Pith. sign in

REVIEW 3 major objections 5 minor 56 references

UniNDM claims that the noise a text-to-image diffusion model predicts at its very first denoising step is enough to distinguish sexually explicit prompts from benign ones, and that steering that same noise can suppress explicit content with

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 19:49 UTC pith:4U7IP3AU

load-bearing objection Real empirical insight, overclaimed theory, and an evaluation protocol that needs tightening before the numbers can be trusted. the 3 major comments →

arxiv 2607.16828 v1 pith:4U7IP3AU submitted 2026-07-18 cs.CV

UniNDM: A Unified Noise-driven Detection and Mitigation Framework Against Sexual Content in Text-to-Image Generation

Yao Huang , Yitong Sun , Huanran Chen , Ruochen Zhang , Shouwei Ruan , Ranjie Duan , Maoxun Yuan , Yinpeng Dong
show 3 more authors
Hui Xue Xiaochun Cao Xingxing Wei
This is my paper
classification cs.CV
keywords text-to-image diffusion modelssexual content safetynoise-based detectionadaptive negative guidanceinitial noise optimizationDiffusion Transformersimplicit prompt detectioncontent moderation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

UniNDM asks whether a text-to-image diffusion model can police itself before it draws anything, and answers with one ingredient: the noise the model predicts at the very first denoising step. The paper claims this early predicted noise carries the prompt's most salient semantic content, and that sexual and benign prompts produce noise vectors that separate cleanly at this stage. Around that property it builds a lightweight detector — a PCA-LDA-SVM classifier applied to the first-step noise tensor — which reports over 90 percent detection on natural and adversarial sexual-prompt benchmarks while keeping benign accuracy near 90 percent on COCO prompts, at roughly a second per sample. When a prompt is flagged, the same framework mitigates by dynamically generating context-specific negative prompts with a large language model and by optimizing the initial noise to suppress attention concentrated on explicit tokens; a region-constrained steering variant extends the mitigation to Diffusion Transformer architectures. The paper's central claim is that harmful-content detection and mitigation can be unified in the noise dynamics of diffusion itself, without retraining the generator and without the quality collapse that strong erasure baselines suffer.

Core claim

The central discovery is that the first predicted noise of a diffusion model is semantically concentrated, not random, and that it differs systematically between benign and sexually explicit prompts. A theorem on a toy Gaussian model shows that an optimal noise predictor's semantic error is O(1/σ_t²), so predictions at large timesteps concentrate quadratically around the prompt's semantic center; the paper takes this as the reason harmful and benign prompts separate in early noise. A PCA-LDA-SVM classifier on the first-step noise tensor detects sexual prompts above 90 percent accuracy on four benchmarks, with benign accuracy near 90 percent, before any image is generated. For mitigation, the

What carries the argument

The load-bearing object is the first-step predicted noise ε_θ(z_T, T, c): the denoising network's estimate of the noise added to the initial pure-Gaussian latent, computed before any image structure exists. Theorem 3.1 states that for a Gaussian data model y = x + δ with a well-trained diffusion model, the optimal predictor's semantic error satisfies E||h_θ*(y_t,t) − x||² = O(1/σ_t²), implying quadratically increasing semantic concentration with timestep; the paper uses this to argue that harmful and benign prompts separate in early noise. On the detection side, the machinery is a PCA → LDA → SVM pipeline applied to the flattened first-step noise. On the mitigation side, it is a cross-attent

Load-bearing premise

The load-bearing premise is that the toy Gaussian theorem — in which a perfectly trained model's noise prediction moves toward the distribution center at large timesteps — transfers to real diffusion models and yields linear separability between sexual and benign categories in first-step noise; if that transference fails, the detector's strong generalization claims rest on dataset artifacts rather than theory.

