{"id":"c41d2969-8345-43cb-a648-9916a6233328","arxiv_id":"2607.16828","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"UniNDM detects sexual intent from early-stage diffusion noise and mitigates it via LLM-generated negative prompts and initial-noise optimization, across U-Net and DiT models.","lead":"This paper proposes a safety system for text-to-image AI that detects sexual content early by analyzing the first noise prediction, then steers the model away from harmful images. If it works broadly, it could make image generators safer without ruining their quality.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3.1 does not establish category separability, and the evaluation protocol cannot yet rule out dataset-specific shortcuts.","rationale":"The reader's weakest assumption is also the most load-bearing concern: the theoretical result proves concentration around a single prototype, not separation between categories, and the empirical design does not fully exclude dataset-specific artifacts. My reading of Theorem 3.1 and the training/evaluation protocol in Sec 4.1 confirms this. The proposed concrete test would directly resolve whether the noise-space separability generalizes to fully held-out sexual datasets and to benign prompts from a different corpus, and whether the theory's predicted monotonic trend actually holds for two classes. Since the reader already assigned CONDITIONAL and the concern, while real, is not yet demonstrated to invalidate the empirical results, I do not move the verdict. The paper should require the additional held-out evaluation and a corrected or softened theoretical claim before acceptance.","tokens_in":25916,"tokens_out":7971,"duration_ms":89949,"concrete_test":"Train the Sec 3.2.3 detector on a single sexual corpus (I2P only) and a single benign corpus (COCO-30k), then freeze all weights/hyperparameters and test on SneakyPrompt SP(N)/SP(P), Ring-A-Bell, MMA, and on benign prompts from a different corpus (e.g., DrawBench or DiffusionDB). Report per-corpus accuracy with bootstrap 95% CIs. Separability is a generic property only if held-out sexual accuracy stays near the in-distribution level and benign false-positive rate does not inflate. In parallel, compute the Fisher discriminant ratio of first-step noise features across reverse timesteps T, T−5, T−10, ... on a two-class mixture; if the ratio is not monotone increasing with t, Theorem 3.1's implied mechanism fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires early-stage predicted noise to separate sexual from benign prompts as a generic semantic property. Theorem 3.1 does not deliver this. It analyzes a single prototype x with y∼N(x,σ²I) and shows E||hθ*(yt,t)−x||²=O(1/σ_t²), i.e., within-class concentration. It never treats two classes; for a two-prototype mixture the optimal conditional denoiser is a posterior-weighted average of class means, and as σ_t grows the posterior weights become uniform, so hθ*(yt,t) collapses toward the global mean rather than to separated class centers. Thus the theorem cannot be cited as proof of separability, and the monotone 'semanticity increases with timestep' claim is at best incomplete. Separately, the detection protocol in Sec 4.1 trains on I2P/MMA sexual plus COCO benign and evaluates on 'unseen parts' of the same corpora plus SneakyPrompt/Ring-A-Bell. Because the detector is PCA+LDA+SVM on first-step noise, it could be exploiting corpus-level cues (I2P vs COCO wording, NSFW vocabulary, or the high guidance scale γ=12.5) rather than a general semantic concentration. Table 1 has no error bars, and Sec 4.4 reveals per-dataset α/β tuning, so the reported 90%+ accuracies do not yet demonstrate distribution-free generalization.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes UniNDM, a two-stage safety framework for text-to-image diffusion models. Stage I trains a lightweight PCA+LDA+SVM classifier on the first-step predicted noise of the diffusion model to distinguish sexual from benign prompts, claiming that early-stage noise carries concentrated semantic information about the prompt. Stage II mitigates detected sexual content via LLM-generated adaptive negative prompts and initial-noise optimization for U-Net models, and via region-constrained semantic guidance plus DiT-adapted noise optimization for DiT models. The paper reports detection accuracies above 90% on I2P, SneakyPrompt, MMA, and Ring-A-Bell while keeping benign accuracy around 90%, and mitigation attack-success rates below 20% across SDv1.4/1.5/2.1/XL and SDv3. A theorem in §3.2.2 is presented as the theoretical justification for the noise-based detector.","tokens_in":26202,"tokens_out":5836,"duration_ms":55245,"significance":"If the empirical results hold, UniNDM offers a genuine practical advance: an inexpensive detector that operates before full image generation and a mitigation method that preserves benign generation quality while reducing sexual content. The evaluation is unusually broad for this area — five model families, natural and adversarial sexual-prompt datasets, multiple state-of-the-art baselines, ablations, and benign-quality metrics — and the public code is a strength. The results are consistent across U-Net and DiT, which supports the architecture-transfer claim. However, the theoretical argument