Research map / Adversarial robustness and security / Attacks on text and graphs
Mitigating Sexual Content Generation via Embedding Distortion in Text-conditioned Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Distorting Embedding Space (DES), a text-encoder fine-tuning defense that pushes unsafe prompt embeddings toward nudity-anticorrelated safe targets while preserving safe embeddings and neutralizing the nudity concept, to block sexual content in diffusion models.
Problem
Text-conditioned diffusion models can generate sexual content, and existing defenses (prompt filters, concept removal, sexual content mitigation) are either bypassed by adversarial prompts or degrade benign image quality.
Approach
Instead of erasing concepts from the U-Net, fine-tune only the text encoder so unsafe embeddings are mapped to safe target vectors (the most dissimilar safe embedding minus a nudity direction), safe embeddings are preserved with a nudity-adjusted loss, and the nudity embedding is aligned with the neutral embedding.
Key results
- DES achieves average ASR of 0.52% on SDv1.5 across adversarial prompts versus 1.44% for AdvUnlearn (best prior text-encoder method).
- On FLUX.1, DES reduces average ASR to 8.86% (9.47% in appendix) versus 43.23% for EraseAnything, a 76.5% reduction.
- DES attains FID 15.44 and CLIP score 25.52 on SDv1.5, close to the original model (16.57 FID, 26.46 CLIP), with training taking 90 seconds and zero inference overhead.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DES embedding distortion instead of AdvUnlearn | SDv1.5 text-conditioned T2I · Black-box adversarial prompts | Avg. ASR (%): 1.44 -> 0.52 | Helped |
| Use DES embedding distortion instead of EraseAnything | FLUX.1 text-conditioned T2I · Black-box adversarial prompts | Avg. ASR (%): 43.23 -> 8.86 | Helped |
| Use DES embedding distortion instead of AdvUnlearn | SDv1.5 text-conditioned T2I · I2P explicit sexual content | FID: 18.94 -> 15.44 | Helped |
| Apply DES rather than AdvUnlearn | SDv1.5 text-conditioned T2I · White-box adaptive attacks | Avg. ASR (%): 7.15 -> 6.47 | Helped |
| Add DES embedding distortion | SDv1.5 T2I · Black-box adversarial prompts with negative prompts | Avg. ASR (%): 78.04 -> 0.33 | Helped |
| Add filtering to DES | SDv1.5 T2I · Black-box adversarial prompts | Avg. ASR (%): 0.52 -> 0.33 | Helped |
Surprising findings
- Text-encoder-only fine-tuning generalizes to adversarial prompts (e.g., Ring-A-Bell, MMA) despite being trained only on natural-language unsafe prompts.
- Several sexual content mitigation methods like SPM and SLD perform poorly, with SPM retaining many nude body parts in I2P generations.
Limitations
- Some adversarial prompts still produce NudeNet-flagged content (e.g., artistic nude images), per the failure case analysis.
- Error bars were not reported due to computational cost.
- Reported numbers for FLUX.1 vary between sections (8.86% vs 9.47%), and a T5-XXL run required CPU offloading that slows training considerably.
Experimental setup
Datasets: CoPro I2P MMA-Diffusion prompts Sneaky prompts Ring-A-Bell prompts P4D prompts UDA prompts CCE prompts COCO 30k
Benchmarks: I2P Sneaky MMA-Diffusion Ring-A-Bell P4D UDA CCE COCO
Metrics: attack success rate FID CLIP score PickScore ImageReward BLIP score
Baselines: SPM SLD Safe-CLIP SAFREE UCE ESD GLoCE SalUn AdvUnlearn EraseAnything GuardT2I Latent Guard
Builds on: AdvUnlearn ESD SalUn Safe-CLIP
Closest papers by meaning
- Training-Free Safe Text Embedding Guidance for Text-to-Image Diffusion Models (NeurIPS 2025 · similarity 0.90)
- Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization (CVPR 2025 · similarity 0.89)
- Get What You Want, Not What You Don't: Image Content Suppression for Text-to-Image Diffusion Models (ICLR 2024 · similarity 0.88)
- SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation (ICLR 2025 · similarity 0.87)
- AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.86)
- On Discrete Prompt Optimization for Diffusion Models (ICML 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.