Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PromptSafe claims a text-only trained soft prompt plus a toxicity gate can hold unsafe image output at a 2.36 percent rate while preserving benign fidelity.

desk verdict Useful, lightweight T2I safety defense with a genuinely new text-only soft-prompt design, but the headline 2.36% number is measured with the same detector used to filter training data, so the safety claim needs independent verification before I would believe the SOTA ranking. read the letter →

arxiv 2508.01272 v2 pith:MLKCA24V submitted 2025-08-02 cs.CV

Zonglei Jing , Xiao Yang , Xiaoqian Li , Siyuan Liang , Aishan Liu , Mingchuan Zhang , Xianglong Liu This is my paper · ORCID
classification cs.CV
keywords text-to-imagesafetyNSFWsuppressionsoftprompttuninggatedtoxicitycontroldiffusionmodelsrewritingbenignpreservation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PromptSafe is a defense framework for text-to-image diffusion models that tries to prove a specific trade-off is available: strong not-safe-for-work (NSFW) suppression without expensive image-text training data and without degrading benign generation. Its central claim is that a universal soft prompt learned from LLM-rewritten text pairs, combined with a toxicity gate that scales the prompt's strength at inference, achieves a 2.36% unsafe generation rate on the I2P benchmark across sexual, violent, political, and disturbing categories. The same mechanism preserves a text-image alignment score of 26.30 on COCO benign prompts, nearly matching the undefended model, and adds no inference time beyond native generation. The paper also claims the defense generalizes to unseen harmful categories, transfers across text-to-image model architectures, and weakens but does not collapse under adaptive white-box attacks.

What carries the argument

The central object is a trainable universal soft prompt embedding $v^*$ whose strength is modulated by a gated control network. Training uses text-only pairs $(P^m, P^s)$ from an LLM rewrite; the diffusion U-Net predicts noise $\epsilon = U(z_T, T, E(P))$ from a randomly sampled latent $z_0 \sim \mathcal{N}(0, I_d)$ with added noise, so no image supervision is needed. A triplet loss organizes the noise-prediction space by pulling $\tilde{\epsilon}^m$ (the soft-prompt-augmented malicious prompt) toward $\epsilon^s$ (its safe rewrite) and pushing it away from $\epsilon^m$, while a benign-preservation loss keeps $\tilde{\epsilon}^s$ close to $\epsilon^s$. At inference the gate $f_\theta$ maps the prompt through a text-image encoder and a three-layer head to a toxicity score $\gamma \in [0,1]$, and the final defensive embedding is the interpolation $v' = \gamma v^* + (1-\gamma)v_0$, prepended to the original prompt embedding.

What would settle it

Run the trained defense on the unsafe-prompt benchmark with the gate forced to $\gamma=0$ (no defense) and with the gate forced to $\gamma=1$ (full defense): if the unsafe ratio at $\gamma=0$ is not near the vanilla baseline, the soft prompt alone is suppressing NSFW and the gate is redundant; if the unsafe ratio at $\gamma=1$ is not near 2.36%, the learned soft prompt, not the gate, is the active ingredient.

Watch

Extended reading notes

Core claim

On the paper's own terms, PromptSafe establishes that a purely text-driven soft prompt can replace image supervision in safe-image diffusion tuning. Instead of training on curated image-text pairs, the authors rewrite unsafe prompts into semantically aligned safe alternatives with an LLM, then optimize a trainable embedding vector that is prepended to the prompt. During training the U-Net's noise prediction on randomly sampled pure-noise latents is used in a triplet loss: the soft-prompt-augmented malicious prompt is pulled toward the safe rewrite and pushed away from the original malicious prompt, while a benign-preservation term keeps the soft prompt neutral on safe rewrites. At inference a gated network estimates prompt toxicity and linearly interpolates between the defensive embedding and a zero vector, so unsafe prompts receive strong intervention and benign prompts are left almost untouched. The measured result is the lowest average unsafe ratio among the compared defenses (2.36% on I2P), benign alignment score 26.30 on COCO, and inference time equal to the base model.