does not actually establish the claimed inter-class separability, and the evaluation protocol leaves open the possibility that the detection and mitigation numbers are inflated by dataset-specific cues and per-dataset hyperparameter tuning. The contribution is therefore significant conditional on closing these gaps.","major_comments":[{"comment":"The theorem proves within-class concentration, not inter-class separability. The model y~N(x, σ²I) has a single prototype x, and Eqs. (9)–(13) only show that E||h(y_t,t)-x||² = O(1/σ_t²), i.e., the predicted noise moves toward one class center. For a two-class mixture, the optimal denoiser is the posterior-weighted average of class centers; as σ_t grows, the posterior weights approach uniform, so the prediction collapses to the global mean rather than moving apart into separated clusters. Thus Theorem 3.1 cannot be cited as proof of the 'inherent separability' claimed in the abstract and §3.2.1. A two-class analysis or a measure of inter-class distance is needed to support the theoretical claim.","section":"§3.2.2, Theorem 3.1"},{"comment":"The detection protocol trains on sexual prompts from I2P and MMA and benign prompts from COCO, then tests on held-out portions of these corpora plus SneakyPrompt and Ring-A-Bell. Because the source corpora differ in prompt style, vocabulary, and attack-token statistics, the high accuracies could reflect corpus-level cues (e.g., I2P wording vs. COCO wording, or adversarial token artifacts) rather than a generic semantic-concentration property. The lack of error bars or bootstrap confidence intervals, and the use of a single elevated guidance scale γ=12.5, make it hard to exclude this explanation. Please report per-dataset confidence intervals and include a matched-style benign control, or a train-on-one-benchmark/test-on-another protocol, to demonstrate that the detector transfers on the semantic property rather than on dataset artifacts.","section":"§4.1 / Table 1"},{"comment":"Mitigation hyperparameters α and β are tuned per dataset: α=0.7 for I2P, SneakyPrompt, and Ring-A-Bell, α=0.6 for MMA, β=0.9 for I2P, SneakyPrompt, and MMA, and β=0.7 for Ring-A-Bell. Since the ASR numbers in Tables 2–4 are obtained with these test-set-specific settings, the claim of a distribution-free, generally applicable safeguard is not fully supported. The paper should report results with a single fixed hyperparameter setting (or a validation-set-based selection) and provide sensitivity curves for α and β on all datasets, not only I2P.","section":"§4.4 / Tables 2–4"}],"minor_comments":[{"comment":"The phrase 'quadratically increasing semantic concentration' is inconsistent with Eq. (7), which states that the semantic error is O(1/σ_t²). Clarify that the error decreases as σ_t² grows.","section":"Abstract / §3.2.2"},{"comment":"The rows Ours_w/o_gen and Ours_w_gen are not defined in the table captions. From §4.3 they correspond to detection-then-refusal and detection-then-mitigation; please state this explicitly in each caption.","section":"Tables 2–4"},{"comment":"Bars marked with '-' are described only as negative NRR in the caption; please add a sentence explaining what a negative NRR means and why it can occur.","section":"Figures 5 and 6"},{"comment":"The appendix heading numbers the theorem as 'Theorem 1.1' while the main text uses 'Theorem 3.1'. Also, 'qradratically' appears twice; please proofread.","section":"Appendix Proof"},{"comment":"The text says the number of training noise samples 'varies across the Stable Diffusion model series' but does not give the actual sizes. Please report the training set sizes for each model.","section":"§4.1"}],"recommendation":"major_revision","confidential_remarks":"The paper is a journal extension of an ACM MM paper; the new DiT extension, the added theory, and the broader evaluation are substantial enough to warrant consideration. My main concern is that the theoretical section overclaims: it establishes within-class concentration but not inter-class separability, and the empirical protocol is not fully controlled against dataset-specific shortcuts. These are fixable with additional analysis rather than a rejection of the overall approach. I see no integrity concerns; the self-citations are frequent but in line with the authors' prior work in this area."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core empirical result is real and worth building on; the theoretical framing is overclaimed and the evaluation has a few soft spots that need cleanup. The paper's contribution is the observation that first-step predicted noise in diffusion models separates sexual from benign prompts, and that this can power a cheap detector and, combined with adaptive LLM negative prompts and initial noise optimization, a mitigation method that works on both U-Net and DiT models. That is genuinely new relative to the text- and image-based detectors in the literature, and the experimental coverage is unusually broad: five model families, five adversarial/natural datasets, and consistent ASR reductions below 20% with benign quality seemingly preserved. The ablations make a plausible case that both the adaptive prompts and the noise optimization matter.