{"id":"3e804fc2-dc2b-4403-a784-a237c9f5fa21","arxiv_id":"2412.16039","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"SafeCFG adapts classifier-free guidance with a learned feature controller so that clean prompts generate normally while harmful prompts are pushed away from unsafe content.","lead":"SafeCFG is a plug-in method for text-to-image diffusion models that weakens harmful generations by replacing the neutral guidance signal with a learned, prompt-dependent 'safe' text embedding. It also uses the distance between that safe embedding and the empty prompt to score prompt harmfulness, enabling a form of label-free fine-tuning of diffusion models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SafeCFG's safety/quality trade-off rests on Eq. (11), which is only a supervised regression target for a small AHFC; no evidence shows it generalizes to unseen harmful and clean prompts, so OOD failure would silently deactivate or distort the guidance.","rationale":"The reader's weakest assumption identifies exactly the same load-bearing point: SafeCFG's behavior depends on AHFC generalizing from its labeled training set to unseen prompts, including I2P. I agree with that identification. The paper's formal appendix does not repair this gap, since the proof in Sec. B starts from Eq. (11) rather than proving that training with Eq. (13) yields Eq. (11) for all inputs. The experiments show impressive numbers on the chosen evaluation sets, but they are a single run without error bars or released code, and the safety evaluation set I2P is drawn from a different distribution than the Mistral-generated training prompts. Given that the entire mechanism is an inference-time substitution of the unconditional score with a learned score surrogate, the decisive question is whether that surrogate extrapolates. This concern does not invalidate the method; it makes the current evidence conditional on a generalization property that has not been demonstrated. The reader's CONDITIONAL verdict is therefore appropriate, and my analysis does not move it: implementation and held-out evaluation should be provided before the claims are taken at face value.","tokens_in":18473,"tokens_out":6148,"duration_ms":62723,"concrete_test":"Obtain or re-train the AHFC checkpoint, then evaluate on a genuinely held-out prompt distribution: e.g., I2P categories self-harm and harassment, which were not used for AHFC training, plus adversarial-harmful prompts from prior red-teaming work. Report NudeNet/Q16 ratios and the per-prompt L2 discrepancy with the Eq. (11) targets: D_clean = E_{xt,t} ||εθ(xt, AHFC(cc), t) − εθ(xt, φ, t)|| and D_harmful = E_{xt,t} ||εθ(xt, AHFC(cf), t) − [2εθ(xt, cf, t) − εθ(xt, φ, t)]||. If D_harmful on unseen harmful prompts is comparable to its training-set value and held-out NudeNet stays near the Table 2 level (e.g., below 0.15), Eq. (11) generalizes; if D_harmful increases materially or held-out safety degrades, the central claim is not robust.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central identity of the method is Eq. (10)/(11): replacing the unconditional score εθ(xt, φ, t) with εθ(xt, AHFC(c), t) must preserve clean generation exactly and reverse the guidance direction for harmful prompts. The only mechanism enforcing this is the regression loss in Eq. (13), evaluated on a finite set of labeled (text, image, timestep) triples; no convergence or generalization guarantee is provided. The Sec. B proof is circular in this respect: it assumes Eq. (11) already holds and then derives the desired probability ratios. AHFC is a 2-layer, 16-head transformer over text embeddings, and for the headline claim to hold this small module must extrapolate a single input-dependent mapping to the full score function εθ for arbitrary prompts, including I2P prompts, which are not in the training split (training harmful prompts are Mistral-generated). If AHFC misclassifies an unseen harmful prompt as clean, safe guidance silently deactivates; if it over-rotates a clean prompt, the promised quality preservation is lost. The reported Table 2 and Fig. 5 are from one fixed evaluation distribution and one training run, so they do not establish the required extrapolation. The other concerns (missing error bars, unreported threshold d_th, and the partially overstated 'unsupervised' claim) are secondary relative to this generalization risk.