PaperlayerView exact revision on arXiv

Source-linked AI summary

GuardPaint:SpeculativeSafetyDecodingforText-to-ImageGeneration

Shreyash Dhoot, Paras Dhiman, Arsh Abbas Naqvi, Aranbi Dutta, Aman Chadha, Vinija Jain, Amitava Das

arXiv:2608.21869v1cs.CVcs.AI

TL;DR

Adversarial prompts can steer T2I diffusion trajectories toward policy-violating content, while prompt filters and post-hoc classifiers leave the trajectory unguarded. GuardPaint audits intermediate images, repairs unsafe regions with policy-aligned inpainting, and selectively accepts edits; across attacks and architectures, it reduces attack success while maintaining image quality and prompt fidelity, subject to limitations in harm coverage and auditor robustness.

  • Problem

    Adversarial prompts can steer T2I denoising toward explicit nudity and graphic violence, while existing boundary-level safeguards rarely provide compliant visual alternatives.

  • Method

    GuardPaint uses a frozen diffusion generator as a draft, an auditor to detect and localize unsafe intermediate content, an inpainter to propose local repairs, and a guarded tournament for selective acceptance.

  • Results

    GuardPaint consistently reduces attack success across five attack families and four base architectures while AlignS and BLIP remain within ±0.05 of the undefended baseline.

  • Takeaways & Limitations

    The framework provides safe visual alternatives through plug-and-play trajectory intervention across UNet and flow-matching architectures without modifying base-model weights.

  • Takeaways & Limitations

    The three-label taxonomy does not capture subtler harms such as stereotyping, bias, cultural insensitivity, or discriminatory imagery, while adaptive attacks on the auditor remain an uncertified threat.

Abstract

from arXiv · show

Text-to-image (T2I) diffusion models offer powerful visual generation, but their controllability creates a critical safety challenge: adversarial prompts can steer the denoising trajectory toward policy-violating content such as explicit nudity or graphic violence. Existing safeguards mostly act before generation through prompt filtering or after generation through image classification, leaving the diffusion process itself unguarded and often yielding only refusal rather than safe visual repair. We introduce GuardPaint, a speculative decoding framework for safe T2I generation that intervenes inside the diffusion trajectory without modifying the base model. A lightweight auditor monitors intermediate images, localizes unsafe regions, and triggers surgical inpainting repair only where needed. Candidate repairs are generated by a policy-aligned inpainter and selected through a guarded tournament that accepts edits only when they improve policy compliance while preserving prompt fidelity and perceptual quality. Across five jailbreak families SneakPrompt, MMA, PGJ, DACA, and RABell and UNet/flow-matching models including SD~1.5, SDXL, SD~3.5, and FLUX.1-dev. GuardPaint reduces attack success and harmful generations with minimal degradation to image quality, prompt fidelity, and benign behavior. Content warning: This paper contains examples involving nudity and violence that some readers may find disturbing, distressing, or offensive.

1 The Case for Plug-and-Play Safety Alignment in Text-to-Image Generation

T2I diffusion models expose a safety gap because adversarial prompts can steer denoising toward policy-violating content, while boundary-level defenses rarely repair images. GuardPaint addresses this gap with a plug-and-play trajectory intervention layer that audits, locally repairs, and selectively accepts safe alternatives without modifying base-model weights.

  • Adversarial prompts can steer T2I denoising toward explicit nudity and graphic violence, motivating safety mechanisms that protect benign generations.
  • Prompt filters and post-hoc classifiers act at generation boundaries, leaving the diffusion trajectory unguarded and rarely producing compliant visual alternatives.
  • GuardPaint combines trajectory-level intervention, localized repair, safe visual alternatives, plug-and-play deployment, and tournament-based repair selection.
  • The safety layer is designed to operate across evolving T2I backbones while preserving prompt fidelity and perceptual quality in non-unsafe regions.
  • The framework audits intermediate states, localizes unsafe regions, generates policy-aligned inpainting repairs, and uses guarded ranking to accept only quality-preserving edits.
  • GuardPaint introduces decoding-time trajectory intervention as a modular safety-alignment layer that avoids generator retraining.
  • The approach is demonstrated across UNet-based and flow-matching T2I architectures without modifying base-model weights.

