SafeCFG: Controlling Harmful Features with Dynamic Safe Guidance for Safe Generation

Hongcheng Gao; Jiadong Pan; Jiebo Luo; Liang Li; Qingming Huang; Zheng-Jun Zha

REVIEW 4 major objections 6 minor 56 references

SafeCFG: Controlling Harmful Features with Dynamic Safe Guidance for Safe Generation

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SafeCFG swaps the empty-condition anchor in classifier-free guidance for a harmfulness-adapted embedding, making higher guidance scales erase harmful content instead of amplifying it.

desk verdict A clever plug-in safety guidance idea with decent empirical support, but the unsupervised claim and the proof need a serious look before it is published. read the letter →

arxiv 2412.16039 v2 pith:EMKAMH3L submitted 2024-12-20 cs.CV

Jiadong Pan , Liang Li , Hongcheng Gao , Zheng-Jun Zha , Qingming Huang , Jiebo Luo This is my paper · ORCID

classification cs.CV

keywords safegenerationtext-to-imagediffusionmodelsclassifier-freeguidancedynamicconcepterasureunsupervisedalignmentharmfulnessdetection

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a mechanism that lets text-to-image diffusion models refuse harmful prompts without retraining the model or degrading ordinary generation. It works by changing what classifier-free guidance subtracts: instead of the score with no text condition, SafeCFG subtracts the score with an embedding that has been processed to strip harmful features. For clean prompts that processed embedding behaves like the empty condition, so the generation trajectory is unchanged; for harmful prompts it acts as a strong negative guide, and the erasure grows as the guidance scale is raised. The same embedding distance also gives a continuous harmfulness score, which the authors use to safely fine-tune diffusion models without any pre-existing clean or harmful labels. Reported results show harmful-content detection dropping while image quality metrics stay close to the unmodified model.

What carries the argument

The load-bearing object is the adaptive harmful feature control (AHFC) module, a small multi-head self-attention transformer that maps a prompt embedding $c$ to an erased embedding $\mathrm{AHFC}(c)$. Dynamic safe guidance (DSG) then uses this embedding in place of the empty condition $\phi$ in the CFG score, so Eq. (10) becomes $\tilde{\boldsymbol{\epsilon}}_\theta(x_t,c,t)=\boldsymbol{\epsilon}_\theta(x_t,c,t)+\eta(\boldsymbol{\epsilon}_\theta(x_t,c,t)-\boldsymbol{\epsilon}_\theta(x_t,\mathrm{AHFC}(c),t))$, with the training loss of Eq. (13) forcing $\mathrm{AHFC}(c_c)\approx\phi$ for clean prompts and $\mathrm{AHFC}(c_f)\approx 2c_f-\phi$ for harmful prompts. A secondary mechanism, the harmful Euclidean distance (HED) $d(c)=\|\mathrm{AHFC}(c)-\phi\|_2$, converts the module's behavior into a per-prompt harmfulness score that drives the unsupervised training objective of Eq. (15).

What would settle it

Run SafeCFG on a held-out set of harmful prompts from categories not in the training set, such as self-harm, hate symbols, or recently coined euphemisms, and measure the harmfulness detection rate as the guidance scale increases; if the rate does not decrease monotonically, or if clean-prompt quality degrades noticeably for clean prompts that share vocabulary with harmful ones, the method's core generalization premise fails.

Watch

Extended reading notes

Core claim

The central claim is that replacing the unconditional score in classifier-free guidance, $\boldsymbol{\epsilon}_\theta(x_t,\phi,t)$, with $\boldsymbol{\epsilon}_\theta(x_t,\mathrm{AHFC}(c),t)$ turns CFG into a safety mechanism while preserving its quality benefits. The adaptive harmful feature control (AHFC) module is trained so that for clean prompts its output embedding is nearly the empty embedding, and for harmful prompts it lies on the opposite side of the empty embedding from the prompt, so the subtracted score becomes negative guidance scaled by the prompt's harmfulness. The paper derives this from a probabilistic view: clean data gets its likelihood boosted while harmful data gets its likelihood suppressed by the modified score. Because the modulation is confined to the unconditional term, the text condition is left intact and text-image alignment is preserved. The paper also establishes that the Euclidean distance between the AHFC output and the empty embedding is a usable harmfulness signal, enabling label-free fine-tuning of the diffusion model itself.

