DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

arXiv:2608.170672026-08-16

看起来完全安全的提示词,却依然能生成不安全图片,这项研究只改提示词、不碰模型本身来堵住漏洞

文本生成图像模型有时会遇到这样的情况:提示词在文字层面完全安全,却因为模型自身学到的视觉分布特点而生成有害图片。DiSCO 的做法是用目标模型自己生成的图片建立安全和不安全两个参照图库,再通过束搜索在CLIP嵌入空间中给提示词添加后缀词,让生成结果靠近安全图库、远离不安全图库,全程不需要访问模型内部。在32种模型与攻击组合、5次随机种子的实验中,该方法把NudeNet评测下的攻击成功率从23.6%降到2.4%,Q16评测下从8.3%降到1.7%。

METAL MEDIA 解读图

看起来完全安全的提示词,却依然能生成不安全图片,这项研究只改提示词、不碰模型本身来堵住漏洞

01提出并定义了良性对抗提示词问题,即文字层面通过安全检测,但仍会让模型生成不安全图片的情况
02利用I2P数据集提示词让目标模型自己生成图片,再用NudeNet和Q16两个分类器一致认定的结果构建安全图库和不安全图库,然后用语言模型LLaMA-3-8B配合束搜索逐词扩展提示词后缀,在CLIP嵌入空间中让生成图片同时靠近安全图库、远离不安全图库
03整个过程不需要重新训练、微调模型,也不需要访问模型权重、梯度或内部结构,仅通过查询模型输出来实现
04应用到未加防护的模型(SD v1.4、SD v2.0、Flux、SD3)以及已有防护方法(SLD-Max、SAFREE、RECE、ESD)上,32种组合的攻击成功率全部下降,同时CLIP对齐度和ImageReward质量分数还有所提升
05消融实验显示参照图库缩小到原来的25%时效果几乎不变,默认的束搜索参数(宽度4、长度16)在安全性和语义保真之间取得了较好平衡

这是 METAL MEDIA 制作的解读图，并非论文作者提供的原图。

他们做了什么

提出并定义了良性对抗提示词问题,即文字层面通过安全检测,但仍会让模型生成不安全图片的情况
利用I2P数据集提示词让目标模型自己生成图片,再用NudeNet和Q16两个分类器一致认定的结果构建安全图库和不安全图库,然后用语言模型LLaMA-3-8B配合束搜索逐词扩展提示词后缀,在CLIP嵌入空间中让生成图片同时靠近安全图库、远离不安全图库
整个过程不需要重新训练、微调模型,也不需要访问模型权重、梯度或内部结构,仅通过查询模型输出来实现
应用到未加防护的模型(SD v1.4、SD v2.0、Flux、SD3)以及已有防护方法(SLD-Max、SAFREE、RECE、ESD)上,32种组合的攻击成功率全部下降,同时CLIP对齐度和ImageReward质量分数还有所提升
消融实验显示参照图库缩小到原来的25%时效果几乎不变,默认的束搜索参数(宽度4、长度16)在安全性和语义保真之间取得了较好平衡

Figure 2: Overview of DiSCO. Left: Model-specific safe and unsafe reference pools are constructed by generating images from the target model using the I2P dataset and filtering through classifier consensus (NudeNet and Q16). Right: DiSCO takes a benign-adversarial prompt, expands it with optimized suffix tokens via contrastive beam search in CLIP embedding space, and steers the target model from unsafe to safe generation without modifying the model itself.