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SafeCFG, a plug-in guidance mechanism for text-to-image diffusion models. It trains a small transformer (AHFC) on text embeddings to produce an embedding that, when used in place of the unconditional score inside classifier-free guidance, leaves the generation trajectory of clean prompts essentially unchanged but reverses the guidance direction for harmful prompts, thereby erasing harmful content. The method is evaluated on Stable Diffusion V1.4, V2.1, and SD XL using I2P prompts for safety and COCO-30K for quality, and it is also used to fine-tune safe models in a claimed unsupervised manner through a Harmful Euclidean Distance (HED) criterion. Experiments report large reductions in NudeNet/Q16 detection rates and small quality losses relative to existing erasure methods.","tokens_in":18743,"tokens_out":6168,"duration_ms":55795,"significance":"If the central identity behind SafeCFG holds on out-of-distribution prompts, the method is a practical and inexpensive plug-in for improving safety in existing diffusion models, with the additional potential of multi-concept erasure and a label-light fine-tuning procedure. Strengths of the paper are its simple architecture, the breadth of tested base models (SD V1.4, V2.1, SD XL), the use of standard safety metrics on I2P, and the demonstration of simultaneous art-style erasure. However, the load-bearing claim of dynamic, fine-grained guidance rests on a training objective that does not itself enforce the required behavior for unseen prompts, and the supplementary proof of effectiveness assumes the very identity that the loss is fitted to. The 'unsupervised' wording is also stronger than what Sec. A.3 supports. These issues are addressable, but they currently leave the main generalization claim under-supported.","major_comments":[{"comment":"The central identity of SafeCFG is Eq. (11), which asserts that AHFC preserves the unconditional score for clean prompts and reverses the harmful CFG direction. The probabilistic proof in Supplementary Sec. B simply assumes this identity through Eqs. (19) and (20), and therefore does not establish that training with Eq. (13) produces the required behavior on unseen prompts. Since the harmful training prompts are Mistral-generated while the safety evaluation is on I2P, the paper should report AHFC's clean/harmful separation accuracy (e.g., HED AUC or a held-out classification metric) and the degree to which Eq. (11) holds on I2P prompts. Without this evidence, the plug-in mechanism is only validated on the training distribution.","section":"Sec. 4.1, Eq. (11); Supplementary Sec. B, Eqs. (19)-(20)"},{"comment":"The paper claims 'unsupervised safe alignment' without pre-defined clean or harmful labels. However, Sec. A.3 states that AHFC is trained by 'combining both clean and harmful images with explicit labels.' The unsupervised step in Sec. 4.2 therefore relies on a label-trained detector; this is more accurately described as pseudo-labeling or two-stage training than as fully unsupervised alignment. Please either revise the claim to reflect this dependence on labeled AHFC training or provide a truly label-free variant of AHFC.","section":"Abstract; Sec. 4.2; Sec. A.3"},{"comment":"Eq. (13) forces epsilon_theta(x_t, AHFC(c_f), t) to equal 2 epsilon_theta(x_t, c_f, t) - epsilon_theta(x_t, phi, t) for every harmful training prompt. Substituting this into Eq. (10) yields exactly negative guidance with a fixed coefficient (eta times one) for all harmful prompts. Consequently, the 'dynamic' and 'fine-grained' control described in the text is not enforced by the training objective; it can only emerge from AHFC's inability to fit the target exactly or from the HED threshold in Sec. 4.2. The paper should either modify the loss to condition on a continuous harmfulness estimate or provide per-prompt evidence that the guidance strength varies with harmfulness as claimed.","section":"Sec. 4.1, Eq. (13)"},{"comment":"All quantitative comparisons are single-run and lack error bars or significance tests. For example, Table 2 reports SafeCFG (SD V1.4) with FID 14.60 versus vanilla SD V1.4 with FID 14.16, a difference that is likely within run-to-run noise. Without repeated seeds or bootstrap intervals, the claim that SafeCFG preserves clean image quality is not statistically supported. Please provide uncertainty