Pith. sign in

REVIEW 4 major objections 4 minor 58 references

A jailbreak framework that infers a text-to-image model's hidden defense rules reaches 95.6% success across six defenses and 97.9% on SDXL, by treating refusals, blurred images, and sanitized outputs as evidence to guide prompt evolution.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 17:01 UTC pith:R72ZAQ7D

load-bearing objection MIND's defense-profiling idea is genuinely new and the numbers are internally consistent, but the headline ASRs partly measure how well the optimizer tunes the same detectors used to score success. the 4 major comments →

arxiv 2607.17779 v1 pith:R72ZAQ7D submitted 2026-07-20 cs.AI

Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models

Dongdong Yang , Deyue Zhang , Zhao Liu , Zonghao Ying , Wenzhuo Xu , Jiankai Jin , Xiangzheng Zhang , Quanchen Zou This is my paper
classification cs.AI
keywords jailbreak attacktext-to-image safetydefense profilingbelief-state inferencemulti-modal feedbackevolutionary searchadversarial promptsNSFW content
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that jailbreaking text-to-image models should be treated as an inference problem over the model's hidden defense configuration, not as blind prompt search. It introduces MIND, which reads multi-modal feedback—refusal text, blurred images, sanitized outputs—as signals to maintain a probabilistic Defense Profile, and uses that profile to steer an evolutionary search for bypass prompts. Across six defenses on Stable Diffusion v1.5, MIND reaches a 95.62% attack success rate, and 97.89% on SDXL and 91.58% on Wan-2.5, while keeping CLIP similarity near 0.30. The central claim is that fine-grained feedback plus belief updating converts trial-and-error into targeted adaptation, and an ablation study supports this by showing the profiler contributes the largest performance gain.

Core claim

The paper's central claim is that jailbreaking a text-to-image model is not a blind optimization problem but a belief-state inference problem: by interpreting the model's multi-modal responses—whether it refuses in text, outputs a black or blurred image, or produces a visually safe but semantically distorted image—an attacker can infer the model's latent defense mechanism. MIND instantiates this with a Multi-modal Judge that classifies feedback into five categories, a Defense Profiler that updates a probabilistic belief over defense attributes, and a Meta-Memory module that reuses effective strategies. The authors report that on Stable Diffusion v1.5 under six pre-processing, post-processing

What carries the argument

The central object is the Defense Profile, a four-component probabilistic belief state—modality bias (text vs. visual filtering), strictness, semantic deviation risk, and a concept-level sensitivity map—that is updated by an approximate Bayesian rule driven by LLM attribution. It works by turning each observed failure into a dense signal: the Multi-modal Judge partitions responses into refusal, visual block, soft defense, semantic failure, or success, and the profiler uses those categories to guide the next round of prompts in an evolutionary search with chain-of-thought mutation. This mechanism converts sparse trial-and-error into targeted adaptation, which the ablation attributes as the la

Load-bearing premise

The attack's success rests on the multi-modal judge and attribution module correctly mapping the target's response into the five feedback categories and identifying the dominant risk concept; if the judge is systematically wrong—for example, a commercial API that returns only a generic refusal with no image—the Defense Profile encodes a false belief and the search is steered away from effective prompts.