What would settle it

Construct a matched evaluation set: benign and sexual prompts with identical subjects, locations, and sentence structure (for example, 'a woman in a bedroom wearing pajamas' versus 'a woman in a bedroom undressing'). Run the trained PCA-LDA-SVM detector on first-step noise from these matched pairs; if accuracy drops to chance, the reported separability is driven by topic differences between the training corpora, not by a semantic property of early noise.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Text-based filters miss implicit sexual prompts because the prompts contain no explicit words; the noise-based detector catches the same prompts from the visual semantics already present in the first denoising step.
  • Because detection costs under a second and needs no completed image, it can run as a gate before generation, enabling a detect-and-refuse mode that the paper reports pushes attack-success rates to roughly 5 percent on several datasets.
  • The mitigation does not modify the generator's weights, so benign prompts suffer little degradation — COCO-30k FID stays in single digits in most configurations — unlike model-intrinsic erasure methods whose CLIP scores drop noticeably.
  • The framework transfers to Diffusion Transformers, where global negative guidance fails; replacing it with attention-mask-localized semantic steering keeps DiT generations safe while preserving non-risk regions.
  • The separability observation extends beyond sexual content: the paper reports substantial mitigation rates for self-harm, violence, and shocking content, suggesting the noise-space mechanism is not specific to nudity.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A testable consequence of the paper's analogy: if early-noise concentration is a property of the diffusion objective itself, the same detector should transfer across samplers and across related generative tasks such as video diffusion, without retraining anything except the small classifier.
  • The theory establishes closeness to a prototype, not class separation; the strongest evidence would come from matching benign and sexual prompts for style and subject. If clusters separate only because the training corpora differ in topic, accuracy on adversarially restyled benign prompts is the place to look.
  • The mitigation pipeline relies on an LLM to generate negative prompts, which opens a secondary attack surface: an adversary who can jailbreak the LLM could defeat the adaptive guidance and leave only the fixed fallback prompt, a scenario the paper does not fully explore.
  • One cheap deployment the paper's numbers imply but never name: use the detector alone as a refusal gate — no LLM, no noise optimization — giving near-zero overhead and the lowest attack-success rates in several tables, at the cost of refusing some benign prompts.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes UniNDM, a two-stage safety framework for text-to-image diffusion models. Stage I trains a lightweight PCA+LDA+SVM classifier on the first-step predicted noise of the diffusion model to distinguish sexual from benign prompts, claiming that early-stage noise carries concentrated semantic information about the prompt. Stage II mitigates detected sexual content via LLM-generated adaptive negative prompts and initial-noise optimization for U-Net models, and via region-constrained semantic guidance plus DiT-adapted noise optimization for DiT models. The paper reports detection accuracies above 90% on I2P, SneakyPrompt, MMA, and Ring-A-Bell while keeping benign accuracy around 90%, and mitigation attack-success rates below 20% across SDv1.4/1.5/2.1/XL and SDv3. A theorem in §3.2.2 is presented as the theoretical justification for the noise-based detector.

Significance. If the empirical results hold, UniNDM offers a genuine practical advance: an inexpensive detector that operates before full image generation and a mitigation method that preserves benign generation quality while reducing sexual content. The evaluation is unusually broad for this area — five model families, natural and adversarial sexual-prompt datasets, multiple state-of-the-art baselines, ablations, and benign-quality metrics — and the public code is a strength. The results are consistent across U-Net and DiT, which supports the architecture-transfer claim. However, the theoretical argument does not actually establish the claimed inter-class separability, and the evaluation protocol leaves open the possibility that the detection and mitigation numbers are inflated by dataset-specific cues and per-dataset hyperparameter tuning. The contribution is therefore significant conditional on closing these gaps.