Load-bearing premise

The whole mechanism depends on the AHFC module generalizing from its training prompts: it must behave like the empty condition for every clean prompt it has never seen, and like a strong negative guide for every harmful prompt it has never seen, including prompts whose phrasing differs from the training data.

Editorial extensions

If this is right

SafeCFG can be applied to an already-trained diffusion model as a plug-in: no base-model parameters change, so existing models can be made safer without retraining.
Because the guidance scale controls how strongly the harmful direction is suppressed, users get a single safety dial: higher values erase more harmful content while clean-image quality continues to improve.
The same mechanism erases multiple harmful categories plus artistic styles simultaneously, so it is not limited to one concept at a time.
The harmfulness distance enables fine-tuning of diffusion models without labels, so safety alignment can be done on uncurated text-image collections.
If clean and harmful distributions are separated in HED space, the distance can also act as a detector that flags harmful prompts before generation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

One implicit consequence is that the whole scheme reduces to how well AHFC transfers: if a user writes a harmful prompt in a style or topic category far from the training distribution, the erased embedding could land near the clean side and the safety dial would stop working; testing this explicitly would require a deliberately out-of-distribution harmful prompt set.
The HED signal is a scalar computed from a forward pass of a small transformer, so it could plausibly be reused as a reward or cost in other alignment pipelines, or as a pre-generation filter, without re-running the diffusion model.
The method's separation of clean and harmful embedding geometry suggests that other differentiable transformations of the prompt embedding might achieve similar dynamic guidance; comparing AHFC to simpler operations such as projection away from a harmful subspace would isolate what the learned attention adds.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the idea is real. Replacing the unconditional score in CFG with a learned, prompt-dependent 'safe' embedding—instead of using a fixed negative prompt or editing weights—is a genuine new move in the safe-diffusion space, and the reported numbers show it buys a lot of safety with modest quality cost. Worth a serious referee, but the paper oversells two things: the 'unsupervised' part and the probability proof.

What's good: SafeCFG is plug-in, works across SD v1.4, v2.1 and XL, and the held-out I2P evaluation shows large drops in NudeNet/Q16 with FID almost unchanged—better than SLD or ESD in the clean-quality columns of Table 2. The art-style erasure is a nice extra. The AHFC design is simple: a 2-layer transformer over text embeddings, trained by score-matching to send clean prompts to null and harmful prompts to a negative-guidance direction (Eq. 13). That makes sense and is easy to reproduce in principle.

Soft spots, in order of importance:

1. The Sec. B 'proof' is not a proof of SafeCFG. It starts by assuming Eq. (11) holds—the exact property the loss fits—and then derives likelihood ratios. That's restating the training goal, not justifying it. If the method works, it works because the regression loss generalizes, not because of that appendix.

2. The 'unsupervised' label is partly overstated. AHFC itself is trained with clean/harmful labels (Sec. A.3). The HED distance then serves as a continuous label for fine-tuning the DM, which is a neat trick, but the supervision is inherited, not absent.

3. The generalization risk is real. AHFC is a small module, and the whole mechanism assumes it will map novel prompts—including adversarial or out-of-distribution ones—to the right side of the decision boundary. The held-out I2P results are encouraging, but they are one fixed evaluation set and one training run. No error bars, and the threshold d_th is never reported. Code would make this much easier to trust.

None of these kill the core contribution. The central inference-time guidance idea is sound and worth building on. But the paper should be revised to drop the proof claims, state the inherited supervision honestly, and provide code plus robustness evaluations.

Who this is for: anyone working on inference-time safety for diffusion models, and anyone who wants a cheap alternative to weight-editing erasure. I'd cite it if the code shows up. Send it to peer review, but expect major revisions.