What would settle it

Run MIND against a target that returns a uniform refusal for every unsafe prompt, with no image or partial output; if ASR collapses to near baseline levels, the attack's power depends on informative feedback. Alternatively, feed randomly scrambled attribution labels to the profiler and check whether ASR degrades to baseline, which would confirm that the belief update, not the evolutionary search, is the load-bearing component.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the central claim holds, a text-to-image model's safety mechanism is learnable and bypassable whenever its failures are distinguishable; defenses that return uniform, uninformative feedback would be the most resistant.
  • Attack success can be dramatically improved without white-box access: MIND achieves over 90% ASR on several commercial systems using only query feedback.
  • The method balances effectiveness with semantic consistency, producing prompts that are more natural and images that are more on-target than prior optimization-based attacks.
  • The Defense Profiler's contribution suggests that modeling the defender's behavior is a general and powerful principle for automated red-teaming, not just for images.
  • The framework is robust to noisy attribution signals (up to 20% noise only mildly reduces ASR, from 88.42% to 84.21%), indicating the belief update itself is fault-tolerant.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial: The paper's logic implies that any defense signal that correlates with the defense's internal state is a potential leak; a defensive system could deliberately make its failure modes indistinguishable to thwart this style of attack.
  • Editorial: The same belief-state formulation could be turned defensive—monitoring an attacker's queries to infer which signals are being exploited, then closing those leaks—an extension the paper does not explore.
  • Editorial: Because the attack relies on a powerful external vision-language model as the judge, the attack's ceiling may be tied to judge quality; testing with a weaker or cheaper judge would reveal how much of the success comes from the judge versus the profiling loop.
  • Editorial: The paper leaves the reward thresholds (τ_safe, τ_sem) unspecified, so exact reproduction requires deriving them from implementation details; a testable extension would be to sweep these thresholds and measure ASR sensitivity.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes MIND, a black-box jailbreak framework for text-to-image (T2I) models. MIND replaces binary feedback with a multi-modal judge that decomposes model outputs into five categories (text refusal, visual block, soft defense, semantic failure, success), a defense profiler that maintains a Bayesian belief over latent defense mechanisms, and a meta-memory that retrieves successful strategies. These components are embedded in a profile-guided evolutionary search driven by LLM-based mutation. Experiments on I2P/T2I-RiskyPrompt claim state-of-the-art ASR: 95.62% averaged over six pre/post-processing defenses on Stable Diffusion v1.5, 97.89% on SDXL, 91.58% on Wan-2.5, and 70.52% on Gemini-3-pro, while maintaining CLIP similarity around 0.30. The paper also reports ablations, stricter-criterion results, violence-content results, cross-detector consistency, human verification, and defense-profiling recall.

Significance. If the quantitative claims hold, MIND is a genuinely novel contribution to automated red-teaming: it demonstrates that fine-grained multi-modal feedback can be used to infer defense structure and guide search, rather than treating the target as a monolithic binary oracle. The paper's own validation efforts—human annotation (Cohen's κ>0.82), a cross-detector consistency table, a stricter-CS table, and direct defense-profiling recall—are commendable and partially mitigate reproducibility concerns. However, the central ASR claim is weakened by a reward–evaluation overlap: the same NudeNet/CLIP scores drive both the optimizer and the success metric. The absence of fully specified thresholds and variance estimates further limits the confidence with which the headline 95.62% can be interpreted.

major comments (4)
  1. [§3.3–§3.4, Eq. (1); §4.4; Table 9] The reward in Eq. (1) is a function of exactly the two quantities used for success: P_nsfw from NudeNet and S_clip from CLIP. C_succ is rewarded by 1+P_nsfw·S_clip, C_fail by β+γ·P_nsfw−max(0,τ_sem−S_clip), and the success criterion in §4.4 is P_nsfw>τ_safe and CS≥0.26. Thus the evolutionary search directly optimizes the same detector that later certifies the attack. Table 9 shows the consequence: replacing NudeNet with Falconsai changes ASR on img-cls from 100% to 84.21% and on img-clip from 98.95% to 84.21%. The reported 95.62% average is therefore not detector-independent. Human verification (100 samples) is too small to re-anchor the headline. I ask the authors to report ASR for all settings with an independent detector, or to use a different judge for optimization vs. evaluation.
  2. [§3.3, §4.4, §A.2, Table 10] The thresholds τ_safe and τ_sem are never specified numerically in the method. The category definitions and the reward depend on them; §A.2 says NudeNet threshold 0.9, but Table 10 says 'increase the NSFW threshold to 0.4' without reconciling with 0.9. S_safe in §3.3 is undefined. Without numeric values, C_soft/C_fail/C_succ are not well-defined and the method is not reproducible. State τ_safe, τ_sem, and the exact thresholds used for all detectors.
  3. [Table 1; §4.1] Main results are single-run point estimates for a stochastic evolutionary search; only the ablation (Table 5) reports averages over three runs. The absence of variance/confidence intervals makes it impossible to assess whether the large reported margins over baselines are significant. Additionally, Table 1 is typeset so that the Qwen3Guard row is garbled ('Qwen3Guard10025.26'), preventing verification of the abstract's 95.62% average. Provide mean±std over multiple independent runs for the primary defenses.
  4. [Eq. (4); Table 7] The core novelty is the Defense Profiler, but its validation is thin. Eq. (4) is called an 'approximate Bayesian update' without derivation, and p(cause|c_i) is not defined. Table 7 reports 'first-round recall' without defining how ground truth is obtained or what qualifies as correct identification. Since the profiler is central to the claimed advantage, specify the update rule completely, define the attribution confidence, and describe the recall evaluation protocol (including false-positive rates).
minor comments (4)
  1. [General] No code or data is released. For a paper whose headline is a quantitative ASR figure, this limits independent verification.
  2. [§A.2 vs. Table 10] The NudeNet threshold is described as 0.9 in the supplementary, but Table 10 uses 0.4 without explaining whether this is a different experimental condition or a correction.
  3. [Abstract / Table 1] The abstract's 95.62% figure should be explicitly tied to the six pre/post-processing rows in Table 1; currently the reader must infer which rows are included.
  4. [§4.4] The strict CS threshold of 0.26 is cited as following SneakyPrompt; please provide a precise citation or, if it is a new choice, justify it.