major comments (3)
  1. [§3.2.2, Theorem 3.1] The theorem proves within-class concentration, not inter-class separability. The model y~N(x, σ²I) has a single prototype x, and Eqs. (9)–(13) only show that E||h(y_t,t)-x||² = O(1/σ_t²), i.e., the predicted noise moves toward one class center. For a two-class mixture, the optimal denoiser is the posterior-weighted average of class centers; as σ_t grows, the posterior weights approach uniform, so the prediction collapses to the global mean rather than moving apart into separated clusters. Thus Theorem 3.1 cannot be cited as proof of the 'inherent separability' claimed in the abstract and §3.2.1. A two-class analysis or a measure of inter-class distance is needed to support the theoretical claim.
  2. [§4.1 / Table 1] The detection protocol trains on sexual prompts from I2P and MMA and benign prompts from COCO, then tests on held-out portions of these corpora plus SneakyPrompt and Ring-A-Bell. Because the source corpora differ in prompt style, vocabulary, and attack-token statistics, the high accuracies could reflect corpus-level cues (e.g., I2P wording vs. COCO wording, or adversarial token artifacts) rather than a generic semantic-concentration property. The lack of error bars or bootstrap confidence intervals, and the use of a single elevated guidance scale γ=12.5, make it hard to exclude this explanation. Please report per-dataset confidence intervals and include a matched-style benign control, or a train-on-one-benchmark/test-on-another protocol, to demonstrate that the detector transfers on the semantic property rather than on dataset artifacts.
  3. [§4.4 / Tables 2–4] Mitigation hyperparameters α and β are tuned per dataset: α=0.7 for I2P, SneakyPrompt, and Ring-A-Bell, α=0.6 for MMA, β=0.9 for I2P, SneakyPrompt, and MMA, and β=0.7 for Ring-A-Bell. Since the ASR numbers in Tables 2–4 are obtained with these test-set-specific settings, the claim of a distribution-free, generally applicable safeguard is not fully supported. The paper should report results with a single fixed hyperparameter setting (or a validation-set-based selection) and provide sensitivity curves for α and β on all datasets, not only I2P.
minor comments (5)
  1. [Abstract / §3.2.2] The phrase 'quadratically increasing semantic concentration' is inconsistent with Eq. (7), which states that the semantic error is O(1/σ_t²). Clarify that the error decreases as σ_t² grows.
  2. [Tables 2–4] The rows Ours_w/o_gen and Ours_w_gen are not defined in the table captions. From §4.3 they correspond to detection-then-refusal and detection-then-mitigation; please state this explicitly in each caption.
  3. [Figures 5 and 6] Bars marked with '-' are described only as negative NRR in the caption; please add a sentence explaining what a negative NRR means and why it can occur.
  4. [Appendix Proof] The appendix heading numbers the theorem as 'Theorem 1.1' while the main text uses 'Theorem 3.1'. Also, 'qradratically' appears twice; please proofread.
  5. [§4.1] The text says the number of training noise samples 'varies across the Stable Diffusion model series' but does not give the actual sizes. Please report the training set sizes for each model.

Circularity Check

0 steps flagged

No circularity found: the detector is a supervised held-out classifier and Theorem 3.1 is a self-contained toy-model calculation, not a fitted prediction.

full rationale

The paper's central empirical claim is that first-step predicted noise can be classified as sexual vs benign. The classifier is trained on labeled first-step noise from part of I2P/MMA and COCO and tested on unseen parts plus SneakyPrompt/Ring-A-Bell; this is standard supervised evaluation, not a fitted parameter renamed as a prediction. The PCA/LDA/SVM parameters are fit to training labels, but the reported accuracies are on held-out data, so the measurement is not forced by construction. Theorem 3.1 is a standalone Gaussian calculation: under y~N(x, sigma^2 I), the optimal denoiser is the posterior mean and the expected squared distance to x is O(1/sigma_t^2). The theorem may not establish two-class separability or the transfer to real diffusion models—that is a correctness/generalization concern—but it does not feed the detector's fitted values back into the classifier, nor does it derive its conclusion from the data being predicted. The only self-citation [26] is an editorial statement that this is an extended version of the authors' ACM MM paper; it is not used as evidence for any technical claim. No load-bearing argument reduces to a self-citation or to a definitional identity. Therefore no significant circularity is present.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The framework does not postulate new physical or architectural entities; it relies on existing diffusion components (noise, attention maps, LLMs). The free parameters are mostly per-dataset stopping criteria and the detection/diffusion guidance scales. The theoretical result rests on a Gaussian toy model, and the mitigation rests on the reliability of cross-attention as a semantic-risk indicator and of an undisclosed LLM.