Referee Report

4 major / 6 minor

Summary. The paper proposes SafeCFG, a plug-in guidance mechanism for text-to-image diffusion models. It trains a small transformer (AHFC) on text embeddings to produce an embedding that, when used in place of the unconditional score inside classifier-free guidance, leaves the generation trajectory of clean prompts essentially unchanged but reverses the guidance direction for harmful prompts, thereby erasing harmful content. The method is evaluated on Stable Diffusion V1.4, V2.1, and SD XL using I2P prompts for safety and COCO-30K for quality, and it is also used to fine-tune safe models in a claimed unsupervised manner through a Harmful Euclidean Distance (HED) criterion. Experiments report large reductions in NudeNet/Q16 detection rates and small quality losses relative to existing erasure methods.

Significance. If the central identity behind SafeCFG holds on out-of-distribution prompts, the method is a practical and inexpensive plug-in for improving safety in existing diffusion models, with the additional potential of multi-concept erasure and a label-light fine-tuning procedure. Strengths of the paper are its simple architecture, the breadth of tested base models (SD V1.4, V2.1, SD XL), the use of standard safety metrics on I2P, and the demonstration of simultaneous art-style erasure. However, the load-bearing claim of dynamic, fine-grained guidance rests on a training objective that does not itself enforce the required behavior for unseen prompts, and the supplementary proof of effectiveness assumes the very identity that the loss is fitted to. The 'unsupervised' wording is also stronger than what Sec. A.3 supports. These issues are addressable, but they currently leave the main generalization claim under-supported.

major comments (4)

[Sec. 4.1, Eq. (11); Supplementary Sec. B, Eqs. (19)-(20)] The central identity of SafeCFG is Eq. (11), which asserts that AHFC preserves the unconditional score for clean prompts and reverses the harmful CFG direction. The probabilistic proof in Supplementary Sec. B simply assumes this identity through Eqs. (19) and (20), and therefore does not establish that training with Eq. (13) produces the required behavior on unseen prompts. Since the harmful training prompts are Mistral-generated while the safety evaluation is on I2P, the paper should report AHFC's clean/harmful separation accuracy (e.g., HED AUC or a held-out classification metric) and the degree to which Eq. (11) holds on I2P prompts. Without this evidence, the plug-in mechanism is only validated on the training distribution.
[Abstract; Sec. 4.2; Sec. A.3] The paper claims 'unsupervised safe alignment' without pre-defined clean or harmful labels. However, Sec. A.3 states that AHFC is trained by 'combining both clean and harmful images with explicit labels.' The unsupervised step in Sec. 4.2 therefore relies on a label-trained detector; this is more accurately described as pseudo-labeling or two-stage training than as fully unsupervised alignment. Please either revise the claim to reflect this dependence on labeled AHFC training or provide a truly label-free variant of AHFC.
[Sec. 4.1, Eq. (13)] Eq. (13) forces epsilon_theta(x_t, AHFC(c_f), t) to equal 2 epsilon_theta(x_t, c_f, t) - epsilon_theta(x_t, phi, t) for every harmful training prompt. Substituting this into Eq. (10) yields exactly negative guidance with a fixed coefficient (eta times one) for all harmful prompts. Consequently, the 'dynamic' and 'fine-grained' control described in the text is not enforced by the training objective; it can only emerge from AHFC's inability to fit the target exactly or from the HED threshold in Sec. 4.2. The paper should either modify the loss to condition on a continuous harmfulness estimate or provide per-prompt evidence that the guidance strength varies with harmfulness as claimed.
[Tables 1, 2, 5, 7] All quantitative comparisons are single-run and lack error bars or significance tests. For example, Table 2 reports SafeCFG (SD V1.4) with FID 14.60 versus vanilla SD V1.4 with FID 14.16, a difference that is likely within run-to-run noise. Without repeated seeds or bootstrap intervals, the claim that SafeCFG preserves clean image quality is not statistically supported. Please provide uncertainty estimates for at least the headline safety and quality metrics.

minor comments (6)

[Eq. (15)] The threshold distance dis_th is used in the unsupervised training objective but its value is never reported in the main text or in Section D of the supplement; please specify it for each model.
[Abstract; Sec. 4.2] The abstract says SafeCFG can 'detect image harmfulness,' but Eq. (14) defines HED on text embeddings rather than on images; please adjust the wording to avoid implying an image-based detector.
[Table 2 and Table 7] There are typos in the tables: 'ESD-Nusity-u10' should be 'ESD-Nudity-u10' and 'Asethetic Score' should be 'Aesthetic Score'.
[References] References [46] and [47] appear to cite the same paper with the same title and pages (ECCV 2024, pp. 385-403) under two different numbers; please consolidate.
[Table 1] The column label 'SOTA CFG' is confusing because CFG is a guidance method, not a safety baseline; please use a clearer description such as 'standard CFG'.
[Fig. 4 caption] There is a typo in the caption: 'Sherpard' should be 'Shepherd'.

