PaperlayerView exact revision on arXiv

Source-linked AI summary

DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

Tong Zhang, Motasem Alfarra, Carlos Hinojosa, Christos Louizos, Bernard Ghanem

arXiv:2608.17067v1cs.AI

TL;DR

Text-to-image models can produce unsafe images from linguistically safe prompts, while many defenses require model access. DiSCO optimizes prompts using black-box contrastive feedback, reducing average ASR from 23.6% to 2.4% under NudeNet and from 8.3% to 1.7% under Q16 across 32 settings.

  • Problem

    Linguistically safe benign-adversarial prompts can still trigger unsafe images, challenging defenses against harmful text-to-image generation.

  • Method

    DiSCO is a training-free, strictly black-box prompt-level defense that expands suffixes using contrastive feedback from safe and unsafe target-model outputs.

  • Results

    23.6%→2.4% NudeNet ASR and 8.3%→1.7% Q16 ASR across 32 system–attack settings, while semantic fidelity and perceptual quality were maintained or improved.

  • Takeaways & Limitations

    DiSCO improves adversarial robustness across undefended and defended text-to-image systems without modifying the generator.

  • Takeaways & Limitations

    DiSCO adds inference computation, requiring T × b × K candidate image generations under default beam search and selective application to detected benign-adversarial cases.

Abstract

from arXiv · show

As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.

1 Introduction

Text-to-image models create serious safety risks because adversarial attacks can induce NSFW outputs, including from prompts that appear linguistically benign. DiSCO addresses this benign-adversarial regime with a training-free, strictly black-box prompt optimizer that improves safety across undefended and defended systems.

  • Motivation: Text-to-image models can generate NSFW content, while open-source accessibility and red-teaming attacks amplify deployment and security risks.These attacks include black-box, white-box, and LLM-driven methods.
  • Limitations: White-box defenses use weight fine-tuning, cross-attention editing, or inference-time steering, but do not scale to proprietary models.LLM prompt rewriting is broader but often fails when textually benign prompts still trigger unsafe generations.
  • Method: DiSCO is a training-free, strictly black-box, plug-and-play module that uses contrastive scoring over safe and unsafe outputs to optimize prompt suffixes.It operates entirely at the prompt level and requires no retraining, fine-tuning, or access to model internals.
  • Benign-adversarial problem: Textually safe prompts can still induce unsafe generations because of the model’s learned output distribution, defining the benign-adversarial regime.This failure mode motivates distribution-guided prompt optimization rather than relying solely on linguistic safety.
  • Results: 23.6% to 2.4% average ASR under NudeNet and 8.3% to 1.7% under Q16 across five seeds and 32 system–attack settings.On I2P under four red-teaming attacks, DiSCO improves safety across undefended and defended systems while maintaining or improving semantic fidelity and perceptual quality.

2 Methodology

DiSCO is a strictly black-box, prompt-level defense that aligns a target generator’s outputs with safe rather than unsafe regions using model-generated reference pools. It expands prompt suffixes through beam search and contrastive feedback while leaving the generator unchanged and preserving semantic fidelity.

  • Problem formulation: Benign adversarial prompts pass language-level safety checks yet still produce unsafe images with high probability.This motivates treating defense as distributional alignment rather than text-only sanitization.
  • Defense setting: DiSCO transforms a rewritten prompt into an optimized prompt using only observable images queried from the target generator, without access to its internals.The generator runs unmodified, and the defense requires no retraining, fine-tuning, architectural changes, or internal representations.
  • Reference pools: DiSCO builds model-specific safe and unsafe image pools from I2P prompts, retaining images classified consistently by both NudeNet and Q16 and discarding disagreements.Because the pools come from the target generator, they reflect its learned visual manifold.
  • Contrastive optimization: The contrastive objective attracts generated images toward safe references and repels them from unsafe references in frozen CLIP embedding space.It randomly resamples R references from each pool at every step; the default is R = 8.
  • Suffix search: DiSCO expands suffixes token-by-token with LLaMA-3-8B, queries the target generator for candidates, scores them contrastively, and retains the top-K beam candidates through T steps.The default beam size is K = 4 and the default number of steps is T = 16.
  • Computational overhead: DiSCO adds inference computation of T × b × K candidate image generations per prompt under default beam search, so it is applied selectively after benign prompts produce unsafe images.This selective invocation is intended to minimize computational overhead.