free parameters (4)
  • Alpha (U-Net noise optimization stopping criterion) = 0.7 for I2P, SneakyPrompt, Ring-A-Bell; 0.6 for MMA
    Tuned on I2P and adjusted for MMA 'due to its higher explicitness' (Sec 4.4). This is a per-dataset choice that affects the balance between mitigation strength and semantic preservation, and leaks test-set information if not set on a validation fold.
  • Beta (DiT noise optimization stopping criterion) = 0.9 for I2P, SneakyPrompt, MMA; 0.7 for Ring-A-Bell
    Similarly tuned per dataset (Sec 4.4), controlling the degree of regional suppression in DiT models.
  • Guidance scale for detection (gamma_det) = 12.5
    Set to 'achieve stronger semantic injection' when extracting first-step noise for the detector (Sec 4.1). Chosen by hand; no sensitivity analysis is shown.
  • PCA dimensionality k = unknown
    The detection pipeline uses PCA (Eq 15a) but the number of principal components k is not specified. This is a hyperparameter of the trained classifier.
axioms (4)
  • ad hoc to paper Data distribution is Gaussian around a prototype: y ∼ N(x, σ²I)
    Assumed in Theorem 3.1 and in the Appendix proof to derive the quadratic semanticity result. Real image distributions are not Gaussian, so the theorem is a toy model.
  • domain assumption The diffusion model is well-trained and achieves the minimal denoising objective, so the optimal prediction equals the posterior mean E[y|y_t]
    Used in the derivation of Eq 9 and Eq 26. In practice, diffusion models are not perfect posterior learners, and the approximation error is not analyzed.
  • domain assumption Cross-attention maps at early denoising steps reflect semantic concentration and can be used to identify explicit-token risk regions
    This is the basis for the initial-noise optimization loss (Eq 19) and the DiT risk mask (Eq 22). The paper cites prior works (InitNo) but does not justify the specific claim that suppressing these attention regions reduces sexual content while preserving the rest of the image.
  • domain assumption The LLM can reliably map implicit sexual phrases to explicit negative descriptions
    The entire adaptive-negative-prompt mechanism (Eq 17) depends on the LLM's linguistic analysis. The LLM is not named, its prompt is not given, and the fallback behavior is described only qualitatively.

pith-pipeline@v1.3.0-alltime-deepseek · 25510 in / 11242 out tokens · 114057 ms · 2026-08-01T19:49:03.679594+00:00 · methodology

0 comments
read the original abstract

Despite the impressive generative capabilities of text-to-image diffusion models, they remain vulnerable to implicit sexual prompts, where subtle cues disguised as benign terms or adversarial tokens unexpectedly generate the inappropriate content due to model biases or latent correlations in training data. Existing safety mechanisms face fundamental limitations: detection methods primarily identify explicit content and fail to capture implicit malicious intent, while mitigation approaches rely on static negative prompts inadequate for diverse implicit scenarios. To address these challenges, we propose UniNDM, a unified noise-driven framework that rethinks safety mechanisms through the lens of noise dynamics in diffusion processes. Our key insight is that early-stage predicted noise exhibits inherent separability between normal and sexually explicit content, which we theoretically demonstrates quadratically increasing semantic concentration with timestep. Leveraging this property, we develop a lightweight noise-based detector achieving superior accuracy with virtually no computational overhead. For mitigation, we introduce noise-enhanced adaptive negative guidance: dynamically generating context-specific negative prompts via large language models to handle diverse implicit content, while optimizing initial noise by suppressing attention concentration on explicit tokens to provide comprehensive protection. Besides the U-Net-based diffusion models, we further extend our framework to emerging Diffusion Transformer architectures through region-constrained semantic guidance tailored for their unified multimodal attention. Comprehensive experiments across U-Net models and DiT models on both natural and adversarial datasets demonstrate substantial improvements over state-of-the-art methods, including SLD, UCE, Safree, etc. Our code is publicly available at https://github.com/Aries-iai/UniNDM.

Figures

Figures reproduced from arXiv: 2607.16828 by Huanran Chen, Hui Xue, Maoxun Yuan, Ranjie Duan, Ruochen Zhang, Shouwei Ruan, Xiaochun Cao, Xingxing Wei, Yao Huang, Yinpeng Dong, Yitong Sun.