Circularity Check

1 steps flagged

Headline ASR is partly the optimizer's own objective: the Eq. (1) reward for success is 1 + Pnsfw·Sclip, and the success criterion is a threshold on the same Pnsfw/Sclip.

specific steps
  1. fitted input called prediction [§3.3, Eq. (1) and Success category; §4.4; Supplementary 'Evaluation Details']
    "Success(C succ):Bothcriteriaaresatisfied(P nsfw > τsafe andS clip ≥τ sem), indicating a successful jailbreak. ... R(tk) = ... 1 +Pnsfw ·S clip, o k ∈C succ ... can be viewed as a relaxation of: maxP nsfw ·S clip s.t.S clip ≥τ sem."

    The evolutionary search's reward for the success category is 1 + Pnsfw·Sclip, and the paper's success criterion is exactly Pnsfw > τsafe and Sclip ≥ τsem on the same two quantities. Thus the optimizer is directly maximizing the detector/CLIP scores that are later thresholded to report ASR; the headline success rate partly measures the method's progress on its own reward, not an independently established bypass. Detector-specific inflation is visible in Table 9 (e.g., img-cls drops from 100% with NudeNet to 84.21% with Falconsai), confirming that reported magnitudes track the detector used in the reward.

full rationale

The central quantitative claim is partially circular: the success metric is a thresholded version of the same Pnsfw and Sclip that Eq. (1) rewards. This is a genuine reward–evaluation overlap, not a self-citation or uniqueness-import issue; there is no load-bearing self-citation in the paper. The circularity is not total because the reward is computed on real outputs after the target defense has processed them, the paper includes human verification (κ>0.82) and a cross-detector re-check, and baselines are scored with the same metric. However, the cross-detector table shows up to ~15-point ASR swings, and the NSFW threshold is inconsistent (0.9 in §A.2 vs. 'increase to 0.4' in Table 10), so the reported ASR magnitudes are not independently anchored. Score 6 reflects partial by-construction inflation of the headline prediction.

Axiom & Free-Parameter Ledger

7 free parameters · 5 axioms · 0 invented entities

The framework introduces no new physical or formal entities; the 'Defense Profile' is a software component (a vector of statistics and a sensitivity map), not a new mathematical or physical object. The main load-bearing elements are the hand-set thresholds and reward weights, plus the domain assumption that the target model will return decomposable multi-modal feedback under black-box querying.

