The advent of Text-to-Image generative models poses significant risks of copyright violation and deepfake generation. Since the rapid proliferation of new copyrighted works and private individuals constantly emerges, reference-based training-free content filters are essential for providing up-to-date protection without the constraints of a fixed knowledge cutoff. However, existing reference-based approaches often lack scalability when handling numerous references and require waiting for finishing image generation. To solve these problems, we propose EDGE-Shield, a scalable content filter during the denoising process that maintains practical latency while effectively blocking violative content. We leverage embedding-based matching for efficient reference comparison. Additionally, we introduce an \textit{x}-pred transformation that converts the model's noisy intermediate latent into the pseudo-estimated clean latent at the later stage, enhancing classification accuracy of violative content at earlier denoising stages. We conduct experiments of violative content filtering against two generative models including Z-Image-Turbo and Qwen-Image. EDGE-Shield significantly outperforms traditional reference-based methods in terms of latency; it achieves an approximate 79% reduction in processing time for Z-Image-Turbo and approximate 50% reduction for Qwen-Image, maintaining the filtering accuracy across different model architectures.
Figures & tables
Figure 1: Comparison of our EDGE-Shield with the existing content filters.
Train + Inp
Train + Out
Ref + Inp
Ref + Out
Ours
Latency
✓
×
✓
×
✓
Scalability
✓
✓
✓
×
✓
Accuracy
✓
✓
✓
✓
✓
Knowledge
×
×
✓
✓
✓
Robustness
×
✓
×
✓
✓
Table 1: Comparison of content filtering paradigms. Output-based methods are crucial for prompt-agnostic filtering, while reference-based approaches are essential for protecting constantly emerging IPs and private individuals. EDGE-Shield bridges the critical gap by integrating these advantages while overcoming the scalability and latency limitations of existing methods.
Figure 2: Overview of embedding caching and the detail component of EDGE-Shield. Left: We compute the embeddings of target references of violative content. Right: we transform the intermediate latent into the clean latent by using our x -pred transformation. EDGE-Shield calculates the similarity score among the embedding of the decoded clean latent and cached embeddings.
Figure 3: Evaluation results of ROC-AUC, Latency, and the number of references on Z-Image-Turbo. (a) Relationship between the number of references and the ROC-AUC score. (b) Relationship between the number of references and the latency time.
T2I Model
Z-Image
Qwen-Image
ROC-AUC
PR-AUC
Time (s)
ROC-AUC
PR-AUC
Time (s)
Normalized L2 [ 3 ]
0.417
0.449
2.137
0.431
0.454
22.003
LPIPS [ 47 ]
0.407
0.441
2.505
0.428
0.451
22.016
DjffSim [ 37 ]
0.706
0.758
2.168
0.719
0.773
22.233
LLaVaGuard [ 9 ]
0.493
0.497
2.425
0.474
0.483
22.498
LLaVa-NEXT [ 19 ]
0.493
0.492
2.257
0.494
0.494
22.868
Table 2: ROC-AUC and PR-AUC scores of violation binary classification for CPDM and HUB, and the time by the average score of single generation. The score of EDGE-Shield shown in this table is calculated at step 1 for Z-Image, at step 25 for Qwen-Image, respectively.
Figure 4: Visualization of Precision-Recall curve.
Figure 5: ROC-AUC visualization of x -pred transformation ablation. This figure shows the ROC-AUC scores across each timesteps for three different models.
Figure 6: Visualized intermediate latents of Z-Image-Turbo, comparing states with and without the x -pred transformation across 9 generation timesteps.
Figure 7: Visualized intermediate latents of Qwen-Image, comparing states with and without the x -pred transformation across 50 generation timesteps.
CPDM
HUB
EDGE-Shield
IP
Individual
IP
Individual
Style
w/ CLIP
0.903
0.970
0.767
0.854
0.616
w/ SigLIP
0.943
0.965
0.804
0.822
0.635
w/ SigLIP2
0.942
0.957
0.813
0.799
0.629
w/ Qwen3VL-Embedding
0.988
0.988
0.827
0.845
0.645
Table 3: ROC-AUC at timestep 0 on Z-Image across image encoders inclding CLIP, SigLIP, SigLIP2, Qwen3-VLM-Embedding.
Figure 8: Accuracy across thresholds from 0.1 to 0.9. (a) Results on Z-Image-Turbo at timestep 1 (b) Results on Qwen-Image at timestep 25.
Table 4: Comparison of Straight and Roundabout prompting methods. Both images were generated by Qwen-Image.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 9: Visualized intermediate latents of SD1.4, comparing states with and without the x -pred transformation across 40 generation timesteps.