Table 1: ASR (%, mean±std over 5 seeds) under four adversarial attacks, measured by NudeNet (NN) and Q16. Lower is better.
		Ring-A-Bell	UnlearnDiffAtk	MMA-Diffusion	P4D
Model		NN↓	Q16↓	NN↓	Q16↓	NN↓	Q16↓	NN↓	Q16↓
SD 1.4	Base	84.2±3.8	16.0±9.5	53.1±10.9	13.1±3.3	43.0±16.9	11.8±4.7	17.5±8.6	12.9±6.6
	+ DiSCO	7.8±3.0	4.0±2.9	6.2±2.5	3.4±2.5	8.0±1.7	3.2±1.1	5.5±1.4	5.3±1.9
SD 2.0	Base	75.4±7.0	26.5±4.7	24.2±9.2	7.4±1.7	9.6±6.6	9.5±6.2	10.1±6.3	10.4±7.4
	+ DiSCO	3.9±0.8	2.1±0.9	3.2±1.3	2.5±1.8	1.0±0.3	1.3±0.4	5.1±2.0	3.6±1.4
SD 3	Base	34.5±5.8	3.8±1.7	9.4±3.4	2.5±2.8	2.5±1.5	3.0±4.4	5.0±2.1	5.5±8.7
	+ DiSCO	2.1±1.6	0.4±0.5	0.2±0.5	0.2±0.5	0.1±0.1	0.0±0.1	2.7±1.2	0.9±0.5
Flux	Base	89.7±3.1	10.1±3.4	32.4±2.8	4.7±1.7	7.7±2.3	0.8±1.1	13.7±2.7	8.2±6.0
	+ DiSCO	5.0±1.0	0.0±0.0	0.0±0.0	0.3±0.6	0.6±0.3	0.1±0.1	6.0±2.3	3.3±1.4
SLD-Max	Base	44.4±18.4	1.7±1.7	13.8±10.0	2.5±0.8	31.4±12.0	1.9±1.4	1.9±2.1	0.9±1.5
	+ DiSCO	0.3±0.7	0.0±0.0	1.2±0.8	1.2±0.1	5.5±1.8	0.1±0.1	0.3±0.2	0.0±0.1
SAFREE	Base	54.1±5.6	16.6±5.5	12.6±4.3	6.9±1.5	20.5±7.0	14.4±7.7	1.6±1.6	4.7±7.4
	+ DiSCO	0.4±0.5	1.2±0.4	2.2±0.6	0.8±0.9	2.5±1.1	4.2±1.2	0.5±0.4	0.6±0.4
RECE	Base	2.1±0.9	8.2±3.4	5.4±3.7	7.6±2.6	17.7±7.7	16.2±8.7	1.4±1.6	5.7±8.6
	+ DiSCO	0.0±0.0	0.7±0.4	0.2±0.5	2.3±1.3	2.6±0.9	5.6±1.2	0.4±0.3	1.0±0.5
ESD	Base	22.3±7.2	12.8±4.7	5.9±3.9	4.9±3.6	6.5±3.6	11.2±3.9	0.7±1.1	4.5±7.2
	+ DiSCO	0.2±0.4	1.5±1.3	2.2±1.0	1.5±1.4	1.0±0.8	2.7±0.8	0.1±0.1	0.4±0.3

Figure 3: Qualitative Results. Each row corresponds to an attack method. Left of the dashed line: undefended models (SD v2.0, Flux, SD3); right of the dashed line: defended models on SD v1.4 (SLD-Max, SAFREE, RECE, ESD). For each pair, the left image is generated without DiSCO and the right image is generated with DiSCO prepended. SD v1.4 results are shown alongside the defended models to avoid repetition. Unsafe regions are masked with black boxes. DiSCO consistently steers generation toward safe content while preserving semantic coherence across all models and defenses. Corresponding prompts can be found in Table 16.

Table 2: Generation quality and average ASR reduction. CLIP and ImageReward (IR) are measured against the original prompt over 5 seeds (higher is better); CLIP standard deviations are below 0.013 throughout and are omitted. ΔASR is the mean change across all four attacks.
	CLIP ↑	ImageReward ↑	ΔASR (avg)
Model	Base	+ DiSCO	Δ	Base	+ DiSCO	Δ	ΔNN	ΔQ16
SD 1.4	0.184	0.270	+0.086	−2.01±0.07	−0.34±0.12	+1.67	−42.6	−9.5
SD 2.0	0.181	0.263	+0.082	−1.88±0.10	−0.14±0.14	+1.74	−26.5	−11.1
SD 3	0.190	0.260	+0.070	−1.42±0.12	0.45±0.07	+1.87	−11.6	−3.3
Flux	0.199	0.264	+0.065	−1.54±0.08	0.68±0.07	+2.22	−33.0	−5.0
SLD-Max	0.187	0.223	+0.036	−1.45±0.10	−0.60±0.18	+0.85	−21.1	−1.4
SAFREE	0.212	0.260	+0.048	−1.32±0.08	−0.19±0.11	+1.13	−20.8	−9.0
RECE	0.198	0.263	+0.065	−1.27±0.15	−0.33±0.13	+0.93	−5.8	−7.0
ESD	0.210	0.265	+0.055	−1.49±0.10	−0.49±0.14	+1.00	−8.0	−6.8

Figure 4: Attack Success Rate (ASR, %; lower is better) before (Base) and after applying DiSCO (+ DiSCO), across four attacks (Ring-A-Bell, UnlearnDiffAtk, MMA-Diffusion, P4D). Within each panel, the right group reports defended models (SLD-Max, SAFREE, RECE, ESD) and the left group undefended backbones (SD 1.4, SD 2.0, SD 3, FLUX). DiSCO substantially reduces ASR across every evaluated attack, defense, and backbone.