Load-bearing premise

The load-bearing premise is that the U-Net's noise prediction on a random pure-noise latent carries enough prompt-dependent semantic signal for the triplet loss to steer the soft prompt; if denoising targets drawn from pure noise are mostly noise-driven, the learned embedding would not be the cause of the reported suppression.

Editorial extensions

If this is right

  • If the central claim is right, text-to-image safety can be strengthened with a few hundred text pairs and no curated image data, removing the main scaling bottleneck of soft-prompt defenses.
  • The gating mechanism implies defense intensity can be matched to per-prompt risk at inference time, so safe prompts should keep native image quality rather than absorbing a uniform style shift.
  • Because the training signal lives in noise-prediction space rather than image space, the same soft prompt training should transfer to any diffusion model with the same text-encoder embedding dimension.
  • The framework can stack on top of safety-aligned models, further lowering unsafe ratios that retraining alone does not eliminate.
  • Adaptive attacks on the gate weaken but do not fully break the defense, which suggests gate robustness is the next natural point of hardening.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension: the noise-prediction triplet could be repurposed as a general prompt-steering primitive, e.g., to edit style or erase concepts, wherever a text-only supervised pair can be written.
  • The paper leaves implicit that the gated classifier is a single point of failure for the whole defense; an attacker who can flip the toxicity score to zero would neutralize the soft prompt without touching the diffusion weights.
  • The pure-noise training objective suggests a cheaper auditing procedure: run the trained soft prompt against a held-out set of adversarial prompt rewrites and measure whether unsafe-ratio gains persist when the gate is bypassed.
  • The reported 2.36% relies on the specific unsafe-image checker used for evaluation; a different checker with different thresholds could give materially different numbers, so cross-checker reproducibility is worth testing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. PromptSafe proposes a gated prompt-tuning defense for text-to-image diffusion models. Instead of training on image-text pairs, it uses an LLM to rewrite unsafe prompts into semantically aligned safe counterparts, then optimizes a universal soft prompt with a triplet loss computed from U-Net noise predictions on pure-noise latents. At inference, a CLIP-based gated network predicts a toxicity score that interpolates between the defensive embedding and a zero vector, so that benign prompts receive little or no intervention. The paper reports a state-of-the-art unsafe generation ratio of 2.36% on I2P, while preserving benign fidelity (CLIP score 26.30 on COCO), and claims generalization to unseen harmful categories, transfer across Stable Diffusion architectures, and robustness under adaptive attacks and jailbreak prompts.

Significance. If validated, the method is practically attractive: it removes the need for costly curated image-text data, introduces a per-prompt adaptive defense strength, and adds negligible inference overhead (matching vanilla SDv1.4 at 0.58 s/image). The reported gains over eight baselines are substantial, and the architecture-level experiments (Table 4, Fig. 4/5) are broader than in many prior works. However, the central safety claim rests on an evaluation metric that is the same classifier used to filter the training corpus, which materially weakens the claim as stated. The training objective's reliance on pure-noise latents also needs empirical validation. These issues are addressable with additional experiments, but they are load-bearing for the paper's headline results.

