Source-linked AI summary
Conditioned Activation Transport for T2I Safety Steering
Maciej Chrabąszcz, Aleksander Szymczyk, Jan Dubiński, Tomasz Trzciński, Franziska Boenisch, Adam Dziedzic
TL;DR
T2I models remain vulnerable to unsafe generation, while standard activation steering can degrade benign image quality. The paper introduces SafeSteerDataset and CAT, combining geometry-aware conditioning with nonlinear transport maps; CAT generalizes across Z-Image and Infinity while reducing toxic output and limiting performance degradation. Inference-time steering does not remove unsafe capability and may be bypassed under distribution shift or adaptive prompting.
Problem
T2I models generate unsafe content across architectures, and standard activation steering can compromise benign image quality while existing resources lack semantically aligned safe-unsafe pairs.
Method
The paper constructs SafeSteerDataset and proposes CAT, which uses a nonlinear MLP transport map with layer-wise conditioning that activates only near unsafe manifolds.
Results
CAT generalizes across Z-Image and Infinity, minimizing toxic output without the performance degradation observed in linearly steered baselines.
Takeaways & Limitations
CAT improves safety while reducing the utility degradation associated with unconditioned or purely linear steering baselines.
Takeaways & Limitations
Inference-time steering does not remove unsafe capability and may be bypassed under distribution shift or adaptive prompting.
Abstract
from arXiv · showhide
Despite their impressive capabilities, current Text-to-Image (T2I) models remain prone to generating unsafe and toxic content. While activation steering offers a promising inference-time intervention, we observe that linear activation steering frequently degrades image quality when applied to benign prompts. To address this trade-off, we first construct SafeSteerDataset, a contrastive dataset containing 2300 safe and unsafe prompt pairs with high cosine similarity. Leveraging this data, we propose Conditioned Activation Transport (CAT), a framework that employs a geometry-based conditioning mechanism and nonlinear transport maps. By conditioning transport maps to activate only within unsafe activation regions, we minimize interference with benign queries. We validate our approach on two state-of-the-art architectures: Z-Image and Infinity. Experiments demonstrate that CAT generalizes effectively across these backbones, significantly reducing Attack Success Rate while maintaining image fidelity compared to unsteered generations. Warning: This paper contains potentially offensive text and images.
1. Introduction
T2I models remain vulnerable to unsafe generation across architectures, while existing internal interventions can be architecture-specific or degrade benign image quality. The paper addresses this with SafeSteerDataset and CAT, which conditionally transports activations within unsafe regions and generalizes across Z-Image and Infinity.
- T2I models generate unsafe content across diffusion and autoregressive architectures, even without explicit jailbreaking prompts.
- Existing internal safety interventions are often architecture-specific or computationally prohibitive, while standard activation steering can compromise benign image quality.
- SafeSteerDataset contains 2300 contrastive safe-unsafe prompt pairs organized into 23 subcategories for high-precision manifold discrimination.
- CAT uses a regularized MLP transport map that activates conditionally within unsafe regions, addressing interference while modeling nonlinear transport maps.
- CAT generalizes across Z-Image and Infinity, minimizing toxic output without the performance degradation observed in linearly steered baselines.
2. Related Work
Prior T2I safety methods span post-hoc filtering, concept erasure, denoising guidance, and activation steering. However, existing steering methods and datasets do not adequately address nonlinear safety manifolds, layer-specific emergence, or semantically aligned safe-unsafe pairs.
- T2I safety alignment has progressed from post-hoc filtering toward interventions within the generative process, including concept erasure and denoising guidance.
- ActAdd applies a global mean-difference vector, whereas Linear-ACT learns a linear distribution map using optimal transport.
- Linear steering may be insufficient when safety mechanisms occupy nonlinear or polyhedral subspaces, and pre-steering conditioning can miss representations emerging at deeper layers.
- Existing T2I safety datasets evaluate broad safety or unsafe prompt detection but lack highly semantically similar safe-unsafe prompt pairs for activation steering.
3. SafeSteerDataset
SafeSteerDataset is designed to isolate toxicity geometry through semantically similar safe and unsafe prompts organized across a fine-grained taxonomy. Its construction balances category coverage and geometric precision using generated candidates and embedding-based filtering.
