PaperlayerView exact revision on arXiv

Source-linked AI summary

Safe Few-Step Generation via Velocity Editing

Yujin Choi, Jaehong Yoon

arXiv:2606.23267v1cs.CVcs.CY

TL;DR

Few-step flow-matching models challenge existing safety methods because limited denoising steps hinder trajectory correction and context-dependent encoders limit prompt-embedding interventions. VESFlow edits the velocity field toward safe outputs, while VESFlow+ adds risk filtering and unsafe-direction repulsion, reducing NudeNet attack success rates to 6.3% on Ring-A-Bell and 6.8% on MMA-Diffusion.

  • Problem

    Few-step generation limits trajectory correction, while context-dependent text encoders constrain toxic-concept removal through prompt-embedding manipulation.

  • Method

    VESFlow edits flow-matching velocity toward a safe-conditional posterior, and VESFlow+ uses risk filtering to repel unsafe trajectories.

  • Results

    6.3% and 6.8% NudeNet attack success rates were achieved by VESFlow+ on Ring-A-Bell and MMA-Diffusion, respectively, while benign generation performance was preserved.

  • Takeaways & Limitations

    VESFlow and VESFlow+ support safety improvements for few-step flow-matching generation while preserving benign generation quality.

  • Takeaways & Limitations

    VESFlow performance depends on the choice of tmax, and the authors identify stabilization as future work.

Abstract

from arXiv · show

Flow matching has recently emerged as a strong paradigm for state-of-the-art text-to-image (T2I) generation, enabling high-quality generation with a small number of sampling steps. As these models are increasingly integrated into real-world applications, ensuring safe and non-sensitive content generation has become a critical requirement. However, adapting safety and concept removal methods to this new generation framework remains an open challenge. Specifically, prior methods largely rely on iterative trajectory steering across a number of denoising steps or on CLIP-centric prompt embedding manipulation. These design assumptions pose fundamental bottlenecks for safety in flow matching-based T2I generation, where limited sampling steps constrain iterative correction and modern context-aware text encoders diminish the effectiveness of embedding-level interventions. In this paper, we propose VESFlow, a training-free safety method tailored to flow matching with extremely few sampling steps. Leveraging the fact that flow matching models learn the marginal velocity, we directly edit the velocity field via a safe-conditional posterior. VESFlow steers the trajectory toward safe outputs while leaving the conditioning prompt unchanged. Building on the observation that VESFlow leaves outputs unchanged under benign prompts, we further introduce a risk score-based filtering that bypasses velocity editing to reduce computational cost while preserving benign prompt generation. Based on this filtering, we propose VESFlow+, a stronger variant of VESFlow that not only edits the velocity toward the safe direction, but also pushes it away from the unsafe direction. Experimental results show that VESFlow+ removes the target concept, reducing the attack success rate by NudeNet to 6.3% on Ring-A-Bell and 6.8% on MMA-Diffusion on the 4-step MeanFlow model, while preserving fidelity on benign prompts.

1 Introduction

Few-step flow-matching models improve sampling efficiency but create safety challenges because iterative safeguards are difficult to deploy and prompt-embedding edits are limited by context-dependent text encoders. VESFLOW addresses these issues by editing the velocity field toward a safe-conditional posterior, while risk filtering enables VESFLOW+ to strengthen safety and preserve benign-prompt fidelity.

