Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

ReVision shows that gating attention-based image edits with a vision-language bounding box suppresses mask spilling, so unsafe concepts can be replaced while the rest of the scene stays intact.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 21:42 UTC pith:NXPSBOJQ

load-bearing objection A plausible post-hoc safety filter with a genuinely useful gating idea, but the headline fidelity numbers are partly built from the method's own box. the 5 major comments →

arxiv 2602.19149 v3 pith:NXPSBOJQ submitted 2026-02-22 cs.CR

ReVision : A Post-Hoc, Vision-Based Technique for Replacing Unacceptable Concepts in Image Generation Pipeline

Gurjot Singh , Prabhjot Singh , Aashima Sharma , Maninder Singh , Ryan Ko This is my paper
classification cs.CR
keywords post-hoc safetyconcept replacementspatial gatingmask spillingvision-language modeldiffusion image editingcontent moderationinstance-consistent localization
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

ReVision tries to establish that a training-free, post-hoc safety layer can replace policy-violating concepts in generated images without degrading benign content. Its central move is to use a vision-language model not only to detect unsafe instances but to return a coarse bounding box that gates the attention-based edit at the latent blending stage, preventing the edit mask from spilling onto semantically related but benign regions. If correct, this makes post-hoc safety editing deployable in multi-concept scenes where prior attention-based methods unintentionally modified benign content. Evidence reported includes higher background fidelity (perceptual LPIPS 0.166→0.058 on multi-concept images), explicit-content detector scores falling to zero, and human recognizability of unsafe content dropping from about 96% to 10%.

Core claim

The central claim is that instance-consistent localization—enforced by a vision-language bounding box converted into a latent-space gate and AND-ed with the attention-refined edit mask—eliminates the mask-spilling failure mode of attention-based post-hoc editing. The gate is applied only to the target diffusion branch during latent blending, blocking cross-instance activation paths in the self-attention graph without collapsing the edit region into a rectangle. The result is that the unsafe concept is replaced with a safe substitute while other instances and the background remain unchanged, which is what allows the pipeline to work in scenes containing multiple interacting concepts. The pipe

What carries the argument

The load-bearing mechanism is VLM-assisted instance-consistent spatial gating: a coarse bounding box from a vision-language detector is scaled to latent resolution, binarized into a gate G, and combined with the attention-derived edit mask M via M′ = M ∧ G at the latent blending step. The gate constrains only the target sample, preserving the source branch's global structure. This breaks the Laplacian-refined attention mask's tendency to propagate activation between visually similar instances, which is the root cause of mask spilling.

Load-bearing premise

The load-bearing premise is that the vision-language model returns an accurate bounding box for every unsafe instance and that this same box is a sound boundary for measuring fidelity; if the box is too small, misses an instance, or drifts, the edit either fails to suppress unsafe content or gates the wrong region, and the reported fidelity numbers inherit the same error.