Circularity Check

1 steps flagged · score 6.0 of 10

SafeCFG's Sec. B proof assumes Eq. (11), which is exactly the regression target of the training loss Eq. (13); the theoretical derivation is a restatement of the fit, though held-out experiments provide some independent support.

self definitional [Eq. (11), Eq. (13), Sec. 4.1, and Sec. B of Supplementary Material]
"According to Eq. (11), similar to the derivation above, for clean data {x_c,c_c}, p(x_t|AHFC(c_c))∼p(x_t), while for harmful data {x_f,c_f}, p(x_t|AHFC(c_f))∼p^2(x_t|c_f)/p(x_t). If we substitute Eq. (19) and Eq. (20) into Eq. (18) ... which results in a lower probability of harmful data assigned by dividing p(c_f|x_t). We utilize the L2 Loss to ensure that the score predicted by AHFC aligns with positive guidance when generating clean images and shifts toward negative guidance when handling harmful images according to Eq. (11)."

The two identities in Eq. (11) are exactly what the L2 loss Eq. (13) fits: the first term drives εθ(xt,AHFC(cc),t) toward εθ(xt,φ,t), and the second term drives εθ(xt,AHFC(cf),t) toward 2εθ(xt,cf,t)−εθ(xt,φ,t), i.e. the negative-guidance score. Section B then assumes Eq. (11) via Eqs. (19) and (20) to conclude that clean likelihood is raised and harmful likelihood is lowered. The proof is therefore not an independent derivation: it unpacks the same score relation that the training loss is explicitly constructed to enforce. On the training distribution Eq. (11) holds by construction only if the loss reaches zero; no argument shows that the small 2-layer, 16-head AHFC satisfies Eq. (11) on unseen prompts.

full rationale

The main load-bearing step is the claimed proof that SafeCFG improves clean-image likelihood and suppresses harmful-image likelihood. That proof (Sec. B) starts from Eq. (11), which is not an independently established property of the trained AHFC but the exact behavior the L2 loss in Eq. (13) is designed to fit. Thus the theoretical derivation reduces to the training objective by construction. I still score this as partial rather than total circularity (6, not 8 or 10): the paper also reports quantitative safety/quality results on I2P and COCO benchmarks with external detectors (NudeNet, Q16), and those experiments are the actual empirical test of whether AHFC generalizes beyond its training distribution. If those evaluations share prompts with training, the independence is weaker, but the paper does not make that overlap explicit. Two further concerns are noted without treating them as circularity: the threshold d_sth in Eq. (15) is never reported, and the 'unsupervised' safe-alignment claim relies on HED, which inherits its clean/harmful discrimination from the labeled AHFC training; these are overstatement and reproducibility issues, not additional circular steps.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central mechanism relies on a learned AHFC module whose training requires labeled clean/harmful data, and on the assumption that embeddings behave like semantic directions. The contribution is a new guidance scheme, not a new physical or mathematical entity; no new particles or forces are introduced.

free parameters (3)

guidance scale eta = 7.5 (default in experiments)
Global scaling of the safe guidance term in Eq. (10); chosen by hand and standard for CFG, but it directly controls the safety-quality trade-off.
HED threshold dis_th = not reported
Determines whether a prompt is treated as harmful in Eq. (15) and scales the safe guidance via exp(dis^2/dis_th^2); its value is not stated, making the unsupervised training setup incompletely specified.
harmful-target coefficient in Eq. (13) = 2
The target for harmful prompts is 2*eps_theta(xt,cf,t) - eps_theta(xt,phi,t); this coefficient fixes the magnitude of the safe guidance and is an ad hoc design choice.

