Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems

Handing Wang; Wanguang Li; Zhaoxin Wang

REVIEW 3 major objections 5 minor 70 references

Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that prompt-level safety filters in T2I systems can be bypassed without target queries by exploiting the representational gap between the filter and the generator, and demonstrates a framework (FGD-Jail) that raises attack

desk verdict Worth a serious referee: the FGD framing is genuinely new and the evaluation is unusually careful, but the tokenization gate as written doesn't connect to the stated surrogate, and the single-seed design leaves the effect sizes provisional. read the letter →

arxiv 2608.00973 v1 pith:AM62HMUZ submitted 2026-08-02 cs.CL

Wanguang Li , Zhaoxin Wang , Handing Wang This is my paper

classification cs.CL

keywords text-to-imagesafetyjailbreakattackzero-queryfilter-generatordiscrepancysurrogateensembleevolutionarysearchprompt-levelfilterNSFWcontent

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the safety filter and the image generator in a text-to-image pipeline read the same prompt in mismatched ways, and that this mismatch—the Filter-Generator Discrepancy (FGD)—can be turned into a reusable zero-query jailbreak. The authors propose FGD-Jail, which screens prompt perturbations with two observable consequences of the gap (how the filter's tokenizer handles Unicode variants, and how an LLM filter's negation-aware reasoning contrasts with the generator encoder's bag-of-words behavior) and then evolves candidates with an evolutionary search that consults only public surrogate filters. On six black-box pipelines built from two filter types and three generators, FGD-Jail raises average attack success to 29.2% (MHSC) and 33.3% (Q16), about 8 and 12 percentage points above the strongest baseline, and it also leads on an undisclosed commercial service. A careful reader should care because, if the transfer holds, the standard filter-first architecture is vulnerable without any query to the deployed system.

What carries the argument

The central object is the Filter-Generator Discrepancy (FGD), formalized as $Q(\delta; x, c) = g(\delta) P(x, x_\delta)$, a gate-and-preservation score. Tokenization-level instantiation: $g_{tok}=1$ when the filter's WordPiece tokenizer maps a perturbed word to an [UNK] sequence while CLIP's byte-level BPE retains recoverable subword evidence, and preservation is $P_{tok} = r(w, \tilde{w}) \cdot \cos(E(w), E(\tilde{w}))$. Semantic-level instantiation: $g_{sem} = \mathbf{1}[R_{LLM}(x_\delta) < R_{LLM}(x)]$, with $P_{sem} = \cos(E(x), E(x_\delta)) - \beta R_{LLM}(x_\delta)$, exploiting CLIP's insensitivity to negation. The evolutionary search combines the worst-case dual-surrogate risk $R = \m

What would settle it

Run FGD-Jail against a prompt-level filter built on a byte-level BPE tokenizer that never emits [UNK], paired with the same generator; if the attack's ASR edge over baselines does not collapse, the tokenization gate is not the operative mechanism. Separately, replace the LLM filter with one explicitly trained to be negation-robust; if semantic-level screening stops contributing, the negation-asymmetry claim would be falsified.

Watch

Extended reading notes

Core claim

FGD-Jail is built on a single observation: in safety-gated T2I pipelines, the prompt filter and the generator read the same prompt under different objectives and representations, so a perturbation can make a prompt unrecognizable to the filter while leaving the visual concept intact for the generator. The paper formalizes this as Filter-Generator Discrepancy (FGD) with the scoring $Q(\delta; x, c) = g(\delta) P(x, x_\delta)$, where $g$ is a gate that requires filter-side risk reduction and $P$ is a preservation factor that retains generator-side semantics. It instantiates the gate twice: tokenization-level (WordPiece filters map Unicode variants to [UNK] while CLIP's byte-level BPE preserves

Load-bearing premise

The load-bearing premise is that the unseen target filter behaves enough like the public surrogate filters—same tokenizer family and same reliance on negation-sensitive intent reasoning—that the offline screening rules generalize to it without any target queries.

