FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decoding

Jinghan Yang; Yihe Fan; Xudong Pan; Min Yang

cs.CVApr 9, 2026

FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decoding

Authors: Jinghan Yang, Yihe Fan, Xudong Pan, Min Yang

Organizations: Fudan University, Shanghai, China · Fudan University, Shanghai Innovation Institute, Shanghai, China

Abstract

Diffusion-based image generation models have advanced rapidly but pose a safety risk due to their potential to generate Not-Safe-For-Work (NSFW) content. Existing NSFW detection methods mainly operate either before or after image generation. Pre-generation methods rely on text prompts and struggle with the gap between prompt safety and image safety. Post-generation methods apply classifiers to final outputs, but they are poorly suited to intermediate noisy images. To address this, we introduce FlowGuard, a cross-model in-generation detection framework that inspects intermediate denoising steps. This is particularly challenging in latent diffusion, where early-stage noise obscures visual signals. FlowGuard employs a novel linear approximation for latent decoding and leverages a curriculum learning approach to stabilize training. By detecting unsafe content early, FlowGuard reduces unnecessary diffusion steps to cut computational costs. Our cross-model benchmark spanning nine diffusion-based backbones shows the effectiveness of FlowGuard for in-generation NSFW detection in both in-distribution and out-of-distribution settings, outperforming existing methods by over 30% in F1 score while delivering transformative efficiency gains, including slashing peak GPU memory demand by over 97% and projection time from 8.1 seconds to 0.2 seconds compared to standard VAE decoding.

Figures & tables

Figure 1. Comparison of NSFW detection paradigms for T2I generation. Existing methods either rely on prompt-level filtering or detect unsafe content after the final image is generated. In-generation approaches enable earlier intervention. A conceptual comparison of three safety-control stages for text-to-image generation. The illustration contrasts prompt-side filtering, post-generation image filtering, and in-generation detection, highlighting that in-generation detection monitors intermediate denoising states and can stop unsafe generation before the final image is produced.

Figure 2. Overview of the FlowGuard framework. (1) Linear Approximation replaces heavy VAE decoding with a lightweight projection layer for early-stage visual reconstruction. (2) The Training Pipeline utilizes a Low-Pass Filter (LPF) and a noise-progressive Curriculum Arrangement to enhance detector robustness. (3) During Deployment , the unified detector intercepts unsafe trajectories across diverse T2I models, skipping final decoding for flagged content to significantly reduce latency and memory overhead. A three-part overview of the FlowGuard framework. On the left, intermediate latents from different text-to-image diffusion models are projected into image-like reconstructions with lightweight linear decoders instead of full VAE decoding. In the middle, a low-pass filter and curriculum-based training improve robustness to noisy intermediate states. On the right, the trained detector evaluates selected denoising steps during inference and terminates generation early when a trajectory is predicted to be unsafe.

		ID					OOD
		PixArt	Flux1	Flux2	SDv1.5	SD3	SDXL	Qwen-Image	Zimage	SD3.5
Falconsai ( Xue et al., 2025 )	Accuracy	0.5010	0.5000	0.5501	0.4950	0.5013	0.4516	0.5005	0.5574	0.5760
	Precision	0.5010	0.5000	0.5501	0.4950	0.5013	0.4516	0.5005	0.5574	0.5760
	Recall	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000
	F1-Score	0.6676	0.6667	0.7098	0.6623	0.6678	0.6222	0.6671	0.7158	0.7310
LlavaGuard-7B ( Helff et al., 2025 )	Accuracy	0.4484	0.5534	0.5501	0.5930	0.6165	0.4933	0.5683	0.5910	0.5647

Table 1. Overall performance on the T2I benchmark. The evaluation is conducted on reconstructed images from the 20th step of the diffusion process with a total of 50 sampling steps. Existing detection methods show limited capability on these noisy intermediate images, while ours achieves consistently better performance on both ID and OOD generators.

Figure 3. Detection accuracy at different denoising steps. The plots evaluate our method against three baselines across diverse architectures. Our approach (red) consistently achieves superior accuracy, particularly in the early-stage denoising regime (steps 10–30), which enables more efficient and robust early-stage safety intervention. A multi-line chart reporting detection accuracy at different diffusion timesteps for several methods. Across most steps, especially earlier noisy ones, FlowGuard maintains higher accuracy than the baseline moderation models, indicating stronger robustness throughout the denoising trajectory.