Method
ROC-AUC
PR-AUC
Time (s)
ROC-AUC
PR-AUC
Time (s)
gpt-4o-mini
0.696
0.705
25.656
0.691
0.714
32.423
Ours w/ CLIP
0.827
0.846
0.404
0.830
0.844
11.621
Ours w/ SigLIP
0.846
0.875
0.402
0.843
0.862
11.619
Ours w/ SigLIP2
0.835
0.869
0.407
0.833
0.854
11.617
Ours w/ Q3VLEmbed
0.857
0.898
0.454
0.844
0.883
12.107
Appendix
Table 5: ROC-AUC and PR-AUC scores of violation binary classification for CPDM and HUB, and the time by the average score of single generation. The score of EDGE-Shield shown in this table is calculated at step 1 for Z-Image, at step 25 for Qwen-Image, respectively. The experimental setup follows the setting of Effectiveness in Sec. 5.1.
Table 6: Qualitative comparison on the HUB dataset. While Reject refers that content filter classifies the image as violative ones, Accept indicates that the generated image is classified as non-violative ones. For EDGE-Shield, we use CLIP as an image encoder and use the threshold value as 0.7.
Content Name
Style
Prompt
Winnie the Pooh
S
Winnie the Pooh, famous cartoon character
R
A lovable golden bear with a red shirt in cartoon style, known for his love of honey and his adventures in a forest.
Ensuring safety and policy compliance in text-to-image diffusion models remains a critical challenge, as benign or adversarial prompts can often elicit prohibited content, e.g. nudity and protected intellectual property. While training-based unlearning methods are effective, they are computationally expensive and prone to catastrophic interference with general capabilities. Conversely, existing test-time defenses are primarily prompt-centric, relying on modifying textual descriptions only, and overlook the visual signals for detection. In this paper, we propose to leverage the intermediate clean image estimated during the generation process and employ a sparse margin objective to detect prohibited concepts. When a violation is detected, we immediately intervene by optimizing a structured low-rank residual in the text-conditioning space via truncated backpropagation. This design allows weight-preserving detection, keeps non-violating inference latency nearly unchanged as the maximum budget increases, and offers flexibility in safety performance via test-time scaling. Extensive experiments on Stable Diffusion v1.4 and v3.5 across nudity removal, IP protection, and style erasure demonstrate superior performance across suppression, fidelity and preservation compared to prior weight-preserving baselines, providing a scalable and flexible solution for safe generative deployment.
Jinya Sakurai, Shueicheng Yan, Xun Xu
1Nanyang Technological University · 2National University of Singapore · Institute of Advanced Intelligence and Computing (IAIC), A*STAR +1
Diffusion-based image generation models have advanced rapidly but pose a safety risk due to their potential to generate Not-Safe-For-Work (NSFW) content. Existing NSFW detection methods mainly operate either before or after image generation. Pre-generation methods rely on text prompts and struggle with the gap between prompt safety and image safety. Post-generation methods apply classifiers to final outputs, but they are poorly suited to intermediate noisy images. To address this, we introduce FlowGuard, a cross-model in-generation detection framework that inspects intermediate denoising steps. This is particularly challenging in latent diffusion, where early-stage noise obscures visual signals. FlowGuard employs a novel linear approximation for latent decoding and leverages a curriculum learning approach to stabilize training. By detecting unsafe content early, FlowGuard reduces unnecessary diffusion steps to cut computational costs. Our cross-model benchmark spanning nine diffusion-based backbones shows the effectiveness of FlowGuard for in-generation NSFW detection in both in-distribution and out-of-distribution settings, outperforming existing methods by over 30% in F1 score while delivering transformative efficiency gains, including slashing peak GPU memory demand by over 97% and projection time from 8.1 seconds to 0.2 seconds compared to standard VAE decoding.
Jinghan Yang, Yihe Fan, Xudong Pan +1
Fudan University, Shanghai, China · Fudan University, Shanghai Innovation Institute, Shanghai, China
Advances in Generative AI (GenAI) have led to the development of various protection strategies to prevent the unauthorized use of images. These methods rely on adding imperceptible protective perturbations to images to thwart misuse such as style mimicry or deepfake manipulations. Although previous attacks on these protections required specialized, purpose-built methods, we demonstrate that this is no longer necessary. We show that off-the-shelf image-to-image GenAI models can be repurposed as generic ``denoisers" using a simple text prompt, effectively removing a wide range of protective perturbations. Across 8 case studies spanning 6 diverse protection schemes, our general-purpose attack not only circumvents these defenses but also outperforms existing specialized attacks while preserving the image's utility for the adversary. Our findings reveal a critical and widespread vulnerability in the current landscape of image protection, indicating that many schemes provide a false sense of security. We stress the urgent need to develop robust defenses and establish that any future protection mechanism must be benchmarked against attacks from off-the-shelf GenAI models. Code is available in this repository: https://github.com/mlsecviswanath/img2imgdenoiser
Xavier Pleimling, Sifat Muhammad Abdullah, Gunjan Balde +4
University of Texas at San Antonio San Antonio, TX, USA