\n\nThe soft spots are real, though none of them sinks the core empirical claim. First, Theorem 3.1 does not prove separability between classes. It shows that in a single-prototype Gaussian model, predicted noise moves toward the prototype as timestep grows — that is within-class concentration. For two classes, the optimal conditional denoiser is a posterior-weighted average of the class means, and at large timesteps the weights go uniform, so the noise collapses to the global mean, not to separated class centers. The paper uses the theorem to claim 'inherent separability', but the math doesn't deliver that.\n\nSecond, the detection protocol is not as clean as it looks. The classifier is trained on first-step noise at guidance scale 12.5, while the baseline detectors and mitigations use 7.5; that's an unfair comparison that can inflate conditioning-related signals. The training set is I2P/MMA sexual plus COCO benign, and evaluation is on unseen parts of the same corpora, so the classifier could be latching onto corpus-level phrasing rather than a general semantic property. The high accuracy on SneakyPrompt and Ring-A-Bell is encouraging, but without error bars and with per-dataset tuning of α and β, the claim of distribution-free generalization is not yet established.\n\nThird, the FID numbers in Tables 2–4 are implausible at face value. FID of 0.3, 1.7, 3.3 on COCO-30k is orders of magnitude below typical values; this looks like a different reference distribution or a measurement bug, and it needs to be clarified before those numbers are cited.\n\nThe paper is an extended journal version of an ACM MM paper, and the core idea is solid enough to deserve a serious referee. I would send it out, with a request to either fix the theorem so it actually addresses inter-class separability or soften the claim substantially, report variances, justify the guidance-scale choice, tune hyperparameters on a validation split, and re-examine the FID computation. The empirical direction is valuable and the community should know about it, but the current version overstates its theoretical guarantee.","headline":"Real empirical insight, overclaimed theory, and an evaluation protocol that needs tightening before the numbers can be trusted.","tokens_in":26735,"tokens_out":3008,"would_cite":true,"duration_ms":30721,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"UniNDM claims that the noise a text-to-image diffusion model predicts at its very first denoising step is enough to distinguish sexually explicit prompts from benign ones, and that steering that same noise can suppress explicit content with","keywords":["text-to-image diffusion models","sexual content safety","noise-based detection","adaptive negative guidance","initial noise optimization","Diffusion Transformers","implicit prompt detection","content moderation"],"falsifier":"Construct a matched evaluation set: benign and sexual prompts with identical subjects, locations, and sentence structure (for example, 'a woman in a bedroom wearing pajamas' versus 'a woman in a bedroom undressing'). Run the trained PCA-LDA-SVM detector on first-step noise from these matched pairs; if accuracy drops to chance, the reported separability is driven by topic differences between the training corpora, not by a semantic property of early noise.","tokens_in":25762,"feed_emoji":"🛡️","tokens_out":9799,"duration_ms":80143,"temperature":0.7,"pith_summary":"UniNDM asks whether a text-to-image diffusion model can police itself before it draws anything, and answers with one ingredient: the noise the model predicts at the very first denoising step. The paper claims this early predicted noise carries the prompt's most salient semantic content, and that sexual and benign prompts produce noise vectors that separate cleanly at this stage. Around that property it builds a lightweight detector — a PCA-LDA-SVM classifier applied to the first-step noise tensor — which reports over 90 percent detection on natural and adversarial sexual-prompt benchmarks while keeping benign accuracy near 90 percent on COCO prompts, at roughly a second per sample. When a prompt is flagged, the same framework mitigates by dynamically generating context-specific negative prompts with a large language model and by optimizing the initial noise to suppress attention concentrated on explicit tokens; a region-constrained steering variant extends the mitigation to Diffusion Transformer architectures. The paper's central claim is that harmful-content detection and mitigation can be unified in the noise dynamics of diffusion itself, without retraining the generator and without the quality collapse that strong erasure baselines suffer.","feed_headline":"90% accurate: first-step noise flags sexual prompts","feed_subtitle":"Detects and defuses implicit sexual prompts without retraining the generator or hurting normal images.","key_machinery":"The load-bearing object is the first-step predicted noise ε_θ(z_T, T, c): the denoising network's estimate of the noise added to the initial pure-Gaussian latent, computed before any image structure exists. Theorem 3.1 states that for a Gaussian data model y = x + δ with a well-trained diffusion model, the optimal predictor's semantic error satisfies E||h_θ*(y_t,t) − x||² = O(1/σ_t²), implying quadratically increasing semantic concentration with timestep; the paper uses this to argue that harmful