The advent of Text-to-Image generative models poses significant risks of copyright violation and deepfake generation. Since the rapid proliferation of new copyrighted works and private individuals constantly emerges, reference-based training-free content filters are essential for providing up-to-date protection without the constraints of a fixed knowledge cutoff. However, existing reference-based approaches often lack scalability when handling numerous references and require waiting for finishing image generation. To solve these problems, we propose EDGE-Shield, a scalable content filter during the denoising process that maintains practical latency while effectively blocking violative content. We leverage embedding-based matching for efficient reference comparison. Additionally, we introduce an \textit{x}-pred transformation that converts the model's noisy intermediate latent into the pseudo-estimated clean latent at the later stage, enhancing classification accuracy of violative content at earlier denoising stages. We conduct experiments of violative content filtering against two generative models including Z-Image-Turbo and Qwen-Image. EDGE-Shield significantly outperforms traditional reference-based methods in terms of latency; it achieves an approximate 79% reduction in processing time for Z-Image-Turbo and approximate 50% reduction for Qwen-Image, maintaining the filtering accuracy across different model architectures.
Figures & tables
Figure 1: Comparison of our EDGE-Shield with the existing content filters.
Train + Inp
Train + Out
Ref + Inp
Ref + Out
Ours
Latency
✓
×
✓
×
✓
Scalability
✓
✓
✓
×
✓
Accuracy
✓
✓
✓
✓
✓
Knowledge
×
×
✓
✓
✓
Robustness
×
✓
×
✓
✓
Table 1: Comparison of content filtering paradigms. Output-based methods are crucial for prompt-agnostic filtering, while reference-based approaches are essential for protecting constantly emerging IPs and private individuals. EDGE-Shield bridges the critical gap by integrating these advantages while overcoming the scalability and latency limitations of existing methods.
Figure 2: Overview of embedding caching and the detail component of EDGE-Shield. Left: We compute the embeddings of target references of violative content. Right: we transform the intermediate latent into the clean latent by using our x -pred transformation. EDGE-Shield calculates the similarity score among the embedding of the decoded clean latent and cached embeddings.
Figure 3: Evaluation results of ROC-AUC, Latency, and the number of references on Z-Image-Turbo. (a) Relationship between the number of references and the ROC-AUC score. (b) Relationship between the number of references and the latency time.
T2I Model
Z-Image
Qwen-Image
ROC-AUC
PR-AUC
Time (s)
ROC-AUC
PR-AUC
Time (s)
Normalized L2 [ 3 ]
0.417
0.449
2.137
0.431
0.454
22.003
LPIPS [ 47 ]
0.407
0.441
2.505
0.428
0.451
22.016
DjffSim [ 37 ]
0.706
0.758
2.168
0.719
0.773
22.233
LLaVaGuard [ 9 ]
0.493
0.497
2.425
0.474
0.483
22.498
LLaVa-NEXT [ 19 ]
0.493
0.492
2.257
0.494
0.494
22.868
Table 2: ROC-AUC and PR-AUC scores of violation binary classification for CPDM and HUB, and the time by the average score of single generation. The score of EDGE-Shield shown in this table is calculated at step 1 for Z-Image, at step 25 for Qwen-Image, respectively.
Figure 4: Visualization of Precision-Recall curve.
Figure 5: ROC-AUC visualization of x -pred transformation ablation. This figure shows the ROC-AUC scores across each timesteps for three different models.
Figure 6: Visualized intermediate latents of Z-Image-Turbo, comparing states with and without the x -pred transformation across 9 generation timesteps.
Figure 7: Visualized intermediate latents of Qwen-Image, comparing states with and without the x -pred transformation across 50 generation timesteps.
CPDM
HUB
EDGE-Shield
IP
Individual
IP
Individual
Style
w/ CLIP
0.903
0.970
0.767
0.854
0.616
w/ SigLIP
0.943
0.965
0.804
0.822
0.635
w/ SigLIP2
0.942
0.957
0.813
0.799
0.629
w/ Qwen3VL-Embedding
0.988
0.988
0.827
0.845
0.645
Table 3: ROC-AUC at timestep 0 on Z-Image across image encoders inclding CLIP, SigLIP, SigLIP2, Qwen3-VLM-Embedding.
Figure 8: Accuracy across thresholds from 0.1 to 0.9. (a) Results on Z-Image-Turbo at timestep 1 (b) Results on Qwen-Image at timestep 25.
Table 4: Comparison of Straight and Roundabout prompting methods. Both images were generated by Qwen-Image.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 9: Visualized intermediate latents of SD1.4, comparing states with and without the x -pred transformation across 40 generation timesteps.
Method
ROC-AUC
PR-AUC
Time (s)
ROC-AUC
PR-AUC
Time (s)
gpt-4o-mini
0.696
0.705
25.656
0.691
0.714
32.423
Ours w/ CLIP
0.827
0.846
0.404
0.830
0.844
11.621
Ours w/ SigLIP
0.846
0.875
0.402
0.843
0.862
11.619
Ours w/ SigLIP2
0.835
0.869
0.407
0.833
0.854
11.617
Ours w/ Q3VLEmbed
0.857
0.898
0.454
0.844
0.883
12.107
Appendix
Table 5: ROC-AUC and PR-AUC scores of violation binary classification for CPDM and HUB, and the time by the average score of single generation. The score of EDGE-Shield shown in this table is calculated at step 1 for Z-Image, at step 25 for Qwen-Image, respectively. The experimental setup follows the setting of Effectiveness in Sec. 5.1.
Table 6: Qualitative comparison on the HUB dataset. While Reject refers that content filter classifies the image as violative ones, Accept indicates that the generated image is classified as non-violative ones. For EDGE-Shield, we use CLIP as an image encoder and use the threshold value as 0.7.
Content Name
Style
Prompt
Winnie the Pooh
S
Winnie the Pooh, famous cartoon character
R
A lovable golden bear with a red shirt in cartoon style, known for his love of honey and his adventures in a forest.