Editorial extensions

If this is right

FGD-Jail's screened search means an attacker needs zero queries to the target, so monitoring-based defenses that detect repeated probing are bypassed by construction.
The ablations show the two screening rules and the dual-surrogate risk are complementary: removing either lowers ASR, and single-surrogate variants overfit to one filter family.
A high bypass rate does not imply jailbreak success; candidates that lose generator-side concept retention pass the filter but produce no unsafe image, so evaluations should report both filter bypass and image-level ASR.
If FGD is real, defenses that treat prompt filtering and generation as independent components are structurally exposed; the paper's conclusion suggests aligning filter and generator representations or coordinating protection across the full pipeline.
The attack transfers to a commercial service with undisclosed moderation, indicating that the discrepancy mechanism is not an artifact of the specific open-source filter choices.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the same representation-level mismatch could generalize to other conditional generators (text-to-video, text-to-3D, or VLM-based pipelines) that pair a classifier-style filter with a frozen text encoder; the paper does not test these.
Editorial inference: a target filter that uses a byte-level BPE tokenizer with no [UNK] would remove the tokenization gate's advantage; a natural extension is to build the gate from the actual tokenizer family or add a euphemism-only tier.
Editorial inference: the absolute ASR numbers come from a fixed 150-prompt benchmark; a more portable claim is the relative gain of discrepancy screening over unscreened evolutionary search, which could be probed on other benchmarks and updated filters.
Editorial inference: FGD suggests a defensive metric—measure the divergence between a proposed filter's decisions and the generator text encoder's similarity on Unicode and negation perturbations, and require filters to reduce that divergence.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a real paper with a genuinely new organizing idea. The Filter-Generator Discrepancy is a useful way to think about transferable prompt attacks, and the authors make it operational with screening rules plus a dual-surrogate evolutionary search.

What it does well: the evaluation is more careful than most attack papers. It tests six black-box pipelines and a commercial service, reports both bypass rate and ASR, and runs ablations that show the screening rules matter. It also discloses that MMA-Diffusion and SneakyPrompt effectively get white-box/query access on two pipelines, which is honest and makes the comparison conservative. Appendix B's controlled test of [UNK]-triggering homoglyphs is the right kind of mechanistic validation to want.

The problem: that validation doesn't fit the stated surrogate. The paper says the tokenization gate relies on the filter tokenizer emitting [UNK], and that the classifier surrogate is Bert-NSFW, which is a DistilRoBERTa model with byte-level BPE and no [UNK] fallback. Appendix B validates the gate using a BERT WordPiece tokenizer, not the surrogate's. If the authors used the target tokenizer to build Q_tok, that leaks target information and breaks the zero-query premise. If they used the surrogate, g_tok is always zero and Eq. (4) can't be computed. Either way, the central tokenization mechanism is not connected to the surrogate signal the paper claims. The ablation says removing Q_tok costs a few points of ASR, so this is load-bearing, not decorative.

Minor issues: single fixed seed, no error bars or significance tests; the GPT-image-2 sample is small; beta in Eq. (5) is unspecified; code and the curated repositories are withheld. None of these sink the semantic-level FGD or the dual-surrogate ensemble, which look plausible and are supported by the ShieldGemma pattern.

Verdict: the idea deserves a real referee and a revision. Ask for a tokenization mechanism that works with a true zero-query surrogate, plus multi-seed runs with error bars. The paper is likely fixable, but the numbers as reported should not be cited as established.

Referee Report

3 major / 5 minor

Summary. The paper proposes FGD-Jail, a zero-query jailbreak framework for safety-gated text-to-image (T2I) systems. It formalizes a Filter-Generator Discrepancy (FGD) between prompt-level safety filters and downstream generators, instantiates it as tokenization-level and semantic-level screening rules for candidate perturbations, and then applies a surrogate-ensemble evolutionary search that uses a worst-case dual-surrogate risk and CLIP-based preservation scoring. Experiments are reported on six local black-box pipelines (two prompt filters × three generators) and on the commercial GPT-image-2 service, with ASR measured by two image safety detectors. The main empirical claim is consistent improvement over four baselines, e.g., 29.2% vs. 21.8% MHSC ASR-4 and 33.3% vs. 21.8% Q16 ASR-4 on average, with additional gains on the online service.