estimates for at least the headline safety and quality metrics.","section":"Tables 1, 2, 5, 7"}],"minor_comments":[{"comment":"The threshold distance dis_th is used in the unsupervised training objective but its value is never reported in the main text or in Section D of the supplement; please specify it for each model.","section":"Eq. (15)"},{"comment":"The abstract says SafeCFG can 'detect image harmfulness,' but Eq. (14) defines HED on text embeddings rather than on images; please adjust the wording to avoid implying an image-based detector.","section":"Abstract; Sec. 4.2"},{"comment":"There are typos in the tables: 'ESD-Nusity-u10' should be 'ESD-Nudity-u10' and 'Asethetic Score' should be 'Aesthetic Score'.","section":"Table 2 and Table 7"},{"comment":"References [46] and [47] appear to cite the same paper with the same title and pages (ECCV 2024, pp. 385-403) under two different numbers; please consolidate.","section":"References"},{"comment":"The column label 'SOTA CFG' is confusing because CFG is a guidance method, not a safety baseline; please use a clearer description such as 'standard CFG'.","section":"Table 1"},{"comment":"There is a typo in the caption: 'Sherpard' should be 'Shepherd'.","section":"Fig. 4 caption"}],"recommendation":"major_revision","confidential_remarks":"The plug-in idea is promising and the experimental scope covers multiple base models, but the paper currently overclaims both the dynamic nature of the guidance and the absence of labels. The generalization risk around AHFC is the key technical concern; it can be mitigated by reporting held-out and I2P-specific separation metrics and by softening the 'unsupervised' phrasing. I recommend major revision rather than rejection because these issues are fixable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the idea is real. Replacing the unconditional score in CFG with a learned, prompt-dependent 'safe' embedding—instead of using a fixed negative prompt or editing weights—is a genuine new move in the safe-diffusion space, and the reported numbers show it buys a lot of safety with modest quality cost. Worth a serious referee, but the paper oversells two things: the 'unsupervised' part and the probability proof.\n\nWhat's good: SafeCFG is plug-in, works across SD v1.4, v2.1 and XL, and the held-out I2P evaluation shows large drops in NudeNet/Q16 with FID almost unchanged—better than SLD or ESD in the clean-quality columns of Table 2. The art-style erasure is a nice extra. The AHFC design is simple: a 2-layer transformer over text embeddings, trained by score-matching to send clean prompts to null and harmful prompts to a negative-guidance direction (Eq. 13). That makes sense and is easy to reproduce in principle.\n\nSoft spots, in order of importance:\n\n1. The Sec. B 'proof' is not a proof of SafeCFG. It starts by assuming Eq. (11) holds—the exact property the loss fits—and then derives likelihood ratios. That's restating the training goal, not justifying it. If the method works, it works because the regression loss generalizes, not because of that appendix.\n\n2. The 'unsupervised' label is partly overstated. AHFC itself is trained with clean/harmful labels (Sec. A.3). The HED distance then serves as a continuous label for fine-tuning the DM, which is a neat trick, but the supervision is inherited, not absent.\n\n3. The generalization risk is real. AHFC is a small module, and the whole mechanism assumes it will map novel prompts—including adversarial or out-of-distribution ones—to the right side of the decision boundary. The held-out I2P results are encouraging, but they are one fixed evaluation set and one training run. No error bars, and the threshold d_th is never reported. Code would make this much easier to trust.\n\nNone of these kill the core contribution. The central inference-time guidance idea is sound and worth building on. But the paper should be revised to drop the proof claims, state the inherited supervision honestly, and provide code plus robustness evaluations.