3 Related Work

Prior work shows that adversarial prompting can elicit NSFW images under both black-box and white-box settings, while existing defenses trade off intervention strength against model-access requirements and portability. Black-box attacks search for safeguard-evading token substitutions, whereas model-editing and inference-time defenses depend on internal access.

  • Adversarial Robustness of Text-to-Image Models: Adversarial prompting reliably elicits NSFW generations under both black-box and white-box threat models.Black-box attacks operate without generator internals, while white-box attacks use more targeted methods.
  • Adversarial Robustness of Text-to-Image Models: Black-box attacks such as Ring-A-Bell and SneakyPrompt search for token substitutions that evade prompt-side safeguards.These attacks craft prompts without accessing the generator’s internal mechanisms.
  • Defending Text-to-Image Models: Weight-modifying and fine-tuning defenses suppress unsafe concepts but require parameter access and may need repeated updates for new failure modes.Examples include ESD, AdvUnlearn, RECE, and the external rectification module SafePatch.
  • Defending Text-to-Image Models: Inference-time defenses avoid permanent edits but still depend on internal representations, limiting portability across architectures.The passage cites SLD-Max as an example of this defense category.

4 Experiments

DiSCO is evaluated across multiple architectures and red-teaming attacks, where it substantially reduces unsafe-generation rates for both undefended and defended models while improving fidelity and image quality. Ablations further show robustness to reference-pool size and benefits from jointly using safe and unsafe pools and tuning beam-search parameters.

  • Experimental setup: DiSCO is tested on UNet-based SD v1.4 and SD v2.0 and DiT-based Flux and SD 3 models.The evaluation spans both major architecture families and multiple model scales.
  • Experimental setup: The evaluation covers Ring-A-Bell, UnlearnDiffAtk, MMA-Diffusion, and P4D under black-box and white-box threat models.ASR is measured primarily with NudeNet and complemented by Q16, while CLIP and ImageReward assess fidelity and quality.
  • Quality and fidelity: CLIP alignment increases by +0.065 to +0.086 and ImageReward by +1.67 to +2.22 for the four undefended backbones.For defended models, CLIP alignment rises by +0.036 to +0.065 and ImageReward also increases, including SAFREE from −1.32 to −0.19.
  • Defended models: 21.1 points is the largest average NudeNet ASR reduction among defended models, achieved by SLD-Max + DiSCO; Ring-A-Bell ASR drops from 44.4% to 0.3%.Across four defenses, DiSCO lowers NudeNet ASR by 13.9 points and Q16 ASR by 6.0 points.
  • Ablations: Reducing the reference pool from 100% to 25% produces nearly identical ASR, with standard deviations of ±0.1–4.4% and an effective pool of ∼670 images.P4D shows a slight degradation from 38.3% →41.4% at 25%, within the pool-sampling noise range.

5 Conclusion

The conclusion reports a comprehensive empirical study of DiSCO’s effect on the safety of undefended and defended text-to-image generation systems across diverse attacks, defenses, and architectures.

  • Conclusion: DiSCO’s prompt optimization was evaluated for improving the safety of both undefended and defended text-to-image generation systems.The study analyzed DiSCO’s effect across both system settings.
  • Conclusion: The empirical study covered four attack methods spanning black-box and white-box threat models.The attacks represented both threat-model categories.
  • Conclusion: The evaluation included four defense methods covering inference-time, weight-editing, and fine-tuning categories.These defense categories were included in the comparative study.
  • Conclusion: The study examined four model architectures spanning UNet-based and DiT-based families.The architecture set included both model families.

A Supplementary Material · A.1 DiSCO Algorithm

DiSCO’s supplementary algorithm expands prompts with model-generated suffix candidates and selects an optimized prompt through contrastive scoring against safe and unsafe reference pools. Beam search retains the top-K candidates across T expansion steps before returning the highest-scoring prompt.