Significance. If the empirical claims hold, the paper would make a useful contribution by turning the filter/generator representation gap into actionable screening criteria and by showing that a zero-query transfer attack can outperform query-based or white-box baselines. The paper has clear strengths: a clean conceptual framework (Eqs. 2–5), a two-stage screening design that is ablated separately, a commercial online evaluation with an undisclosed pipeline, detailed appendices describing the repositories and evolutionary operators, and a fixed-seed reproducibility statement. The main risks are the correctness of the tokenization-level gate with the stated surrogate, the lack of any variance estimates for the headline numbers, and the closeness between surrogate families and target filter families, which weakens the transferability claim.

major comments (3)

[Eq. (4), Appendix A, Appendix B] The tokenization-level gate g_tok is central to the paper's mechanism, but as written it cannot be computed with the stated surrogate. The method text says g_tok=1 when the filter tokenizer maps a variant to [UNK], and Appendix A says token-level candidates are screened with 'the surrogate filter's tokenizer (an [UNK] check)'. The only classifier surrogate, Bert-NSFW (michelleli99/NSFW_text_classifier), is a fine-tuned DistilRoBERTa model, which uses byte-level BPE and never emits [UNK] for arbitrary Unicode; every byte sequence has a byte-level fallback. Thus g_tok would be 0 for all candidates. Appendix B's validation (63.3% vs. 6.4% evasion) is performed with 'the BERT tokenizer', i.e., a WordPiece tokenizer that is neither the surrogate's nor, as far as the paper states, the target's. This is a load-bearing mismatch: the token-level screening repository, the Q_tok score, and the abla
[Tables 1, 3, 4; Appendix D 'Reproducibility'] All reported results come from a single fixed random seed (seed=42), with no confidence intervals, bootstrap intervals, or significance tests. The main differences between methods are often 8–12 percentage points on 150 prompts; with n=150, the standard error of a proportion near 30% is about 3.7 pp, so a 95% CI is roughly ±7 pp. The ablation differences are much smaller — e.g., Table 3 shows MHSC ASR-4 of 29.22% (full) vs. 25.67% (w/o both), and Table 4 shows Q16 ASR-4 of 33.34% vs. 32.23% for R_LLM-only — and these are well within noise at the stated sample size. The fixed-seed statement is not a substitute for repeated-seed or bootstrap uncertainty quantification. Without this, the strength of the empirical claims, especially the ablations and the ensemble comparison, cannot be assessed.
[Experiments: target/surrogate families; Eq. (6); SC metric] The transferability claim is only weakly tested because the target filters are deliberately drawn from the same two families as the surrogates: DistilBert-NSFW vs. the DistilRoBERTa-based Bert-NSFW, and ShieldGemma vs. Qwen-Guard. This is not circular in a logical sense, but it means the reported six-pipeline averages may overstate transfer to filters outside these families. The commercial GPT-image-2 evaluation is a better out-of-family test and should be expanded (with sample size and repeated runs). In addition, CLIP is used both as the generator-side surrogate during search and as the semantic-consistency scoring metric during evaluation, so SC is not independent of the optimization objective. ASR is judged by MHSC/Q16, so it is not directly inflated, but the paper should report SC with a different embedding model to confirm that the preservation claim is not an artifact of optimizin

minor comments (5)

[Appendix F] The running text refers to 'Table 6' and 'Table 7' for the ablation results, but the corresponding appendix tables are numbered 10 and 11. Fix the cross-references.
[Table 2] The GPT-image-2 benchmark does not state the number of prompts used. The text says 'sampled online benchmark' but no N is given, so the reported BR/ASR values cannot be interpreted with uncertainty in mind.
[Appendix E] The access-level alignment is described in prose, but Table 1 does not mark the two pipelines where SneakyPrompt and MMA-Diffusion use Stable Diffusion v1.5 as a white-box/query-based generator. A footnote or symbol on those columns would help readers discount those comparisons appropriately.
[Method, Eq. (2)] The formal notation C(x), c, and recognizability A_M(x,c) is introduced but not used in the subsequent instantiations. Either connect these objects to g and P explicitly or simplify the formalization to avoid an unused layer of notation.
[Appendix H] The responsible-release statement says code will be released 'upon publication.' For a reproducibility-focused claim, an anonymized artifact or a detailed configuration listing (exact tokenizer versions, model revisions, seed usage) would strengthen the manuscript now.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack pipeline is a self-contained empirical construction; the central results are measured on held-out target pipelines and external detectors, not derived from the method's own fitted outputs.