What would settle it

Take a multi-concept image in which the detector returns a box covering only part of the unsafe instance—for example, a person holding a gun with the gun outside the box, or two overlapping figures of the same category. If the edited image still shows a detectable unsafe element outside the box while the background-fidelity metric, computed on the complement of that same box, reports near-perfect preservation, then the central claim (that gating yields instance-consistent suppression while preserving the scene) is falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Post-hoc safety editing becomes usable in multi-concept scenes without retraining the generator; one generic visual-language detector covers nudity, violence, copyrighted characters, public figures, and substance use.
  • Background fidelity improves substantially in complex scenes: multi-concept LPIPS drops from 0.166 to 0.058, PSNR rises from 18.2 to 28.0, and SSIM from 0.908 to 0.986.
  • Category-specific detectors show near-complete suppression: explicit-content scores fall from 70.51 to 0, and specific identity recognition for copyrighted characters drops from 1.00 to 0.02.
  • Human recognizability of policy-violating content falls from about 96% to 10% when generic labels are excluded.
  • The modular design means safety policies can be updated by changing the detector prompt, rather than retraining or modifying the generator.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's claims: because the same bounding box that gates the edit also defines the region excluded from fidelity evaluation, the reported LPIPS/PSNR/SSIM gains are partly measuring the method's own constraint; a stricter test would compare against an independent segmentation of the edited region.
  • Beyond the paper's claims: the safety guarantee inherits the blind spots of the vision-language detector; if the detector misses an instance or returns a drifting box, unsafe content can survive outside the gate. Swapping in an open-source detector with weaker boxes and re-running the benchmark would quantify how brittle the guarantee is.
  • Beyond the paper's claims: the gate's per-instance application suggests the scheme could be applied to sequential video frames or multi-image generation; the reported 4–5 second overhead for multi-concept edits, however, suggests real-time deployment remains a constraint.
  • Beyond the paper's claims: a residual-failure mode exists when the edit does not fully overwrite content inside the box, and since the gate never constrains the source branch, global context from the original image can still propagate; probing near-duplicate or adversarial inputs inside the box would test the pipeline's worst case.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. ReVision is a training-free, post-hoc safety pipeline for text-to-image and image-to-image generation. It uses Gemini-2.5-Flash to detect policy-violating instances in a generated image and to return, per instance, a semantic label, source/target prompts, blend words, and a bounding box. The image is then edited with LOCATEdit, whose attention-derived latent mask is intersected with a binary gate derived from the bounding box (Eq. 5) to prevent mask spilling in multi-concept scenes. The paper reports background-fidelity improvements over LOCATEdit (e.g., multi-concept LPIPS 0.166 to 0.058), CLIP alignment gains, near-total suppression on NudeNet, CopyCAT, and GCD detectors, and a human study claiming a drop in recognizability from 95.99% to 10.16%.

Significance. The paper targets a real and practically important failure mode: attention-based post-hoc editing can spill onto benign content in multi-concept scenes, undermining deployability of safety pipelines. The proposed mechanism is simple, training-free, and does not require category-specific segmentation models, which is attractive for production safety layers. The masking-spilling analysis is clearly motivated, and the independent detector results (NudeNet, CopyCAT, GCD) provide useful evidence that unsafe content is suppressed. If the central fidelity claim were supported by an independent evaluation, this would be a useful contribution to the post-hoc safety literature. At present, however, the headline fidelity result is structurally tied to the same spatial supervision used by the method, and the bounding-box accuracy on which the method relies is not validated.