Figure 1
Figure 1. Figure 1: Middle: Pornographic scenarios can be categorized into explicit and implicit cases, with the latter further subdivided into two distinct types: [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of UniNDM. Stage I: Noise-based Detection utilizes predicted noise separability to achieve classification. Stage II: When sexual prompts are detected, adaptive mitigation begins by optimizing the initial noise through suppressing significant foreground regions in the attention maps. For U-Net architectures, this is followed by adaptive negative guidance with LLM-generated negative prompts tailored… view at source ↗
Figure 3
Figure 3. Figure 3: Visualized separability of predicted noises at different timesteps for benign and sexual generations using t-SNE. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Generation outcomes for identical prompts under varying initial [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: The Nudity Removal Rate (NRR) across different exposed body parts on I2P. The top and bottom parts correspond to the results using [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: The Nudity Removal Rate (NRR) across different exposed body parts on I2P. The top and bottom parts correspond to the results using [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Visual comparisons of mitigation methods evaluated in this work across varied diffusion models, containing natural and adversarial prompts. [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Performance under varying input prompt lengths and [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗
Figure 10
Figure 10. Figure 10: Visual comparison of UniNDM mitigation across self-harm, [PITH_FULL_IMAGE:figures/full_fig_p013_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

56 extracted references · 15 linked inside Pith

  1. [1]

    Glide: Towards photorealistic image generation and editing with text-guided diffusion models,

    A. Nichol, P . Dhariwal, A. Ramesh, P . Shyam, P . Mishkin, B. Mc- Grew, I. Sutskever, and M. Chen, “Glide: Towards photorealistic image generation and editing with text-guided diffusion models,” arXiv preprint arXiv:2112.10741, 2021

    Pith/arXiv arXiv 2021

  2. [2]

    High-resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P . Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    2022

  3. [3]

    [Online]

    Midjourney, 2022. [Online]. Available: https://www.midjourney. com

    2022

  4. [4]

    Diffusion-based visual art creation: A survey and new perspectives,

    B. Wang, Q. Chen, and Z. Wang, “Diffusion-based visual art creation: A survey and new perspectives,”ACM Computing Surveys, 2024

    2024

  5. [5]

    Photorealistic text-to-image diffusion models with deep language understanding,

    C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. L. Denton, K. Ghasemipour, R. Gontijo Lopes, B. Karagol Ayan, T. Salimans et al., “Photorealistic text-to-image diffusion models with deep language understanding,”Advances in neural information processing systems, vol. 35, pp. 36 479–36 494, 2022

    2022

  6. [6]

    Roentgen: Vision-language foundation model for chest x-ray generation,

    P . Chambon, C. Bluethgen, C. P . Langlotz, and A. Chaudhari, “Roentgen: Vision-language foundation model for chest x-ray generation,”arXiv preprint arXiv:2211.12737, 2022

    Pith/arXiv arXiv 2022

  7. [7]

    Diffinfinite: Large mask-image synthesis via parallel random patch diffusion in histopathology,

    M. Aversa, G. Nobis, M. Hägele, K. Standvoss, M. Chirica, R. Murray-Smith, A. M. Alaa, L. Ruff, D. Ivanova, W. Samek et al., “Diffinfinite: Large mask-image synthesis via parallel random patch diffusion in histopathology,”Advances in Neural Information Processing Systems, vol. 36, pp. 78 126–78 141, 2023

    2023

  8. [8]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models,

    P . Schramowski, M. Brack, B. Deiseroth, and K. Kersting, “Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 22 522–22 531

    2023

  9. [9]

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,

    Y. Qu, X. Shen, X. He, M. Backes, S. Zannettou, and Y. Zhang, “Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,” inProceedings of the 2023 ACM SIGSAC conference on computer and communications security, 2023, pp. 3403–3417

    2023

  10. [10]

    Sneakyprompt: Jail- breaking text-to-image generative models,

    Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao, “Sneakyprompt: Jail- breaking text-to-image generative models,” in2024 IEEE symposium on security and privacy (SP). IEEE, 2024, pp. 897–912

    2024

  11. [11]

    Safe-clip: Removing nsfw concepts from vision-and- language models,

    S. Poppi, T. Poppi, F. Cocchi, M. Cornia, L. Baraldi, and R. Cuc- chiara, “Safe-clip: Removing nsfw concepts from vision-and- language models,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 340–356

    2024

  12. [12]

    Erasing concepts from diffusion models,

    R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau, “Erasing concepts from diffusion models,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 2426–2436

    2023

  13. [13]

    Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers,

    C.-P . Huang, K.-P . Chang, C.-T. Tsai, Y.-H. Lai, F.-E. Yang, and Y.-C. F. Wang, “Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 360–376. 15