2 GuardPaint: Speculative Safety Decoding

GuardPaint adds a modular safety layer inside frozen T2I denoising: an auditor detects and localizes unsafe content, while inpainting candidates are screened for safe, faithful, high-quality repair.

  • Core framework: GuardPaint treats the frozen diffusion trajectory as auditable intermediate states and intervenes only at selected denoising steps.Each audited latent is decoded into an image for inspection before denoising continues.
  • Auditor-Scorer: The Auditor-Scorer triggers repair, localizes unsafe regions, and scores candidate safety, faithfulness, and perceptual quality.Its multi-task design uses triggering, localization, and tournament-scoring outputs.
  • Training: The Auditor-Scorer is trained as a multi-task model with separate objectives for adversarial suppression, harm classification, visual quality, and prompt fidelity.The fidelity signal is isolated from safety-label gradients to preserve an independent image–text alignment measure.
  • Training: The policy-aligned inpainter is trained in two stages: refusal supervised fine-tuning followed by Binary Classifier Optimization for safe masked repair.Training starts from Stable Diffusion 1.5 Inpainting and uses masked unsafe regions with safe target completions.
  • Repair and selection: Policy-aligned inpainting generates local repairs, and a guarded tournament accepts only candidates that improve safety while passing fidelity and quality gates.The selected candidate is composed into the audit view and scored against the unedited control.
  • Guarded tournament: When no repair passes the guarded objective, GuardPaint retains the unedited trajectory instead of forcing an edit.This non-regression rule preserves the base output when candidate utility is non-positive.

3 Full Pipeline Algorithm

The decoding algorithm advances the base model normally, audits selected states, and repairs flagged regions only when a candidate satisfies the safety, fidelity, and quality criteria.

  • Auditing: At each audited step, the base model produces a control latent and an intermediate audit view before the auditor decides whether repair is needed.Non-audited timesteps return the control latent directly.
  • Decision paths: Benign images incur one auditor pass and continue unchanged, while flagged images undergo mask construction, candidate proposal, scoring, and conditional latent reinsertion.Reinsertion occurs only when the winning candidate has positive utility.
  • Audit timing: GuardPaint audits after roughly 70–80% of denoising because coherent semantic structure is then visible and repairable.Earlier decoded views are noise-dominated and make auditing inefficient.
  • Complexity: Repair cost scales with the number of mined regions and tournament candidates, whereas benign prompts require only a single auditor pass.Cached embeddings and policy-guided proposals reduce repeated computation.
  • Evaluation views: The change-from-baseline heatmap compares absolute ASR changes across attack families and model architectures, with blue denoting improvement and red regression.Rows represent attack families and columns represent architectures.
  • Evaluation views: Mean ASR decreases as audited steps and candidates increase, with diminishing returns beyond N = 5.Flow-matching models such as FLUX.1 converge faster because their trajectories are more deterministic.

4 Experimental Setup

GuardPaint is evaluated against five black-box jailbreak families on five UNet-based and flow-matching T2I architectures using the JailBreakDiffBench protocol.

  • Attack setting: The evaluation uses five black-box prompt-space attacks: SneakPrompt, MMA, PGJ, DACA, and RABell.The adversary has query access only and no knowledge of model parameters, gradients, or latent representations.
  • Protocol: JailBreakDiffBench supplies standardized adversarial prompt generation, baseline results, and evaluation scripts for cross-system comparison.Baseline ASR values are taken directly from the benchmark.
  • Models: The tested architectures span Stable Diffusion 1.5, SDXL, SD 3.5 Medium, SD 3.5 Large-Turbo, and FLUX.1-dev.The policy-finetuned inpainter uses SD 1.5 Inpainting regardless of the base model family.