major comments (3)
  1. [Sec. 5.1 and Eq. (4)] The Unsafe Ratio metric is computed using the UD checker from [36], which is the same detector used as fsafe in Eq. (4) to filter the training corpus: a rewritten prompt is kept only if fsafe(G(P_s))=1, and the soft prompt is then optimized to pull unsafe prompts toward those safe embeddings. Evaluating with the same classifier is circular and differential, because PromptSafe's training pipeline has implicit access to the evaluation metric while the eight baselines do not. This can inflate both the absolute 2.36% number and the relative ranking. The same issue affects the generalization results in Table 3 and the jailbreak results in Table 4c. Please report Unsafe Ratio with an independent safety detector (e.g., a different NSFW classifier or human evaluation), or at minimum present both metrics for all methods and discuss the circularity explicitly.
  2. [Sec. 4.2, Eq. (6)] The training procedure samples a clean latent z0 ~ N(0, I_d) from the Gaussian prior and then adds T steps of noise before asking the U-Net to predict the noise. In standard DDPM training, noise prediction is supervised by a real image latent; with pure noise as the 'clean' input, the denoising target is ill-defined and the predicted noise may be dominated by input noise rather than by prompt semantics. The claim that the predicted noise 'becomes entirely reliant on the cross attention-driven text condition' is not self-evident and needs direct validation. Please provide empirical evidence that the noise predictions for different prompts are meaningfully separable, or compare against a variant trained with real image latents (e.g., from COCO) to show that the pure-noise objective is not merely fitting noise.
  3. [Tables 1, 3, and 4] All reported numbers are point estimates with no error bars, confidence intervals, or statistical significance tests. This is particularly problematic for the benign preservation comparisons where differences are small (e.g., CLIP 26.30 vs. 26.27 for SafeGuider in Table 1; LPIPS 0.694 vs. 0.696). Without variance information or a significance test, the claim that PromptSafe 'outperforms' these baselines on benign preservation is not empirically supported. Please report mean and standard deviation over multiple seeds or runs, and indicate the number of prompts and images used for each metric.
minor comments (5)
  1. [Throughout] There are several typos and grammatical errors: 'Inspired of' should be 'Inspired by', 'suggestes' should be 'suggests', and 'relies on heavily on' is redundant. These should be corrected.
  2. [Eq. (1)] Equation (1) has mismatched parentheses: I = G(P) = D( U(z_T | E_p), where ... should be D(U(z_T | E_p)), with the closing parenthesis before 'where'. Please fix the notation.
  3. [Fig. 1 and surrounding text] The manuscript contains internal version markers and layout notes (e.g., '20250725 - head -v2' and '20250728 - v4' with instructions like '字少一点，大一点，只留下关键内容，加粗加红') that should be removed before submission.
  4. [Sec. 4.3 and Eq. (10)] The gated network is trained on 'curated unsafe datasets' and MS COCO 2017 val captions, but the precise composition and size of the malicious training set for the gate are not given. Please specify which datasets are used and how the benign/malicious balance is set, since the gate's behavior is central to the adaptive defense claim.
  5. [Sec. 5.2] The paper states that 'we train one soft prompt per unsafe category and prepend all four to the input at inference for joint control', but the details of how the four embeddings are combined (concatenation, averaging, or something else) and how the gate modulates them are not described. Please clarify the exact inference-time composition.

Circularity Check

1 steps flagged · score 6.0 of 10

The SOTA 2.36% unsafe rate is measured with the same UD checker used to filter the training corpus, so the central safety claim is partially circular.

  1. fitted input called prediction [Section 4.1, Eq. (4); Section 5.1, Evaluation Metrics]
    "P∗s = {P s_i | fsim(P m_i, Ps_i) ≥ τ ∧ fsafe(G(P s_i)) = 1}, (4) ... fsafe(·) denotes a safety image checker based on [36], returning 1 if the generated image is safe and 0 otherwise. ... Unsafe Ratio measures the proportion of generated images classified as unsafe using UD checker [36]."

    The same UD checker [36] is used both to filter the training corpus in Eq. (4) and to compute the reported Unsafe Ratio in Sec. 5.1. Safe rewrites are kept only if fsafe(G(P s_i)) = 1, and the soft prompt is optimized to pull unsafe prompts toward these UD-passing safe prompts. Reporting Unsafe Ratio with that same detector therefore evaluates the defense against the very classifier it was constructed to satisfy, giving PromptSafe implicit access to the metric while the eight baselines do not. This can inflate the absolute 2.36% number and the relative ranking; the central safety claim is not an independent measurement of NSFW suppression.