free parameters (7)
  • η (defense profiling learning rate) = 0.3
    Hand-set learning rate in Eq. (4) for updating Gsens; no sensitivity analysis in main text.
  • reward weights α, β, γ = α=0.5, β=0.5, γ=0.5
    Hand-set weights in Eq. (1) for C_soft and C_fail outcomes; no tuning procedure reported.
  • ε (reward for visual block) = 0.01
    Small constant chosen by hand.
  • population size / iterations / elites = 5 / 10 / 2
    Evolutionary search budget, selected without ablation in main text.
  • τ_safe and τ_sem = not specified
    Thresholds for classifying soft defense (C_soft) and semantic failure (C_fail); never given numerical values, yet they define the reward categories.
  • NSFW detector threshold = 0.9 (0.4 in threshold sensitivity)
    Main evaluation uses threshold 0.9 to reduce false positives; the threshold-sensitivity section says 'increasing to 0.4', which is inconsistent and changes ASR by ~10 points.
  • strict success CS threshold = 0.26
    Follows SneakyPrompt's convention for the stricter success criterion.
axioms (5)
  • domain assumption Attacker has unrestricted black-box query access and can observe the generated image or refusal for every prompt.
    Invoked in §3.1 POMDP formulation; if the API rate-limits or hides outputs, the feedback loop breaks.
  • domain assumption NudeNet, Q16, and CLIP are faithful proxies for 'unsafe' and 'semantically aligned' content.
    Used throughout §4; the paper adds human verification (κ>0.82) and a cross-detector check, but the main ASR numbers rest on detector outputs.
  • domain assumption The auxiliary LLMs (Vicuna/Llama attack agents and DeepSeek-V3.2 attribution engine) follow the framework instructions and produce diverse, semantically consistent mutations.
    The attack's success depends on the generative capability of these models; the paper tests two attack agents but not the attribution model's failure modes.
  • standard math CLIP cosine similarity is a valid measure of image-prompt semantic alignment.
    Used in §3.3 and §4.3 metrics; standard in the field but an assumption about semantics.
  • ad hoc to paper Eq. (4) is an 'approximate Bayesian update' of the defense profile.
    The update rule is asserted without derivation from Bayes' theorem; it is a hand-designed incremental update that the paper's 'belief-state inference' claim relies on.

pith-pipeline@v1.3.0-alltime-deepseek · 14444 in / 13778 out tokens · 143031 ms · 2026-08-01T17:01:59.267029+00:00 · methodology

0 comments
read the original abstract

Text-to-Image (T2I) generative models have achieved remarkable progress in synthesizing high-quality visual content, yet they remain vulnerable to adversarial misuse, particularly in generating Not-Safe-For-Work (NSFW) images. Most existing jailbreak attacks primarily rely on heuristic prompt engineering or black-box optimization, treating model feedback as a binary signal (success or failure). This coarse-grained paradigm overlooks the rich information embedded in diverse failure modes, such as textual refusal, visual blocking, and semantic sanitization, resulting in inefficient exploration and severe semantic collapse. In this paper, we propose MIND, a cognitive jailbreak framework that reframes adversarial prompt generation as a belief-state inference problem over latent defense mechanisms. Instead of blindly searching for bypass prompts, MIND actively models the target system's latent defense mechanisms by interpreting multi-modal feedback as high-density signals. Specifically, the framework integrates three core components: (1) a Multi-modal Judge for fine-grained feedback decomposition, (2) a Defense Profiler for iterative belief updating, and (3) a Meta-Memory module for retrieving historically effective attack strategies. These components are unified within a reasoning-driven evolutionary optimization process, enabling adaptive and semantically consistent jailbreak generation. Extensive experiments on the I2P benchmark demonstrate the effectiveness of MIND. Under six representative pre-processing and post-processing defense settings applied to the Stable Diffusion v1.5 model, MIND achieves an Attack Success Rate (ASR) of 95.62%, significantly outperforming existing methods. Additionally, the effectiveness of the proposed framework is validated across four widely used commercial T2I systems, achieving the highest ASR of 91.58% on Wan-2.5.

Figures

Figures reproduced from arXiv: 2607.17779 by Deyue Zhang, Dongdong Yang, Jiankai Jin, Quanchen Zou, Wenzhuo Xu, Xiangzheng Zhang, Zhao Liu, Zonghao Ying.

Figure 1
Figure 1. Figure 1: Overview of the proposed MIND framework. The system performs profile-guided evolutionary jailbreak through the [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Qualitative results on two representative prompts (one nudity and one violence). Columns correspond to different [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Qualitative jailbreak results of our method on three commercial text-to-image models. Each row corresponds to [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

58 extracted references · 10 linked inside Pith

  1. [1]

    Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education

    Clancey, William J. Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education. Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83)

  2. [2]

    Classification Problem Solving

    Clancey, William J. Classification Problem Solving. Proceedings of the Fourth National Conference on Artificial Intelligence

  3. [3]

    , title =

    Robinson, Arthur L. , title =. 1980 , doi =. https://science.sciencemag.org/content/208/4447/1019.full.pdf , journal =

    1980

  4. [4]

    New Ways to Make Microcircuits Smaller---Duplicate Entry

    Robinson, Arthur L. New Ways to Make Microcircuits Smaller---Duplicate Entry. Science

