When Guidance Becomes a Guard: Early Interception of Unsafe Inputs in Text-to-Image Generation

Yanchun Li; Yujin Wu; Gangkai Shen; Ming Yang; Li Zeng; Xianlong Wang; Hangtao Zhang; Shujuan Tian

cs.CVOct 19, 2026

When Guidance Becomes a Guard: Early Interception of Unsafe Inputs in Text-to-Image Generation

Authors: Yanchun Li, Yujin Wu, Gangkai Shen, Ming Yang, Li Zeng, Xianlong Wang, Hangtao Zhang, Shujuan Tian

Organizations: Xiangtan University · Changsha University of Science and Technology · City University of Hong Kong · Huazhong University of Science and Technology

Abstract

Text-to-image diffusion models can produce unsafe content, while output filtering intervenes only after synthesis. We investigate whether native generation signals enable early detection of unsafe and adversarial inputs. We find that classifier-free guidance exposes strong safety signals in conditional responses, accessible through compact statistics and linear readouts. Based on this finding, we propose Conditional Semantic Trajectory Interception (CSTI), which aggregates activation contrasts between conditional and unconditional responses at early checkpoints for calibrated risk detection. CSTI fits concept-specific detectors using canonical concept and safe examples, without attack samples, intermediate image decoding, or generator modification. Across five generators, four adversarial attack collections, and two general NSFW datasets, CSTI achieves the strongest overall performance among six baselines at a matched 5% FPR. Early interception reduces generation latency by over 60% on intercepted paths. These results demonstrate the effectiveness of native conditional responses for early safety interception.

Figures & tables

Figure 1: From late checking to early interception. (a) Crafted prompts can induce unsafe generations. (b) Post-generation safety checks incur the full generation cost. (c) In this example, CSTI reads early CFG activations at steps 5, 10, and 15, intercepting risky inputs while allowing accepted requests to continue unchanged. Intermediate images are shown only for illustration.

Analysis	Defense	Generation signal	In-generation interception	No image reconstruction	Frozen generator	Safe calibration
Prompt	Text-classifier [ 21 ]	$\circ$	$\circ$	–	$\bullet$	$\circ$
	Detoxify [ 11 ]	$\circ$	$\circ$	–	$\bullet$	$\circ$
	Latent Guard [ 18 ]	$\circ$	$\circ$	–	$\bullet$	$\circ$
Generation control	ESD [ 7 ]	$\circ$	$\circ$	$\bullet$	$\circ$	$\circ$
	SLD [ 24 ]	$\bullet$	$\circ$	$\bullet$	$\bullet$	$\circ$
	CRG [ 5 ]	$\bullet$	$\circ$	$\bullet$	$\bullet$	$\circ$

Table 1: Comparison of representative T2I safety defenses. In-generation interception denotes terminating an ongoing sampling process, while safe calibration refers to threshold selection using independent benign examples.

\bullet

\circ

denote support/no support, and – denotes not applicable.

Figure 2: Overview of CSTI. (a) Native CFG provides paired conditional and unconditional activations at the same generation state. Their difference forms a conditional contrast. (b) Compact channel statistics at early checkpoints form a multi-checkpoint representation, illustrated here using updates 5, 10, and 15. (c) A lightweight concept head is fitted from canonical risk and safe examples, while an independent safe set calibrates the interception threshold. In this example, CSTI decides once at update 15.

Generator	Method	Nudity						Violence		Macro $\uparrow$
		RAB	MMA	Custom	P4D	I2P	UnLearn	RAB	I2P
SD1.4	Text Classifier	26.28	45.67	23.50	12.21	10.87	13.90	35.13	20.54	24.95
	Latent Guard	52.35	56.42	55.18	55.83	20.15	20.74	54.86	19.32	40.27
	GuardT2I	84.62	56.18	66.24	48.35	50.27	47.62	24.86	17.32	39.99
	IGD	96.96	93.79	85.27	96.49	96.83	96.97	97.18	77.28	90.80
	Wukong	80.00	84.70	80.89	89.52	86.71	76.75	93.77	76.78	84.18

Table 2: Main comparison of unsafe-input detection at a matched 5% FPR. We report TPR (%,

\uparrow

) on unsafe inputs across five text-to-image generators, six nudity collections, and two violence collections. Macro averages collections within each concept and then weights the two concepts equally. Bold and underlined values indicate the best and second-best results, respectively.

Panel of Figure 3 — Figure 3: Early safety readability across layers, sampling stages, and classifiers. (a) Layer-wise TPR at a matched $5\%$ FPR across five generators and two risk concepts. (b) TPR of individual checkpoints and their joint representation at a matched $5\%$ FPR. (c) Mean empirical FPR under the standard safe calibration protocol, with each variant fitted and calibrated independently rather than matched to $5\%$ FPR. (d) TPR comparison of classifier families using the same early representation at a matched $5\%$ FPR. Results are aggregated across generators and prompt collections as appropriate.