full rationale

The central safety metric is contaminated: Eq. (4) selects training safe prompts with fsafe based on [36], and Sec. 5.1 measures Unsafe Ratio with the same UD checker [36]. The learned soft prompt is trained to make unsafe prompts align with those UD-passing safe prompts, so the reported unsafe rate is partly an artifact of the evaluation detector. This makes the headline SOTA comparison uneven and reduces the strength of the safety claim. No other load-bearing circularity was found: the text-only training corpus construction, triplet loss, and gated control are independent of the final metric apart from this shared detector, and self-citations to [14, 15, 28] are not load-bearing for the derivation. The pure-noise training objective in Eq. (6) is a questionable assumption about U-Net behavior, but it is not a circularity. Overall, the paper has one substantial train/eval circularity affecting its main quantitative claim, so the score is 6.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method rests on several untested domain assumptions: that noise predictions from random pure-noise latents encode prompt semantics; that the UD checker is a valid safety oracle both for filtering and for evaluation; that LLM rewrites preserve semantic alignment; and that the gated classifier reliably estimates toxicity. These are not derived or externally validated, so the contribution is conditional on them.

free parameters (4)
  • lambda (loss weight) = 0.7 (chosen from 0.1-0.9 sweep)
    Balances triplet detoxification loss and benign preservation loss; Table 5 shows safety improves monotonically with lambda while CLIP drops, and 0.6-0.7 is selected as the best trade-off.
  • triplet margin M = not reported
    Controls semantic separation in Eq. (7); no value or sensitivity analysis is given.
  • similarity threshold tau = 0.7
    Filters LLM rewrites by CLIP semantic similarity to the original unsafe prompt in Eq. (4).
  • number of soft tokens = 4 (one per unsafe category)
    The paper trains one soft prompt per category and prepends all four at inference; the token length per category is not specified.
assumptions (4)
  • domain assumption The U-Net's noise prediction on random pure-noise latents encodes prompt semantics useful for soft prompt tuning.
    Section 4.2 Eq. (6) uses z0 ~ N(0,I_d) as the clean latent for computing epsilon_m, epsilon_s, and epsilon_tilde_m; no evidence is given that such noise predictions are semantically discriminative.
  • domain assumption The UD checker (Unsafe Diffusion, [36]) provides a valid safety oracle for both training data filtering and evaluation.
    Eq. (4) filters candidate safe rewrites by fsafe based on [36], and Sec. 5.1 measures Unsafe Ratio with the same UD checker, creating a circular safety measure.
  • domain assumption LLM rewrites preserve semantic alignment (CLIP similarity >= 0.7) and visual safety.
    Eq. (4) assumes the LLM plus filtering yields safe, semantically consistent pairs; no human evaluation is provided.
  • domain assumption The gated network's toxicity score reliably separates malicious from benign prompts at inference.
    Section 4.3 trains a three-layer classifier on CLIP embeddings; Table 4b shows it degrades under PGD attack, so its reliability is situational.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generation." pith.science (2026). https://pith.science/paper/MLKCA24V

@misc{pith2026250801272,
  author       = {Pith},
  title        = {Pith review of: PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MLKCA24V}},
  note         = {Machine review of arXiv:2508.01272}
}
read the original abstract

Text-to-image (T2I) models have demonstrated remarkable generative capabilities but remain vulnerable to producing not-safe-for-work (NSFW) content, such as violent or explicit imagery. While recent moderation efforts have introduced soft prompt-guided tuning by appending defensive tokens to the input, these approaches often rely on large-scale curated image-text datasets and apply static, one-size-fits-all defenses at inference time. However, this results not only in high computational cost and degraded benign image quality, but also in limited adaptability to the diverse and nuanced safety requirements of real-world prompts. To address these challenges, we propose PromptSafe, a gated prompt tuning framework that combines a lightweight, text-only supervised soft embedding with an inference-time gated control network. Instead of training on expensive image-text datasets, we first rewrite unsafe prompts into semantically aligned but safe alternatives using an LLM, constructing an efficient text-only training corpus. Based on this, we optimize a universal soft prompt that repels unsafe and attracts safe embeddings during the diffusion denoising process. To avoid over-suppressing benign prompts, we introduce a gated mechanism that adaptively adjusts the defensive strength based on estimated prompt toxicity, thereby aligning defense intensity with prompt risk and ensuring strong protection for harmful inputs while preserving benign generation quality. Extensive experiments across multiple benchmarks and T2I models show that PromptSafe achieves a SOTA unsafe generation rate (2.36%), while preserving high benign fidelity. Furthermore, PromptSafe demonstrates strong generalization to unseen harmful categories, robust transferability across diffusion model architectures, and resilience under adaptive adversarial attacks, highlighting its practical value for safe and scalable deployment.