- Examples: Table 1 presents representative benign and harmful descriptions with corresponding Z-image examples across safety categories.
- The dataset contains 2300 safe-unsafe pairs across 23 subcategories, with each pair consisting of semantically similar safe and explicitly unsafe prompts.
- Taxonomy: The taxonomy decomposes toxicity into six high-risk categories to support steering vectors across distinct unsafe-content modes.
- Taxonomy: Fine-grained subcategories distinguish specific scenarios, such as environmental crime from drug crime, preventing overemphasis on one toxicity aspect.
- Construction: The construction pipeline generated exactly 100 contrastive pairs for each of 23 subcategories, producing 2,300 candidate pairs before filtering.
4. Conditioned Activation Transport
Conditioned Activation Transport (CAT) combines a nonlinear transport map with conditioning that applies steering only in unsafe activation regions. Its geometry-aware design targets complex unsafe manifolds while preserving benign generations through identity behavior and safe-input regularization.
- Framework: CAT decomposes inference-time safety steering into a learned nonlinear transport map and a conditioning mechanism that decides when to apply it.The transport map captures complex safety manifolds, while conditioning addresses the safety–image-fidelity trade-off.
- Framework: The transport operates on mean-pooled internal activations, broadcasts the resulting steering across spatial tokens, and uses residual strength α.The residual formulation leaves the original generation unchanged when the conditioning mask is inactive.
- Transport and regularization: A dual-objective loss aligns unsafe activations with safe targets while penalizing changes to already-safe inputs.The regularization term makes the transport map learn when to apply changes.
- Geometry-aware conditioning: CAT uses geometry-aware conditioning strategies based on a regularized precision matrix to obtain stable Mahalanobis-based boundaries in high-dimensional latent spaces.The proposed variants include probabilistic discrimination and an out-of-distribution formulation centered on unsafe activations.
- Geometry-aware conditioning: The out-of-distribution variant activates steering within the high-density region around the unsafe centroid, using a quantile threshold such as ηq = 0.95.Safe examples are treated as out-of-distribution to define a boundary tightly around the unsafe concept.
- Geometric validation: Synthetic-manifold experiments show that nonlinear transport succeeds where linear methods fail on rotations, non-convex crescents, and multimodal clusters, while all methods handle simple translation.ActAdd and Linear-ACT fail to model required rotations or topology and compromise directions across XOR clusters; MLP Transport matches the target geometries.
5. Experiments
Experiments evaluate CAT across Z-Image and Infinity using safety and benign-prompt utility metrics. CAT generally provides the strongest safety–quality trade-off, while linear steering can suppress unsafe outputs by damaging image fidelity.
- Evaluation setup: Experiments evaluate safety with Attack Success Rate and benign-prompt utility with CLIP score across Z-Image and Infinity.Lower ASR indicates safer generation, while CLIP measures text–image alignment on benign prompts.
- Overall results: CAT achieves the superior safety–utility trade-off across both evaluated architectures.Table 2 compares the best configuration of each steering method.
- Overall results: For Z-Image, CAT reduces ASR from 33.91% to 6.96% while preserving a CLIP score of 0.33.Baseline methods either retain higher ASR or incur greater image-quality degradation.
- Overall results: For Infinity, CAT reduces ASR to 4.78% while maintaining a CLIP score of 0.32.Linear-ACT reaches ASR 2.61% but collapses CLIP to 0.16, indicating severe image degradation.
- Interpretation: The results suggest that linear safety gains can arise from image corruption, whereas CAT better preserves the natural image manifold.The paper links CAT’s utility preservation to the complexity of safety geometry beyond a single linear direction.
- Conditioning effects: Conditioning generally recovers image quality but can slightly increase unsafe outputs, with geometry-aware conditioning offering a tighter compromise than simple bounds.On Infinity, Mahalanobis OOD conditioning raises Linear-ACT CLIP from 0.07 to 0.16 while keeping ASR at 2.61%; Min-Max raises CLIP to 0.25 but ASR to 13.48%.
- Steering modalities: Steering both text and vision modalities yields the best results, combining semantic-request neutralization with generative-trajectory correction.Text-only steering offers marginal ASR gains with quality degradation, while vision-only steering provides poor suppression.