\n\nWho this is for: anyone working on inference-time safety for diffusion models, and anyone who wants a cheap alternative to weight-editing erasure. I'd cite it if the code shows up. Send it to peer review, but expect major revisions.","headline":"A clever plug-in safety guidance idea with decent empirical support, but the unsupervised claim and the proof need a serious look before it is published.","tokens_in":19316,"tokens_out":3018,"would_cite":true,"duration_ms":27791,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SafeCFG swaps the empty-condition anchor in classifier-free guidance for a harmfulness-adapted embedding, making higher guidance scales erase harmful content instead of amplifying it.","keywords":["safe generation","text-to-image diffusion models","classifier-free guidance","dynamic safe guidance","concept erasure","unsupervised safe alignment","harmfulness detection"],"falsifier":"Run SafeCFG on a held-out set of harmful prompts from categories not in the training set, such as self-harm, hate symbols, or recently coined euphemisms, and measure the harmfulness detection rate as the guidance scale increases; if the rate does not decrease monotonically, or if clean-prompt quality degrades noticeably for clean prompts that share vocabulary with harmful ones, the method's core generalization premise fails.","tokens_in":18251,"feed_emoji":"🛡️","tokens_out":5583,"duration_ms":47322,"temperature":0.7,"pith_summary":"This paper proposes a mechanism that lets text-to-image diffusion models refuse harmful prompts without retraining the model or degrading ordinary generation. It works by changing what classifier-free guidance subtracts: instead of the score with no text condition, SafeCFG subtracts the score with an embedding that has been processed to strip harmful features. For clean prompts that processed embedding behaves like the empty condition, so the generation trajectory is unchanged; for harmful prompts it acts as a strong negative guide, and the erasure grows as the guidance scale is raised. The same embedding distance also gives a continuous harmfulness score, which the authors use to safely fine-tune diffusion models without any pre-existing clean or harmful labels. Reported results show harmful-content detection dropping while image quality metrics stay close to the unmodified model.","feed_headline":"Reversing CFG: higher guidance now erases harmful images","feed_subtitle":"A learned embedding replaces the empty condition, so clean prompts keep quality while harmful prompts are pushed away.","key_machinery":"The load-bearing object is the adaptive harmful feature control (AHFC) module, a small multi-head self-attention transformer that maps a prompt embedding $c$ to an erased embedding $\\mathrm{AHFC}(c)$. Dynamic safe guidance (DSG) then uses this embedding in place of the empty condition $\\phi$ in the CFG score, so Eq. (10) becomes $\\tilde{\\boldsymbol{\\epsilon}}_\\theta(x_t,c,t)=\\boldsymbol{\\epsilon}_\\theta(x_t,c,t)+\\eta(\\boldsymbol{\\epsilon}_\\theta(x_t,c,t)-\\boldsymbol{\\epsilon}_\\theta(x_t,\\mathrm{AHFC}(c),t))$, with the training loss of Eq. (13) forcing $\\mathrm{AHFC}(c_c)\\approx\\phi$ for clean prompts and $\\mathrm{AHFC}(c_f)\\approx 2c_f-\\phi$ for harmful prompts. A secondary mechanism, the harmful Euclidean distance (HED) $d(c)=\\|\\mathrm{AHFC}(c)-\\phi\\|_2$, converts the module's behavior into a per-prompt harmfulness score that drives the unsupervised training objective of Eq. (15).","core_discovery":"The central claim is that replacing the unconditional score in classifier-free guidance, $\\boldsymbol{\\epsilon}_\\theta(x_t,\\phi,t)$, with $\\boldsymbol{\\epsilon}_\\theta(x_t,\\mathrm{AHFC}(c),t)$ turns CFG into a safety mechanism while preserving its quality benefits. The adaptive harmful feature control (AHFC) module is trained so that for clean prompts its output embedding is nearly the empty embedding, and for harmful prompts it lies on the opposite side of the empty embedding from the prompt, so the subtracted score becomes negative guidance scaled by the prompt's harmfulness. The paper derives this from a probabilistic view: clean data gets its likelihood boosted while harmful data gets its likelihood suppressed by the modified score. Because the modulation is confined to the unconditional term, the text condition is left intact and text-image alignment is preserved. The paper also establishes that the Euclidean distance between the AHFC output and the empty embedding is a usable harmfulness signal, enabling label-free fine-tuning of the diffusion model itself.","pith_inferences":["One implicit consequence is that the whole scheme reduces to how well AHFC transfers: if a user writes a harmful prompt in a style or topic category