major comments (5)
  1. [§6.1, Eq. (5)–(6)] The background-fidelity metric is circular with the gating mechanism. In Eq. (5), the Gemini bounding box B is converted into the gate G, so ReVision is architecturally forbidden from editing outside G. In Eq. (6), the same bounding box is used to define the background region on which LPIPS/PSNR/SSIM are computed. Thus the reported improvement (e.g., multi-concept LPIPS 0.166→0.058) is partly forced by construction: LOCATEdit is unconstrained by G, and its outside-box changes are exactly the mask spilling the gate removes. To support the claim of improved scene preservation, fidelity must be evaluated on an independently defined preservation region (e.g., human/instance masks or a second detector’s boxes), and mask-level IoU between the gate and the true instance should be reported.
  2. [§5.2.2, §6.1] The spatial-gating claim depends entirely on the quality of Gemini’s bounding boxes, but no box-quality validation is reported. There is no IoU against human annotations or independent instance masks, no box-size distribution, and no failure-case analysis. If B is too small or drifts, unsafe content can remain outside the gate while also being excluded from the fidelity metric, making both the safety and fidelity results optimistic. The paper should validate that the boxes reliably cover the entire unsafe instance (and only that instance) before asserting instance-consistent localization.
  3. [§6.2 and Appendix A] The CLIP semantic-alignment evaluation is potentially confounded by the fact that Gemini generates both the target prompts used for editing and the safe/unsafe prompt pairs used for CLIP scoring. A generic safe prompt paired with a specific unsafe prompt can produce large CLIP gains without evidence of genuine concept removal, and the same model writing both text signals couples the metric to Gemini’s wording. The authors should evaluate with fixed, independently authored prompt templates and/or human-validated prompt pairs, and should report per-image distributions rather than only means.
  4. [§6.4] The human-study result is presented as a headline claim (95.99%→10.16%) but rests on only 36 images and 1,260 concept-level judgments, with no inter-annotator agreement, no confidence intervals, and no per-category breakdown. The post hoc reclassification of generic descriptions such as “TV character” or “superhero” as non-recognizable is subjective; a generic superhero may still be a copyright-relevant recognition. The authors should justify the sample size, report agreement metrics, and make the generic-label exclusion rule explicit and independently auditable.
  5. [Abstract vs. §5.1] The abstract claims an ‘800-image benchmark,’ while Section 5.1 describes a 245-image benchmark (170 single-concept and 75 multi-concept). The CopyCAT experiment additionally mentions 100 copyrighted-character images. This is a material inconsistency in the paper’s central empirical contribution and must be reconciled, with the benchmark composition fully specified.
minor comments (5)
  1. [§4.2.1 / Table 11] Table 11 is cited in the body as evidence for single-concept localization, but it appears only in the Appendix; please place it near the citation or clearly reference the appendix.
  2. [Eq. (4) and notation] The notation T={(y_t)}T_{t=1} is malformed; it should be a list or set, and the symbol T is reused for both the number of instances and the target branch. Also, Hℓ/Wℓ should be defined at first use.
  3. [§6.4] The judgment-count arithmetic is unclear: 36 images × 5 categories × 35 participants gives 6,300 possible judgments, yet the paper reports 1,260. Please specify how many annotators evaluated each image and how the 630 original / 630 edited split was obtained.
  4. [§8] Latency figures (1–2s, 6–7s, 4–5s) are reported without standard deviations or hardware details for the Gemini API calls; please state whether these are medians, means, or observed ranges, and how many trials were averaged.
  5. [§6.3.1] The phrase ‘average nudity score is reduced to 0’ may overstate certainty. Please report the number of images used, the full score distribution, and whether any near-threshold detections remain below NudeNet’s confidence cutoff.

Circularity Check

2 steps flagged

Background-fidelity metric is computed on the complement of the same Gemini box used as the edit gate, so the headline LPIPS gain is partly forced by construction.

specific steps
  1. fitted input called prediction [Section 5.2.2 Eq. (5) and Section 6.1 Eq. (6)]
    "An instance consistency is enforced by converting the bounding box B into a latent-space binary gate G ... The final edit mask is then computed as: M′ = M∧G. (5) ... Specifically, the bounding box localization provided by Gemini-2.5-Flash is used to identify the spatial extent of the detected unsafe concept and exclude this region from evaluation. All metrics are computed on the complement of this bounding box ... mbg = m(I orig, Iedit)bg (6)"

    The same Gemini bounding box B is both the source of the edit constraint and the evaluation mask. Eq. (5) makes the edit mask a subset of the gate G(B); Eq. (6) measures background fidelity only on complement(B). ReVision is therefore architecturally forbidden from changing the evaluated region, so the reported LPIPS/PSNR/SSIM gains over LOCATEdit mostly measure the hard rectangular gate, not instance-consistent localization. If B is too small or drifts, unsafe content can remain outside the gate while the fidelity metric still reports high preservation, because that same region is excluded. The multi-concept improvement 0.166→0.058 is thus partly forced by construction.

  2. other [Section 5.2.1/footnote 2 and Section 6.2 Eq. (7)]
    "In addition to extracting unsafe concepts and generating the corresponding source prompt, target prompt, and blend words, the use of Gemini is extended to return an additional structured output ... In this work, target prompts are automatically generated by Gemini ... Let p_unsafe denote the original source prompt describing the unsafe concept and p_safe the corresponding safe target prompt generated by Gemini."