    2024

  14. [14]

    Unified concept editing in diffusion models,

    R. Gandikota, H. Orgad, Y. Belinkov, J. Materzy ´ nska, and D. Bau, “Unified concept editing in diffusion models,” inProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2024, pp. 5111–5120

    2024

  15. [15]

    Latent guard: a safety framework for text-to-image generation,

    R. Liu, A. Khakzar, J. Gu, Q. Chen, P . Torr, and F. Pizzati, “Latent guard: a safety framework for text-to-image generation,” in European Conference on Computer Vision. Springer, 2024, pp. 93–109

    2024

  16. [16]

    Safety checker model card,

    Machine Vision & Learning Group LMU, “Safety checker model card,” https://huggingface.co/CompVis/ stable-diffusion-safety-checker, 2022, accessed 29/09/2022

    2022

  17. [17]

    SAFREE: Training-free and adaptive guard for safe text-to-image and video generation,

    J. Yoon, S. Yu, V . Patil, H. Yao, and M. Bansal, “SAFREE: Training-free and adaptive guard for safe text-to-image and video generation,” inThe Thirteenth International Conference on Learning Representations, 2025. [Online]. Available: https: //openreview.net/forum?id=hgTFotBRKl

    2025

  18. [18]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?

    Y.-L. Tsai, C.-Y. Hsu, C. Xie, C.-H. Lin, J.-Y. Chen, B. Li, P .-Y. Chen, C.-M. Yu, and C.-Y. Huang, “Ring-a-bell! how reliable are concept removal methods for diffusion models?” inICLR, 2024

    2024

  19. [19]

    Prompting4debugging: Red-teaming text-to-image diffusion mod- els by finding problematic prompts,

    Z.-y. Chin, C.-m. Jiang, C.-c. Huang, P .-Y. Chen, and W.-C. Chiu, “Prompting4debugging: Red-teaming text-to-image diffusion mod- els by finding problematic prompts,” inInternational Conference on Machine Learning, 2024

    2024

  20. [20]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now,

    Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu, “To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now,” in European Conference on Computer Vision. Springer, 2024, pp. 385– 403

    2024

  21. [21]

    Initno: Boost- ing text-to-image diffusion models via initial noise optimization,

    X. Guo, J. Liu, M. Cui, J. Li, H. Yang, and D. Huang, “Initno: Boost- ing text-to-image diffusion models via initial noise optimization,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 9380–9389

    2024

  22. [22]

    Not all noises are created equally: Diffusion noise selection and optimization,

    Z. Qi, L. Bai, H. Xiong, and Z. Xie, “Not all noises are created equally: Diffusion noise selection and optimization,”arXiv preprint arXiv:2407.14041, 2024

    Pith/arXiv arXiv 2024

  23. [23]

    Good seed makes a good crop: Discovering secret seeds in text-to-image diffusion models,

    K. Xu, L. Zhang, and J. Shi, “Good seed makes a good crop: Discovering secret seeds in text-to-image diffusion models,” in 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). IEEE, 2025, pp. 3024–3034

    2025

  24. [24]

    The crystal ball hypothesis in diffusion models: Anticipating object positions from initial noise,

    Y. Ban, R. Wang, T. Zhou, B. Gong, C.-J. Hsieh, and M. Cheng, “The crystal ball hypothesis in diffusion models: Anticipating object positions from initial noise,”arXiv preprint arXiv:2406.01970, 2024

    Pith/arXiv arXiv 2024

  25. [25]

    Scaling rectified flow transformers for high-resolution image synthesis,

    P . Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boeselet al., “Scaling rectified flow transformers for high-resolution image synthesis,” inForty-first international conference on machine learning, 2024

    2024

  26. [26]

    Ndm: A noise-driven detection and mitigation framework against implicit sexual intentions in text-to-image generation,

    Y. Sun, Y. Huang, R. Zhang, H. Chen, S. Ruan, R. Duan, and X. Wei, “Ndm: A noise-driven detection and mitigation framework against implicit sexual intentions in text-to-image generation,” inProceedings of the 33rd ACM International Conference on Multimedia, ser. MM ’25. New York, NY, USA: Association for Computing Machinery, 2025, p. 11462–11471. [Online]...

