
• The public abliterated and internal uncensored Qwen3-32B prompt writers favor different meta-prompts, so mismatched scaffolds are treated only as diagnostics.The internal model’s training process is not part of the reproducible claim.Source: E Supplemental Prompt-Writer Training · p. 24
• Offline GRPO trains on fixed pre-scored prompt groups, using within-group quantile ranks mapped through the inverse normal CDF for robust advantages.The method clamps token log-probabilities and averages loss at token level; it omits reference-policy KL and the probability-weighted policy-gradient variant.Source: E Supplemental Prompt-Writer Training · p. 24
• Neither SFT nor offline GRPO improves the public abliterated model; offline GRPO improves local ASR for the internal model, without clear transfer to DALL·E 3.SFT is roughly neutral for the internal model, and all training results remain supplemental.Source: E Supplemental Prompt-Writer Training · p. 25, Table 17 · p. 25

F Prompt-Writer Transfer

• GPT-4.1 JB uses the persona-based jailbreak wrapper as prompt writer for DALL·E 3 self-injury and graphic-violence rows because the aligned model otherwise refused or failed the role.The wrapper is described in the context of Table 19.Source: F Prompt-Writer Transfer · p. 25
• Several low-refusal open-weight prompt writers reach ASR close to the RISE-Ablit reference on the local hard testbed, provided they follow the prompt-writing role.The comparison uses a 2,500-target-call budget; the table gives prompt-level ASR@0.7.Source: F Prompt-Writer Transfer · p. 25, Table 18 · p. 26
• The strategy-transfer matrix applies source strategies with a different prompt-writing model in fixed-strategy mode and reports prompt-level ASR@0.7.Cells marked “–” were not run.Source: Table 19 · p. 26

G Cloud-VLM Judge Threshold Sweeps

• The Gemini threshold sweep reports performance by target on a split that differs slightly from the compact calibration table.Table 21 gives the corresponding target-specific metrics.Source: G Cloud-VLM Judge Threshold Sweeps · p. 26, Table 21 · p. 27
• Capable independent judges agree with Gemini on 75–84% of images at threshold 0.7 while reaching comparable standalone F1, but several judges refuse, error, or are over-strict.Claude Sonnet 4.6 refused or errored on 261 of 582 images, GPT-4.1 on 242, and Gemini 3.1 Pro had recall 0.30 at threshold 0.7.Source: G Cloud-VLM Judge Threshold Sweeps · p. 26, Table 22 · p. 27
• Table 20 presents a Cloud-VLM judge threshold sweep on 582 human-labeled sexual-content images, including 216 explicit positives; “Scored” excludes refusals and API/model errors.Source: Table 20 · p. 27

H Survey of T2I Red-Teaming Methods

• Reported DALL·E 3 results are not directly comparable across papers because target version, prompt budget, denominator, safety category, and judge differ.Source: H Survey of T2I Red-Teaming Methods · p. 28
• Reported DALL·E 3 methods include trained attackers optimizing target-query or curriculum prompt sets, feedback-trained attackers, and seed-pool or distributional approaches.The passage names RPG-RT [Cao et al., 2025], Reason2Attack [Zhang et al., 2025b], FGPI, DREAM [Li et al., 2025], and JANUS [Zheng et al., 2026].Source: H Survey of T2I Red-Teaming Methods · p. 28
• Other methods report DALL·E 3 bypass or judge-ASR without attacker training, while several related attacks report no DALL·E 3 ASR.ART [Li et al., 2024] provides qualitative DALL·E examples but no DALL·E ASR; other listed attacks motivate evaluation choices and baseline checks.Source: H Survey of T2I Red-Teaming Methods · p. 28