- Fine-grained safety steering: Even within the sexual-content category, linear methods degrade fidelity, whereas CAT maintains ASR 4.68% with CLIP 0.33 on Z-Image.Linear-ACT lowers CLIP to 0.27, while Affine steering lowers it to 0.08 on Infinity in the reported comparison.
6. Limiations
The paper identifies limitations of inference-time steering, including bypass under distribution shift, missed localized unsafe features, and reliance on automated safety evaluation.
- Inference-time steering may be bypassed under distribution shift or adaptive prompting because it does not remove the underlying unsafe capability.
- Mean-pooled activations can miss spatially localized unsafe features that token- or region-level mechanisms may target more effectively.
- The evaluation relies on the automated ShieldGemma safety judge rather than human annotation.
7. Conclusion
The conclusion presents CAT as a conditioned, geometry-aware transport method for reducing unsafe content while limiting benign-image degradation, supported by SafeSteerDataset and cross-model evaluation.
- CAT combines a learned transport map toward a safe manifold with layer-wise conditioning that activates near unsafe manifolds.
- SafeSteerDataset provides semantically aligned safe and unsafe prompt pairs across a granular toxicity taxonomy for safety-steering research.
- CAT is evaluated across two state-of-the-art models and reduces utility degradation observed with unconditioned or purely linear steering baselines.
- The authors state that SafeSteerDataset will be released as an open-source resource to support reproducible research.
Impact statement
The authors aim to advance safer image generation while acknowledging that steering techniques could be misused for harmful objectives.
- The paper aims to advance machine learning research toward safer image generation.
- The authors acknowledge that steering techniques could be misused if directed toward harmful objectives.
A. Additional Qualitative Examples
Qualitative examples compare CAT with no steering and prior steering methods on Infinity and Z-Image, emphasizing unsafe-element suppression alongside scene preservation.
- On Infinity, CAT eliminates unsafe visual elements such as blood, violence, robbery, and suicide while preserving the surrounding scene and background context.
- On Z-Image, CAT precisely eliminates unsafe visual elements including nudity.
- ActAdd and Linear-ACT fail to remove harmful content or alter image semantics effectively, whereas CAT suppresses unsafe content with minimal changes.
B. Data Generation Prompt
The dataset-generation prompt directs an AI safety specialist to create safe-versus-unsafe contrastive prompt pairs for specified harmful concepts. Category labels are inserted dynamically, and Gemini 2.5-Pro is used with temperature 0.7.
- Gemini 2.5-Pro generated the queries at temperature 0.7.
- The prompt asks an expert dataset creator to generate high-quality safe-versus-unsafe prompt pairs for harmful concepts.
- Main-category and subcategory labels are supplied as dynamic variables during prompt generation.The template uses {category} and {subcategory}.
- Figure 7 presents the system prompt template used for generating the contrastive dataset.
C. Example SafeSteerDataset Prompts
The SafeSteerDataset examples pair benign and unsafe prompts that are closely related in scene or concept while differing in harmful content. Examples span violence, illegal activity, disturbing imagery, hate symbols, stereotypes, humiliation, and counterfeiting.
- The examples are organized by category, subcategory, situation, safe prompt, unsafe prompt, and similarity.
- Disturbing imagery: The dataset covers harmful imagery including possessed dolls, gory dentistry, grotesque creatures, infected injuries, and drug paraphernalia.
- Bias and hate: Other examples target hate symbols, segregation, historical exploitation, ageism, socioeconomic stereotypes, and gender stereotypes.
- Illegal activity: Pairs preserve a shared scene while changing the depicted content, such as ordinary vehicle activity versus explosions, car bombs, or theft.
D. Detailed Steering Results
The detailed steering-results section compares methods across conditioning, steering strength, and regularization settings for Z-Image and Infinity. It evaluates CLIP alongside overall and per-policy unsafe-generation rates, where higher CLIP and lower ASR are preferred.
- Results compare ActAdd, LinearAct, Affine Transport Map, and CAT variants across the Z-Image and Infinity backbones.
- Higher CLIP is preferred, while lower ASR and unsafe-category rates are preferred.
- The sweeps vary conditioning and steering strength α ∈{0.25, 0.5, 0.75, 1.0}, with regularization included where applicable.
- Evaluation reports CLIP and overall ASR together with sexual, hate, humiliation, violence, illegal, and disturbing-content rates.