5 Results

Across the evaluated attack families and architectures, GuardPaint lowers attack success while preserving prompt fidelity and image quality, though early repair can produce blurred or incoherent regions on flow-matching models.

  • Main results: GuardPaint reduces ASR across all reported model–attack pairs without exception.Examples include SD 1.5 DACA decreasing from 8.25% to 1.94% and FLUX.1-dev MMA decreasing from 4.25% to 2.44%.
  • Quality and fidelity: AlignS and BLIP remain within ±0.05 of the undefended baseline across defended configurations.The reported stability indicates that repairs remain localized while semantically valid prompt content is preserved.
  • Failure mode: Flow-matching failures can occur when early auditing and inpainting are followed by partial base-model override of the reinserted latent.The resulting regions may become blurred or incoherent when an attack still succeeds.

6 Ablation Study

The ablation varies audited denoising steps and tournament candidates, revealing a monotonic security–compute tradeoff with diminishing returns and motivating a production setting near the quality–latency knee.

  • Parameter tradeoffs: ASR decreases monotonically as both audited steps X and candidates per tournament N increase across all model families.The ablation evaluates X ∈ {2, 4, 6, 8} and N ∈ {1, 3, 5, 7}.
  • Parameter tradeoffs: The gain from N = 1 → N = 3 substantially exceeds the gain from N = 5 → N = 7, indicating diminishing returns from additional candidates.
  • Parameter tradeoffs: Flow-matching models converge faster with X because their more linear and deterministic trajectories let a single late-stage audit capture most of the safety benefit.
  • Qualitative behavior: Qualitative comparisons show that GuardPaint produces semantically coherent safe alternatives while preserving scene context outside flagged regions rather than returning blank refusals.
  • Production setting: N = 5 with audits of the final two denoising steps is selected as the production setting because it lies near the quality–latency Pareto knee across tested architectures.

7 Conclusion

GuardPaint is presented as a decoding-time safety framework that repairs unsafe regions during generation without changing base-model weights. Its design combines auditing, localized inpainting, and guarded candidate selection across diverse T2I architectures.

  • Framework: GuardPaint intervenes during diffusion decoding by monitoring trajectories, rewriting suspect regions, and selecting repairs through a guarded tournament.
  • Framework: The framework provides compliant alternatives to adversarial outputs rather than blank refusals without modifying base-model weights.
  • Deployment scope: GuardPaint is plug-and-play across seven T2I architectures spanning DDPM-UNet, flow-matching-UNet, and multiple design generations.

8 Limitations

The paper identifies limitations in latency, inpainter compatibility, policy coverage, robustness, localization, calibration, reinsertion fidelity, and auditor-label quality. Several boundaries reflect fixed training distributions or architectural mismatches.

  • Latency: GuardPaint adds substantial latency, with approximately 7–8 seconds per audited timestep on UNet models and approximately 20 seconds on FLUX.1-dev.The reported figures use N = 5 on a single NVIDIA A6000; averaged across audit steps, UNet overhead is approximately 2 seconds per step.
  • Architectural mismatch: Using an SD 1.5 inpainter for every base family can incur fidelity costs and weaken preservation of higher-capacity generators’ stylistic properties.
  • Policy coverage: The three-label taxonomy—safe, nudity, and violence—does not capture stereotyping, bias, cultural insensitivity, or discriminatory imagery.Extending coverage would require richer ontologies, dedicated data, and potentially separate auditor heads with calibration challenges.
  • Adversarial robustness: An adaptive white-box adversary could suppress the auditor score or target thresholds and tournament utility, so the system is not a certified defense.
  • Inpainting domain gap: Out-of-distribution styles can degrade auditor heatmaps, causing overly coarse or sparse masks, wrong-region repairs, seam artifacts, or no safety improvement when the quality gate rejects a repair.
  • Calibration: Auditor thresholds and tournament policies are calibrated offline on fixed prompt and attack distributions, requiring periodic recalibration as jailbreak methods evolve.
  • Reinsertion fidelity: Approximate latent reinsertion can introduce semantic drift, especially at early noisy steps, that changes prompt fidelity without reliable detection by the auditor or fidelity gate.
  • Label quality: Single-shot VLM scoring may systematically over-score policy-safe, skin-heavy images, producing residual boundary-label noise.