far from the training distribution, the erased embedding could land near the clean side and the safety dial would stop working; testing this explicitly would require a deliberately out-of-distribution harmful prompt set.","The HED signal is a scalar computed from a forward pass of a small transformer, so it could plausibly be reused as a reward or cost in other alignment pipelines, or as a pre-generation filter, without re-running the diffusion model.","The method's separation of clean and harmful embedding geometry suggests that other differentiable transformations of the prompt embedding might achieve similar dynamic guidance; comparing AHFC to simpler operations such as projection away from a harmful subspace would isolate what the learned attention adds."],"forward_implications":["SafeCFG can be applied to an already-trained diffusion model as a plug-in: no base-model parameters change, so existing models can be made safer without retraining.","Because the guidance scale controls how strongly the harmful direction is suppressed, users get a single safety dial: higher values erase more harmful content while clean-image quality continues to improve.","The same mechanism erases multiple harmful categories plus artistic styles simultaneously, so it is not limited to one concept at a time.","The harmfulness distance enables fine-tuning of diffusion models without labels, so safety alignment can be done on uncurated text-image collections.","If clean and harmful distributions are separated in HED space, the distance can also act as a detector that flags harmful prompts before generation."],"supporting_citations":[{"why":"Supplies the classifier-free guidance formulation that SafeCFG modifies.","marker":"[14]"},{"why":"Provides the text-to-image diffusion models on which SafeCFG is evaluated.","marker":"[27]"},{"why":"Is the concept-erasure baseline whose safety and quality trade-off SafeCFG improves on.","marker":"[5]"},{"why":"Supplies the safe-guidance baseline and the harmful-prompt benchmark used in evaluation.","marker":"[31]"},{"why":"Supplies the attention mechanism underlying the adaptive harmful feature control module.","marker":"[39]"},{"why":"Supplies the text encoder whose embeddings AHFC processes and whose semantic space grounds the Harmful Euclidean Distance.","marker":"[24]"}],"fun_headline_variants":["CFG's empty condition swapped: harmful prompts get negative guidance","SafeCFG flips CFG so only harmful prompts are erased, clean stay sharp","Label-free safe alignment via adaptive harmfulness-based guidance","One learned embedding turns CFG into a safety switch with no labels","Dynamic guidance: clean keeps quality, harmful gets pushed away"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole mechanism depends on the AHFC module generalizing from its training prompts: it must behave like the empty condition for every clean prompt it has never seen, and like a strong negative guide for every harmful prompt it has never seen, including prompts whose phrasing differs from the training data.","fun_headline_variants_meta":{"raw":{"variants":["CFG's empty condition swapped: harmful prompts get negative guidance","SafeCFG flips CFG so only harmful prompts are erased, clean stay sharp","Label-free safe alignment via adaptive harmfulness-based guidance","One learned embedding turns CFG into a safety switch with no labels","Dynamic guidance: clean keeps quality, harmful gets pushed away"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000475,"raw_usage":{"total_tokens":2362,"prompt_tokens":957,"completion_tokens":1405,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":573,"completion_tokens_details":{"reasoning_tokens":1316}},"tokens_in":573,"tokens_out":1405,"duration_ms":10338,"temperature":1.0,"reasoning_tokens":1316,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T10:51:06.004078+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SafeCFG on a held-out set of harmful prompts from categories not in the training set, such as self-harm, hate symbols, or recently coined euphemisms, and measure the harmfulness detection rate as the guidance scale increases; if the rate does not decrease monotonically, or if clean-prompt quality degrades noticeably for clean prompts that share vocabulary with harmful ones, the method's core generalization premise fails.","supporting_citations":[],"review_version":1}