  • Motivation: Few-step flow matching and MeanFlow reduce sampling cost by learning velocity information, enabling extremely few-step and even one-step generation.MeanFlow learns average velocity between time steps, while standard flow matching learns instantaneous velocity.
  • Challenges: Iterative training-free safeguards are difficult to deploy in few-step generation because they rely on repeated guidance during sampling.One described approach replaces the unconditional score in classifier-free guidance with a score conditioned on an unsafe negative prompt.
  • Challenges: Prompt-embedding interventions are constrained by language-model-based encoders that produce context-dependent representations, making toxic concepts harder to localize or remove at the token level.The limitation applies to modern state-of-the-art text-to-image models using such encoders.
  • VESFLOW: VESFLOW is a training-free method that replaces trajectory-level correction with velocity-level editing toward a safe-conditional posterior without modifying the text embedding.The method directly edits the learned marginal velocity field.
  • Results: 15.2%: VESFLOW reduces the NudeNet attack success rate to 15.2% on Ring-A-Bell using a 4-step MeanFlow model.The result is reported for VESFLOW in the supplied introduction passage.
  • VESFLOW+: Risk score filtering reduces per-step gradient computation and preserves benign-prompt fidelity, supporting VESFLOW+, which attracts trajectories toward safe regions and repels them from unsafe regions.Ablation studies also support robustness to the choice of scorer and evaluator.

2 Related Works

Prior training-free concept-removal methods mainly intervene during inference by modifying sampling trajectories or conditioning text embeddings. Emerging flow-matching approaches include parameter-tuned, trajectory-exploration, and training-free methods.

  • Training-free concept removal: Training-free safety methods suppress unsafe generation at inference time by modifying sampling trajectories without updating model parameters.Safe Denoiser uses a negation set to steer samples away from avoided regions, while Shielded Diffusion applies trajectory-level repellency primarily for protected-reference avoidance and diversity.
  • Training-free concept removal: Other methods modify conditioning text embeddings, using unsafe negative prompts or toxic-concept subspaces to suppress harmful generation.Safe Latent Diffusion replaces the unconditional score with an unsafe-negative-prompt-conditioned score, while SAFREE projects prompt token embeddings away from a toxic-concept subspace.
  • Concept removal in flow matching: Flow-matching concept removal includes EraseAnything, which uses bi-level optimization with LoRA-based parameter tuning for rectified flow transformers.These methods emerged as flow matching became central to state-of-the-art text-to-image generation.
  • Concept removal in flow matching: EraseFlow formulates concept unlearning as trajectory-balance-based exploration over denoising paths via GFlowNets, while SGF provides a training-free flow-matching formulation.The passage identifies these as emerging concept-removal methods for flow-matching-based models.

3 Background and Motivation

Flow matching transports Gaussian-prior samples to data through a learned velocity field and supports few-step generation through average-velocity modeling. These few-step regimes expose limitations in trajectory guidance and motivate alternatives to embedding-level concept removal.

  • Flow Matching Background: Flow matching learns a velocity field that transports samples from a simple prior to the data distribution and uses an ODE for sampling.The background considers a linear path between Gaussian noise x1 and data x0, with conditional velocity x1 − x0 and marginal velocity field vt.
  • Few-Step Generation: MeanFlow enables few-step generation by modeling average velocity between time steps instead of instantaneous velocity.MeanFlow achieves high-fidelity ImageNet generation in one step, while distillation of FLUX into MeanFlow achieves high-fidelity text-to-image generation in 4 steps.
  • Trajectory-Level Guidance: Existing training-free guidance methods become unreliable with few sampling steps because insufficient trajectory correction prevents their cumulative steering effect.These methods inject small guidance terms at each ODE denoising step to gradually steer trajectories toward safe regions while maintaining fidelity.
  • Trajectory-Level Guidance: Applying guidance at nearly every few-step iteration and increasing its scale can push samples off the data manifold, degrading fidelity rather than improving safety.The 1D toy example illustrates failure modes of trajectory-level guidance across different sampling-step counts.
  • Embedding Editing: Embedding editing globally transforms the conditional velocity field by modifying prompt embeddings to remove toxic concepts while preserving neutral concepts.SAFREE projects embeddings away from a toxic concept subspace, whereas Semantic Surgery performs vector subtraction.

4 VESFlow: Velocity Editing for Safe Flow Matching

VESFlow edits a pretrained flow-matching model’s velocity field toward safe-conditional generation without changing prompt embeddings or retraining. VESFlow+ filters prompts by risk and additionally pushes unsafe prompts away from the unsafe-conditional direction, while benign generation remains effectively unchanged.