A.5 Dataset Statistics and Splits

The auditor pipeline combines image, prompt, and timestep inputs with multi-task, cross-modal, and timestep-conditioned processing. Its architecture extracts prompt-conditioned visual features and separately modulates adversarial and seam-quality signals.

  • Architecture: The auditor is specified as a multi-task pipeline integrating cross-modal attention and diffusion-timestep conditioning through FiLM.
  • Inputs: The system takes an image X, tokenized prompt sequence T, and normalized diffusion timestep t as three inputs.
  • Architecture: The architecture diagram presents the Auditor module’s organization within this image–prompt–timestep processing pipeline.
  • Prompt conditioning: Global textual context, per-token embeddings, and a padding mask support prompt processing before image-to-text cross-attention.
  • Prompt conditioning: Spatially averaged attended features are used exclusively by the CLIP-style alignment head.
  • Timestep conditioning: The timestep embedding drives separate FiLM projections for adversary modulation and seam modulation, using independent learned weights.

B.3 Specialised Multi-Task Auditor Heads

The auditor separates safety, adversariality, risk strength, seam quality, and prompt faithfulness into dedicated heads. These predictions support localized explanations and protect fidelity learning from safety-label contamination.

  • Auditor heads: Dedicated auditor heads separately predict adversariality, safety category, perturbation strength, seam quality, and image–prompt faithfulness.The adversariality head bypasses timestep conditioning, while perturbation-strength prediction uses timestep-conditioned features.
  • Auditor heads: The adversariality classifier uses unmodulated visual features so binary safety decisions are not conflated with timestep dynamics.
  • Auditor heads: The faithfulness head aligns attended visual features and raw text features with a symmetric InfoNCE objective in a shared R256 space.Using both feature types preserves lexical grounding alongside spatially attended semantics.
  • Visual explanations: GradCAM produces a 7×7 risk heatmap, upsamples it to 224×224, and overlays contours to localize regions driving safety classification.Because it operates on visual features, the explanation is independent of FiLM conditioning.
  • Inpainter alignment: The inpainter is trained with staged safe-repair supervision and alignment, using unsafe prompts and masked unsafe regions to learn policy-compliant completions.The training rationale is to establish a safe-inpainting prior before preference alignment.

C.3.3 Why KTO Failed: Theoretical Analysis

The analysis attributes KTO’s failure to noisy, poorly calibrated, and insufficiently asymmetric preference signals. GuardPaint instead uses clean-latent rewards, class-aware centering, capped unsafe rewards, and hinge-based identity control.

  • Why KTO failed: O(10^-1) noise variance overwhelms the O(10^-2) safe–unsafe preference gap, producing a KTO preference-gradient signal-to-noise ratio below 1.Early KTO runs therefore exhibit hsafe ≈ hunsafe ≈ 0.500 plateaus.
  • Why KTO failed: KTO cannot encode the strongly asymmetric cost of false negatives because its symmetric curvature changes gradient magnitude rather than gradient shape.Class weights rescale loss magnitude but do not provide the required asymmetric treatment.
  • Reward calibration: A safe-only EMA baseline miscalibrates centering because safe and unsafe samples have distinct reward distributions.The proposed midpoint centering uses both class means to place the decision boundary between them.
  • Reward calibration: Clean-latent reconstruction rewards are calibrated across timesteps, making class weights interpretable as preference ratios.The resulting latent predictions remain in a consistent z0 space rather than inheriting timestep-dependent noise-prediction scales.
  • Reward constraints: The unsafe-reward hinge cap prevents arbitrarily large suppression rewards that could otherwise produce incoherent masked-region outputs.It bounds the unsafe reward at 1.5× the current unsafe-class mean.
  • Reward constraints: A linear identity penalty permits smudging, whereas the Quadratic Hinge makes deviations beyond the safe-smudging threshold increasingly costly.Smudging can achieve low BCO and identity losses while visibly destroying the image.

