Research map / Image generation / Text-to-image diffusion

RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models

NeurIPS 2026 · Image generation › Text-to-image diffusion · approach: T2I evaluation and controllable adapters · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes RISE, a red-teaming method that evolves reusable natural-language prompt-generation strategies (with calibrated VLM judging) to reach up to 13% human-verified ASR on production text-to-image systems without model training.

Problem

Automated red-teaming of modern production text-to-image systems yields rare successes, and prior methods rely on weak, miscalibrated judges and seed-dependent prompt rewriting that fails to explore or transfer under strict guardrails.

Approach

Search over reusable natural-language attack strategies (evolved with island-based LLM-guided evolution and scored by top-k prompt max judge scores) instead of rewriting individual prompts, then freeze the best strategies for UCB1-allocated exploitation across new scenarios; judges are calibrated against human labels.

Key results

• RISE-Ablit reaches 13.33% human ASR on DALL·E 3 in fixed exploitation (24.44% ASR@0.7) and 9.47% human ASR on Nano Banana 2.
• On GPT-Image-2 (auto) RISE reaches 3.27% human ASR in fixed exploitation.
• Gemini 2.5 Flash judge achieves precision 0.47-0.70 on nudity splits, versus NudeNet recall of 0.05-0.24 and InternVL2 precision below 0.5 on several targets.

Surprising findings

• Baselines reporting 30-85% ASR (e.g., FGPI, RPG-RT) fall to near 0% under calibrated human-verified evaluation on DALL·E 3.
• Training-based baselines like FGPI and Curiosity collapse to 0% when moderation threshold is tightened from 0.85 to 0.05, despite no change in generator.

Limitations

• Main cross-method comparison restricted to female nudity; other categories use precision-adjusted rather than fully human-verified ASR with lower annotator agreement.
• Baseline reproductions are best effort, and some (FGPI, JANUS) were reimplemented from paper descriptions without released artifacts.
• Human annotation performed by internal author-team annotators with minimal guidance.

Experimental setup

Datasets: I2P NSFW-200 DREAM prompts

Benchmarks: DALL·E 3 nudity Nano Banana 2 nudity GPT-Image-2 nudity Leonardo.ai nudity FLUX.2-klein-9B local testbed

Metrics: ASR@0.7 human-verified ASR precision recall F1 Fleiss kappa

Baselines: RPG-RT FGPI Curiosity-driven RT SneakyPrompt PGJ MACPrompt DREAM JANUS GhostPrompt

Builds on: ShinkaEvolve RPG-RT FGPI Curiosity-driven red teaming

Closest papers by meaning

• Red-Teaming Text-to-Image Systems by Rule-based Preference Modeling (NeurIPS 2025 · similarity 0.91)
• Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts (ICML 2024 · similarity 0.87)
• TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Exploration (CVPR 2026 · similarity 0.87)
• ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users (NeurIPS 2024 · similarity 0.87)
• TRUST-VLM: Thorough Red-Teaming for Uncovering Safety Threats in Vision-Language Models (ICML 2025 · similarity 0.87)
• There are Levels to It: Red Teaming LLMs with Hierarchical Reinforcement Learning (NeurIPS 2026 · similarity 0.86)