assumptions (4)

domain assumption Score-based diffusion models can be guided by modifying text embeddings, and L2 distances in embedding space reflect semantic safe/harmful directions (Eqs. 10, 14).
The whole method assumes that replacing the null embedding phi with AHFC(c) and taking embedding distances yields meaningful safe/harmful guidance.
domain assumption AHFC training on a finite labeled set transfers to unseen harmful prompts.
Generalization of the learned feature controller to I2P prompts is assumed; the paper provides no theory or guarantee.
domain assumption For clean prompts the trained AHFC exactly recovers unconditional-score behavior (Eq. 11).
Eq. (11) is asserted for clean c; the loss only approximately enforces this on training prompts.
standard math DDPM/score equivalence and classifier-free guidance derivation (Eqs. 1-8).
The paper relies on established diffusion model theory and the standard CFG formula.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SafeCFG: Controlling Harmful Features with Dynamic Safe Guidance for Safe Generation." pith.science (2026). https://pith.science/paper/EMKAMH3L

@misc{pith2026241216039,
  author       = {Pith},
  title        = {Pith review of: SafeCFG: Controlling Harmful Features with Dynamic Safe Guidance for Safe Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EMKAMH3L}},
  note         = {Machine review of arXiv:2412.16039}
}

read the original abstract

Diffusion models (DMs) have demonstrated exceptional performance in text-to-image tasks, leading to their widespread use. With the introduction of classifier-free guidance (CFG), the quality of images generated by DMs is significantly improved. However, one can use DMs to generate more harmful images by maliciously guiding the image generation process through CFG. Existing safe alignment methods aim to mitigate the risk of generating harmful images but often reduce the quality of clean image generation. To address this issue, we propose SafeCFG to adaptively control harmful features with dynamic safe guidance by modulating the CFG generation process. It dynamically guides the CFG generation process based on the harmfulness of the prompts, inducing significant deviations only in harmful CFG generations, achieving high quality and safety generation. SafeCFG can simultaneously modulate different harmful CFG generation processes, so it could eliminate harmful elements while preserving high-quality generation. Additionally, SafeCFG provides the ability to detect image harmfulness, allowing unsupervised safe alignment on DMs without pre-defined clean or harmful labels. Experimental results show that images generated by SafeCFG achieve both high quality and safety, and safe DMs trained in our unsupervised manner also exhibit good safety performance.

Figures

Figures reproduced from arXiv: 2412.16039 by the authors.

**Figure 2.** Implementation of SafeCFG. The prompt input provides embeddings processed by adaptive harmful feature control [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Unsupervised safe training process of DMs. (i) Given text embeddings [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Images generated by different safe methods. Our [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Histograms of 𝑑𝑖𝑠(𝑐) for clean and harmful concepts. Results show that 𝑑𝑖𝑠(𝑐) enables unsupervised training of Safe DMs. This distance measures the harmfulness of 𝑐, aiding in the dynamic adjustment of parameters for safety-aligned training [PITH_FULL_IMAGE:figures…

**Figure 7.** Figure 7: Generated images after removing Van Gogh’s style. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

**Figure 8.** Figure 8: Clean images generated by SafeCFG at different guidance scales. When generating clean images, the generation [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

**Figure 9.** Figure 9: Harmful images and artistic images generated by SafeCFG at different guidance scales. When generating harmful [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 17 canonical work pages

[1]

James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al . 2023. Improving im- age generation with better captions.Computer Science. https://cdn. openai. com/papers/dall-e-3. pdf2, 3 (2023), 8

2023
[2]

Yuzhu Cai, Sheng Yin, Yuxi Wei, Chenxin Xu, Weibo Mao, Felix Juefei-Xu, Siheng Chen, and Yanfeng Wang. 2024. Ethical-Lens: Curbing Malicious Usages of Open-Source Text-to-Image Models.arXiv preprint arXiv:2404.12104(2024)

work page Pith review arXiv 2024
[3]

Ruidong Chen, Honglin Guo, Lanjun Wang, Chenyu Zhang, Weizhi Nie, and An-An Liu. 2025. TRCE: Towards Reliable Malicious Concept Erasure in Text-to- Image Diffusion Models.arXiv preprint arXiv:2503.07389(2025)

arXiv 2025
[4]

Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis.Advances in Neural Information Processing Systems(2021)

work page 2021
[5]

Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau
[6]

Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyńska, and David Bau. 2024. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 5111–5120