    The CLIP alignment evaluation uses the safe prompt produced by the same Gemini model that generates the edit's target prompt. The reported gain toward p_safe is therefore measuring consistency with the method's own replacement description, not an externally fixed benchmark. This is a soft loop: CLIP itself is an independent model, but the evaluation text is not independent of the editing input, so the +0.121 alignment gain should be interpreted as Gemini-consistency rather than neutral safety alignment.

full rationale

The central derivation—VLM-assisted spatial gating M' = M ∧ G—is not itself circular: it is a real architectural modification of LOCATEdit. However, the paper's strongest fidelity claim is structurally entangled with that modification. Equation (5) converts the Gemini bounding box B into the latent gate G, and Eq. (6) evaluates background fidelity on complement(B). Since ReVision is hard-forbidden from editing outside G, the outside-box region is essentially the source reconstruction, so LPIPS/PSNR/SSIM on complement(B) measure the effect of the hard gate rather than instance-precise localization. The multi-concept improvement from 0.166 to 0.058 is thus partly by construction; a crude rectangular crop large enough to contain the concept would produce a similar background-fidelity result. The paper does not independently validate box quality (no IoU against human/instance masks, no box-size distribution, no failure analysis), so box errors can leave unsafe content outside the gate while the metric still reports high fidelity. The CLIP alignment evaluation also uses Gemini-generated target prompts, creating a soft self-reference. Independent evidence (NudeNet to 0, CopyCAT, GCD, and the human study) supports the content-suppression claim and prevents a higher score. The self-citation to ANTIMIRROR [6] is contextual and not load-bearing. Overall, this is partial circularity in the evaluation, not in the derivation of the method.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

No fitted free parameters are introduced: the method uses off-the-shelf components and reports no tuned constants. The load-bearing assumptions are the reliability of Gemini's bounding boxes, the semantic validity of attention-based localization, the safety of auto-generated target prompts, and the appropriateness of using the Gemini box as the evaluation boundary. No new physical or conceptual entities are postulated; 'mask spilling' is a named failure mode, not an entity.

axioms (4)
  • domain assumption Gemini-2.5-Flash returns an accurate bounding box for every unsafe instance in the scene.
    Section 5.2.2: the box B is converted into the latent gate G in Eq. (5). If the box is missing, misplaced, or too loose, edits are either not applied or applied to benign regions. The paper asserts boxes are reliable but provides no failure-rate analysis.
  • domain assumption LOCATEdit's cross-attention-derived mask M* correctly localizes the target concept at latent resolution.
    Section 4.2.1: the whole pipeline rests on attention maps for blend words pointing to the unsafe concept. This is inherited from prior work and not re-validated beyond qualitative examples.
  • domain assumption The safe target prompt generated by Gemini is an acceptable replacement and does not itself introduce policy-violating content.
    Section 5.2.1: target prompts are auto-generated; if the replacement is semantically wrong or unsafe, the defense fails or changes the intended image semantics.
  • domain assumption The background-fidelity metric, computed on the complement of the Gemini box, is an appropriate measure of unintended edits.
    Section 6.1 uses the same bounding box for both gating and evaluation. This assumes the box tightly contains all edited pixels and that any change outside it is an error. This assumption is load-bearing for the headline fidelity comparisons.

pith-pipeline@v1.3.0-alltime-deepseek · 18803 in / 12183 out tokens · 121153 ms · 2026-08-02T21:42:28.358124+00:00 · methodology

0 comments
read the original abstract

Image-generative models are widely deployed across industries. Recent studies show that they can be exploited to produce unacceptable content. Existing mitigation strategies rely on prompt filtering and safety-aware training, both of which can be bypassed and often degrade generative quality. In this work, we propose ReVision, a training-free, prompt-based, post-hoc safety framework for image-generation pipeline. ReVision acts as a post-generation safeguard by analyzing generated images and selectively editing unsafe concepts without altering the underlying generator. Prior post-hoc editing methods often rely on imprecise spatial localization, limiting deployability, in multi-concept scenes. To address this limitation, ReVision introduces a VLM-assisted spatial gating mechanism for instance-consistent localization, enabling integrity-preserving edits. We introduce an 800-image benchmark spanning single- and multi-unsafe-concept images, each composed alongside benign concepts in shared scenes. On this benchmark, ReVision improves CLIP alignment toward safe prompts by +0.121, reduces multi-concept background LPIPS from 0.166 to 0.058, and eliminates NudeNet detections (70.51 -> 0). Across external benchmarks, ReVision outperforms prior methods, and a human study shows it reduces recognizability of unacceptable content from 96% to 10%.