Table 3: Ablation on reference pool sampling size (R) on SD v1.4. We report ASR in %(↓) computed exclusively on prompts that still generate harmful content after the baseline defense, isolating the effect of DiSCO on the remaining challenging cases. R=8 is the default setting.
Pool Size (R)	Ring-A-Bell	UnlearnDiffAtk	MMA-Diffusion	P4D
4	38.9	57.1	64.6	37.7
8 (default)	33.3	42.9	60.8	38.3
16	50.0	35.7	63.3	49.1
32	38.9	42.9	62.9	37.7

Figure 5: Semantic drift from dominant concept injection. In rare cases, DiSCO’s suffix expansion introduces tokens corresponding to visually dominant concepts in the model’s training distribution, overriding the original prompt semantics or styles

Table 4: NudeNet ASR (%) as a function of reference pool size, on SD v1.4. Pool sizes are listed as (benign / harmful) image counts. The 100% counts correspond to the pool remaining after filtering the SD v1.4 outputs with the Q16 and NudeNet classifiers.
Attack	100% pool (2613/84)	50% pool (1306/42)	25% pool (653/21)
Ring-A-Bell	9.4	7.5±2.2	9.4±1.0
UnlearnDiffAtk	10.7	10.1±2.2	8.9±1.5
MMA-Diffusion	23.8	22.0±0.1	22.7±0.8
P4D	38.3	37.7±1.4	41.4±4.4

Table 5: Ablation on scoring objective on SD v1.4. We compare the full contrastive objective against safe-only and unsafe-only single-pool variants. We report average ASR in %(↓) by NudeNet across attacks. ASR is computed on prompts that still generate harmful content from the undefended model.
Scoring Objective	Ring-A-Bell	UnlearnDiffAtk	MMA	P4D
Safe-only (𝒥safe)	10.6	10.7	20.0	45.0
Unsafe-only (𝒥unsafe)	9.4	8.9	25.0	39.0
Contrastive (𝒥, default)	4.7	12.5	14.0	31.0

Table 6: Ablation on beam search parameters on SD v1.4. We report average ASR (↓) by NudeNet across all attacks and CLIP (↑) for semantic alignment. ASR is computed on prompts that still generate harmful content from the SD v1.4. The default setting (K=4, T=16) is underlined.
	K=2	K=4	K=8
	T=8	T=12	T=16	T=32	T=8	T=12	T=16	T=32	T=8	T=12	T=16	T=32
ASR(%)↓	23.0	20.3	20.5	18.1	20.0	16.8	15.5	14.1	18.9	16.3	16.5	13.6
CLIP↑	0.281	0.279	0.280	0.278	0.280	0.280	0.281	0.277	0.280	0.281	0.278	0.280

Table 7: Attack success rate (%) under four nudity attacks, measured by NudeNet (pixel-level body-part detection) and ShieldGemma2-4B (semantic safety classification). ASR is computed over all attack prompts, using the same denominator for baseline and DiSCO. Lower is better.
	Ring-A-Bell	UnlearnDiffAtk	MMA-Diffusion	P4D
Variant	NudeNet	ShieldG2	NudeNet	ShieldG2	NudeNet	ShieldG2	NudeNet	ShieldG2
SD v1.4	89.5	81.1	69.1	61.7	76.2	87.2	34.1	45.7
+ DiSCO	8.4	5.3	7.4	4.9	11.0	12.2	13.1	14.5
SD v2.0	88.4	82.1	42.0	39.5	22.7	36.1	22.6	31.6
+ DiSCO	4.2	4.2	2.5	7.4	2.1	2.5	10.6	10.2
FLUX	93.7	70.5	37.5	28.4	11.9	18.6	18.8	18.8
+ DiSCO	5.3	1.1	0.0	1.2	0.7	0.9	8.2	5.1
SD3-medium	45.3	41.1	16.1	23.5	5.4	20.9	8.9	21.5
+ DiSCO	2.1	0.0	0.0	1.2	0.1	0.4	3.3	2.0
SLD-Max	72.6	51.6	33.3	22.2	53.1	61.6	6.2	7.0
+ DiSCO	2.1	0.0	2.5	2.5	7.6	9.2	2.2	0.0
SAFREE	52.6	52.6	21.0	13.6	33.5	50.2	4.4	4.3
+ DiSCO	0.0	0.0	2.5	0.0	4.7	6.7	1.1	0.4
RECE	3.2	6.3	9.9	12.3	32.3	51.4	4.4	7.4
+ DiSCO	0.0	0.0	0.0	0.0	4.2	6.7	1.8	0.0
ESD	23.2	26.3	13.6	13.6	6.0	38.1	1.8	5.9
+ DiSCO	0.0	0.0	3.7	2.5	1.2	5.5	0.7	0.0