2024
[7]

Hongcheng Gao, Hao Zhang, Yinpeng Dong, and Zhijie Deng. 2023. Evaluating the robustness of text-to-image diffusion models against real-world attacks.arXiv preprint arXiv:2306.13103(2023)

arXiv 2023
[8]

Leon A Gatys, Alexander S Ecker, and Matthias Bethge. 2016. Image style transfer using convolutional neural networks. InProceedings of the IEEE conference on computer vision and pattern recognition. 2414–2423

2016

Show all 56 references

[9]

Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. 2024. Reliable and efficient concept erasure of text-to-image diffusion models.arXiv preprint arXiv:2407.12383(2024)

2024 arXiv
[10]

Alvin Heng and Harold Soh. 2024. Selective amnesia: A continual learning approach to forgetting in deep generative models.Advances in Neural Information Processing Systems36 (2024)

2024
[11]

Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi
[12]

Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in Neural Information Processing Systems (2017), 6626–6637

2017
[13]

Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. InAdvances in Neural Information Processing Systems

2020
[14]

Jonathan Ho and Tim Salimans. 2022. Classifier-free diffusion guidance.arXiv preprint arXiv:2207.12598(2022)

2022 arXiv
[15]

Yuepeng Hu, Zhengyuan Jiang, and Neil Zhenqiang Gong. 2025. SafeText: Safe Text-to-image Models via Aligning the Text Encoder.arXiv preprint arXiv:2502.20623(2025)

2025 arXiv
[16]

Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, De- vendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al . 2023. Mistral 7B.arXiv preprint arXiv:2310.06825(2023)

2023 arXiv
[17]

Durk P Kingma, Tim Salimans, and Max Welling. 2015. Variational dropout and the local reparameterization trick.Advances in Neural Information Processing Systems28 (2015)

2015
[18]

Felix Koulischer, Johannes Deleu, Gabriel Raya, Thomas Demeester, and Luca Ambrogioni. 2024. Dynamic Negative Guidance of Diffusion Models.arXiv preprint arXiv:2410.14398(2024)

2024 arXiv
[19]

LAION-AI. 2022. LAION-Aesthetics-Predictor V1. https://github.com/LAION- AI/aesthetic-predictor

2022
[20]

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. InComputer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Procee...

2014
[21]

Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. 2021. Glide: Towards photorealistic image generation and editing with text-guided diffusion models.arXiv preprint arXiv:2112.10741(2021)

2021 arXiv
[22]

Jiadong Pan, Hongcheng Gao, Zongyu Wu, Taihang Hu, Li Su, Qingming Huang, and Liang Li. 2024. Leveraging catastrophic forgetting to develop safe diffusion models against malicious finetuning.Advances in Neural Information Processing Systems37 (2024), 115208–115232

2024
[23]

Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. 2023. Sdxl: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952 (2023)

2023 arXiv
[24]

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. InInternational Conference on Machine Learnin...

2021
[25]

Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tramèr
[26]

Dillon Reis, Jordan Kupec, Jacqueline Hong, and Ahmad Daoudi. 2023. Real-time flying object detection with YOLOv8.arXiv preprint arXiv:2305.09972(2023)

2023 arXiv
[27]

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10684–10695

2022
[28]

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. 2015. U-net: Convolutional networks for biomedical image segmentation. InInternational Conference on Medical image computing and computer-assisted intervention. Springer, 234–241

2015
[29]

Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. 2022. Photorealistic text-to-image diffusion models with deep language understanding. InAdvances in Neural Inf...

2022
[30]

Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. 2016. Improved techniques for training gans. InAdvances in Neural Information Processing Systems

2016
[31]

Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting
[32]

Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. 2022. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content?. InProceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. 1350–1361

2022
[33]

Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. 2022. Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in Neural In...