    arXiv 2025

  27. [27]

    Zero-shot text-to-image generation,

    A. Ramesh, M. Pavlov, G. Goh, S. Gray, C. Voss, A. Radford, M. Chen, and I. Sutskever, “Zero-shot text-to-image generation,” inInternational conference on machine learning. Pmlr, 2021, pp. 8821–8831

    2021

  28. [28]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P . Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inInternational conference on machine learning. PmLR, 2021, pp. 8748–8763

    2021

  29. [29]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis,

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach, “Sdxl: Improving latent diffusion models for high-resolution image synthesis,”arXiv preprint arXiv:2307.01952, 2023

    Pith/arXiv arXiv 2023

  30. [30]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P . J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”Journal of machine learning research, vol. 21, no. 140, pp. 1–67, 2020

    2020

  31. [31]

    Multitrust: A comprehensive benchmark towards trustworthy multimodal large language mod- els,

    Y. Zhang, Y. Huang, Y. Sun, C. Liu, Z. Zhao, Z. Fang, Y. Wang, H. Chen, X. Yang, X. Weiet al., “Multitrust: A comprehensive benchmark towards trustworthy multimodal large language mod- els,”Advances in Neural Information Processing Systems, vol. 37, pp. 49 279–49 383, 2024

    2024

  32. [32]

    Mmdt: Decoding the trust- worthiness and safety of multimodal foundation models,

    C. Xu, J. Zhang, Z. Chen, C. Xie, M. Kang, Y. Potter, Z. Wang, Z. Yuan, A. Xiong, Z. Xionget al., “Mmdt: Decoding the trust- worthiness and safety of multimodal foundation models,”arXiv preprint arXiv:2503.14827, 2025

    Pith/arXiv arXiv 2025

  33. [33]

    Perception-guided jailbreak against text-to-image models,

    Y. Huang, L. Liang, T. Li, X. Jia, R. Wang, W. Miao, G. Pu, and Y. Liu, “Perception-guided jailbreak against text-to-image models,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 25, 2025, pp. 26 238–26 247

    2025

  34. [34]

    Gradbias: Unveiling word influence on bias in text-to-image generative models,

    M. D’Inca, E. Peruzzo, M. Mancini, X. Xu, H. Shi, and N. Sebe, “Gradbias: Unveiling word influence on bias in text-to-image generative models,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  35. [35]

    T2i- compbench++: An enhanced and comprehensive benchmark for compositional text-to-image generation,

    K. Huang, C. Duan, K. Sun, E. Xie, Z. Li, and X. Liu, “T2i- compbench++: An enhanced and comprehensive benchmark for compositional text-to-image generation,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  36. [36]

    Unified prompt attack against text-to-image generation models,

    D. Peng, Q. Ke, M. H. Huang, P . Hu, and J. Liu, “Unified prompt attack against text-to-image generation models,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  37. [37]

    Breaking the ceiling: Exploring the potential of jailbreak attacks through expanding strategy space,

    Y. Huang, Y. Sun, S. Ruan, Y. Zhang, Y. Dong, and X. Wei, “Breaking the ceiling: Exploring the potential of jailbreak attacks through expanding strategy space,”arXiv preprint arXiv:2505.21277, 2025

    Pith/arXiv arXiv 2025

  38. [38]

    How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms,

    Y. Zeng, H. Lin, J. Zhang, D. Yang, R. Jia, and W. Shi, “How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, pp. 14 322–14 350

    2024

  39. [39]

    Mma- diffusion: Multimodal attack on diffusion models,

    Y. Yang, R. Gao, X. Wang, T.-Y. Ho, N. Xu, and Q. Xu, “Mma- diffusion: Multimodal attack on diffusion models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 7737–7746

    2024

  40. [40]

    Reliable and efficient concept erasure of text-to-image diffusion models,

    C. Gong, K. Chen, Z. Wei, J. Chen, and Y.-G. Jiang, “Reliable and efficient concept erasure of text-to-image diffusion models,” in European Conference on Computer Vision. Springer, 2024, pp. 73–88

    2024

  41. [41]

    Towards nsfw-free text-to-image generation via safety-constraint direct preference optimization,