  • Safe-conditional velocity: VESFlow constructs a safe-conditional velocity by directly editing the pretrained marginal velocity toward trajectories whose endpoints lie in the safe region.The method does not modify prompt embeddings or rely on accumulated trajectory-level corrections.
  • Velocity guidance: Safety-score guidance strengthens corrections for high-risk generations and naturally decays as sampling approaches t → 0.VESFlow caps t with tmax < 1 to avoid divergence and applies a scaling hyperparameter λ through v ← v + λ ∆v.
  • MeanFlow extension: The same safety guidance extends to MeanFlow by editing its predicted average velocity under the assumption that corrections vary slowly along near-linear sampling intervals.MeanFlow learns average rather than instantaneous velocity and supports one-step generation.
  • Benign-prompt preservation: VESFlow minimally edits confidently safe generations because the safety-classifier gradient vanishes, preserving the original sampling trajectory for benign prompts.The velocity difference satisfies ∥v_t − ṽ_t∥ → 0 for t ≠ 1 as g[x̄] → 0.
  • Risk-based filtering: Risk-score filtering applies VESFlow only when r(c) > τ, using a single prompt-level similarity computation with τ = 0.3 in the experiments.The filter uses normalized CLIP text embeddings and is designed to avoid misclassifying unsafe prompts as safe while preserving benign generation quality.
  • VESFlow+: VESFlow+ replaces marginal velocity guidance with v(x_t|c, s = 1) − v(x_t|c, s = 0), pushing high-risk prompts toward safety and away from unsafe behavior.This stronger editing direction becomes available after filtering identifies prompts with high p(s = 0|c).

5 Experiments

Experiments evaluate VESFLOW and VESFLOW+ on few-step flow-matching T2I models using safety, quality, robustness, stability, and runtime analyses. The results indicate improved safety with preserved benign generation quality, while filtering reduces the computational overhead on benign prompts.

  • Experimental setup: VESFLOW and VESFLOW+ are evaluated on FLUX.1-lite-8B with 8 sampling steps and MeanFlow with 4 sampling steps.These models represent the few-step flow-matching setting targeted by the methods.
  • Evaluation: Safety is measured on Ring-A-Bell and MMA-Diffusion using Attack Success Rate and Toxic Rate, with NudeNet and Q16 providing toxic-class probabilities.ASR is the fraction of images exceeding toxic-class probability 0.6, while TR averages that probability across generated images.
  • Main results: VESFLOW and VESFLOW+ improve safety across few-step flow-matching models while preserving benign generation quality.Qualitative comparisons include both proposed methods and training-free baselines; for STG nudity, missed in-loop NudeNet detections leave the baseline image unchanged.
  • Risk score-based filtering: FID and CLIP scores remain unchanged without risk score-based filtering on benign MS-COCO 1K prompts, with slightly lower FID at small guidance scale.This ablation supports the claim that filtering is not strictly necessary for benign generation quality, although VESFLOW+ assumes filtering has identified unsafe prompts.
  • Stability: Skipping the first guidance step substantially degrades safety, whereas larger tmax generally yield stronger safety performance.The stabilization strategy bounds the correction near the singular endpoint while retaining early-step guidance.
  • Scorer robustness: VESFLOW(+) achieves similar safety performance with LAION or NudeNet guidance scorers when evaluated independently with LLaVA.The result suggests that effectiveness does not depend on a particular scorer implementation.
  • Runtime: VESFLOW requires roughly twice the computation of the unguided baseline without filtering, but filtering eliminates this overhead on benign prompts.The added cost comes from computing the scorer gradient with respect to the image; measurements use FLUX over 8 sampling steps on one NVIDIA A100 GPU.