Figure 4. Ablation studies on the proposed components. The top row illustrates the impact of LPF cutoff-ratio ( $r$ ) on performance, while the bottom row compares the full FlowGuard model against a baseline without curriculum learning (w/o CL). An ablation figure with multiple plots. The top row compares different low-pass filter cutoff ratios and shows that adding the filter improves performance over the no-filter baseline. The bottom row compares the full FlowGuard model with a variant trained without curriculum learning and shows that curriculum learning yields more stable and stronger performance across denoising steps.

Figure 5. Efficiency of VAE Decoder vs. Linear Approximation. The proposed linear approach maintains near-zero overhead across all scales, whereas the standard VAE decoder scales linearly—reaching 50s latency and 30,000 MiB of peak GPU memory at a batch size of 50. Two plots compare the computational cost of standard VAE decoding and the proposed linear approximation. The first plot shows inference time increasing sharply for the VAE decoder as batch size grows, while the linear approximation remains close to zero. The second plot shows peak GPU memory also growing substantially for the VAE decoder, whereas the linear approximation stays low and nearly flat.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6. Qualitative comparison between images reconstructed by the VAE decoder and our Linear decoder across various T2I models. As illustrated, the images generated by the Linear decoder are rendered at a smaller resolution and exhibit a color discrepancy and increased blurring compared to the VAE ground truth. However, while these outputs sacrifice fine-grained aesthetic details, the semantic integrity and critical features remain distinguishable.

Figure 7. Examples of reconstructed images with different Fourier low-pass filter cutoff ratios across denoising steps.

		Flux1	Flux2	PixArt	Qwen-Image	SD3	SD3.5	SDv1.5	SDXL	Zimage
train	safe	2705	683	2726	0	1251	0	2663	0	0
train	unsafe	1954	2034	4246	0	1294	0	3538	0	0
test	safe	200	233	200	200	200	512	200	300	200
test	unsafe	250	196	249	496	200	438	255	300	249

Appendix

Table 2. Construction of FlowGuard Dataset.

Explore similar work

Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation
May 1, 2026Chi Zhang, Changjia Zhu, Xiaowen Li +2Adversarial Robustness Safe T2I Generation
Bellini College of Artificial Intelligence, Cybersecurity and Computing, University of South Florida, Tampa, FL, USA · Department of Electrical and Computer Engineering, College of Engineering, University of South Florida, Tampa, FL, USA
Safe Image Generation via Reinforcement Learning
Oct 5, 2026Eungyeol Han, Jong-Seok LeeT2I Generation Safe T2I Generation
Yonsei University School of Integrated Technology
Test-Time Scaling for Safe Text-Guided Image Generation via Intermediate Clean Estimates
Aug 4, 2026Jinya Sakurai, Shueicheng Yan, Xun XuTest-Time Optimization T2I Generation
1Nanyang Technological University · 2National University of Singapore · Institute of Advanced Intelligence and Computing (IAIC), A*STAR +1

May 1, 2026J/K move · Enter open · S save

Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation

Chi Zhang, Changjia Zhu, Xiaowen Li, Yao Liu+1

Bellini College of Artificial Intelligence, Cybersecurity and Computing, University of South Florida, Tampa, FL, USA · Department of Electrical and Computer Engineering, College of Engineering, University of South Florida, Tampa, FL, USA

Adversarial Robustness Safe T2I Generation T2I Diffusion Models

Open paper AskPDF arXiv

Text-to-image (T2I) diffusion models have the ability to build high-quality pictures from text prompts, but they pose safety concerns because they can generate offensive or disturbing imagery when provided with harmful inputs. Existing safety filters typically rely on text-based classifiers or image-based checkers that completely block the output upon detecting a threat, issuing an explicit allow/block feedback signal to the user. This binary strategy leaves models vulnerable to adversarial attacks that alter keywords to bypass detection, and it causes high false-alarm rates that degrade the experience for benign users. To address such vulnerabilities, we propose Disciplined Diffusion (DDiffusion), a novel robust text-to-image diffusion that counters Not Safe For Work (NSFW) generation by uncovering implicit malicious semantics in prompt embeddings. DDiffusion leverages a semantic retrieval mechanism to evaluate prompts against concept distributions rather than relying on brittle pairwise similarity. Furthermore, it employs a localization method during the diffusion process to selectively edit only the harmful regions of the generated image. By returning locally sanitized images instead of applying uniform blocking, DDiffusion suppresses malicious content while preserving generation fidelity for benign prompts and avoiding the binary allow-deny signal on which existing probing attacks rely.

Abstract

Explore similar work

Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation

Safe Image Generation via Reinforcement Learning

Test-Time Scaling for Safe Text-Guided Image Generation via Intermediate Clean Estimates