full rationale

The paper's derivation chain is an attack-construction pipeline, not a predictive model fitted to the target. Equations (3)-(7) define screening and fitness scores using only public surrogates (CLIP, Bert-NSFW, Qwen-Guard) and fixed hyperparameters chosen on a held-out pilot set. The reported ASR/BR are measured on held-out target filters and generators (DistilBert-NSFW, ShieldGemma, SD variants, GPT-image-2) with external image-safety detectors (MHSC, Q16), so the success metric is not the optimization objective. The only self-citation (Liu et al. 2026) is a related-work pointer and is not load-bearing. The Appendix B tokenization validation is internally inconsistent—the UNK group is defined via a BERT WordPiece tokenizer while the named classifier surrogate (michelleli99/NSFW_text_classifier) is a DistilRoBERTa byte-level BPE model that does not emit [UNK]—but this is a reproducibility/technical limitation, not circularity: Eq. (4) is an assumed gate, not an output re-derived from the target. The paper's central claim remains an empirical transfer result with independent external evaluation, so no step reduces to its own input by construction.

Assumptions & free parameters 6 free parameters · 5 assumptions · 1 invented entities

The framework's central premise is that surrogate-observed tokenizer and semantic asymmetries transfer to unknown target filters. It introduces one conceptual entity, FGD, with no independent falsifiable handle outside this paper. Hyperparameters are pilot-tuned, and one parameter (beta) is unspecified, which weakens the formal completeness of the quality score.

free parameters (6)

tau (risk threshold) = 0.2
Chosen by comparing tau in {0.1, 0.2} in a pilot study on a held-out prompt subset; directly controls when the fitness drops the risk penalty.
lambda (risk-penalty weight) = 1.0
Set with tau in the fitness function Eq. (7); not justified independently.
Preservation penalty weights (lambda_cov, lambda_vis, lambda_len, lambda_coh) = 0.5, 0.6, 0.1, 0.15
Chosen by pilot study to keep preservation weights dominant; affects the trade-off between evasion and generation intent.
CLIP-similarity stop threshold tau_sim = 0.85
Used as a termination condition in the evolutionary search; no sensitivity analysis.
Validity thresholds (Lmax, cmin, vmin) = 40 words, 0.8, 0.8
Hard constraints on candidate prompts; Lmax was chosen by comparing 40 vs 77 in a pilot study.
beta in P_sem
Eq. (5) defines P_sem = cos(E(x), E(x_delta)) - beta * R_LLM(x_delta), but no value for beta is reported anywhere in the paper, making the semantic screening score incompletely specified.

assumptions (5)

domain assumption WordPiece-style tokenizers map Unicode-lookalike variants to [UNK] and lose lexical identity, while CLIP byte-level BPE retains recoverable subwords.
Used to define g_tok in Eq. (4) and validated in Appendix B, but the validation uses a BERT tokenizer while the stated classifier surrogate is a DistilRoBERTa model, which uses byte-level BPE rather than WordPiece.
domain assumption LLM safety filters perform sentence-level negation and intent reasoning, while CLIP is a bag-of-words encoder largely insensitive to negation.
Used to justify g_sem in Eq. (5); imported from cited work (Yuksekgonul et al. 2023; Alhamoud et al. 2025) and from surrogate validation with Qwen3Guard in Appendix B.
domain assumption The dual-surrogate risk R = max(R_CLS, R_LLM) computed from public surrogates approximates the unknown target filter's decision.
Central to Eq. (6) and the fitness function; the target filters in Table 1 are deliberately from the same two families as the surrogates, which is favorable for this assumption.
domain assumption MHSC and Q16 image detectors correctly label generated images as unsafe for measuring attack success.
All ASR numbers depend on these detectors; no human annotation, detector calibration, or threshold reporting is provided.
domain assumption Fixing 'important blocks' during crossover preserves generator-side concept retention.
Used in Algorithm 1 and Appendix D; the paper provides no isolated validation of this operator, only aggregate ASR and SC results.

invented entities (1)

Filter-Generator Discrepancy (FGD)
purpose: Postulated representational misalignment between prompt-level safety filters and downstream generators, used to screen perturbations and guide the attack search.
FGD is not directly measured; it is inferred from tokenizer behavior, CLIP bag-of-words properties, and surrogate filter responses, and its utility is demonstrated only through this paper's attack experiments.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems." pith.science (2026). https://pith.science/paper/AM62HMUZ

