Research map / Image generation / Fast diffusion sampling

Safe Few-Step Generation via Velocity Editing

NeurIPS 2026 · Image generation › Fast diffusion sampling · approach: Rectified flow straightening · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes VESFlow, a training-free method that edits the velocity field of few-step flow-matching/MeanFlow T2I models toward a safe-conditional velocity via a Bayesian decomposition with a nudity/violence safety scorer, plus a risk-score filter and a stronger VESFlow+ variant.

Problem

Concept removal (safe generation) in few-step flow-matching text-to-image models is hard because trajectory-level guidance has too few steps to correct, and embedding-editing methods are less effective with modern T5-based sentence-level text encoders.

Approach

Edit the marginal velocity directly toward the safe-conditional velocity v(x_t|c,s=1) using a Bayes-rule gradient of a safety verifier evaluated on the predicted clean sample; apply a risk-score prompt filter so benign prompts are untouched, and for unsafe prompts additionally repel from the unsafe-conditional velocity (VESFlow+).

Key results

• On 4-step MeanFlow, VESFlow+ reduces NudeNet ASR on Ring-A-Bell from 0.709 (baseline) to 0.063 and on MMA-Diffusion from 0.417 to 0.068.
• On 8-step FLUX.1-lite, VESFlow+ reaches ASR 0.013 on Ring-A-Bell nudity and 0.003 on MMA-Diffusion, with FID 26.55 vs 27.13 baseline.
• Risk-score filtering (tau=0.3) keeps MS-COCO FID/CLIP essentially unchanged from baseline across guidance scales.

Surprising findings

• Skipping the first sampling step substantially degrades safety, indicating early steps are critical for few-step safety guidance.
• Combining VESFlow+ with Semantic Surgery on MeanFlow yields only a marginal ASR improvement (0.506 to 0.443) and underperforms VESFlow+ alone.

Limitations

• Endpoint singularity from the t/(1-t) factor makes guidance unstable near t=1, requiring a heuristic t_max clamp.
• Scorer gradient computation adds roughly twice the baseline cost in the worst case.
• Violence scorer is a self-trained MLP and hyperparameters are transferred from nudity without category-specific tuning.

Experimental setup

Datasets: I2P MS-COCO Ring-A-Bell MMA-Diffusion

Benchmarks: Ring-A-Bell MMA-Diffusion MS-COCO

Metrics: ASR toxic rate FID CLIP score

Baselines: SGF STG SAFREE Semantic Surgery Baseline (unguided)

Builds on: flow matching MeanFlow SAFREE Safe Latent Diffusion

Closest papers by meaning

• Blockwise Flow Matching: Improving Flow Matching Models For Efficient High-Quality Generation (NeurIPS 2025 · similarity 0.88)
• Differential Vector Erasure: Unified Training-Free Concept Erasure for Flow Matching Models (NeurIPS 2026 · similarity 0.88)
• Discrete Flow Matching (NeurIPS 2024 · similarity 0.87)
• Trajectory as the Teacher: Few-Step Discrete Flow Matching via Energy-Navigated Distillation (NeurIPS 2026 · similarity 0.87)
• Transition Matching: Scalable and Flexible Generative Modeling (NeurIPS 2025 · similarity 0.87)
• Coreset-Induced Conditional Velocity Flow Matching (NeurIPS 2026 · similarity 0.87)