{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2022:IEGNBUD7G6PVOBI5AG4H3ACV7V","short_pith_number":"pith:IEGNBUD7","schema_version":"1.0","canonical_sha256":"410cd0d07f379f57051d01b87d8055fd4420925ba9755b3d3537506e6ea107c7","source":{"kind":"arxiv","id":"2210.04610","version":5},"attestation_state":"computed","paper":{"title":"Red-Teaming the Stable Diffusion Safety Filter","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR","cs.CV","cs.CY","cs.LG"],"primary_cat":"cs.AI","authors_text":"Daniel Paleka, David Lindner, Florian Tram\\`er, Javier Rando, Lennart Heim","submitted_at":"2022-10-03T14:04:46Z","abstract_excerpt":"Stable Diffusion is a recent open-source image generation model comparable to proprietary models such as DALLE, Imagen, or Parti. Stable Diffusion comes with a safety filter that aims to prevent generating explicit images. Unfortunately, the filter is obfuscated and poorly documented. This makes it hard for users to prevent misuse in their applications, and to understand the filter's limitations and improve it. We first show that it is easy to generate disturbing content that bypasses the safety filter. We then reverse-engineer the filter and find that while it aims to prevent sexual content, "},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2210.04610","kind":"arxiv","version":5},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2022-10-03T14:04:46Z","cross_cats_sorted":["cs.CR","cs.CV","cs.CY","cs.LG"],"title_canon_sha256":"aecda0f957904c7648aeeb3547fb1bd0c333876b3731061bcd049fbabbd72864","abstract_canon_sha256":"8efd1b284b3d7ba8edebf7fda2785efe364c6d199da72d0e15516147eac77861"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:15:00.254776Z","signature_b64":"vMNcRCjd+ZPlrFdpy9pjwSEYkGFCZZnLMUzMUIM6AFnir47qsDClOK5jjRzzRe9KoQmkcsQb/jeQ2eK8b4uPBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"410cd0d07f379f57051d01b87d8055fd4420925ba9755b3d3537506e6ea107c7","last_reissued_at":"2026-07-05T05:15:00.254391Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:15:00.254391Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Red-Teaming the Stable Diffusion Safety Filter","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR","cs.CV","cs.CY","cs.LG"],"primary_cat":"cs.AI","authors_text":"Daniel Paleka, David Lindner, Florian Tram\\`er, Javier Rando, Lennart Heim","submitted_at":"2022-10-03T14:04:46Z","abstract_excerpt":"Stable Diffusion is a recent open-source image generation model comparable to proprietary models such as DALLE, Imagen, or Parti. Stable Diffusion comes with a safety filter that aims to prevent generating explicit images. Unfortunately, the filter is obfuscated and poorly documented. This makes it hard for users to prevent misuse in their applications, and to understand the filter's limitations and improve it. We first show that it is easy to generate disturbing content that bypasses the safety filter. We then reverse-engineer the filter and find that while it aims to prevent sexual content, "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2210.04610","kind":"arxiv","version":5},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2210.04610/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2210.04610","created_at":"2026-07-05T05:15:00.254448+00:00"},{"alias_kind":"arxiv_version","alias_value":"2210.04610v5","created_at":"2026-07-05T05:15:00.254448+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2210.04610","created_at":"2026-07-05T05:15:00.254448+00:00"},{"alias_kind":"pith_short_12","alias_value":"IEGNBUD7G6PV","created_at":"2026-07-05T05:15:00.254448+00:00"},{"alias_kind":"pith_short_16","alias_value":"IEGNBUD7G6PVOBI5","created_at":"2026-07-05T05:15:00.254448+00:00"},{"alias_kind":"pith_short_8","alias_value":"IEGNBUD7","created_at":"2026-07-05T05:15:00.254448+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":24,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2606.25548","citing_title":"Concept Removal for Frontier Image Generative Models","ref_index":100,"is_internal_anchor":false},{"citing_arxiv_id":"2606.24192","citing_title":"Co-occurring associated retained concepts in Diffusion Unlearning","ref_index":12,"is_internal_anchor":false},{"citing_arxiv_id":"2606.27147","citing_title":"Safe Autoregressive Image Generation with Iterative Self-Improving Codebooks","ref_index":16,"is_internal_anchor":false},{"citing_arxiv_id":"2606.17257","citing_title":"Pulling The REINS: Training-Free Safety Alignment of Video Diffusion Models via Representation Steering","ref_index":17,"is_internal_anchor":false},{"citing_arxiv_id":"2606.06875","citing_title":"Unified Safe In-context Image Generation in Multimodal Diffusion Transformers via Restricting Unsafe Information