@misc{pith2026260800973,
  author       = {Pith},
  title        = {Pith review of: Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AM62HMUZ}},
  note         = {Machine review of arXiv:2608.00973}
}

read the original abstract

Text-to-image (T2I) systems typically have prompt-level safety filters before the generator to block unsafe requests, yet such systems remain vulnerable to malicious jailbreak prompts. Transfer-based attacks construct adversarial prompts offline without querying the target, but they tend to overfit to a single surrogate. Moreover, they explore a large search space in which semantic or perceptual similarity alone cannot guarantee both filter evasion and preservation of the unsafe generation intent, wasting effort on low-potential candidates. We observe that the filter and the generator process the same prompt under different objectives and representations, and term this gap the Filter-Generator Discrepancy (FGD), which allows a perturbation to reduce a prompt's perceived risk to the filter while preserving the visual concept needed by the generator. Building on FGD, we propose a zero-query jailbreak framework that screens perturbations into a high-potential candidate set via observable discrepancy rules at the tokenization and semantic stages, and then performs a surrogate-ensemble evolutionary search that requires no access to the target. Experiments on six black-box pipelines and a commercial online service show that our method consistently outperforms representative baselines, raising the average attack success rate to 29.2\% (MHSC) and 33.3\% (Q16) across the six pipelines and improving over the strongest baseline by about 8 and 12 percentage points, respectively.

Figures

Figures reproduced from arXiv: 2608.00973 by the authors.

**Figure 2.** Overview of FGD-Jail. For a source prompt [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 4.** Per-pipeline results of the surrogate-ensemble ab [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

Figures from the paper (4 more)

**Figure 3.** Figure 3: Per-pipeline results of the FGD screening ablation [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]

**Figure 5.** Figure 5: Qualitative attack examples (1/3). Highlighted tokens in the adversarial prompt mark the differences from the source [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]

**Figure 6.** Figure 6: Qualitative attack examples (2/3). Highlighted tokens in the adversarial prompt mark the differences from the source [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

**Figure 7.** Figure 7: Qualitative attack examples (3/3). Highlighted tokens in the adversarial prompt mark the differences from the source [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

70 extracted references · 32 canonical work pages

[1]

H.; Kim, Y.; and Ghassemi, M

Alhamoud, K.; Alshammari, S.; Tian, Y.; Li, G.; Torr, P. H.; Kim, Y.; and Ghassemi, M. 2025. Vision-language models do not understand negation. In Proceedings of the Computer Vision and Pattern Recognition Conference, 29612--29622

2025
[2]

M.; Huang, C.-C.; Chen, P.-Y.; and Chiu, W.-C

Chin, Z.-Y.; Jiang, C. M.; Huang, C.-C.; Chen, P.-Y.; and Chiu, W.-C. 2024. Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts. In Forty-first International Conference on Machine Learning

work page 2024
[5]

Devlin, J.; Chang, M.-W.; Lee, K.; and Toutanova, K. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), 4171--4186

2019
[6]

Esser, P.; Kulal, S.; Blattmann, A.; Entezari, R.; M \"u ller, J.; Saini, H.; Levi, Y.; Lorenz, D.; Sauer, A.; Boesel, F.; et al. 2024. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning

2024
[7]

Gandikota, R.; Materzynska, J.; Fiotto-Kaufman, J.; and Bau, D. 2023. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, 2426--2436

work page 2023
[9]

Huang, Y.; Liang, L.; Li, T.; Jia, X.; Wang, R.; Miao, W.; Pu, G.; and Liu, Y. 2025. Perception-guided jailbreak against text-to-image models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 26238--26247

work page 2025
[11]

Kumari, N.; Zhang, B.; Wang, S.-Y.; Shechtman, E.; Zhang, R.; and Zhu, J.-Y. 2023. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, 22691--22702

work page 2023
[12]

Li, M. 2022. Fine-tuned DistilRoBERTa-base for NSFW Classification. https://huggingface.co/michelleli99/NSFW_text_classifier. Model card. Accessed: 2026-3-1

work page 2022

Show all 70 references

[13]

