Organizations: School of Computer Science and Technology, Fudan University, China · Institute of Big Data, Fudan University, China · Nanjing University of Information Science and Technology, China
The widespread deployment of text-to-image diffusion models is significantly challenged by the generation of visually harmful content, such as sexually explicit content, violence, and horror imagery. Common safety interventions, ranging from input filtering to model concept erasure, often suffer from two critical limitations: (1) a severe trade-off between safety and context preservation, where removing unsafe concepts degrades the fidelity of the safe content, and (2) vulnerability to adversarial attacks, where safety mechanisms are easily bypassed. To address these challenges, we propose SafeCtrl, a Region-Aware safety control framework operating on a Detect-Then-Suppress paradigm. Unlike global safety interventions, SafeCtrl first employs an attention-guided Detect module to precisely localize specific risk regions. Subsequently, a localized Suppress module, optimized via image-level Direct Preference Optimization (DPO), neutralizes harmful semantics only within the detected areas, effectively transforming unsafe objects into safe alternatives while leaving the surrounding context intact. Extensive experiments across multiple risk categories demonstrate that SafeCtrl achieves a superior trade-off between safety and fidelity compared to state-of-the-art methods. Crucially, our approach exhibits improved resilience against adversarial prompt attacks, offering a precise and robust solution for responsible generation.
Figures & tables
Fig. 1: Solving the safety and context preservation trade-off. (a) The original Stable Diffusion generates unsafe content (e.g., sexually explicit content) from a harmful prompt. (b) Prior Global Fine-tuning methods (e.g., ESD) remove the concept but suffer from severe context degradation, altering the background, lighting, and identity. (c) SafeCtrl (Ours) employs a Region-Aware “Detect-Then-Suppress” paradigm. By keeping the base model frozen (Blue blocks) and using a external module (Green blocks) trained via DPO, SafeCtrl precisely localizes and neutralizes risk, ensuring safety while strictly preserving the original context and artistic intent.
Fig. 2: The overall architecture of the SafeCtrl framework. (Left) SafeCtrl is instantiated as a set of external modules that operate in parallel with frozen U-Net. The safety control is adaptively activated within specific diffusion stages: the Detection Timestep Window [Tstart,Tswitch] and the Suppression Timestep Window [Tswitch,0] . (Right) A detailed view inside a single Safety Control Module, illustrating the Detect-Then-Suppress paradigm. The Risk Detection component first analyzes image features to compute risk mask.The suppression process is governed by an activation trigger ( A ). Only if a risk is detected does the Preference-Aligned Suppression component activate, computing a safety-guided attention output ( Vsafe ) to the original cross-attention layer.
Fig. 3: Detailed comparison of NudeNet detection counts on the I2P benchmark. Each subplot corresponds to a different safety method, showing the number of generated images flagged for various nudity-related categories (lower is better).
Fig. 4: Impact of Timesteps on Detection Accuracy. mIoU scores across concepts consistently improve as the denoising step t decreases (1000 → 0). This empirically justifies our Dynamic Scheduling. We activate detection around t∈[600,800] where semantic structures stabilize, avoiding computation on early noisy steps.
Fig. 5: Qualitative Comparison on Nudity Suppression. Columns show results using the same seed. SLD often fail to ensure safety, whereas ESD, SPM, AlignGuard and RDM, achieve safety at the cost of altering the original background and identity, leading to context degradation. Although CR operates locally, its hard replacement can appear rigid artifacts. SafeCtrl combines precise localization (red masks) with natural DPO-based suppression, consistently generating safe outputs while preserving the original artistic intent and background details.
Method
Overall ↓
FID ↓
CLIP ↑
H-Score ↑
Original SD
0.40
14.30
0.2626
0.750
SLD (CVPR’23)
0.19
18.22
0.2543
0.640
ESD (ICCV’23)
0.18
17.34
0.2381
0.402
SPM (CVPR’24)
0.34
14.77
0.2581
0.751
AlignGuard (ICCV’25)
0.14
20.80
0.2554
0.501
RDM (WWW’25)
0.12
15.13
0.2588
0.869
TABLE I: Quantitative Comparison on I2P and COCO-30K. We report the Overall Unsafe Ratio (lower ↓ is better), FID (lower ↓ ), and CLIP (higher ↑ ). The H-Score (higher ↑ ) quantifies the trade-off, calculated as the harmonic mean of Safety ( 1−Overall ) and normalized Utility. SafeCtrl achieves the best safety–utility trade-off.
Method
Pascal-Car
CelebA-HQ
Pascal-Horse
Avg.
ReGAN
52.2
69.9
54.3
58.8
SLiMe
68.3
75.7
63.3
69.1
SegDDPM*
-
78.0
58.7
-
CR
69.3
78.1
64.3
70.6
Ours (SafeCtrl)
72.1
78.3
65.7
72.0
TABLE II: Localization Accuracy (mIoU ↑ ) on Proxy Benchmarks. Evaluating under a 10-shot setting. SafeCtrl outperforms baselines including the heavyweight CR, verifying precise region awareness.