    S. Ruan, Z. Wu, Y. Huang, R. Zhang, Y. Sun, C. Kang, and X. Wei, “Towards nsfw-free text-to-image generation via safety-constraint direct preference optimization,”arXiv preprint arXiv:2504.14290, 2025

    arXiv 2025

  42. [42]

    Safetydpo: Scalable safety alignment for text-to- image generation,

    R. Liu, C. I. Chieh, J. Gu, J. Zhang, R. Pi, Q. Chen, P . Torr, A. Khakzar, and F. Pizzati, “Safetydpo: Scalable safety alignment for text-to- image generation,”arXiv preprint arXiv:2412.10493, 2024

    Pith/arXiv arXiv 2024

  43. [43]

    Stair: Improving safety alignment with introspective reasoning,

    Y. Zhang, S. Zhang, Y. Huang, Z. Xia, Z. Fang, X. Yang, R. Duan, D. Yan, Y. Dong, and J. Zhu, “Stair: Improving safety alignment with introspective reasoning,”arXiv preprint arXiv:2502.02384, 2025

    Pith/arXiv arXiv 2025

  44. [44]

    Realsafe- r1: Safety-aligned deepseek-r1 without compromising reasoning capability,

    Y. Zhang, Z. Zeng, D. Li, Y. Huang, Z. Deng, and Y. Dong, “Realsafe- r1: Safety-aligned deepseek-r1 without compromising reasoning capability,”arXiv preprint arXiv:2504.10081, 2025

    Pith/arXiv arXiv 2025

  45. [45]

    Classifier-free diffusion guidance,

    J. Ho and T. Salimans, “Classifier-free diffusion guidance,”arXiv preprint arXiv:2207.12598, 2022

    Pith/arXiv arXiv 2022

  46. [46]

    Microsoft coco: Common objects in context,

    T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P . Perona, D. Ramanan, P . Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13. Springer, 2014, pp. 740–755

    2014

  47. [47]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research, vol. 9, no. 11, 2008

    2008

  48. [48]

    A threshold selection method from gray-level histograms,

    N. Otsuet al., “A threshold selection method from gray-level histograms,”Automatica, vol. 11, no. 285-296, pp. 23–27, 1975

    1975

  49. [49]

    Latent space disentanglement in diffusion transformers enables precise zero- shot semantic editing,

    Z. Shuai, C. Wu, Z. Tang, B. Song, and L. Shen, “Latent space disentanglement in diffusion transformers enables precise zero- shot semantic editing,”arXiv preprint arXiv:2411.08196, 2024

    Pith/arXiv arXiv 2024

  50. [50]

    Clipscore: A reference-free evaluation metric for image captioning,

    J. Hessel, A. Holtzman, M. Forbes, R. L. Bras, and Y. Choi, “Clipscore: A reference-free evaluation metric for image captioning,” arXiv preprint arXiv:2104.08718, 2021

    Pith/arXiv arXiv 2021

  51. [51]

    distilroberta-nsfw-prompt-stable- diffusion,

    AdamCodd, “distilroberta-nsfw-prompt-stable- diffusion,” https://huggingface.co/AdamCodd/ distilroberta-nsfw-prompt-stable-diffusion, 2024

    2024

  52. [52]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkatet al., “Gpt-4 technical report,”arXiv preprint arXiv:2303.08774, 2023

    Pith/arXiv arXiv 2023

  53. [53]

    Bertscore: Evaluating text generation with bert,

    T. Zhang, V . Kishore, F. Wu, K. Q. Weinberger, and Y. Artzi, “Bertscore: Evaluating text generation with bert,”arXiv preprint arXiv:1904.09675, 2019

    Pith/arXiv arXiv 1904

  54. [54]

    Nudenet: Neural nets for nudity classification, detec- tion and selective censoring,

    notAI tech, “Nudenet: Neural nets for nudity classification, detec- tion and selective censoring,” 2019

    2019

  55. [55]

    Nsfw image detection,

    Falconsai, “Nsfw image detection,” https://huggingface.co/ Falconsai/nsfw_image_detection, 2024

    2024

  56. [56]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochre- iter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,”Advances in neural information processing systems, vol. 30, 2017. 16 Yao Huangis a Master student at Institute of Artificial Intelligence, Beihang University (BUAA), where he received his BS degree in...

    2017