Liu, J.; Wang, Z.; Wang, H.; Tian, C.; and Jin, Y. 2026. Token-level constraint boundary search for jailbreaking text-to-image models. IEEE Transactions on Evolutionary Computation

2026
[14]

Mehrabi, N.; Goyal, P.; Dupuy, C.; Hu, Q.; Ghosh, S.; Zemel, R.; Chang, K.-W.; Galstyan, A.; and Gupta, R. 2024. Flirt: Feedback loop in-context red teaming. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 703--718

2024
[15]

OpenAI . 2026. GPT-image-2. https://platform.openai.com/docs/models/gpt-image-2. OpenAI Developer Documentation. Accessed: 2026-05-01

2026
[16]

Qu, Y.; Shen, X.; He, X.; Backes, M.; Zannettou, S.; and Zhang, Y. 2023. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, 3403--3417

2023
[17]

W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al

Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning, 8748--8763. PmLR

2021
[19]

Rando, J.; Paleka, D.; Lindner, D.; Heim, L.; and Tramer, F. 2022. Red-Teaming the Stable Diffusion Safety Filter. In NeurIPS ML Safety Workshop

2022
[20]

Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684--10695

2022
[21]

Sauer, A.; Lorenz, D.; Blattmann, A.; and Rombach, R. 2024. Adversarial diffusion distillation. In European Conference on Computer Vision, 87--103. Springer

2024
[22]

Schramowski, P.; Brack, M.; Deiseroth, B.; and Kersting, K. 2023. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 22522--22531

2023
[23]

Schramowski, P.; Tauchmann, C.; and Kersting, K. 2022. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the 2022 ACM conference on fairness, accountability, and transparency, 1350--1361

2022
[24]

Schuhmann, C.; Beaumont, R.; Vencu, R.; Gordon, C.; Wightman, R.; Cherti, M.; Coombes, T.; Katta, A.; Mullis, C.; Wortsman, M.; et al. 2022. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in neural information processing systems,...

2022
[25]

Y.; Li, B.; Chen, P.-Y.; Yu, C.-M.; and Huang, C.-Y

Tsai, Y.-L.; Hsu, C.-Y.; Xie, C.; Lin, C.-H.; Chen, J. Y.; Li, B.; Chen, P.-Y.; Yu, C.-M.; and Huang, C.-Y. 2024. Ring-a-bell! how reliable are concept removal methods for diffusion models? In International Conference on Learning Representations, volume 2024, 41543--41554

2024
[27]

Yan, S.; Wei, H.; Fei, J.; Yang, G.; Zhao, Z.; and Wang, Z. 2025. Universally Unfiltered and Unseen: Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguards. In Proceedings of the 33rd ACM International Conference on Multimedia, 11279--11287

2025
[28]

Yang, Y.; Gao, R.; Wang, X.; Ho, T.-Y.; Xu, N.; and Xu, Q. 2024 a . Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 7737--7746

2024
[29]

Yang, Y.; Hui, B.; Yuan, H.; Gong, N.; and Cao, Y. 2024 b . Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE symposium on security and privacy (SP), 897--912. IEEE

2024
[30]

Yuksekgonul, M.; Bianchi, F.; Kalluri, P.; Jurafsky, D.; and Zou, J. 2023. When and Why Vision-Language Models Behave like Bags-Of-Words, and What to Do About It? In The Eleventh International Conference on Learning Representations

2023
[32]

Zhang, Y.; Jia, J.; Chen, X.; Chen, A.; Zhang, Y.; Liu, J.; Ding, K.; and Liu, S. 2024. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision, 385--403. Springer

2024
[34]

Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education

Clancey, William J. Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education. Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83)
[35]

Classification Problem Solving

Clancey, William J. Classification Problem Solving. Proceedings of the Fourth National Conference on Artificial Intelligence
[36]

, title =

Robinson, Arthur L. , title =. 1980 , doi =. https://science.sciencemag.org/content/208/4447/1019.full.pdf , journal =

1980
[37]

New Ways to Make Microcircuits Smaller---Duplicate Entry

Robinson, Arthur L. New Ways to Make Microcircuits Smaller---Duplicate Entry. Science
[38]

