Just as outside input could help refine filters, IWF thinks that tech companies should also be working more closely with advocates to scrutinize models to better tackle AI-generated CSAM.

“Assessing CSAM is a highly specialized task that requires expert training and welfare support, and is not something for tech companies or machine learning scientists to take lightly,” IWF’s spokesperson said. “But safety must be baked into new technology by design—this includes testing models before they are released to market to make sure they cannot be used to create nude or sexual imagery of children.”

Possible mitigation

Using a method like RISE, White Circle thinks, could help frontier labs flag more jailbreaks more quickly and rapidly ramp up defenses to block harmful outputs. In addition to testing blocks on explicit images, firms could also use the method to prevent other banned outputs, like images depicting graphic violence or self-harm.

But the labs have not yet come calling for the reproduction pipeline, which will be shared on White Circle’s GitHub to help policymakers assess whether AI safety laws are needed to keep frontier labs in check.

Frontier labs won’t invest seriously in safety testing until it’s mandatory, Shilov told Ars. The preprint argues that existing automated red-teaming tools, which typically rewrite harmful prompts one at a time, are poorly suited to testing today’s hardened commercial models. RISE instead takes reusable natural-language attack strategies and uses them to generate many varied prompts, which White Circle says can help labs find and patch weaknesses faster.

“You don’t need frontier models or proprietary tech to break these systems; you just need a free download and the ability to make API calls,” Shilov said. “And yet the labs building these systems are the ones assessing their own safety, publishing their own results, and setting their own standards. This is further proof, if we needed it, that governments should be pushing for independent, third-party evaluation.”

Correction: This story has been updated to correct several errors. An earlier version described a passage from the RISE preprint as explaining how AI models could block harmful outputs; the passage instead describes the researchers’ attack method. It also said the method bypassed safety filters about 13 percent of the time; that was the highest human-verified rate, achieved on DALL·E 3, and rates for other models were lower. The story also misidentified the judge model, which was Gemini 2.5 Flash, and has been updated to note that the attacking model had its safety training removed.