Research map / Image generation / Text-to-image diffusion

OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Models

NeurIPS 2025 · Image generation › Text-to-image diffusion · approach: T2I evaluation and controllable adapters · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Builds OVERT, a synthetic benchmark of 4,600 seemingly harmful but benign text-to-image prompts across nine safety categories (plus 1,785 harmful OVERT-unsafe prompts) to measure over-refusal and the safety-utility trade-off in five T2I models.

Problem

Text-to-image models often refuse benign prompts that merely contain sensitive cues (over-refusal), and no large-scale benchmark systematically measures this for T2I models.

Approach

An automatic LLM-based pipeline converts over-refusal seed prompts from WildGuardMix (and directly generated prompts for discrimination and violence) into T2I prompts, then filters, deduplicates, and rejection-samples them with Chameleon-7B to target over-refusal, and creates paired harmful counterparts.

Key results

• Over-refusal is widespread: DALL-E-3-Web refuses 51.7% of OVERT-mini prompts on average, Imagen-3 29.1%, and SD-3.5-Large only 2.0%.
• Safety and over-refusal are strongly correlated across models (Spearman 0.898), indicating a safety-utility trade-off.
• Prompt rewriting lowers refusal on some categories but semantic fidelity is low (e.g., 44.0% for illegal activities with Gemini-2.0 rewriting).

Measured effects reported in the paper

Surprising findings

• DALL-E-3-Web and FLUX1.1-Pro refuse more benign illegal-activity prompts than their paired harmful counterparts.
• SD-3.5-Large with its post-hoc safety checker has near-zero refusal on both benign and harmful prompts.

Limitations

• Synthetic LLM-generated prompts may lack diversity and natural human input patterns.
• Rejection sampling with Chameleon-7B may introduce selection bias, and Chameleon cannot be evaluated on the benchmark.
• Harmfulness judgments by VLMs and the LLM-based filtering depend on the same LLM family, risking self-enhancement bias.

Experimental setup

Datasets: WildGuardMix OVERT-mini (sampled from OVERT)

Benchmarks: OVERT-mini OVERT-unsafe

Metrics: refusal rate harmful content rate safe response rate Spearman correlation semantic fidelity

Baselines: Imagen-3 DALL-E-3-API DALL-E-3-Web FLUX1.1-Pro Stable Diffusion 3.5 Large

Builds on: WildGuardMix XSTest OR-Bench

Closest papers by meaning

• T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation (CVPR 2025 · similarity 0.91)
• Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts (ICML 2024 · similarity 0.90)
• Position: Towards Implicit Prompt For Text-To-Image Models (ICML 2024 · similarity 0.89)
• T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Models (NeurIPS 2024 · similarity 0.89)
• Who Evaluates the Evaluations? Objectively Scoring Text-to-Image Prompt Coherence Metrics with T2IScoreScore (TS2) (NeurIPS 2024 · similarity 0.89)
• Arena-T2I Hard: Benchmarking and Improving Faithfulness with Dependency-Aware Checklist Rewards (NeurIPS 2026 · similarity 0.89)