6 Limitations and Future Works

VESFlow’s guidance scale is sensitive to endpoint behavior caused by the t/(1−t) factor, making performance depend on tmax. Future work will seek a more principled stabilization scheme that leverages pretrained flow matching directly.

  • Sensitivity to endpoint behavior: VESFlow performance depends on the choice of tmax because its score-based editing term explicitly introduces the t/(1−t) factor.Pretrained flow-matching models directly predict the velocity field, whereas VESFlow introduces this factor explicitly in score-based editing.
  • Future work: Future work will develop a more principled stabilization scheme leveraging pretrained flow matching directly.

7 Conclusion

The paper introduces VESFLOW, a training-free concept-removal method for few-step flow-matching models that edits the velocity field toward a safe-conditional posterior, along with the risk-score-triggered VESFLOW+ variant.

  • Method Summary: VESFLOW directly edits the velocity field toward a safe-conditional posterior instead of relying on trajectory-level guidance.VESFLOW+ is a stronger variant available after a risk score identifies a prompt as unsafe.

A Experimental details … A.4 Motivating example

The experimental setup specifies sampling, resolution, scorers, hyperparameter ranges, datasets, and baseline adaptations for few-step safety evaluation. Additional experiments use an independent LLaVA evaluator, while motivating examples use a continuous conditional velocity model and controlled velocity perturbations.

  • A.1 VESFLOW and VESFLOW+ Configurations: FLUX.1-lite-8B uses 8 sampling steps, while MeanFlow uses 4; all images are generated at 512 × 512 with guidance scale 3.5 and seed 42.These settings define the main reproducible generation configuration.
  • A.1 VESFLOW and VESFLOW+ Configurations: Nudity scoring uses the LAION CLIP-based NSFW detector, deliberately avoiding NudeNet as the scorer because NudeNet is reserved for evaluation.The violence scorer is instead a lightweight MLP modeled after the LAION nudity detector, using comparable safe and unsafe data distributions.
  • A.1 VESFLOW and VESFLOW+ Configurations: VESFLOW tunes tmax ∈ {0.95, 0.99} and λ ∈ {0.1, 0.3, 0.5, 1.0, 3.0}, whereas VESFLOW+ tunes λ ∈ {0.01, 0.03, 0.05, 0.1}.VESFLOW+ searches smaller λ values because its velocity-editing term increases guidance magnitude.
  • A.1 VESFLOW and VESFLOW+ Configurations: The benchmarks contain 79 Ring-A-Bell nudity prompts, 400 MMA-Diffusion adversarial prompts, and 250 Ring-A-Bell violence prompts.These datasets cover nudity and violence evaluation.
  • A.2 Baseline Configurations: For few-step baselines, guidance is applied over the full MeanFlow trajectory because narrow sub-intervals produce almost no effective modification.SGF uses λ ∈ {0.01, 0.03, 0.1, 0.3}, while STG searches η = 0.1, 0.5, 1.
  • A.2 Baseline Configurations: SAFREE uses α = 0.01 with 41 nudity and 18 violence concepts, while Semantic Surgery uses γ = 0.02, β = −0.06, and αthr = 0.5 on T5 sequence embeddings.Both baselines use the same concept sets and stronger safety-oriented settings than their default many-step configurations.
  • A.3 Additional Evaluator: Scorer robustness is evaluated with LLaVA-1.5-7B as an independent evaluator, avoiding the circularity of using NudeNet for both guidance and evaluation.LLaVA runs in bf16 precision on a single GPU and answers whether an image contains nudity or sexually explicit content with YES or NO.
  • A.4 Motivating example: The motivating toy examples use a three-layer, hidden-dimension-128 conditional velocity model trained continuously over conditions from −1 (unsafe) to +1 (safe).Trajectory-level flow matching adds a softplus guidance term at each step, while another experiment averages directional components after small velocity perturbations.

A.5 Compute · B Additional Experiments

The experiments use different GPU hardware by model: MeanFlow runs on four RTX 4090 GPUs, while FLUX runs on A100 GPUs.