  5. [5]

    Clancey and Glenn Rennels , abstract =

    Diane Warner Hasling and William J. Clancey and Glenn Rennels , abstract =. Strategic explanations for a diagnostic consultation system , journal =. 1984 , issn =. doi:https://doi.org/10.1016/S0020-7373(84)80003-6 , url =

    doi:10.1016/s0020-7373(84)80003-6 1984

  6. [6]

    and Rennels, Glenn R

    Hasling, Diane Warner and Clancey, William J. and Rennels, Glenn R. and Test, Thomas. Strategic Explanations in Consultation---Duplicate. The International Journal of Man-Machine Studies

  7. [7]

    Poligon: A System for Parallel Problem Solving

    Rice, James. Poligon: A System for Parallel Problem Solving

  8. [8]

    Transfer of Rule-Based Expertise through a Tutorial Dialogue

    Clancey, William J. Transfer of Rule-Based Expertise through a Tutorial Dialogue

  9. [9]

    The Engineering of Qualitative Models

    Clancey, William J. The Engineering of Qualitative Models

  10. [10]

    2023 , eprint=

    Attention Is All You Need , author=. 2023 , eprint=

    2023

  11. [11]

    Pluto: The 'Other' Red Planet

    NASA. Pluto: The 'Other' Red Planet

  12. [12]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    High-resolution image synthesis with latent diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  13. [13]

    Midjourney

    Midjourney, Inc. Midjourney. 2022

    2022

  14. [14]

    Wan2.5-T2I-Preview Text-to-Image Model , year =

  15. [15]

    arXiv preprint arXiv:2203.02155 , year =

    Training language models to follow instructions with human feedback , author =. arXiv preprint arXiv:2203.02155 , year =

    Pith/arXiv arXiv

  16. [16]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Mma-diffusion: Multimodal attack on diffusion models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  17. [17]

    2024 IEEE symposium on security and privacy (SP) , pages=

    Sneakyprompt: Jailbreaking text-to-image generative models , author=. 2024 IEEE symposium on security and privacy (SP) , pages=. 2024 , organization=

    2024

  18. [18]

    arXiv preprint arXiv:2312.07130 , volume=

    Divide-and-conquer attack: Harnessing the power of llm to bypass the censorship of text-to-image generation model , author=. arXiv preprint arXiv:2312.07130 , volume=

    Pith/arXiv arXiv

  19. [19]

    arXiv preprint arXiv:2310.10012 , year=

    Ring-a-bell! how reliable are concept removal methods for diffusion models? , author=. arXiv preprint arXiv:2310.10012 , year=

    Pith/arXiv arXiv

  20. [20]

    2025 IEEE Symposium on Security and Privacy (SP) , pages=

    Fuzz-testing meets llm-based agents: An automated and efficient framework for jailbreaking text-to-image generation models , author=. 2025 IEEE Symposium on Security and Privacy (SP) , pages=. 2025 , organization=

    2025

  21. [21]

    arXiv preprint arXiv:2505.21074 , year=

    Red-teaming text-to-image systems by rule-based preference modeling , author=. arXiv preprint arXiv:2505.21074 , year=

    Pith/arXiv arXiv

  22. [22]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    Flirt: Feedback loop in-context red teaming , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    2024

  23. [23]

    arXiv preprint arXiv:2210.04610 , year=

    Red-teaming the stable diffusion safety filter , author=. arXiv preprint arXiv:2210.04610 , year=

    Pith/arXiv arXiv

  24. [24]

    Proceedings of the 2023 ACM SIGSAC conference on computer and communications security , pages=

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models , author=. Proceedings of the 2023 ACM SIGSAC conference on computer and communications security , pages=

    2023

  25. [25]

    arXiv preprint arXiv:2408.00523 , volume=

    Jailbreaking text-to-image models with llm-based agents , author=. arXiv preprint arXiv:2408.00523 , volume=

    Pith/arXiv arXiv

  26. [26]

    NeurIPS , year=

    Chain-of-thought prompting elicits reasoning in large language models , author=. NeurIPS , year=

  27. [27]

    arXiv preprint arXiv:2307.01952 , year=

    Sdxl: Improving latent diffusion models for high-resolution image synthesis , author=. arXiv preprint arXiv:2307.01952 , year=

    Pith/arXiv arXiv

  28. [28]