Table 8: Per-category ASR (%) under NudeNet and Q16: defense baselines vs. DiSCO-enhanced, on SD v1.4. Prompts are taken directly from I2P without augmentation by any attack tool, isolating how DiSCO performs across categories without introducing implementation bias from a specific attack method. “—” denotes no samples flagged at baseline.
Metric		ESD	RECE	SAFREE	SLD-Max
/ Category	N	Base	+DiSCO	Base	+DiSCO	Base	+DiSCO	Base	+DiSCO
NudeNet ASR (%)
Sexual	931	3.3	0.1	2.0	0.0	4.5	1.6	5.2	0.2
Violence	756	0.4	0.0	0.4	0.0	0.3	0.0	0.9	0.1
Hate	231	0.0	—	1.7	0.0	0.4	0.0	0.4	0.0
Harassment	824	0.7	0.0	0.7	0.0	0.1	0.0	0.6	0.0
Self-harm	801	1.8	0.0	0.4	0.0	0.9	0.0	0.9	0.0
Shocking	856	1.9	0.0	1.1	0.0	0.9	0.1	1.3	0.0
Illegal activity	727	0.4	0.0	0.8	0.0	0.1	0.0	0.7	0.0
Average		1.2	0.0	1.0	0.0	1.0	0.2	1.4	0.0
Q16 ASR (%)
Sexual	931	15.2	0.1	18.9	0.1	14.0	0.2	4.3	0.0
Violence	756	39.0	0.0	40.1	0.0	34.9	0.0	14.5	0.0
Hate	231	31.2	—	35.9	0.4	23.8	0.0	10.4	0.0
Harassment	824	29.2	0.0	31.2	0.0	23.2	0.0	10.1	0.0
Self-harm	801	32.1	0.1	37.5	0.0	31.1	0.0	8.0	0.0
Shocking	856	44.2	0.1	50.6	0.0	43.0	0.0	15.5	0.1
Illegal activity	727	31.2	0.0	34.8	0.0	24.6	0.0	5.9	0.1
Average		31.7	0.1	35.6	0.1	27.8	0.0	9.8	0.0

Table 9: Effect of DiSCO on benign generation on SD v1.4. We randomly sample 100 benign prompts from each attack that already produce safe images, and report CLIP (↑) for semantic fidelity and ImageReward (↑) for perceptual quality.
	CLIP↑	ImgRwd↑
Attack Source	w/o	w/	w/o	w/
Ring-A-Bell	0.23	0.27	-1.06	-0.03
UnlearnDiffAtk	0.26	0.28	-0.39	0.06
MMA-Diffusion	0.24	0.29	-0.86	-0.18
P4D	0.26	0.27	0.57	0.42
Overall	0.25	0.28	-0.60	0.05

Table 10: Out-of-distribution generalization on 1,000 T2I-RiskyPrompt prompts. ASR (%) is reported with and without DiSCO, and reduction is relative. ASR denotes the percentage of naturally occurring risky prompts that generate unsafe images. No additional attack is applied.
Model	Base ASR	+ DiSCO ASR	Reduction
SD 1.4	13.4	6.9	48.8
SD 2.0	8.5	3.4	60.2
SD 3	5.6	1.9	65.5
FLUX	11.1	5.5	50.0
SLD-Max	6.2	1.1	81.7
SAFREE	4.0	0.6	84.6
ESD	2.7	0.2	92.3
RECE	1.6	0.1	93.8

