Skip to content
PartnerinAI
AI Safety Research

AI Image Model Safety: ChatGPT and Google Models Tested

AI image model safety tests found newer ChatGPT and Google image models easier to bypass for explicit content. See what the findings do - and don't - prove.

PartnerinAI3 min read541 words
AI Image Model Safety: ChatGPT and Google Models Tested
Table of Contents

Quick Answer

White Circle told Ars Technica that its tests found OpenAI's ChatGPT Images 2.5 and Google's Nano Banana 2.1 significantly easier to bypass for explicit images than their predecessors. The reporting does not provide a universal bypass rate or establish how often users could generate such images.

The work focused on whether prompts could get the systems to produce explicit content despite safeguards designed to block it. White Circle’s comparison offers a warning sign for AI image model safety, but the available reporting does not establish a definitive measure of how likely either model is to generate nudes when prompted.

What White Circle’s testing found about the newer models

White Circle told Ars Technica that the newer systems were “significantly more breakable” than their predecessors in its tests. The organization is described as a public benefit corporation, with backing from senior figures and researchers associated with Anthropic, DeepMind, Hugging Face, and OpenAI.

The reported finding is comparative: it concerns how the latest versions performed against earlier versions under the researchers’ testing. The report does not provide enough detail to treat the results as a universal pass-or-fail score, or to conclude that every user could reliably bypass either model’s protections. It also does not establish that the models produce explicit content in response to ordinary requests.

That distinction matters. A safety test can show that a safeguard has weaknesses under particular conditions without demonstrating how often those conditions arise in everyday use. The reporting also does not supply a definitive, directly comparable rate for the two models.

What the findings do - and do not - show about AI image safety

The tests examined one clear category of unwanted output: explicit imagery. That makes the results a useful signal about the strength of explicit-content filters, but not a complete assessment of either model’s safety. The findings do not, on their own, measure performance across other risks, such as deceptive imagery, nonconsensual depictions, or harmful instructions.

Still, difficulty blocking a recognizable category of explicit content can prompt broader questions about how image-generation safeguards are designed and evaluated. If filters can be circumvented under tested conditions, companies may need to assess whether related protections are robust across different prompts and use cases. That is a concern to investigate, not proof that every other safety measure is failing.

Why safeguard failures matter, and what OpenAI and Google said

For people using image tools, safeguards affect whether a system can be misused to create unwanted or harmful material. For developers, the findings underscore the value of repeated AI image safety testing after model updates. A new version may improve image quality or instruction-following while changing how reliably its filters work.

Ars Technica said it shared White Circle’s findings with OpenAI and Google, but neither company responded before its report was published. That means the reporting contains no company response addressing the tests or describing any planned changes.

White Circle’s results are best read as a comparative warning, not a conclusive ranking of how easy each model is to trick. More detail about testing methods and results would help readers assess the scale of the gap. Follow our coverage for updates on AI image safety testing and changes to image-generation safeguards.

Step-by-Step Guide

  1. Define the safety scope

    Specify the content category being evaluated, such as safeguards against explicit imagery, and avoid treating one category as a full model safety assessment.

  2. Compare model versions

    Test the newer model against its predecessor under consistent conditions so the results show a comparison rather than an isolated outcome.

  3. Document test conditions

    Record the evaluation scope, prompt categories, and outcome criteria so readers can understand what the results do and do not cover.

  4. Separate findings from rates

    Report comparative observations distinctly from measured bypass rates, and do not imply that a test result predicts everyday user outcomes.

  5. Seek responses and follow up

    Give the model providers an opportunity to comment, note whether they respond, and update the assessment if further methods or results become available.

Key Statistics

  • White Circle described ChatGPT Images 2.5 and Nano Banana 2.1 as significantly more breakable than their predecessors in its tests.White Circle's comparative characterization was reported by Ars Technica; the article does not provide a universal score for the result.
  • The reported evaluation focused on attempts to generate explicit imagery despite safeguards.This is the testing scope described in the article; it should not be interpreted as a comprehensive evaluation of all image-generation risks.
  • The reporting supplies no definitive, directly comparable bypass rate for the two models.Ars Technica's account, as summarized in the article, does not establish how often either model can be bypassed or how reliably users could do so.

Frequently Asked Questions

Which image models did White Circle test?
White Circle tested OpenAI's ChatGPT Images 2.5 and Google's Nano Banana 2.1. Ars Technica reported that the testing focused on whether prompts could get the systems to generate explicit images despite safeguards. White Circle compared the newer models with their predecessors.
What did White Circle find about the image models?
White Circle said the newer models were significantly more breakable than their predecessors in its tests. The report describes a comparative finding, not a universal pass-or-fail score. It does not establish that ordinary requests produce explicit content.
How often can ChatGPT Images 2.5 or Nano Banana 2.1 be bypassed?
The reporting does not establish a definitive bypass rate for either model. It does not provide enough detail to treat the findings as a prediction of how often users could bypass safeguards. More information about methods and results would help quantify the gap.
Do the findings prove that all AI image safeguards are failing?
No, the findings do not prove that all AI image safeguards are failing. The reported tests address explicit imagery and do not assess every other risk or protection. They are a reason to investigate safeguards across other prompts and use cases, not proof of broader failures.
Did OpenAI and Google respond to the findings?
Neither company responded before Ars Technica published its report, according to the article. The reporting therefore includes no company response to the tests or description of planned changes. That does not establish whether either company addressed the findings later.

Key Takeaways

  • White Circle reported that both newer models were significantly more breakable than their predecessors in its tests.
  • The reported tests focused on whether prompts could bypass safeguards against explicit imagery.
  • The reporting does not provide a definitive bypass rate or a directly comparable score for the two models.
  • The findings are a warning about one safety category, not a full assessment of either model's safety.
  • Ars Technica reported that OpenAI and Google did not respond before its article was published.