Statistics	TPR@5 $\uparrow$	AUROC $\uparrow$
Mean only	85.93	0.9170
RMS only	82.56	0.8846
Mean + RMS (default)	94.50	0.9802

Table 3: Feature-statistics ablation. Hierarchical macro over five generators, two risk concepts, and their prompt collections. Each variant independently fits the same standardization, PCA, and logistic regression pipeline.

Method	SD1.4	SD3.5 Medium
Text Classifier	38.43	38.43
Latent Guard	16.38	14.20
GuardT2I	32.50	26.13
IGD	15.78	16.24
Wukong	20.38	18.21
DAG †	7.78	8.11

Table 4: False-positive comparison on OVERT. We report FPR (%,

\downarrow

) on 1,600 near-concept samples. Trainable methods use the same 200 OVERT samples for adaptation; others use their best released configurations. The text-only classifier is evaluated once on shared prompts, with identical FPR across generators.

Generator	Full (s)	Early Stop (s)	Saving (%) $\uparrow$	Peak GPU (GiB)
SD1.4	2.674	0.789	70.56	3.49/3.49/2.12
SD1.5	2.378	0.709	70.22	3.49/3.49/2.11
SDXL	6.600	1.867	71.72	18.49/18.50/7.09
SD3.5 Medium	21.247	8.213	61.41	12.06/12.06/12.06
Z-Image	62.360	23.488	62.21	12.52/12.52/12.52

Table 5: Computational efficiency across five text-to-image generators. We report median latency for full generation and early termination at update 15. Savings are median paired reductions. Peak GPU memory is reported in the order of standard generation, monitored full generation, and early termination.

Safe T2I Generation

Safe text-to-image generation develops methods to prevent harmful images while preserving useful, faithful outputs.

See all 52 papers

GuardPaint:SpeculativeSafetyDecodingforText-to-ImageGeneration
Aug 22, 2026Shreyash Dhoot, Paras Dhiman, Arsh Abbas Naqvi +4Safe T2I Generation Adversarial Attacks on Diffusion Models
Pragya Lab, BITS Pilani Goa, India · Apple, USA · Meta, USA
Introspective Attention Modulation for Safe Text-to-Image Generation
Jul 16, 2026Basim Azam, Hossein Rahmani, Naveed AkhtarDiffusion Transformer T2I Generation
The University of Melbourne, Australia · Lancaster University, United Kingdom
Test-Time Scaling for Safe Text-Guided Image Generation via Intermediate Clean Estimates
Aug 4, 2026Jinya Sakurai, Shueicheng Yan, Xun XuTest-Time Optimization T2I Generation
1Nanyang Technological University · 2National University of Singapore · Institute of Advanced Intelligence and Computing (IAIC), A*STAR +1

Aug 22, 2026J/K move · Enter open · S save

GuardPaint:SpeculativeSafetyDecodingforText-to-ImageGeneration

Shreyash Dhoot, Paras Dhiman, Arsh Abbas Naqvi, Aranbi Dutta+3

Pragya Lab, BITS Pilani Goa, India · Apple, USA · Meta, USA

Safe T2I Generation Adversarial Attacks on Diffusion Models Adversarial Examples

Open paper AskPDF arXiv

Text-to-image (T2I) diffusion models offer powerful visual generation, but their controllability creates a critical safety challenge: adversarial prompts can steer the denoising trajectory toward policy-violating content such as explicit nudity or graphic violence. Existing safeguards mostly act before generation through prompt filtering or after generation through image classification, leaving the diffusion process itself unguarded and often yielding only refusal rather than safe visual repair. We introduce GuardPaint, a speculative decoding framework for safe T2I generation that intervenes inside the diffusion trajectory without modifying the base model. A lightweight auditor monitors intermediate images, localizes unsafe regions, and triggers surgical inpainting repair only where needed. Candidate repairs are generated by a policy-aligned inpainter and selected through a guarded tournament that accepts edits only when they improve policy compliance while preserving prompt fidelity and perceptual quality. Across five jailbreak families SneakPrompt, MMA, PGJ, DACA, and RABell and UNet/flow-matching models including SD~~1.5, SDXL, SD~~3.5, and FLUX.1-dev. GuardPaint reduces attack success and harmful generations with minimal degradation to image quality, prompt fidelity, and benign behavior. Content warning: This paper contains examples involving nudity and violence that some readers may find disturbing, distressing, or offensive.

Abstract

Safe T2I Generation

Explore similar work

GuardPaint:SpeculativeSafetyDecodingforText-to-ImageGeneration

Introspective Attention Modulation for Safe Text-to-Image Generation

Test-Time Scaling for Safe Text-Guided Image Generation via Intermediate Clean Estimates