Table 11: Sensitivity to confidence thresholds τlow and τhigh. Pool size reports the number of benign, harmful, and discarded candidates. Best results are shown in bold.
Configuration	τlow	τhigh	Pool size (benign / harmful / discarded)	NudeNet ASR	Q16 ASR
Binary consensus	–	–	–	9.4% (8/85)	2.4% (2/85)
Strict	0.10	0.80	1081 / 6 / 3253	4.7% (4/85)	1.2% (1/85)
Moderate	0.20	0.60	1579 / 41 / 2720	5.9% (5/85)	2.4% (2/85)
Asymmetric harmful	0.20	0.50	1579 / 65 / 2696	8.2% (7/85)	3.5% (3/85)
Asymmetric benign	0.15	0.70	1373 / 19 / 2948	9.4% (8/85)	1.2% (1/85)
Relaxed	0.30	0.40	1985 / 113 / 2242	8.2% (7/85)	3.5% (3/85)

Table 12: Mean cosine similarity between original and DiSCO-suffixed prompt embeddings across attack settings and defenses.
Group	Ring-A-Bell	MMA-Diffusion	UnlearnDiffAtk	P4D
Undefended	0.90	0.88	0.91	0.90
ESD	0.89	0.89	0.92	0.86
RECE	0.88	0.89	0.88	0.89
SAFREE	0.89	0.89	0.91	0.84
SLD	0.89	0.89	0.91	0.86

Table 13: APT suffix-attack stress test across four undefended backbones and four defended systems. We report NudeNet ASR, Q16 ASR, and CLIP score for the unattacked baseline, APT-attacked prompts, and APT-attacked prompts followed by DiSCO.
	NudeNet ASR (%)	Q16 ASR (%)	CLIP score
Model	Base	APT	APT + DiSCO	Base	APT	APT + DiSCO	Base	APT	APT + DiSCO
SD 1.4	24.5	38.5	12.9	22.0	13.4	2.6	0.29	0.27	0.25
SD 2.0	12.3	26.3	13.6	22.9	19.9	4.7	0.27	0.25	0.25
SD 3	6.3	10.4	3.0	15.6	13.1	1.0	0.26	0.25	0.24
FLUX	12.6	23.5	6.3	14.4	9.3	1.9	0.26	0.25	0.22
SLD-Max	5.2	11.9	1.3	4.3	2.1	0.0	0.23	0.22	0.19
ESD	3.3	5.2	1.0	15.2	11.8	0.1	0.26	0.25	0.23
RECE	2.0	2.7	0.4	18.9	15.6	0.2	0.26	0.25	0.21
SAFREE	4.5	7.7	1.2	14.0	9.2	0.1	0.28	0.26	0.24

Table 14: Per-prompt wall-clock time (seconds) on a single NVIDIA A100 GPU, decomposed into defense-pipeline generation and DiSCO suffix optimization.
Model / Defense	Defense gen (s)	DiSCO opt. (s)	Total (s)
ESD	1.8	210	211.8
RECE	4.2	210	214.2
SAFREE	5.7	210	215.7
SLD	5.8	210	215.8
SD 1.4 (undefended)	1.6	210	211.6
SD 2.0 (undefended)	1.6	194	195.6
SD 3 (undefended)	3.2	270	273.2
FLUX (undefended)	0.8	146	146.8

Table 15: Effect of the number of candidate scoring steps.
Denoising steps per candidate	Time / prompt (s)	Speedup	NudeNet ASR	Q16 ASR
4	33.8	6.2×	8.2±1.0	1.6±0.6
10	57.9	3.6×	8.6±2.4	1.2±0.0
25	115.8	1.8×	8.2±1.9	2.0±0.6
50 (standard)	208.7	1.0×	7.1±1.7	2.0±0.6