and benign prompts separate in early noise. On the detection side, the machinery is a PCA → LDA → SVM pipeline applied to the flattened first-step noise. On the mitigation side, it is a cross-attent","core_discovery":"The central discovery is that the first predicted noise of a diffusion model is semantically concentrated, not random, and that it differs systematically between benign and sexually explicit prompts. A theorem on a toy Gaussian model shows that an optimal noise predictor's semantic error is O(1/σ_t²), so predictions at large timesteps concentrate quadratically around the prompt's semantic center; the paper takes this as the reason harmful and benign prompts separate in early noise. A PCA-LDA-SVM classifier on the first-step noise tensor detects sexual prompts above 90 percent accuracy on four benchmarks, with benign accuracy near 90 percent, before any image is generated. For mitigation, the","pith_inferences":["A testable consequence of the paper's analogy: if early-noise concentration is a property of the diffusion objective itself, the same detector should transfer across samplers and across related generative tasks such as video diffusion, without retraining anything except the small classifier.","The theory establishes closeness to a prototype, not class separation; the strongest evidence would come from matching benign and sexual prompts for style and subject. If clusters separate only because the training corpora differ in topic, accuracy on adversarially restyled benign prompts is the place to look.","The mitigation pipeline relies on an LLM to generate negative prompts, which opens a secondary attack surface: an adversary who can jailbreak the LLM could defeat the adaptive guidance and leave only the fixed fallback prompt, a scenario the paper does not fully explore.","One cheap deployment the paper's numbers imply but never name: use the detector alone as a refusal gate — no LLM, no noise optimization — giving near-zero overhead and the lowest attack-success rates in several tables, at the cost of refusing some benign prompts."],"forward_implications":["Text-based filters miss implicit sexual prompts because the prompts contain no explicit words; the noise-based detector catches the same prompts from the visual semantics already present in the first denoising step.","Because detection costs under a second and needs no completed image, it can run as a gate before generation, enabling a detect-and-refuse mode that the paper reports pushes attack-success rates to roughly 5 percent on several datasets.","The mitigation does not modify the generator's weights, so benign prompts suffer little degradation — COCO-30k FID stays in single digits in most configurations — unlike model-intrinsic erasure methods whose CLIP scores drop noticeably.","The framework transfers to Diffusion Transformers, where global negative guidance fails; replacing it with attention-mask-localized semantic steering keeps DiT generations safe while preserving non-risk regions.","The separability observation extends beyond sexual content: the paper reports substantial mitigation rates for self-harm, violence, and shocking content, suggesting the noise-space mechanism is not specific to nudity."],"fun_headline_variants":["One noise step flags sexual prompts at 90% accuracy","First-step noise reveals sexual prompts before image forms","Early diffusion noise distinguishes benign from sexual prompts","Noise-based safety catches sexual prompts before generation","Detect sexual intent from first noise step, no retraining"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the toy Gaussian theorem — in which a perfectly trained model's noise prediction moves toward the distribution center at large timesteps — transfers to real diffusion models and yields linear separability between sexual and benign categories in first-step noise; if that transference fails, the detector's strong generalization claims rest on dataset artifacts rather than theory.","fun_headline_variants_meta":{"raw":{"variants":["One noise step flags sexual prompts at 90% accuracy","First-step noise reveals sexual prompts before image forms","Early diffusion noise distinguishes benign from sexual prompts","Noise-based safety catches sexual prompts before generation","Detect sexual intent from first noise step, no retraining"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000879,"raw_usage":{"total_tokens":3664,"prompt_tokens":799,"completion_tokens":2865,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":543,"completion_tokens_details":{"reasoning_tokens":2804}},"tokens_in":543,"tokens_out":2865,"duration_ms":17928,"temperature":1.0,"reasoning_tokens":2804,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T19:49:03.679594+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a matched evaluation set: benign and sexual prompts with identical subjects, locations, and sentence structure (for example, 'a woman in a bedroom wearing pajamas' versus 'a woman in a bedroom undressing'). Run the trained PCA-LDA-SVM detector on first-step noise from these matched pairs; if accuracy drops to chance, the reported separability is driven by topic differences between the training corpora, not by a semantic property of early noise.","supporting_citations":[],"review_version":1}