Figures

Figures reproduced from arXiv: 2508.01272 by the authors.

Figure 1
Figure 1. Illustration of PromptSafe defense. A toxicity-aware gated network dynamically adjusts the strength of soft prompt em￾beddings, enabling effective suppression of NSFW while preserv￾ing the benign generation quality. 1. Introduction Text-to-image (T2I) diffusion models, such as Stable Dif￾fusion [3, 40], have achieved remarkable success in gener￾ating high-fidelity images from natural language prompts. However, the w… view at source ↗
Figure 2
Figure 2. Overview of the framework. (1) unsafe prompts are safety rewritten via an LLM; (2) a universal soft prompt is trained to repel [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Visualization of generated outputs among different de [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Transferability of PromptSafe across T2I models with same or different text encoder architectures. to 9.13%, revealing a clear weakening of defense capacity under ℓ∞-PGD adversarial attack. ❷ LPIPS remains stable and CLIP slightly increases, indicating that benign pres…
Figure 6
Figure 6. Figure 6: Ablation on different inference strategies. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Memory Enhanced Fractional-Order Dung Beetle Optimization for Photovoltaic Parameter Identification

    cs.NE 2025-08 reject novelty 3.0 of 10

    The claimed MFO-DBO algorithm and its CEC2017/PV results are absent from the manuscript, which instead contains an unrelated prompt-stealing attack paper.

Reference graph

Works this paper leans on

50 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [36]

    Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Sav- vas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text- to-image models. https://arxiv.org/abs/2305.13873v2, 2023. 2, 3, 4

    work page Pith review arXiv 2023

  2. [1]

    GPT-4 Technical Report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ah- mad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. GPT-4 Technical Report. arXiv preprint arXiv:2303.08774,

    arXiv

  3. [2]

    Distorting embedding space for safety: A defense mechanism for adversarially robust dif- fusion models, 2025

    Jaesin Ahn and Heechul Jung. Distorting embedding space for safety: A defense mechanism for adversarially robust dif- fusion models, 2025. 4

    work page 2025

  4. [3]

    Stable Diffusion V1-4

    CompVis. Stable Diffusion V1-4. https : / / huggingface.co/CompVis/stable-diffusion- v1-4, 2022. 1, 2

    work page 2022

  5. [4]

    Harnessing LLM to attack LLM-guarded text-to-image models, 2024

    Yimo Deng and Huangxun Chen. Harnessing LLM to attack LLM-guarded text-to-image models, 2024. 2

    work page 2024

  6. [5]

    PRJ: Perception–Retrieval–Judgement for Generated Im- ages

    Qiang Fu, Zonglei Jing, Zonghao Ying, and Xiaoqian Li. PRJ: Perception–Retrieval–Judgement for Generated Im- ages. Electronics, 14(12):2354, 2025. 2

    work page 2025

  7. [6]

    Bermano, Gal Chechik, and Daniel Cohen-Or

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H. Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image gen- eration using textual inversion, 2022. 1

    work page 2022

  8. [7]

    Unified concept editing in dif- fusion models, 2024

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in dif- fusion models, 2024. 2

    work page 2024

Show all 50 references
  1. [8]

    RT-attack: Jailbreaking text-to-image models via random token, 2024

    Sensen Gao, Xiaojun Jia, Yihao Huang, Ranjie Duan, Jin- dong Gu, Yang Liu, and Qing Guo. RT-attack: Jailbreaking text-to-image models via random token, 2024. 2, 7

    2024

  2. [9]