  • A.1 DiSCO Algorithm: DiSCO takes a prompt, target model, suffix generator, safe and unsafe pools, beam width K, suffix length T, and sample size R as inputs.The algorithm returns an optimized prompt p∗.
  • A.1 DiSCO Algorithm: At each step, the suffix generator proposes next-token extensions for every prompt currently in the beam.Each beam candidate can produce multiple extended prompt candidates.
  • A.1 DiSCO Algorithm: The target model generates an image for each extended candidate, keeping evaluation entirely tied to the candidate prompt’s generated output.The image is denoted x̂ ← G(p̂_j).
  • A.1 DiSCO Algorithm: Each generated image is scored by subtracting its cosine similarity to sampled unsafe references from its cosine similarity to sampled safe references.The score uses randomly sampled subsets of size R from both pools.
  • A.1 DiSCO Algorithm: Once T expansion steps finish, the algorithm returns the beam candidate with the maximum contrastive score as the optimized prompt.The final selection is p∗ ← arg max p̂∈B J(p̂).
  • A.1 DiSCO Algorithm: The procedure initializes the beam with the input prompt and repeats candidate expansion for t = 1 to T.Each expansion step constructs a new candidate set before beam pruning.
  • A.1 DiSCO Algorithm: After scoring, DiSCO retains the top-K candidates by the contrastive objective and repeats this pruning after every expansion step.The retained candidates form the next beam B.

A.2 Is the Evaluation Circular?

The evaluation addresses circularity by re-evaluating all settings with ShieldGemma2-4B, an independent safety classifier excluded from DiSCO’s candidate scoring. Its disagreements with NudeNet indicate that it captures a distinct, only partially overlapping notion of image safety.

  • Independence of the evaluation: ShieldGemma2-4B re-evaluates every setting despite playing no role in candidate scoring, providing an independent check against alignment with NudeNet and Q16 decision boundaries.NudeNet detects exposed body parts at the pixel level, whereas ShieldGemma2-4B is a 4B-parameter vision-language model.
  • Disagreement with NudeNet: 35.4% against 32.9%: ShieldGemma2-4B reports higher ASR than NudeNet in 18 of 32 model-attack settings before DiSCO is applied.This difference shows that the external classifier does not simply reproduce NudeNet’s measurements.
  • Disagreement with NudeNet: 38.1% versus 6.0% and 51.4% versus 32.3%: under MMA-Diffusion, ShieldGemma2-4B and NudeNet diverge sharply for ESD and RECE, respectively.The reported pairs are ESD under ShieldGemma2-4B versus NudeNet, followed by RECE under ShieldGemma2-4B versus NudeNet.

A.3 Generality Across NSFW Categories from I2P Dataset

DiSCO generalizes across all seven I2P harm categories when layered onto four existing defenses. It achieves near-total suppression of unsafe generation across categories without category-specific tuning, stacking gains on top of vanilla defenses.

  • Generality Across NSFW Categories: DiSCO is evaluated with ESD, RECE, SAFREE, and SLD-Max across all seven I2P harm categories.The evaluation applies DiSCO on top of four defense mechanisms to test whether its benefits extend beyond nudity.
  • Generality Across NSFW Categories: Under NudeNet, DiSCO reduces average ASR from 1.0–1.4% to ≤0.2%, with nearly every category reaching 0.0%.These results measure per-category performance across the I2P harm spectrum.
  • Generality Across NSFW Categories: Under Q16, DiSCO lowers average ASR from 9.8–35.6% to at most 0.1%, including violence, shocking, and self-harm categories.Q16 captures a broader notion of inappropriate content, and DiSCO brings categories that vanilla defenses barely address close to zero.
  • Generality Across NSFW Categories: Because DiSCO is training-free and does not optimize toward any particular category, its uniform near-zero ASR indicates generalization rather than category-specific tuning.The gains also stack on top of existing defenses.

A.4 Does DiSCO affect benign generation?

DiSCO generally preserves generation quality for prompts that already produce safe images. Across four prompt sources, it improves average semantic fidelity and perceptual quality without systematic degradation, despite a slight ImageReward decrease for P4D.