Clancey and Glenn Rennels , abstract =

Diane Warner Hasling and William J. Clancey and Glenn Rennels , abstract =. Strategic explanations for a diagnostic consultation system , journal =. 1984 , issn =. doi:https://doi.org/10.1016/S0020-7373(84)80003-6 , url =

1984 doi
[39]

and Rennels, Glenn R

Hasling, Diane Warner and Clancey, William J. and Rennels, Glenn R. and Test, Thomas. Strategic Explanations in Consultation---Duplicate. The International Journal of Man-Machine Studies
[40]

Poligon: A System for Parallel Problem Solving

Rice, James. Poligon: A System for Parallel Problem Solving
[41]

Transfer of Rule-Based Expertise through a Tutorial Dialogue

Clancey, William J. Transfer of Rule-Based Expertise through a Tutorial Dialogue
[42]

The Engineering of Qualitative Models

Clancey, William J. The Engineering of Qualitative Models
[43]

2023 , eprint=

Attention Is All You Need , author=. 2023 , eprint=

2023
[44]

Pluto: The 'Other' Red Planet

NASA. Pluto: The 'Other' Red Planet
[45]

arXiv preprint arXiv:2508.02324 , year=

Qwen-image technical report , author=. arXiv preprint arXiv:2508.02324 , year=

arXiv
[46]

arXiv preprint arXiv:2504.11346 , year =

Gao, Yu and Gong, Lixue and Guo, Qiushan and Hou, Xiaoxia and Lai, Zhichao and Li, Fanshi and Li, Liang and Lian, Xiaochen and Liao, Chao and Liu, Liyang and Liu, Wei and Shi, Yichun and Sun, Shiqi and Tian, Yu and Tian, Zhi and Wang, Peng and Wang, Rui and Wang, Xuanda and Wa...

arXiv
[47]

Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

High-resolution image synthesis with latent diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=
[48]

arXiv preprint arXiv:2204.06125 , volume=

Hierarchical text-conditional image generation with clip latents , author=. arXiv preprint arXiv:2204.06125 , volume=

arXiv
[49]

Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=
[50]

Proceedings of the 2023 ACM SIGSAC conference on computer and communications security , pages=

Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models , author=. Proceedings of the 2023 ACM SIGSAC conference on computer and communications security , pages=

2023
[51]

NeurIPS ML Safety Workshop , year=

Red-Teaming the Stable Diffusion Safety Filter , author=. NeurIPS ML Safety Workshop , year=
[52]

arXiv preprint arXiv:2412.00064 , year=

Diffguard: Text-based safety checker for diffusion models , author=. arXiv preprint arXiv:2412.00064 , year=

arXiv
[53]

2024 IEEE symposium on security and privacy (SP) , pages=

Sneakyprompt: Jailbreaking text-to-image generative models , author=. 2024 IEEE symposium on security and privacy (SP) , pages=. 2024 , organization=

2024
[54]

Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

Mma-diffusion: Multimodal attack on diffusion models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=
[55]

International Conference on Learning Representations , volume=

Ring-a-bell! how reliable are concept removal methods for diffusion models? , author=. International Conference on Learning Representations , volume=
[56]

for now , author=

To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now , author=. European Conference on Computer Vision , pages=. 2024 , organization=

2024
[57]

Forty-first International Conference on Machine Learning , year=

Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts , author=. Forty-first International Conference on Machine Learning , year=
[58]

IEEE Transactions on Evolutionary Computation , year=

Token-level constraint boundary search for jailbreaking text-to-image models , author=. IEEE Transactions on Evolutionary Computation , year=
[59]

arXiv preprint arXiv:2312.07130 , volume=

Divide-and-conquer attack: Harnessing the power of llm to bypass the censorship of text-to-image generation model , author=. arXiv preprint arXiv:2312.07130 , volume=

arXiv
[60]

Proceedings of the 33rd ACM International Conference on Multimedia , pages=

Universally Unfiltered and Unseen: Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguards , author=. Proceedings of the 33rd ACM International Conference on Multimedia , pages=
[61]

Proceedings of the AAAI Conference on Artificial Intelligence , volume=

Perception-guided jailbreak against text-to-image models , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=
[62]

arXiv preprint arXiv:2510.14276 , year=

Qwen3Guard Technical Report , author=. arXiv preprint arXiv:2510.14276 , year=

arXiv
[63]