2022
[34]

Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli
[35]

InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 22522–22531
[36]

Yang Song and Stefano Ermon. 2019. Generative modeling by estimating gradients of the data distribution. InAdvances in Neural Information Processing Systems. 11895–11907

2019
[37]

Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Ste- fano Ermon, and Ben Poole. 2021. Score-Based Generative Modeling through Stochastic Differential Equations. InInternational Conference on Learning Repre- sentations

2021
[38]

Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. Journal of machine learning research9, 11 (2008)

2008
[39]

A Vaswani. 2017. Attention is all you need.Advances in Neural Information Processing Systems(2017)

2017
[40]

Jiaming Song, Chenlin Meng, and Stefano Ermon. 2020. Denoising diffusion implicit models.arXiv preprint arXiv:2010.02502(2020)

2020 arXiv
[41]

Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. 2024. Erasediff: Erasing data influence in diffusion models.arXiv preprint arXiv:2401.05779(2024)

2024 arXiv
[42]

Zongyu Wu, Hongcheng Gao, Yueze Wang, Xiang Zhang, and Suhang Wang
[43]

Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi
[44]

Hongxiang Zhang, Yifeng He, and Hao Chen. 2024. SteerDiff: Steering towards Safe Text-to-Image Diffusion Models.arXiv preprint arXiv:2410.02710(2024)

2024
[45]

Mandic Vladimir and Weisinger Jared. 2019. Nudenet: Neural nets for nudity classification, detection and selective censoring. https://github.com/vladmandic/ nudenet

2019
[46]

Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. 2024. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision. Springer, 385–403

2024
[47]

Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. 2025. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision. Springer, 385–403

2025
[48]

<s>[INST]Can you give me 50 descriptions of harmful pictures?[/INST]

Wendi Zheng, Jiayan Teng, Zhuoyi Yang, Weihan Wang, Jidong Chen, Xiaotao Gu, Yuxiao Dong, Ming Ding, and Jie Tang. 2024. Cogview3: Finer and faster text-to-image generation via relay diffusion.arXiv preprint arXiv:2403.05121 (2024). SafeCFG: Controlling Harmful Features with D...

2024 arXiv
[50]

In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

Forget-me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 1755–1764
[52]

Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang
[2015]

In International Conference on Machine Learning

Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning. PMLR, 2256–2265
[2018]

InProceedings of the IEEE conference on computer vision and pattern recognition

The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition. 586–595
[2021]

In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

CLIPScore: A Reference-free Evaluation Metric for Image Captioning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 7514–7528

2021
[2022]

Red-teaming the stable diffusion safety filter.arXiv preprint arXiv:2210.04610 (2022)

2022 arXiv
[2023]

InProceedings of the IEEE/CVF International Conference on Computer Vision

Erasing concepts from diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision. 2426–2436
[2024]

arXiv Preprint, May, 2025, arXiv.org Pan et al

Universal Prompt Optimizer for Safe Text-to-Image Generation.arXiv preprint arXiv:2402.10882(2024). arXiv Preprint, May, 2025, arXiv.org Pan et al

2024 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al . 2023. Improving im- age generation with better captions.Computer Science. https://cdn. openai. com/papers/dall-e-3. pdf2, 3 (2023), 8

2023

[2] [2]

Yuzhu Cai, Sheng Yin, Yuxi Wei, Chenxin Xu, Weibo Mao, Felix Juefei-Xu, Siheng Chen, and Yanfeng Wang. 2024. Ethical-Lens: Curbing Malicious Usages of Open-Source Text-to-Image Models.arXiv preprint arXiv:2404.12104(2024)

work page Pith review arXiv 2024

[3] [3]

Ruidong Chen, Honglin Guo, Lanjun Wang, Chenyu Zhang, Weizhi Nie, and An-An Liu. 2025. TRCE: Towards Reliable Malicious Concept Erasure in Text-to- Image Diffusion Models.arXiv preprint arXiv:2503.07389(2025)

arXiv 2025

[4] [4]

Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis.Advances in Neural Information Processing Systems(2021)

work page 2021

[5] [5]

Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau

[6] [6]

Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyńska, and David Bau. 2024. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 5111–5120

2024

[7] [7]

Hongcheng Gao, Hao Zhang, Yinpeng Dong, and Zhijie Deng. 2023. Evaluating the robustness of text-to-image diffusion models against real-world attacks.arXiv preprint arXiv:2306.13103(2023)

arXiv 2023

[8] [8]

Leon A Gatys, Alexander S Ecker, and Matthias Bethge. 2016. Image style transfer using convolutional neural networks. InProceedings of the IEEE conference on computer vision and pattern recognition. 2414–2423

2016