OpenAI and Google Image Models Were Easier to Bypass in a Female Nudity Test

OpenAI’s GPT-Image-2.5 Flare and Google’s Nano Banana 2.1 were more susceptible to prompts seeking female nudity than their predecessors in a repeatable test by AI safety firm White Circle.

White Circle recorded a prompt-level success rate of 7.8% for GPT-Image-2.5 Flare, compared with 3.3% for GPT-Image-2. Nano Banana 2.1 scored 20.7%, versus 9.5% for Nano Banana 2. White Circle applied the same evaluation approach to the newer models that it had used on their earlier versions.

The percentages refer to prompts that produced at least one output considered a violation during the evaluation, not the share of images created overall or a typical user’s odds of receiving prohibited content. Each crafted prompt was run three times; it counted as successful if any one output was confirmed to contain explicit female nudity by a human annotator on the author team.

White Circle used the publicly available Qwen3-32B model, with its safety training removed, to develop adversarial prompts. Its process evolved reusable prompt-writing strategies, then applied the five strongest to generate varied requests. Gemini 2.5 Flash assessed the resulting images, and the judging process was calibrated against about 1,300 images labeled by people.

The work focused on female nudity, which the services tested prohibit. Commercial image generators may screen requests before image creation, review the output afterward or rely on safety behavior built into the model; the measured result reflects the complete service as tested. In White Circle’s earlier lineup, DALL-E 3’s 13.3% result was the largest manually confirmed rate among tested targets, rather than an average.

The comparison does not identify what caused the gap between versions. The test cannot determine whether the gap came from model changes or moderation settings, and both could have played a role.

Google describes separate human red-team evaluations by a team outside model development as finding Nano Banana 2.1’s content-safety performance, including child safety, similar to or better than Gemini 3 Flash. Google also says work to make the model more resistant to jailbreak attempts is ongoing.

White Circle released the testing code publicly but did not disclose its exact prompts or strategies.