Research map / Image generation / Text-to-image diffusion
SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SAFREE, a training-free method that filters unsafe concepts from text embeddings via orthogonal projection, self-validating denoising-step control, and Fourier-domain latent re-attention to make text-to-image and video diffusion generation safer without weight edits.
Problem
Safe generation in text-to-image and text-to-video diffusion models: existing unlearning/editing methods require training or weight changes and degrade quality, while prior training-free filters are brittle to implicit triggers and shift prompt distributions.
Approach
Detects trigger tokens by measuring how far each mask-pooled prompt embedding lies from a user-defined toxic concept subspace, projects those tokens orthogonally away from that subspace while staying in the prompt's input space, gates the filtered embedding over denoising steps with a cosine-based self-validating threshold, and attenuates low-frequency latent features in the Fourier domain.
Key results
- On five T2I red-teaming benchmarks, SAFREE reduces attack success rate versus the best training-free baselines (e.g., 47% lower than I2P, 13% lower than MMA-Diffusion, 34% lower than UnlearnDiff per the text), with ASR of 0.384 on P4D and 0.282 on UnlearnDiffAtk for SD-v1.4.
- On SDXL and SD-v3, SAFREE reduces unsafe outputs by 48% and 47% respectively across benchmarks.
- On the SafeSora T2V benchmark, SAFREE lowers unsafe rates for ZeroScopeT2V and CogVideoX-5B across all five categories (e.g., Violence 71.68 to 50.60 for ZeroScopeT2V).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply SAFREE to SD-v1.4 | SD-v1.4 · I2P, P4D, Ring-A-Bell, MMA-Diffusion, and UnlearnDiffAtk | ASR: 0.178 -> 0.034; 0.987 -> 0.384; 0.831 -> 0.114; 0.957 -> 0.585; 0.697 -> 0.282 | Mixed |
| Replace selected token embeddings with null embeddings (ablation) | SAFREE · P4D | ASR: 0.417 -> 0.430 | Hurt |
| Replace selected token embeddings with null embeddings (ablation) | SAFREE · COCO | FID: 36.5 -> 37.6 | Hurt |
| Use orthogonal token projection instead of null token replacement (ablation) | SAFREE · COCO | FID: 37.6 -> 36.5 | Helped |
| Add self-validating filtering to orthogonal token projection (ablation) | SAFREE · COCO | FID: 36.5 -> 36.1 | Helped |
| Add self-validating filtering to orthogonal token projection (ablation) | SAFREE · P4D | ASR: 0.417 -> 0.461 | Hurt |
| Add latent re-attention to orthogonal token projection (ablation) | SAFREE · COCO | FID: 36.5 -> 42.2 | Hurt |
| Apply SAFREE to SDXL | SDXL · P4D, Ring-A-Bell, MMA-Diffusion, and UnlearnDiffAtk | ASR: 0.709 -> 0.285; 0.532 -> 0.241; 0.501 -> 0.169; 0.345 -> 0.246 | Helped |
| Apply SAFREE to SD-v3 | SD-v3 · P4D, Ring-A-Bell, MMA-Diffusion, and UnlearnDiffAtk | ASR: 0.715 -> 0.271; 0.646 -> 0.430; 0.528 -> 0.165; 0.598 -> 0.302 | Helped |
| Apply SAFREE to ZeroScopeT2V | ZeroScopeT2V · SafeSora Violence, Terrorism, Racism, Sexual, and Animal Abuse | safety score: 71.68 -> 50.60; 76.00 -> 52.00; 73.33 -> 57.77; 51.51 -> 18.18; 66.66 -> 37.03 | Helped |
| Apply SAFREE to CogVideoX-5B | CogVideoX-5B · SafeSora Violence, Terrorism, Racism, Sexual, and Animal Abuse | safety score: 80.12 -> 59.03; 76.00 -> 56.00; 73.33 -> 64.44; 75.75 -> 30.30; 92.59 -> 48.14 | Helped |
Limitations
- Filtering fails when toxic prompts are highly implicit or chain-of-thought style, which can still jailbreak SAFREE.
- Relies on user-defined toxic concept keyword sets to build the concept subspace.
- Hyperparameters (alpha, gamma, s) are fixed and only sensitivity to alpha is examined.
Experimental setup
Datasets: I2P P4D Ring-A-Bell MMA-Diffusion UnlearnDiffAtk COCO-30k SafeSora
Benchmarks: I2P P4D Ring-A-Bell MMA-Diffusion UnlearnDiffAtk COCO-30k SafeSora
Metrics: attack success rate FID CLIP score TIFA LPIPS accuracy (MCQA)
Baselines: SLD-Medium SLD-Strong SLD-Max UCE RECE ESD SA CA MACE SDID
Builds on: classifier-free guidance Safe Latent Diffusion UCE
Closest papers by meaning
- Training-Free Safe Text Embedding Guidance for Text-to-Image Diffusion Models (NeurIPS 2025 · similarity 0.90)
- Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization (CVPR 2025 · similarity 0.90)
- ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning (ICLR 2025 · similarity 0.88)
- Towards Resilient Safety-driven Unlearning for Diffusion Models against Downstream Fine-tuning (NeurIPS 2025 · similarity 0.88)
- Towards Safe Concept Transfer of Multi-Modal Diffusion via Causal Representation Editing (NeurIPS 2024 · similarity 0.88)
- Growth Inhibitors for Suppressing Inappropriate Image Concepts in Diffusion Models (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.