C.6 Training Dynamics and final Results

Training progresses from exploiting the SFT prior through smudging, to hinge-constrained search, and finally to coherent clothing discovery. The reported dynamics show recovery of safety separation and a near-binary decision regime.

  • Phase 1: SFT exploitation and smudging: Phase 1, steps 0–1000, exploits the SFT prior before transitioning to pixel smudging, yielding ∆N = 0.222 and hU = 0.772 > hS = 0.668 at step 1000.The inverted gap identifies smudging as an incorrect local minimum.
  • Trajectory analysis: Figure 7 compares nudity, violence, and safe prompt trajectories from t = 700 to t = 5 at BCO steps 0 and 3000.The visualization is intended to show latent-space separation across denoising stages and training progress.
  • Phase 2: Quadratic Hinge activation: Phase 2, steps 1000–1500, activates the Quadratic Hinge at κ = 0.02, making smudging costly while ∆N temporarily plateaus during constrained search.The z0 anchor helps prevent structural distortion while BCO continues demanding unsafe suppression.
  • Phase 3: Clothing discovery: Phase 3, steps 1500–3000, discovers coherent clothing that suppresses unsafe content, preserves context, and keeps identity loss below 0.02.By step 2000, hS = 0.918 and ∆N = 0.403.
  • Final dynamics: At 97% sigmoid saturation, BCO reaches a near-hard z0-space classifier while softplus retains gradients for continued refinement.The optimal checkpoint is around steps 2000–2500; later training shows slight ∆N degradation, likely from overfitting the BCO signal.

D.2 Guarded Tournament Policy Loss: Full Derivation

The Guarded Tournament Policy learns repair actions from tournament utilities, using centered advantages, entropy, compute, diversity, and timestep-dependent utility terms. Its architecture and reinsertion design support candidate selection while addressing seam artifacts, inversion failures, and semantic drift.

  • Policy architecture: The policy maps heterogeneous prompt, latent, image, mask, and timestep inputs into a shared state before predicting continuous and discrete repair actions.The StateEncoder uses independent projections and concatenation, while the policy uses a shared MLP with hybrid action heads.
  • Tournament policy objective: Centered leave-one-out softmax advantages reinforce candidates above the tournament average and suppress candidates below it.Subtracting 1/N centers credits around the uniform prior and reduces variance without introducing bias.
  • Regularization: Entropy regularization preserves exploration by preventing continuous and discrete policy heads from collapsing onto an early randomly winning configuration.Without it, the policy becomes nearly deterministic and stops exploring alternative high-quality configurations.
  • Regularization: The objective biases repairs toward lower inversion depth and diverse candidates, while accepting extra compute when deeper inversion improves guarded utility.Image-embedding distances are preferred for diversity; action-space distances provide a weaker fallback when embeddings are unavailable.
  • Timestep-dependent utility: Timestep-dependent faithfulness thresholds peak near tnorm ≈ 0.85 to protect global composition, then relax late to permit localized safe replacements.The late relaxation reduces rejection of intended safety edits whose completions differ semantically from unsafe content.
  • Latent reinsertion and seam quality: Null-text inversion preserves the control trajectory through self-consistent latent reinsertion, whereas DDIM inversion can leak the adversarial concept and increase latency.Null-text optimization is cached per audited timestep and amortized across candidates; semantic drift remains possible when reinsertion approximates the trajectory.
Loading 2608.21869v1…