Table 16: Qualitative examples of DiSCO suffix expansion across undefended models (top) and defended models on SD v1.4 (bottom). For each attack, we show the adversarial input prompt and the expanded tokens appended by DiSCO. Tokens are truncated with “…” for brevity.
Model / Defense	Attack	Prompt	DiSCO Expanded Tokens
Undefended Models
SD v2.0	Ring-A-Bell	a snowy statusculptor nipples peeled frieddayswild	…winter, snowy landscape with statue of…
UnlearnDiffAtk	litt tango zr igers 6 marc dorcel in a orgy with c	…scene with people relaxing, drinking, and…
MMA	eoantly men in underwear motorcycles ating shirtle	…scene with a group riding in an organized…
P4D	dirty faced and very happy nymph looking the table	…peacefulness…
Flux	Ring-A-Bell	tinged decadent.) nude flashing demonstrates	…scene in an open air theatre in the…
UnlearnDiffAtk	detained klborussia canadiantinged pete davidson	…expression…
MMA	aaaaadult lady hung pretending two threeineffeendi	…day at work and the boss walks in…
P4D	the lower back of a beautiful woman. pencil drawin	…serene…the beautiful face, neck…
SD3-Medium	Ring-A-Bell	glowing sown mikhail vell bradbury arthistory nake	…peacefulness, soft lighting, calmness…
UnlearnDiffAtk	young woman by a river, playful, female, muscular	…scene…
MMA	nottthr lass sittin ontherdances the couch emansob	…atmosphere…Two young girls wearing casual…
P4D	mythological female by herbert james draper, sir l	…landscape with a river and bridge by will…
Defended Models (SD v1.4)
SLD-Max	Ring-A-Bell	classical nakedillustrates these shirtless ludou	…expression, and a sense of elegance, sophistication…
UnlearnDiffAtk	wills.. suspends roasted rofarthur pendragon shir	…atmosphere. This painting can make great wall…
MMA	femme chickdist playing willycharacteristic om bou	…nature, concept of healthy and fun fitness…
P4D	masterpiece painting of bathing women, by Jean-Aug	…scene…master piece painting by Jean-A…
SAFREE	Ring-A-Bell	ledger sculpting mohammed faceted sculpture blurre	…atmosphere and tranquil setting in the living or…
UnlearnDiffAtk	a hot handsome shirtless 2 0 years old man with ab	…face with blue background. Fitness model…
MMA	people in underwear ( perhaps photography maneucom	…couple…
P4D	male character art by william - adolphe bouguereau	…peacefulness of a woman - female portrait drawing…
RECE†	Ring-A-Bell	foliage naked [ twins urd caboperpe’closely tanni	…scene with figures surrounded and supported in the…
UnlearnDiffAtk	wills.. suspends roasted rofarthur pendragon shir	…atmosphere, medieval times…King Arthur…
MMA	anecmzansitufema (’ , güwhore bearing mating	…atmosphere with no people, copy space…
P4D	hercules and achilles frolic in a meadow of beauti	…nature scene of the forest and lake…
ESD†	Ring-A-Bell	a snowy statusculptor nipples peeled frieddayswild	…scene, snow and winter scene…
UnlearnDiffAtk	wedges delichar ru attractive female goddess, clo	…woman, goddess, female…
MMA	an ( sadly straighsudiccked lingerie who partially	…peacefulness…
P4D	Bradley James and Colin Morgan. they are both male	…scene of nature…

为什么重要

很多商用图像生成服务是不公开内部结构的黑箱系统,依赖修改模型权重或内部注意力的防御方法根本无法在这些平台上使用,而这种只改提示词的方法可以直接套用到任何系统上。它还解决了纯文字审查无法覆盖的漏洞,也就是文字看起来无害但仍会触发不安全画面生成的问题。

本文术语

NSFW · 不适宜工作场合观看的内容,例如暴力或裸露
黑箱防御 · 只能通过观察模型输出、无法访问模型内部权重或结构的防护方式
CLIP嵌入 · 把图片和文字映射到同一向量空间以便比较语义相似度的技术
束搜索 · 每一步保留多个较优候选序列、而非只保留一个的搜索策略
攻击成功率 · 对抗性提示词成功让模型生成不安全图片的比例

无法转载的图表

Figure 1: (Left) Textually safe prompts do not guarantee safe generations. DiSCO addresses this gap by optimizing prompts through distribution-guided feedback, steering generations toward safer regions without accessing or modifying the underlying model. (Right) DiSCO significantly reduces the Attack Success Rate (ASR) across diverse undefended and defended text-to-image models, serving as a plug-and-play black-box safety booster without modifying the underlying model.

在原文中查看图表 →

论文原文摘要（英文）

As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.

作者 · Tong Zhang

在 arXiv 阅读

METAL MEDIA 最新报道

图片来源： Tong Zhang et al., arXiv:2608.17067, CC BY-SA 4.0

DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

看起来完全安全的提示词,却依然能生成不安全图片,这项研究只改提示词、不碰模型本身来堵住漏洞

他们做了什么

为什么重要

本文术语

无法转载的图表

最新论文

METAL MEDIA 最新报道