    A comprehensive evaluation framework for deep model robustness

    Jun Guo, Wei Bao, Jiakai Wang, Yuqing Ma, Xinghai Gao, Gang Xiao, Aishan Liu, Jian Dong, Xianglong Liu, and Wen- jun Wu. A comprehensive evaluation framework for deep model robustness. Pattern Recognition, 2023. 7

    2023

  3. [10]

    Copyrightshield: Spatial similarity guided backdoor defense against copyright infringement in diffusion models

    Zhixiang Guo, Siyuan Liang, Aishan Liu, and Dacheng Tao. Copyrightshield: Spatial similarity guided backdoor defense against copyright infringement in diffusion models. arXiv preprint arXiv:2412.01528, 2024. 1

    2024 arXiv

  4. [11]

    Detoxify, 2020

    Laura Hanu and Unitary team. Detoxify, 2020. https://github.com/unitaryai/detoxify. 2

    2020

  5. [12]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In Advances in Neural Infor- mation Processing Systems, pages 6840–6851. Curran Asso- ciates, Inc., 2020. 3

    2020

  6. [13]

    SafeText: Safe text-to-image models via aligning the text en- coder, 2025

    Yuepeng Hu, Zhengyuan Jiang, and Neil Zhenqiang Gong. SafeText: Safe text-to-image models via aligning the text en- coder, 2025. 4

    2025

  7. [14]

    Optimal control and filtering for hierarchical decision prob- lems with h ınfty constraint based on stackelberg strategy

    Zonglei Jing, Xiaoqian Li, Peijun Ju, and Huanshui Zhang. Optimal control and filtering for hierarchical decision prob- lems with h ınfty constraint based on stackelberg strategy. IEEE Transactions on Automatic Control, 69(9):6238–6245,

  8. [15]

    CogMorph: Cog- nitive morphing attacks for text-to-image models, 2025

    Zonglei Jing, Zonghao Ying, Le Wang, Siyuan Liang, Ais- han Liu, Xianglong Liu, and Dacheng Tao. CogMorph: Cog- nitive morphing attacks for text-to-image models, 2025. 2, 7

    2025

  9. [16]

    SafeGen: Mitigating sexually explicit content generation in text-to-image models

    Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. SafeGen: Mitigating sexually explicit content generation in text-to-image models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 4807–4821,

    2024

  10. [17]

    Badclip: Dual- embedding guided backdoor attack on multimodal con- trastive learning

    Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual- embedding guided backdoor attack on multimodal con- trastive learning. arXiv preprint arXiv:2311.12075 , 2023. 1

    2023 arXiv

  11. [18]

    Re- visiting backdoor attacks against large vision-language mod- els from domain shift

    Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Ais- han Liu, Mingli Zhu, Xiaochun Cao, and Dacheng Tao. Re- visiting backdoor attacks against large vision-language mod- els from domain shift. In Proceedings of the Computer Vi- sion and Pattern Recognition Conference, pages ...

    2025

  12. [19]

    T2vshield: Model-agnostic jailbreak defense for text- to-video models

    Siyuan Liang, Jiayang Liu, Jiecheng Zhai, Tianmeng Fang, Rongcheng Tu, Aishan Liu, Xiaochun Cao, and Dacheng Tao. T2vshield: Model-agnostic jailbreak defense for text- to-video models. arXiv preprint arXiv:2504.15512, 2025. 1

    2025 arXiv

  13. [20]

    Lawrence Zitnick, and Piotr Doll ´ar

    Tsung-Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Doll ´ar. Microsoft COCO: Common objects in context, 2015. 2, 6

    2015

  14. [21]

    Perceptual-sensitive gan for generating adversarial patches

    Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In AAAI, 2019. 6

    2019

  15. [22]

    Spatiotemporal attacks for embodied agents

    Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen J Maybank, and Dacheng Tao. Spatiotemporal attacks for embodied agents. InECCV, 2020. 6

    2020

  16. [23]

    Bias-based universal adver- sarial patch attack for automatic check-out

    Aishan Liu, Jiakai Wang, Xianglong Liu, Bowen Cao, Chongzhi Zhang, and Hang Yu. Bias-based universal adver- sarial patch attack for automatic check-out. In ECCV, 2020. 7