Proceedings of the IEEE/CVF international conference on computer vision , pages=

Erasing concepts from diffusion models , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=
[64]

Proceedings of the IEEE/CVF international conference on computer vision , pages=

Ablating concepts in text-to-image diffusion models , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=
[65]

Proceedings of the 2022 ACM conference on fairness, accountability, and transparency , pages=

Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? , author=. Proceedings of the 2022 ACM conference on fairness, accountability, and transparency , pages=

2022
[66]

arXiv preprint arXiv:2206.00169 , year=

Discovering the hidden vocabulary of dalle-2 , author=. arXiv preprint arXiv:2206.00169 , year=

arXiv
[67]

Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

Flirt: Feedback loop in-context red teaming , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

2024
[68]

arXiv preprint arXiv:1609.08144 , year=

Google's neural machine translation system: Bridging the gap between human and machine translation , author=. arXiv preprint arXiv:1609.08144 , year=

arXiv
[69]

Bert: Pre-training of deep bidirectional transformers for language understanding , author=. Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers) , pages=

2019
[70]

International conference on machine learning , pages=

Learning transferable visual models from natural language supervision , author=. International conference on machine learning , pages=. 2021 , organization=

2021
[71]

The Eleventh International Conference on Learning Representations , year=

When and Why Vision-Language Models Behave like Bags-Of-Words, and What to Do About It? , author=. The Eleventh International Conference on Learning Representations , year=
[72]

Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

Vision-language models do not understand negation , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=
[73]

Advances in neural information processing systems , volume=

Laion-5b: An open large-scale dataset for training next generation image-text models , author=. Advances in neural information processing systems , volume=
[74]

arXiv preprint arXiv:2407.21772 , year=

Shieldgemma: Generative ai content moderation based on gemma , author=. arXiv preprint arXiv:2407.21772 , year=

arXiv
[75]

GPT-image-2 , year =
[76]

Forty-first international conference on machine learning , year=

Scaling rectified flow transformers for high-resolution image synthesis , author=. Forty-first international conference on machine learning , year=
[77]

European Conference on Computer Vision , pages=

Adversarial diffusion distillation , author=. European Conference on Computer Vision , pages=. 2024 , organization=

2024
[78]

2022 , publisher =

Michelle Li , title =. 2022 , publisher =

2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

H.; Kim, Y.; and Ghassemi, M

Alhamoud, K.; Alshammari, S.; Tian, Y.; Li, G.; Torr, P. H.; Kim, Y.; and Ghassemi, M. 2025. Vision-language models do not understand negation. In Proceedings of the Computer Vision and Pattern Recognition Conference, 29612--29622

2025

[2] [2]

M.; Huang, C.-C.; Chen, P.-Y.; and Chiu, W.-C

Chin, Z.-Y.; Jiang, C. M.; Huang, C.-C.; Chen, P.-Y.; and Chiu, W.-C. 2024. Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts. In Forty-first International Conference on Machine Learning

work page 2024

[3] [5]

Devlin, J.; Chang, M.-W.; Lee, K.; and Toutanova, K. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), 4171--4186

2019

[4] [6]

Esser, P.; Kulal, S.; Blattmann, A.; Entezari, R.; M \"u ller, J.; Saini, H.; Levi, Y.; Lorenz, D.; Sauer, A.; Boesel, F.; et al. 2024. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning

2024

[5] [7]

Gandikota, R.; Materzynska, J.; Fiotto-Kaufman, J.; and Bau, D. 2023. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, 2426--2436

work page 2023

[6] [9]

Huang, Y.; Liang, L.; Li, T.; Jia, X.; Wang, R.; Miao, W.; Pu, G.; and Liu, Y. 2025. Perception-guided jailbreak against text-to-image models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 26238--26247

work page 2025

[7] [11]

Kumari, N.; Zhang, B.; Wang, S.-Y.; Shechtman, E.; Zhang, R.; and Zhu, J.-Y. 2023. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, 22691--22702

work page 2023

[8] [12]

Li, M. 2022. Fine-tuned DistilRoBERTa-base for NSFW Classification. https://huggingface.co/michelleli99/NSFW_text_classifier. Model card. Accessed: 2026-3-1

work page 2022