Research map / Image generation / Text-to-image diffusion
GuardT2I: Defending Text-to-Image Models from Adversarial Prompts
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GuardT2I, a generative moderator that fine-tunes a conditional LLM to translate Stable Diffusion text-guidance embeddings back into text and flags prompts whose interpretation diverges from the input or contains NSFW words.
Problem
Text-to-image models can be misused via adversarial prompts that look benign to humans but elicit NSFW images, and existing post-hoc classifier moderators (OpenAI, Azure, AWS) and concept-erasing methods handle these poorly.
Approach
Instead of classifying prompts, a conditional LLM (c·LLM, with cross-attention fed by the T2I text-encoder guidance embedding) reconstructs the prompt text from the embedding; a verbalizer keyword check plus a sentence-similarity check between input and reconstruction flags adversarial prompts.
Key results
- GuardT2I achieves average AUROC 96.77% (AUROC 98.86% on MMA-Diffusion) and average AUPRC 96.16% across six adversarial datasets, outperforming all listed moderators on average.
- Average FPR@TPR95 of 19.26% versus 27.55% for the best baseline (OpenAI-Moderation) on the same datasets; ASR averages 11.68% versus 61.86% for ESD.
- Under adaptive attacks on 100 MMA-Diffusion prompts, the adaptive attack success rate is at most 16%, and 300x faster per-prompt latency than SafetyChecker (0.059s vs 17.9s).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use GuardT2I instead of OpenAI-Moderation | Stable Diffusion v1.5 adversarial-prompt moderation · Adversarial prompts (average) | AUROC (%): 91.51 -> 96.77 | Helped |
| use GuardT2I instead of AWS Comprehend | Stable Diffusion v1.5 adversarial-prompt moderation · Adversarial prompts (average) | AUPRC (%): 89.30 -> 96.16 | Helped |
| use GuardT2I instead of OpenAI-Moderation | Stable Diffusion v1.5 adversarial-prompt moderation · Adversarial prompts (average) | FPR@TPR95: 27.55 -> 19.26 | Helped |
| use GuardT2I instead of SLD-medium | Stable Diffusion v1.5 adversarial-prompt defense · Adversarial prompts (average) | ASR (%): 72.36 -> 11.68 | Helped |
| use GuardT2I instead of ESDu1 | Stable Diffusion v1.5 normal use · Normal use case | FID: 49.24 -> 52.10 | Hurt |
| use GuardT2I instead of ESDu1 | Stable Diffusion v1.5 normal use · Normal use case | CLIP-Score: 0.1501 -> 0.1502 | Helped |
| add the Verbalizer to the Sentence-Similarity Checker (ablation) | GuardT2I · SneakyPrompt | AUROC (%): 97.39 -> 97.86 | Helped |
| add the Verbalizer to the Sentence-Similarity Checker (ablation) | GuardT2I · MMA-Diffusion | AUROC (%): 97.17 -> 98.86 | Helped |
| add the Verbalizer to the Sentence-Similarity Checker (ablation) | GuardT2I · I2P-Sexual | AUROC (%): 91.42 -> 93.05 | Helped |
| add the Verbalizer to the Sentence-Similarity Checker (ablation) | GuardT2I · I2P | AUROC (%): 92.41 -> 92.56 | Helped |
| add the Sentence-Similarity Checker to the Verbalizer (ablation) | GuardT2I · Adversarial prompts (average, ablation) | AUROC (%): 59.65 -> 95.58 | Helped |
| increase adaptive attack weight α from 0.2 to 0.5 (ablation) | Adaptive attack on GuardT2I · MMA-Diffusion adaptive attack | Adaptive Attack Success Rate (%): 12.00 -> 16.00 | Mixed |
Surprising findings
- Adaptive attacks that bypass GuardT2I tend to produce much weaker NSFW synthesis, so bypass rate and T2I NSFW rate trade off against each other.
- OpenAI-Moderation achieves 98.50% AUROC on SneakyPrompt but only 73.02% on MMA-Diffusion, showing unstable generalization of classifier moderators.
Limitations
- Verbalizer keyword list is fixed by developers and can miss names or entities such as Trump, producing false negatives.
- Rare terminology can trigger false positives because the c·LLM reconstructs unusual words poorly.
- Evaluated only on Stable Diffusion v1.5 and adaptive attacks on 100 prompts with one attack method.
Experimental setup
Datasets: LAION-COCO I2P SneakyPrompt MMA-Diffusion Ring-A-Bell P4D
Benchmarks: SneakyPrompt MMA-Diffusion I2P-Sexual I2P Ring-A-Bell P4D
Metrics: AUROC AUPRC FPR@TPR95 ASR FID CLIP-Score
Baselines: OpenAI-Moderation Microsoft Azure AWS Comprehend NSFW-text-classifier Detoxify ESD SLD SafetyChecker
Builds on: Stable Diffusion MMA-Diffusion teacher forcing
Closest papers by meaning
- AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.87)
- Direct Unlearning Optimization for Robust and Safe Text-to-Image Models (NeurIPS 2024 · similarity 0.87)
- Training-Free Safe Text Embedding Guidance for Text-to-Image Diffusion Models (NeurIPS 2025 · similarity 0.86)
- Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails (NeurIPS 2026 · similarity 0.86)
- OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Models (NeurIPS 2025 · similarity 0.85)
- ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.