  • A.5 Compute: MeanFlow experiments use 4 NVIDIA GeForce RTX 4090 GPUs with 24GB each.The hardware setup is specified for the MeanFlow experiments.
  • A.5 Compute: FLUX experiments use NVIDIA A100 GPUs with 40GB each.The hardware setup is specified separately for FLUX experiments.

B.1 Encoder-Level Analysis: CLIP vs. T5

Embedding-editing methods perform poorly on few-step flow-matching models with T5 encoders because toxic semantics are distributed across many embedding directions rather than tightly localized. T5’s sentence-level encoding can also spread toxic content from one token into neighboring tokens.

  • Encoder-Level Analysis: CLIP vs. T5: Embedding-editing methods such as SAFREE and Semantic Surgery perform poorly with few-step flow-matching models using T5-based encoders.
  • Encoder-Level Analysis: CLIP vs. T5: T5 is pretrained on long-context text to capture sentence-level semantics, whereas CLIP uses image–text contrastive matching and produces relatively localized embeddings.
  • Encoder-Level Analysis: CLIP vs. T5: Toxic content from a single token tends to leak into neighboring tokens after T5 encoding.
  • Encoder-Level Analysis: CLIP vs. T5: The validation measured how tightly clustered toxic concepts are in CLIP and T5 embedding spaces using within-set cosine similarity.
  • Encoder-Level Analysis: CLIP vs. T5: For toxic prompts, CLIP yields a tight, high-similarity distribution, while T5 shows substantially lower similarity and a much wider spread across directions.

B.2 Number of time steps … C VESFLOW+: stronger variation of VESFLOW

VESFLOW remains safer than trajectory-level baselines as sampling steps increase, while its filtering preserves benign generation and supports scorer flexibility. VESFLOW+ strengthens safety guidance by combining attraction toward safe outputs with repulsion from unsafe outputs, although filtering is required beforehand and prompt editing can reduce its additional benefit.

  • B.2 Number of time steps: VESFLOW remains safer than trajectory-level baselines as the number of sampling steps increases, despite its base toxic rate increasing more noticeably.Trajectory-level methods benefit from additional opportunities for per-step corrections, whereas VESFLOW remains effective beyond the extremely few-step setting.
  • B.3 Different Scorer: VESFLOW can use different safety scorers, including NudeNet, although the main experiments avoid NudeNet to prevent overlap between guidance and evaluation.NudeNet is described as suitable because its nudity-specific, sigmoid-bounded output satisfies the derivation’s required regularity property.
  • B.4 Embedding modification: The guidance correction vanishes as t →0, returning sampling dynamics toward the original velocity field near generation’s end.With N sampling steps, the smallest sampled time is typically on the order of 1/N, which remains relatively large when N is small.
  • B.4 Embedding modification: Highly toxic prompts with very small p(s = 1|c) can make safe-conditional estimation unstable, motivating optional prompt-level safety methods.The experiments combine VESFLOW with Semantic Surgery to increase the likelihood of safe conditioning before sampling.
  • B.4 Embedding modification: Prompt-level embedding modification can reduce VESFLOW+’s additional benefit and make its stronger guidance unstable as g(¯x) →0.This occurs for MeanFlow with Semantic Surgery, whereas risk score-based filtering mitigates the issue without prompt-level modification.
  • C VESFLOW+: stronger variation of VESFLOW: VESFLOW+ directly shifts velocity from the unsafe-conditional component toward the safe-conditional component when unsafe content dominates the marginal velocity.Its contrastive update is defined as vt(xt|c, s = 1) − vt(xt|c, s = 0) and extends to MeanFlow models.
  • C VESFLOW+: stronger variation of VESFLOW: VESFLOW+ combines attraction toward the safe region with repulsion away from the unsafe direction, so filtering must precede its application.The repulsive force may be unsuitable for an arbitrary marginal velocity field.
Loading 2606.23267v1…