Figures

Figures reproduced from arXiv: 2602.19149 by Aashima Sharma, Gurjot Singh, Maninder Singh, Prabhjot Singh, Ryan Ko.

Figure 1
Figure 1. Figure 1: ReVision Threat Model: Post-generation safety pipeline within the provider’s Trusted Computing Base (TCB). 3 Threat Model We define the adversarial setting, attack surface, and defensive scope for ReVision in a realistic produc￾tion deployment. Deployment Setting. We consider a standard cloud-based deployment in which a service provider exposes a T2I or I2I generative model via a pub￾lic API. Users control… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Robust and Generalizable Safety Steering for Text-to-Image Diffusion Transformers

    cs.AI 2026-05 unverdicted novelty 4.0

    SafeDIG applies position-aware sparse feature transfer via SAEs in DiT models to reduce unsafe generations in target risk domains on FLUX.1 Dev and SD 3.5 while keeping source safety and quality.

Reference graph

Works this paper leans on

35 extracted references · 11 linked inside Pith · cited by 1 Pith paper

  1. [1]

    Reti- nal image restoration using transformer and cycle-consistent generative adversarial network

    Alnur Alimanov and Md Baharul Islam. Reti- nal image restoration using transformer and cycle-consistent generative adversarial network. In2022 International Symposium on Intelligent Signal Processing and Communication Systems (ISPACS), pages 1–4. IEEE, 2022

    2022

  2. [2]

    Nudenet: Neural nets for nudity detection and censoring, 2022

    Praneeth Bedapudi. Nudenet: Neural nets for nudity detection and censoring, 2022

    2022

  3. [3]

    Bloomberg Law. States Target AI Deepfakes in Taylor Swift Aftermath (Correct).https:// news.bloomberglaw.com/artificial-intel ligence/state-lawmakers-target-ai-dee pfakes-in-taylor-swift-aftermath, 2024. Accessed: 2024-09-15

    2024

  4. [4]

    stable-diffusion-safety-checker.http s://huggingface.co/CompVis/stable-diffu sion-safety-checker, 2022

    CompVis. stable-diffusion-safety-checker.http s://huggingface.co/CompVis/stable-diffu sion-safety-checker, 2022. Model card on Hugging Face. Accessed: 2025-12-29

    2022

  5. [5]

    Espresso: Robust concept filtering in text-to-image models

    Anudeep Das, Vasisht Duddu, Rui Zhang, and N Asokan. Espresso: Robust concept filtering in text-to-image models. InProceedings of the Fif- teenth ACM Conference on Data and Applica- tion Security and Privacy, pages 305–316, 2024

    2024

  6. [6]

    Do concept replacement techniques really erase unacceptable concepts? arXiv preprint arXiv:2506.08991, 2025

    Anudeep Das, Gurjot Singh, Prach Chantasan- titam, and N Asokan. Do concept replacement techniques really erase unacceptable concepts? arXiv preprint arXiv:2506.08991, 2025

    Pith/arXiv arXiv 2025

  7. [7]

    Gemini: A family of highly ca- pable multimodal models

    G Team. Gemini: A family of highly ca- pable multimodal models. arXiv preprint arXiv:2312.11805, 2023. Available athttps: //arxiv.org/abs/2312.11805

    Pith/arXiv arXiv 2023

  8. [8]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Be- linkov, Joanna Materzy´ nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Confer- ence on Applications of Computer Vision, pages 5111–5120, 2024

    2024

  9. [9]

    Qi Guo, Shanmin Pang, Xiaojun Jia, Yang Liu, and Qing Guo. Efficient generation of targeted 22 and transferable adversarial examples for vision- language models via diffusion models.IEEE Transactions on Information Forensics and Se- curity, 2024

    2024

  10. [10]

    Fantastic copyrighted beasts and how (not) to generate them.arXiv preprint arXiv:2406.14526, 2024

    Luxi He, Yangsibo Huang, Weijia Shi, Ting- hao Xie, Haotian Liu, Yue Wang, Luke Zettle- moyer, Chiyuan Zhang, Danqi Chen, and Peter Henderson. Fantastic copyrighted beasts and how (not) to generate them.arXiv preprint arXiv:2406.14526, 2024