Flows","ref_index":11,"is_internal_anchor":false},{"citing_arxiv_id":"2606.06140","citing_title":"RedEdit: Agentic Red-Teaming of Image Safety Classifiers via MCTS-Guided Photo-Editing","ref_index":38,"is_internal_anchor":false},{"citing_arxiv_id":"2606.06356","citing_title":"Where Should Knowledge Enter? A Layered Framework for Knowledge Infusion in Multimodal Iterative Generative Model","ref_index":24,"is_internal_anchor":false},{"citing_arxiv_id":"2606.01837","citing_title":"Benign Inputs, Harmful Outputs: Cross-Modal Jailbreaking via Distributed Semantic Recomposition","ref_index":19,"is_internal_anchor":false},{"citing_arxiv_id":"2606.02453","citing_title":"Initialization is Half the Battle: Generating Diverse Images from a Guidance Potential Posterior","ref_index":30,"is_internal_anchor":false},{"citing_arxiv_id":"2605.19739","citing_title":"FlowErase-RL: Rethinking Concept Erasure as Reward Optimization in Flow Matching Models","ref_index":33,"is_internal_anchor":false},{"citing_arxiv_id":"2605.26332","citing_title":"Erased but Exploitable: Black-box Embedding-Aware Prompting Against Unlearned Text-to-Image Diffusion Models","ref_index":35,"is_internal_anchor":false},{"citing_arxiv_id":"2605.29390","citing_title":"Orthogonal Negative Guidance in Attention Feature Space for Text-to-Image Generation","ref_index":44,"is_internal_anchor":false},{"citing_arxiv_id":"2606.00140","citing_title":"Geometric Erasure by Contrastive Velocity Matching in Rectified Flows","ref_index":35,"is_internal_anchor":false},{"citing_arxiv_id":"2406.14194","citing_title":"VLBiasBench: A Comprehensive Benchmark for Evaluating Bias in Large Vision-Language Model","ref_index":55,"is_internal_anchor":false},{"citing_arxiv_id":"2605.18719","citing_title":"SafeDiffusion-R1: Online Reward Steering for Safe Diffusion Post-Training","ref_index":20,"is_internal_anchor":false},{"citing_arxiv_id":"2605.19739","citing_title":"FlowErase-RL: Rethinking Concept Erasure as Reward Optimization in Flow Matching Models","ref_index":32,"is_internal_anchor":false},{"citing_arxiv_id":"2310.12508","citing_title":"SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation","ref_index":137,"is_internal_anchor":false},{"citing_arxiv_id":"2604.25119","citing_title":"Evaluation without Generation: Non-Generative Assessment of Harmful Model Specialization with Applications to CSAM","ref_index":43,"is_internal_anchor":false},{"citing_arxiv_id":"2605.01113","citing_title":"Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation","ref_index":13,"is_internal_anchor":false},{"citing_arxiv_id":"2604.10032","citing_title":"Closed-Form Concept Erasure via Double Projections","ref_index":51,"is_internal_anchor":false},{"citing_arxiv_id":"2604.09253","citing_title":"Mosaic: Multimodal Jailbreak against Closed-Source VLMs via Multi-View Ensemble Optimization","ref_index":30,"is_internal_anchor":false},{"citing_arxiv_id":"2604.09213","citing_title":"SHIFT: Steering Hidden Intermediates in Flow Transformers","ref_index":26,"is_internal_anchor":false},{"citing_arxiv_id":"2604.04575","citing_title":"Erasure or Erosion? Evaluating Compositional Degradation in Unlearned Text-To-Image Diffusion Models","ref_index":24,"is_internal_anchor":false},{"citing_arxiv_id":"2604.06285","citing_title":"Harnessing Hyperbolic Geometry for Harmful Prompt Detection and Sanitization","ref_index":13,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V","json":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V.json","graph_json":"https://pith.science/api/pith-number/IEGNBUD7G6PVOBI5AG4H3ACV7V/graph.json","events_json":"https://pith.science/api/pith-number/IEGNBUD7G6PVOBI5AG4H3ACV7V/events.json","paper":"https://pith.science/paper/IEGNBUD7"},"agent_actions":{"view_html":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V","download_json":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V.json","view_paper":"https://pith.science/paper/IEGNBUD7","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2210.04610&json=true","fetch_graph":"https://pith.science/api/pith-number/IEGNBUD7G6PVOBI5AG4H3ACV7V/graph.json","fetch_events":"https://pith.science/api/pith-number/IEGNBUD7G6PVOBI5AG4H3ACV7V/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V/action/timestamp_anchor","attest_storage":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V/action/storage_attestation","attest_author":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V/action/author_attestation","sign_citation":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V/action/citation_signature","submit_replication":"https://pith.science/pith/IEGNBUD7G6PVOBI5AG4H3ACV7V/action/replication_record"}},"created_at":"2026-07-05T05:15:00.254448+00:00","updated_at":"2026-07-05T05:15:00.254448+00:00"}