ChatGPT Images 2.5 System Card

ChatGPT Images 2.5 is a major step forward in image generation capabilities. The model produces more consistent results when editing images, and improves infographic accuracy and layout. Users can change an image’s setting, style, or composition while retaining more of the details. New features such as sketch-based generation, templates, and shared prompts give users more control over the generation process, and faster generation lets users create and iterate in less time. The core safety stack we are using with ChatGPT Images 2.5 is based on the same foundations as our ChatGPT Images 2.0 safety stack, with added safeguards for addressing new risks that emerge as models become more capable.

Like OpenAI’s other models, GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare were trained on diverse datasets, including information that is publicly available on the internet, information that we partner with third parties to access, and information that our users or human trainers and researchers provide or generate. Our data processing pipeline includes rigorous filtering to maintain data quality and mitigate potential risks. We use advanced data filtering processes to reduce personal information from training data. We also employ safety classifiers to help prevent or reduce the use of harmful or sensitive content, including explicit materials such as sexual content involving a minor.

Compared to our past ChatGPT Images 2.0 deployment, ChatGPT Images 2.5 allows for heightened realism that could, absent safeguards, allow more convincing deepfakes, including political, sexual, or otherwise sensitive imagery of real people, places or events.

Such images violate our usage policies, and we have protections in place to help prevent them from reaching users, including safeguards at the prompt (text) and image layers.

GPT-Image-2.5-Sunburst includes multiple layers of image-specific safety protection. We have special-purpose safety prompts designed to block potentially violative image requests before the image generation process begins, safety-focused image classifiers designed to block potentially violative input images from being fed into the final generation, combined analysis of input images and prompts to evaluate potential malicious edits, and a final step where we analyze whether the generated image violates our policies before we show the image to the user.

Below we explain each of these safety layers in a bit more detail:

Safety-focused image and text classifiers have been part of our image safety stack since the original GPT-4o image generation launch, and we have continuously improved the system since then. Most notably, recent improvements include:

We used an automated evaluation to measure the efficacy of our safety stack for the GPT-Image-2.5-Sunburst model and the GPT-Image-2.5-Flare model. We tested our end-to-end safety system using challenging prompts we specifically designed to generate images that would violate our policy broadly across all safety categories we track (e.g. violence, sexual content), so the numbers below are not representative of how often such prompts arise in production traffic.

Definitions:

Within each policy area, the three outcome columns account for all evaluated prompts. An asterisk (*) indicates p < 0.05 versus ChatGPT Images 2.0 for the same outcome and policy area (two-sided exact McNemar test; unadjusted for multiple comparisons). No unsafe-shown difference meets this threshold.

Automated policy labels may contain errors, and varying policy-specific sample sizes impact statistical precision. The findings apply to a fixed adversarial test set as well as the model and safeguard configurations evaluated.

OpenAI’s Preparedness Framework is designed to track and prepare for models with frontier capabilities that could create new risks of severe harm in three tracked categories: Biological and Chemical, Cybersecurity, and AI Self-Improvement. Because image models are unable to create and execute code in a way that would enable AI Self-Improvement, we do not have evidence that GPT-Image-2.5-Sunburst nor GPT-Image-2.5-Flare pose meaningful risk in this category.

For the Cyber and Biological categories, we adapted existing language-model capability evaluations to assess image-generation capabilities. For each task, we instructed the model to generate an image containing both a visible reasoning scratchpad and a final answer. We then graded only the final answer rendered in the image, using the evaluation’s existing grading criteria. This allowed us to test the model on the same underlying cyber-capability and biological-capability questions while eliciting and evaluating its response through its native image modality.

The results indicate that neither GPT-Image-2.5-Sunburst nor GPT-Image-2.5-Flare cross the Bio High threshold or the Cyber High threshold.

We, regardless and as done in GPT-Images 2.0, take a precautionary approach and apply mitigations appropriate for a model treated as High capability in the biological-risk domain. These mitigations include an image-specific adaptation of our existing biological-risk safety policy, which we apply to all ChatGPT Images 2.5 inputs and outputs using our safety reasoning model.

As with GPT-Images 2.0, we use a safety reasoning model to detect and block all ChatGPT Images 2.5 outputs that are flagged as violating the above-noted image-specific variant of our biological safety policy. To test the performance of the safety monitor, we developed an evaluation set of images and used them to evaluate our safety monitor’s performance. We found that it has comparable rates of recall and precision to our similar live text-based biological risk mitigation systems. As with our other policy blocks, we apply this blocking at both the image input (editing) and image output layers and generation stops if any image is detected to violate.

As with GPT-Images 2.0, we are enabling the same policy enforcement checks for biorisk that we do with our text-based models, largely outlined in this article. We use advanced reasoning models with high biological capabilities to detect biological misuse, combining our automated systems with human reviewers to monitor and enforce our policies. We have integrated the analysis from our image-based safety reasoning model into the signals we use to detect ongoing misuse. In some cases where we detect ongoing patterns of misuse we suspend the offending accounts.

We have continued to prioritize enhancing our provenance tools. For ChatGPT Images 2.5, our expanded provenance safety tooling includes:

We recognize that there is no single solution to provenance, but are committed to improving the provenance ecosystem, continuing to collaborate on this issue across industry and with civil society, and helping build context and transparency to content created from ChatGPT Images 2.5 and across our products.