    2020

  17. [24]

    Training robust deep neural networks via adversarial noise propagation

    Aishan Liu, Xianglong Liu, Hang Yu, Chongzhi Zhang, Qiang Liu, and Dacheng Tao. Training robust deep neural networks via adversarial noise propagation. TIP, 2021. 7

    2021

  18. [25]

    X-adv: Physical adversarial object attacks against x-ray prohibited item detection

    Aishan Liu, Jun Guo, Jiakai Wang, Siyuan Liang, Renshuai Tao, Wenbo Zhou, Cong Liu, Xianglong Liu, and Dacheng Tao. X-adv: Physical adversarial object attacks against x-ray prohibited item detection. In USENIX Security Symposium, 2023

    2023

  19. [26]

    Towards defend- ing multiple lp-norm bounded adversarial perturbations via gated batch normalization

    Aishan Liu, Shiyu Tang, Xinyun Chen, Lei Huang, Haotong Qin, Xianglong Liu, and Dacheng Tao. Towards defend- ing multiple lp-norm bounded adversarial perturbations via gated batch normalization. International Journal of Com- puter Vision, 2023. 7

    2023

  20. [27]

    Exploring the rela- tionship between architecture and adversarially robust gen- eralization

    Aishan Liu, Shiyu Tang, Siyuan Liang, Ruihao Gong, Boxi Wu, Xianglong Liu, and Dacheng Tao. Exploring the rela- tionship between architecture and adversarially robust gen- eralization. In CVPR, 2023. 6

    2023

  21. [28]

    Towards Defending Multiple $$\ell p$$-Norm Bounded Adversarial Perturba- tions via Gated Batch Normalization

    Aishan Liu, Shiyu Tang, Xinyun Chen, Lei Huang, Haotong Qin, Xianglong Liu, and Dacheng Tao. Towards Defending Multiple $$\ell p$$-Norm Bounded Adversarial Perturba- tions via Gated Batch Normalization. International Journal of Computer Vision, 132(6):1881–1898, 2024. 4

    2024

  22. [29]

    Jailbreaking the text-to-video generative models.arXiv preprint arXiv:2505.06679, 2025

    Jiayang Liu, Siyuan Liang, Shiqian Zhao, Rongcheng Tu, Wenbo Zhou, Xiaochun Cao, Dacheng Tao, and Siew Kei Lam. Jailbreaking the text-to-video generative models.arXiv preprint arXiv:2505.06679, 2025. 1

    2025 arXiv

  23. [30]

    Harnessing percep- tual adversarial patches for crowd counting

    Shunchang Liu, Jiakai Wang, Aishan Liu, Yingwei Li, Yijie Gao, Xianglong Liu, and Dacheng Tao. Harnessing percep- tual adversarial patches for crowd counting. In ACM CCS,

  24. [31]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv:1706.06083 [cs, stat], 2019. 7

    2019 arXiv

  25. [32]

    OpenAI Moderation

    OpenAI. OpenAI Moderation. https://platform.openai.com/docs/guides/moderation/overview,

  26. [33]

    SDXL: Improving latent diffusion models for high-resolution image synthesis, 2023

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M ¨uller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis, 2023. 7

    2023

  27. [34]

    Safe-CLIP: Removing NSFW concepts from vision-and-language mod- els, 2024

    Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, and Rita Cucchiara. Safe-CLIP: Removing NSFW concepts from vision-and-language mod- els, 2024. 4

    2024

  28. [35]

    SafeGuider: Robust and practical content safety control for text-to-image models

    Peigui Qi, Kunsheng Tang, Wenbo Zhou, Weiming Zhang, Nenghai Yu, Tianwei Zhang, Qing Guo, and Jie Zhang. SafeGuider: Robust and practical content safety control for text-to-image models. CCS 2025, 2025. 4, 5

    2025

  29. [37]

    Learning transferable visual models from natural language supervision, 2021

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision, 2021. 4

    2021

  30. [38]

    Can machines help us answering ques- tion 16 in datasheets, and In turn reflecting on inappropriate content?, 2022

    Patrick Schramowski, Christopher Tauchmann, Kristian Ker- sting, Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. Can machines help us answering ques- tion 16 in datasheets, and In turn reflecting on inappropriate content?, 2022. 2

    2022

  31. [39]

    Safe latent diffusion: Mitigating in- appropriate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating in- appropriate degeneration in diffusion models. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 22522–22531, Vancouver, BC, Can...

