whitecircle / rise

RISE 
 Red-teaming via Iterative Strategy Evolution
 Blog ·
 Announcement ·
 arXiv ·
 NeurIPS 2026 
## What is RISE
Most automated red-teaming for text-to-image models optimises one prompt at a time, which
stops working once a target blocks nearly everything: the search gets almost no signal to
learn from. 
RISE searches one level up. It evolves short natural-language *strategies* —
instructions telling a prompt-writing LLM how to construct an attack — and scores each
strategy by the images the prompts it produces actually get past the target. A strategy is
judged on many prompts rather than one, so rare successes still move the search, and a
strategy that works transfers to new scenarios without re-running the search.
The pipeline needs no human-written attack prompts and uses an automated approach for scoring attack vectors. You supply the judging criteria for a
category and a few plain scenario descriptions; an island-model evolutionary loop does the
rest, with a VLM judge scoring every generated image against the criteria.
## What is in this repository
**Included:** full pipeline, configs for 3 categories (nudity, self-harm, graphic violence)
against the 3 production targets from the paper (DALL·E 3, GPT-Image-2, Nano-Banana 2) plus
two newer releases (GPT-Image-2.5-flare, Nano-Banana 2.1), the judge criteria for those
categories, and the local FLUX.2 testbed used in the paper.
**Not included:** the attack strategies and prompts the search discovered, the
images it generated, and the judge criteria for critical categories. Those
carry more misuse risk than the method itself. Everything needed to rerun the search and
find your own is here.
 [code] 
## Setup
Python ≥ 3.12.
 [code] 
Credentials are read from a `.env` file. You need only the ones your run touches:
- `OPENROUTER_API_KEY` — the attacker LLM and the judge
- `OPENAI_API_KEY` — the DALL·E 3 and GPT-Image targets, and the local testbed's moderation
- `FAL_KEY` — the Nano-Banana targets, served through fal.ai
That is the whole setup: the configs reach every model over an API, so nothing needs to run
locally unless you want it to.
### The attacker LLM
The configs default to:
- `qwen/qwen3-32b` on OpenRouter for all three attacker roles
(`prompt_model`, `strategy_model`, `scenario_model`)
- `google/gemini-2.5-flash` as a judge, also via OpenRouter.
Paper's runs used an abliterated variant of the same model, which refuses less in the
prompt-writing role, but depending on the target and category, the stock model often performs
comparably. To use the abliterated one, serve it locally:
 [code] 
then point the three attacker blocks at it, in whichever configs you are running:
 [code] 
Any endpoint speaking the OpenAI chat API works here, hosted or local. Note that
`OPENROUTER_API_KEY` must still be set even when the attacker points at a local endpoint:
the client reads it regardless of `base_url`. Appendix F of the paper compares several
drivers.
## Running a search
 [code] 
Configs are `_qwen