    Pith/arXiv arXiv 2024

  11. [11]

    Selective amnesia: A continual learning approach to forgetting in deep generative models

    Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. InNeurIPS, 2023

    2023

  12. [12]

    Ablating concepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models. InICCV, pages 22634–22645. IEEE, 2023

    2023

  13. [13]

    MACE: mass con- cept erasure in diffusion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. MACE: mass con- cept erasure in diffusion models. InCVPR, pages 6430–6440. IEEE, 2024

    2024

  14. [14]

    Robust concept erasure using task vectors.arXiv preprint arXiv:2404.03631, 2024

    Minh Pham et al. Robust concept erasure using task vectors.arXiv preprint arXiv:2404.03631, 2024

    Pith/arXiv arXiv 2024

  15. [15]

    Cir- cumventing concept erasure methods for text- to-image generative models.arXiv preprint arXiv:2308.01508, 2023

    Minh Pham, Kelly O Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Cir- cumventing concept erasure methods for text- to-image generative models.arXiv preprint arXiv:2308.01508, 2023

    Pith/arXiv arXiv 2023

  16. [16]

    Philip Pullella. Pope Francis warns against ‘per- verse’ dangers of AI, renews call for worldwide regulation — theglobeandmail.com.https: //www.theglobeandmail.com/business/int ernational-business/article-pope-franc is-warns-against-perverse-dangers-of-a i-renews-call-for/. Accessed: 2024-09-15

    2024

  17. [17]

    Unsafe diffusion: On the generation of un- safe images and hateful memes from text-to- image models

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of un- safe images and hateful memes from text-to- image models. InProceedings of the 2023 ACM SIGSAC conference on computer and communi- cations security, pages 3403–3417, 2023

    2023

  18. [18]

    Hierarchical text- conditional image generation with clip latents

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 1(2):3, 2022

    Pith/arXiv arXiv 2022

  19. [19]

    Scale where it matters: Training-free localized scaling for dif- fusion models.arXiv preprint arXiv:2511.19917, 2025

    Qin Ren, Yufei Wang, Lanqing Guo, Wen Zhang, Zhiwen Fan, and Chenyu You. Scale where it matters: Training-free localized scaling for dif- fusion models.arXiv preprint arXiv:2511.19917, 2025

    arXiv 2025

  20. [20]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨ orn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF con- ference on computer vision and pattern recogni- tion, pages 10684–10695, 2022

    2022

  21. [21]

    Sara Mahdavi, Rapha Gon- tijo Lopes, Tim Salimans, Jonathan Ho, David J Fleet, and Mohammad Norouzi

    Chitwan Saharia, William Chan, Saurabh Sax- ena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, S. Sara Mahdavi, Rapha Gon- tijo Lopes, Tim Salimans, Jonathan Ho, David J Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep lan- guage understanding. InAdvances in Neural Information Pro...

  22. [22]

    Image quality assessment through fsim, ssim, mse and psnr—a compar- ative study.Journal of Computer and Commu- nications, 7(3):8–18, 2019

    Umme Sara, Morium Akter, and Moham- mad Shorif Uddin. Image quality assessment through fsim, ssim, mse and psnr—a compar- ative study.Journal of Computer and Commu- nications, 7(3):8–18, 2019

    2019

  23. [23]

    Failures to find transferable image jailbreaks be- tween vision-language models.arXiv preprint arXiv:2407.15211, 2024

    Rylan Schaeffer, Dan Valentine, Luke Bailey, James Chua, Cristobal Eyzaguirre, Zane Du- rante, Joe Benton, Brando Miranda, Henry Sleight, John Hughes, et al. Failures to find transferable image jailbreaks be- tween vision-language models.arXiv preprint arXiv:2407.15211, 2024. 23

    Pith/arXiv arXiv 2024

  24. [24]

    How much can clip benefit vision-and-language tasks?arXiv preprint arXiv:2107.06383, 2021