  • Evaluation setup: DiSCO was evaluated on 100 randomly sampled benign prompts from each attack approach that produced safe images under undefended SD v1.4.The evaluation measured false positives with ASR, semantic alignment with CLIP, and perceptual quality with ImageReward.
  • Semantic fidelity: 0.25 to 0.28: average CLIP increases across the four prompt sources after applying DiSCO.CLIP measures semantic fidelity, with higher values indicating better performance.
  • Perceptual quality: −0.60 to 0.05: average ImageReward increases across the four prompt sources after applying DiSCO.ImageReward measures perceptual quality, although it decreases slightly for P4D.
  • Overall effect: The aggregate results indicate that DiSCO does not systematically degrade semantic fidelity or perceptual quality on benign generations.This conclusion holds despite the slight ImageReward decrease observed for P4D.

A.5 Out-of-Distribution Generalization to T2I-RiskyPrompt

DiSCO generalizes to naturally occurring risky prompts from the unseen T2I-RiskyPrompt dataset, reducing ASR across all evaluated systems with the original fixed reference pools. Its consistent transfer performance supports distributional generalization beyond I2P and attack-specific prompt constructions.

  • Evaluation setup: DiSCO was evaluated on 1,000 T2I-RiskyPrompt prompts excluded from reference-pool construction and hyperparameter selection.The prompts were naturally occurring risky prompts, and no additional attack was applied.
  • Results: DiSCO reduces ASR across all eight evaluated systems.On undefended backbones, relative reductions range from 48.8% to 65.5%; with existing defenses, reductions reach 81.7% to 93.8%, leaving 0.1% to 1.1% residual ASR.
  • Discussion: The consistent reductions using original fixed reference pools support transfer beyond I2P and the attack constructions used in the main evaluation.This suggests DiSCO captures transferable properties of each generator’s safe and unsafe output distributions rather than overfitting to the evaluated prompt distribution or attacks.

A.6 Confidence-Aware Reference-Pool Construction … A.11 Limitation and Future Work

The appendix evaluates confidence-aware pool filtering, preference-based extensions, semantic drift, text-extended attacks, computational overhead, and suffix-induced concept injection. DiSCO retains high semantic similarity and can be accelerated substantially, but pool coverage, adaptive attacks, and dominant-concept injection remain limitations.

  • A.6 Confidence-Aware Reference-Pool Construction: Confidence-aware filtering excludes classifier disagreements and low-confidence agreements by retaining only high-confidence harmful or low-confidence benign samples.Images satisfying neither threshold condition are treated as ambiguous and excluded.
  • A.6 Confidence-Aware Reference-Pool Construction: 9.4%→4.7% NudeNet ASR and 2.4%→1.2% Q16 ASR are achieved by the strict configuration, but it retains only six harmful references.The moderate configuration retains 41 harmful images, while relaxed settings can dilute contrastive guidance and increase Q16 ASR to 3.5%.
  • A.7 Preference-Based Safety Settings: DiSCO’s binary contrastive objective generalizes to multiple safety-level pools with deployment-specific weights without changing beam search.Meaningful safety levels and weight calibration are identified as future work rather than evaluated contributions.
  • A.8 Quantifying Semantic Drift from Suffix Optimization: 0.84–0.92 mean cosine similarity across attack settings and defenses indicates only a modest semantic shift of approximately 10–15%.The result suggests suffixes steer generation toward safety without drastically altering the underlying prompt meaning.
  • A.9 How does DiSCO perform on Text-Extended Attack Approaches: APT raises NudeNet ASR across undefended backbones, while DiSCO reduces the APT-induced SD 2.0 NudeNet ASR from 26.3% to 13.6%.The SD 2.0 result remains above the 12.3% unattacked baseline, and the test is treated as non-adaptive because APT does not anticipate DiSCO.
  • A.10 Computational overhead.: 256 candidate image generations are required per prompt under K = 4, T = 16, and b = 4, with diffusion forward passes dominating optimization cost.FLUX requires 4 inference steps per candidate and is reported as fastest at 146s, compared with 50 steps for SD-based models.
  • A.10 Computational overhead.: 6.2 × speedup reduces 4-step scoring optimization from 3.5 minutes to approximately 34 seconds, with ASR within ±2% of the 50-step baseline.Total defense generation plus DiSCO overhead falls below 36 seconds per prompt.
  • A.11 Limitation and Future Work: DiSCO’s autoregressive suffix expansion can inject visually dominant concepts from the training distribution, overriding the original prompt’s semantics or style.Examples include popular animated characters and common animals that dominate generated images despite the original content.
Loading 2608.17067v1…