# False Claims, Credible Images: A Red-Teaming Benchmark for Commercial Image Generators

arXiv: https://arxiv.org/abs/2610.11112 · HTML: https://mlsanity.com/paper/2610.11112/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security.
- Builds on 8 of its 54 references that are in the map.
- First posted on arXiv 8 Oct 2026.

## Placed in

- LLM safety and security / [Vision-language and text-to-image safety](https://mlsanity.com/safety/vision-language-and-text-to-image-safety/)

## Builds on (most cited first, 8 of 8)

- [DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence](https://mlsanity.com/paper/2606.19348/) (2026)
- [Towards Unified Multimodal Misinformation Detection in Social Media: A Benchmark Dataset and Baseline](https://mlsanity.com/paper/2509.25991/) (2025)
- [Image-to-Video Diffusion: From Foundations to Open Frontiers](https://mlsanity.com/paper/2605.17248/) (2026)
- [TextFake: Benchmarking AI-Generated Image Detection on Text-Rich Images](https://mlsanity.com/paper/2606.01050/) (2026)
- [Dual-branch Robust Unlearnable Examples](https://mlsanity.com/paper/2605.01718/) (2026)
- [TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models](https://mlsanity.com/paper/2607.24897/) (2026)
- [PC2: Politically Controversial Content Generation via Jailbreaking Attacks on GPT-based Text-to-Image Models](https://mlsanity.com/paper/2601.05150/) (2026)
- [SynCred-Bench: Benchmarking Synthetic Credibility in AI-Generated Visual Misinformation](https://mlsanity.com/paper/2606.03348/) (2026)

## Abstract (arXiv)

Image-generation models can now produce text-rich, natural-looking visual artifacts that are hard to distinguish from real-world evidence, such as news reports and textbook pages. Yet, the same capability introduces a new risk: these models can just as easily fabricate visual misinformation. Even commercial models (e.g., GPT-Image-2) readily produce it. Curiously, we find that these models can recognize a claim as false when asked, yet still render that very claim as credible visual evidence. This discrepancy points to a blind spot in current alignment: safeguards judge what an image shows, not what it asserts; however, existing red-teaming benchmarks target conventional harmful content, such as violent or explicit imagery, and say little about where the alignment boundaries lie for visual misinformation, especially in commercial models. To fill this gap, we introduce EpiReal-Bench, the first systematic benchmark for evaluating visual misinformation risks in commercial image generators, comprising 10k false-claim prompts and 10k corresponding generated images that span 10 real-world claim categories and 10 credible visual formats. We further introduce EpiReal-Attack, a skill-guided black-box optimization framework that uses Pareto-based selection and multimodal feedback to identify commands that bypass alignment safeguards while preserving visual realism, textual legibility, and semantic fidelity. Experiments on four commercial models reveal that more than 70% of false-claim prompts elicit images that faithfully depict the corresponding misinformation, and EpiReal-Attack pushes this rate to 95%. Most worryingly, these models are only a click away, and their outputs are cheap to spread yet hard to disbelieve, leaving this dimension of alignment largely unguarded.