Research map / Image generation / Text-to-image diffusion

Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization

CVPR 2025 · Image generation › Text-to-image diffusion · approach: Concept erasure in diffusion models · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Detect-and-Guide (DAG), which optimizes guideline token embeddings on a small annotated set to detect nudity via cross-attention maps during sampling and applies region-restricted, adaptively scaled safety guidance to erase sexual content from Stable Diffusion without fine-tuning.

Problem

Post-hoc safe generation for text-to-image diffusion models: existing unlearning methods are text-centric and fine-tuning or guidance methods cause severe mode shifts and poor text alignment on multi-concept real-world prompts, when erasing sexual content.

Approach

Optimize a few guideline token embeddings with a CAM loss (background leakage and negative sample losses) so that cross-attention maps from high-level U-Net layers precisely localize unsafe regions at each timestep; use these maps as a gate and magnitude scaler for classifier-free safety guidance, so guidance only edits detected regions with adaptive strength.

Key results

• DAG achieves VQA Score 0.72 on COCO-1K, versus 0.70 for SDv1.4 and 0.42 for the strongest fine-tuning defense, with FIDreal 58.22 comparable to undefended SDv1.4.
• On Ring-A-Bell adversarial prompts DAG reaches an 88.14% erase rate, and on MMA adversarial prompts 77.60%, without any weight tuning.
• DAG outperforms all guidance-based baselines (SLD variants and SEGA) in NudeNet unsafe-class counts on I2P-sexual, though fine-tuning methods such as SalUn and AdvUnlearn erase more.

Measured effects reported in the paper

Surprising findings

• Single-step cross-attention maps are sufficient for detection, so accumulating maps over all timesteps is unnecessary.
• Fine-tuning-based erasure methods with the strongest erasure (e.g., SalUn) suffer severe generation-quality and text-alignment degradation.

Limitations

• Evaluated only on sexual/nudity content; generalization to other harmful concepts is not shown.
• Fails on hard-to-erase nudity where prompts trigger memorized unsafe images and the sampling mode collapses within the first few steps.
• Shows slight background modifications and is second rather than best on VQA Score-SG fine-grained alignment.

Experimental setup

Datasets: I2P COCO-1K (resampled from MS-COCO validation) Ring-A-Bell adversarial prompts MMA adversarial prompts

Benchmarks: I2P-sexual I2P-sexual-complex Ring-A-Bell MMA COCO-1K

Metrics: NudeNet number of detected unsafe classes erase rate FID vs real images FID vs SDv1.4 VQA score VQA Score-SG

Baselines: ESD SLD-weak SLD-medium SLD-strong SPM SA SalUn Self-Dis SEGA MACE AdvUnlearn SDv2.1

Builds on: safety guidance (SLD) SEGA token optimization for cross-attention maps (Token Optimization for segmentation classifier-free guidance

Closest papers by meaning

• Growth Inhibitors for Suppressing Inappropriate Image Concepts in Diffusion Models (ICLR 2025 · similarity 0.91)
• Training-Free Safe Text Embedding Guidance for Text-to-Image Diffusion Models (NeurIPS 2025 · similarity 0.91)
• Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts (ICML 2024 · similarity 0.91)
• Comprehensive Assessment and Analysis for NSFW Content Erasure in Text-to-Image Diffusion models (NeurIPS 2025 · similarity 0.90)
• SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation (ICLR 2025 · similarity 0.90)
• Six-CD: Benchmarking Concept Removals for Text-to-image Diffusion Models (CVPR 2025 · similarity 0.90)