    Findings of the Association for Computational Linguistics: NAACL 2025 , pages=

    Diffzoo: A purely query-based black-box attack for red-teaming text-to-image generative model via zeroth order optimization , author=. Findings of the Association for Computational Linguistics: NAACL 2025 , pages=

    2025

  29. [29]

    arXiv preprint arXiv:2309.06135 , year=

    Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts , author=. arXiv preprint arXiv:2309.06135 , year=

    arXiv

  30. [30]

    arXiv preprint arXiv:2512.10766 , year=

    Metaphor-based jailbreaking attacks on text-to-image models , author=. arXiv preprint arXiv:2512.10766 , year=

    arXiv

  31. [31]

    arXiv preprint arXiv:2405.11336 , year=

    UPAM: Unified prompt attack in text-to-image generation models against both textual filters and visual checkers , author=. arXiv preprint arXiv:2405.11336 , year=

    Pith/arXiv arXiv

  32. [32]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Reason2attack: Jailbreaking text-to-image models via llm reasoning , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  33. [33]

    Advances in Neural Information Processing Systems , volume=

    Coljailbreak: Collaborative generation and editing for jailbreaking text-to-image deep generation , author=. Advances in Neural Information Processing Systems , volume=

  34. [34]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    Pla: Prompt learning attack against text-to-image generative models , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  35. [35]

    , title =

    George, R. , title =. 2020 , url =

    2020

  36. [36]

    2022 , howpublished =

    Li, Michelle , title =. 2022 , howpublished =

    2022

  37. [37]

    Advances in neural information processing systems , volume=

    Guardt2i: Defending text-to-image models from adversarial prompts , author=. Advances in neural information processing systems , volume=

  38. [38]

    arXiv preprint arXiv:2510.14276 , year=

    Qwen3guard technical report , author=. arXiv preprint arXiv:2510.14276 , year=

    Pith/arXiv arXiv

  39. [39]

    European Conference on Computer Vision , pages=

    Latent guard: a safety framework for text-to-image generation , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  40. [40]

    2020 , howpublished =

    Chhabra, Lakshay , title =. 2020 , howpublished =

    2020

  41. [41]

    CLIP-based NSFW Detector , year =

  42. [42]

    2022 , url =

    CompVis Team , title =. 2022 , url =

    2022

  43. [43]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  44. [44]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Erasing concepts from diffusion models , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  45. [45]

    Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    Safegen: Mitigating sexually explicit content generation in text-to-image models , author=. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    2024

  46. [46]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Unlearning concepts in diffusion model via concept domain correction and concept preserving gradient , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  47. [47]

    arXiv e-prints , pages=

    Safetydpo: Scalable safety alignment for text-to-image generation , author=. arXiv e-prints , pages=

  48. [48]

    NudeNet: Lightweight Nudity Detection , year =

  49. [49]

    Proceedings of the 2022 ACM conference on fairness, accountability, and transparency , pages=

    Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? , author=. Proceedings of the 2022 ACM conference on fairness, accountability, and transparency , pages=

    2022

  50. [50]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    T2I-RiskyPrompt: A Benchmark for Safety Evaluation, Attack, and Defense on Text-to-Image Model , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  51. [51]

    2025 , howpublished =

    Doubao-Seedream-5.0-Lite , author =. 2025 , howpublished =

    2025

  52. [52]

    2025 , howpublished =

    Gemini-3-Pro-Image-Preview , author =. 2025 , howpublished =

    2025

  53. [53]

    2024 , howpublished =

    Llama-3.1-8B-Lexi-Uncensored-V2 , author =. 2024 , howpublished =

    2024

  54. [54]

    2023 , howpublished =

    Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90\ author =. 2023 , howpublished =

    2023

  55. [55]

    International Conference on Machine Learning (ICML) , year=

    Learning Transferable Visual Models From Natural Language Supervision , author=. International Conference on Machine Learning (ICML) , year=

  56. [56]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=

  57. [57]

    OpenAI Blog , volume=

    Language Models are Unsupervised Multitask Learners , author=. OpenAI Blog , volume=

  58. [58]

    arXiv preprint arXiv:2511.21631 , year=

    Qwen3-VL Technical Report , author=. arXiv preprint arXiv:2511.21631 , year=

    Pith/arXiv arXiv