    Sheng Shen, Liunian Harold Li, Hao Tan, Mo- hit Bansal, Anna Rohrbach, Kai-Wei Chang, Zhewei Yao, and Kurt Keutzer. How much can clip benefit vision-and-language tasks?arXiv preprint arXiv:2107.06383, 2021

    Pith/arXiv arXiv 2021

  25. [25]

    Locatedit: Graph laplacian optimized cross at- tention for localized text-guided image editing

    Achint Soni, Meet Soni, and Sirisha Rambhatla. Locatedit: Graph laplacian optimized cross at- tention for localized text-guided image editing. arXiv preprint arXiv:2503.21541, 2025

    Pith/arXiv arXiv 2025

  26. [26]

    Modera- tor: Moderating text-to-image diffusion models through fine-grained context-based policies

    Peiran Wang, Qiyu Li, Longxuan Yu, Ziyao Wang, Ang Li, and Haojian Jin. Modera- tor: Moderating text-to-image diffusion models through fine-grained context-based policies. In CCS, pages 1181–1195. ACM, 2024

    2024

  27. [27]

    AEIOU: A unified de- fense framework against NSFW prompts in text- to-image models.CoRR, abs/2412.18123, 2024

    Yiming Wang, Jiahao Chen, Qingming Li, Xing Yang, and Shouling Ji. AEIOU: A unified de- fense framework against NSFW prompts in text- to-image models.CoRR, abs/2412.18123, 2024

    arXiv 2024

  28. [28]

    Ace: Anti- editing concept erasure in text-to-image mod- els

    Zihao Wang, Yuxiang Wei, Fan Li, Renjing Pei, Hang Xu, and Wangmeng Zuo. Ace: Anti- editing concept erasure in text-to-image mod- els. InProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recogni- tion, pages 23505–23515, 2025

    2025

  29. [29]

    Nsfw-classifier guided prompt sani- tization for safe text-to-image generation.arXiv preprint arXiv:2506.18325, 2025

    Yu Xie, Chengjie Zeng, Lingyun Zhang, and Yanwei Fu. Nsfw-classifier guided prompt sani- tization for safe text-to-image generation.arXiv preprint arXiv:2506.18325, 2025

    Pith/arXiv arXiv 2025

  30. [30]

    Mma- diffusion: Multimodal attack on diffusion mod- els

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma- diffusion: Multimodal attack on diffusion mod- els. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024

    2024

  31. [31]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In2024 IEEE symposium on security and privacy (SP), pages 897–912. IEEE, 2024

    2024

  32. [32]

    Score-based-diffusion-model-based synthetic ct generation from mr images and post-hoc un- certainty analysis

    Si Young Yie, Siyeop Yoon, Jaewon Yang, Kyungsang Kim, Jae Sung Lee, and Quanzheng Li. Score-based-diffusion-model-based synthetic ct generation from mr images and post-hoc un- certainty analysis. InMedical Imaging 2025: Im- age Processing, volume 13406, pages 600–604. SPIE, 2025

    2025

  33. [33]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features as a per- ceptual metric. InProceedings of the IEEE Con- ference on Computer Vision and Pattern Recog- nition (CVPR), pages 586–595. IEEE Computer Society, 2018

    2018

  34. [34]

    In34th USENIX Security Sym- posium (USENIX Security 25), pages 879–895, 2025

    Yuyang Zhang, Kangjie Chen, Xudong Jiang, Ji- ahui Wen, Yihui Jin, Ziyou Liang, Yihao Huang, Run Wang, and Lina Wang.{USD}:{NSFW} content detection for{Text-to-Image}models via scene graph. In34th USENIX Security Sym- posium (USENIX Security 25), pages 879–895, 2025

    2025

  35. [35]

    Mde-edit: Masked dual-editing for multi- object image editing via diffusion models.arXiv preprint arXiv:2505.05101, 2025

    Hongyang Zhu, Haipeng Liu, Bo Fu, and Yang Wang. Mde-edit: Masked dual-editing for multi- object image editing via diffusion models.arXiv preprint arXiv:2505.05101, 2025. 24

    Pith/arXiv arXiv 2025