Method
SD
SLD
ESD
SPM
AlignG.
RDM
CR
Ours
Unsafe ↓
0.95
0.97
0.54
0.65
0.63
0.32
0.27
0.28
TABLE III: Robustness against Adversarial Prompts (Ring-A-Bell). We report the Unsafe Ratio ( ↓ ). SafeCtrl maintains robust defense, achieving performance on par with CR.
Method
Total Added Params ↓
Latency (s) ↓
Original SD
-
10.63
CR
∼ 860 M
12.70
Ours (SafeCtrl)
∼ 75 M
11.77
TABLE IV: Efficiency Analysis. Unlike CR which duplicates the U-Net ( ∼ 860M params), SafeCtrl is a lightweight plugin ( ∼ 75M), offering comparable safety with significantly lower overhead.
Fig. 6: Generalization to Diverse Visual Risks. SafeCtrl effectively generalizes beyond nudity to mitigate other distinct visual threats. Suppression of abstract horror concepts (e.g., ghosts, zombies, monsters) into benign objects (e.g., dolls, humans) or suppression of concrete violence/weapons (e.g., knives, guns) into safe alternatives.
Text-to-image (T2I) diffusion models have the ability to build high-quality pictures from text prompts, but they pose safety concerns because they can generate offensive or disturbing imagery when provided with harmful inputs. Existing safety filters typically rely on text-based classifiers or image-based checkers that completely block the output upon detecting a threat, issuing an explicit allow/block feedback signal to the user. This binary strategy leaves models vulnerable to adversarial attacks that alter keywords to bypass detection, and it causes high false-alarm rates that degrade the experience for benign users. To address such vulnerabilities, we propose Disciplined Diffusion (DDiffusion), a novel robust text-to-image diffusion that counters Not Safe For Work (NSFW) generation by uncovering implicit malicious semantics in prompt embeddings. DDiffusion leverages a semantic retrieval mechanism to evaluate prompts against concept distributions rather than relying on brittle pairwise similarity. Furthermore, it employs a localization method during the diffusion process to selectively edit only the harmful regions of the generated image. By returning locally sanitized images instead of applying uniform blocking, DDiffusion suppresses malicious content while preserving generation fidelity for benign prompts and avoiding the binary allow-deny signal on which existing probing attacks rely.
Chi Zhang, Changjia Zhu, Xiaowen Li +2
Bellini College of Artificial Intelligence, Cybersecurity and Computing, University of South Florida, Tampa, FL, USA · Department of Electrical and Computer Engineering, College of Engineering, University of South Florida, Tampa, FL, USA
State-of-the-art flow based text-to-image (T2I) models exhibit remarkable generative abilities but remain vulnerable to producing unsafe content. Prior safety efforts range from concept erasure and prompt filtering to classifier-based gating. However, simple techniques like parameter efficient adaptations of the models easily bypass such guardrails. We introduce a unique principled approach that achieves safety by regulating the model's attention dynamics through inference-time introspection, exhibiting intrinsic robustness. Our method analyzes and rebalances attention activations throughout image synthesis, steering generations away from unsafe concepts while preserving semantic alignment. This introspective control ensures safety of deployed models. Across standard and adversarial safety benchmarks, our approach achieves remarkable safety scores while maintaining or even improving alignment and perceptual quality. Our results reveal that attention-space regulation offers a considerably more promising path to safer diffusion transformer based image generation than the existing concept erasing mechanism.Our code can be accessed at https://basim-azam.github.io/iam/
Basim Azam, Hossein Rahmani, Naveed Akhtar
The University of Melbourne, Australia · Lancaster University, United Kingdom
Controlling the behavior of text-to-image generative models is critical for safe and practical deployment. Existing safety approaches typically rely on model fine-tuning or curated datasets, which can degrade generation quality or limit scalability. We propose an inference-time steering framework that leverages gradient feedback from frozen pretrained foundation models to guide the generation process without modifying the underlying generator. Our key observation is that vision-language foundation models encode rich semantic representations that can be repurposed as off-the-shelf supervisory signals during generation. By injecting such feedback through clean latent estimates at each sampling step, our method formulates safety steering as an energy-based sampling problem. This design enables modular, training-free safety control that is compatible with both diffusion and flow-matching models and can generalize across diverse visual concepts. Experiments demonstrate state-of-the-art robustness against NSFW red-teaming benchmarks and effective multi-target steering, while preserving high generation quality on benign non-targeted prompts. Our framework provides a principled approach for utilizing foundation models as semantic energy estimators, enabling reliable and scalable safety control for text-to-image generation.
Yaoteng Tan, Zikui Cai, M. Salman Asif
University of California Riverside · University of Maryland