    2023

  32. [40]

    Stable Diffusion V2-1

    StabilityAI. Stable Diffusion V2-1. https : / / huggingface . co / stabilityai / stable - diffusion-2-1, 2023. 1, 2

    2023

  33. [41]

    Robustart: Benchmarking robust- ness on architecture design and training techniques

    Shiyu Tang, Ruihao Gong, Yan Wang, Aishan Liu, Jiakai Wang, Xinyun Chen, Fengwei Yu, Xianglong Liu, Dawn Song, Alan Yuille, et al. Robustart: Benchmarking robust- ness on architecture design and training techniques. ArXiv,

  34. [42]

    Automatic Evaluation for Text- to-image Generation: Task-decomposed Framework, Dis- tilled Training, and Meta-evaluation Benchmark, 2024

    Rong-Cheng Tu, Zi-Ao Ma, Tian Lan, Yuehao Zhao, Heyan Huang, and Xian-Ling Mao. Automatic Evaluation for Text- to-image Generation: Task-decomposed Framework, Dis- tilled Training, and Meta-evaluation Benchmark, 2024. 6

    2024

  35. [43]

    Dual Attention Suppression At- tack: Generate Adversarial Camouflage in Physical World

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual Attention Suppression At- tack: Generate Adversarial Camouflage in Physical World. In 2021 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 8561–8570, Nashville...

    2021

  36. [44]

    AEIOU: A unified defense framework against NSFW prompts in text-to-image models, 2024

    Yiming Wang, Jiahao Chen, Qingming Li, Xing Yang, and Shouling Ji. AEIOU: A unified defense framework against NSFW prompts in text-to-image models, 2024. 4

    2024

  37. [45]

    Srd: Reinforcement-learned se- mantic perturbation for backdoor defense in vlms

    Shuhan Xu, Siyuan Liang, Hongling Zheng, Yong Luo, Ais- han Liu, and Dacheng Tao. Srd: Reinforcement-learned se- mantic perturbation for backdoor defense in vlms. arXiv preprint arXiv:2506.04743, 2025. 1

    2025

  38. [46]

    MMA-diffusion: MultiModal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. MMA-diffusion: MultiModal attack on diffusion models. https://arxiv.org/abs/2311.17516v4,

    arXiv

  39. [47]

    SneakyPrompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. SneakyPrompt: Jailbreaking text-to-image generative models. In 2024 IEEE Symposium on Security and Privacy (SP), pages 897–912, 2024. 2

    2024

  40. [48]

    Reasoning- Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models, 2025

    Zonghao Ying, Deyue Zhang, Zonglei Jing, Yisong Xiao, Quanchen Zou, Aishan Liu, Siyuan Liang, Xiangzheng Zhang, Xianglong Liu, and Dacheng Tao. Reasoning- Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models, 2025. 2

    2025

  41. [49]

    PromptGuard: Soft prompt-guided unsafe content moderation for text-to-image models, 2025

    Lingzhi Yuan, Xiaojun Jia, Yihao Huang, Wei Dong, and Yang Liu. PromptGuard: Soft prompt-guided unsafe content moderation for text-to-image models, 2025. 1, 2, 3, 4

    2025

  42. [50]

    Interpreting and im- proving adversarial robustness of deep neural networks with neuron sensitivity

    Chongzhi Zhang, Aishan Liu, Xianglong Liu, Yitao Xu, Hang Yu, Yuqing Ma, and Tianlin Li. Interpreting and im- proving adversarial robustness of deep neural networks with neuron sensitivity. IEEE Transactions on Image Processing,

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.