Haste Makes Waste? Towards Safe Few-Step Text-to-Image Models

Lior Ziv; Mahmood Sharif

cs.CVOct 27, 2026

Haste Makes Waste? Towards Safe Few-Step Text-to-Image Models

Authors: Lior Ziv, Mahmood Sharif

Organizations: Tel Aviv University

Abstract

While few-step distilled text-to-image models have gained traction due to their fast generation times, the speed-up implications on their unsafe generation rates remain unknown. We uncover an inherent tension between speed and safety: few-step models are often more unsafe than their teachers, and reducing the number of inference steps consistently raises unsafe generation rates. We further find that acceleration makes unsafe concepts harder to erase in few-step models, with existing concept-erasure methods markedly less effective than in teachers. We offer a mechanistic diagnosis for why erasure methods fail on few-step models, finding that the fragility of few-step models' generation process and the way generation guidance is usually distilled into those models may hinder established concept-erasure methods. To address the speed-safety trade-off, we propose DICE (Distillation-Integrated Concept Erasure), a post-distillation erasure method tailored for few-step models. DICE aligns both its latent construction and its generation-preservation loss with the distillation method that produced the model, keeping erasure faithful to few-step models. DICE demonstrates strong results in our evaluation. For example, on FLUX Schnell, DICE reduces unsafe-generation rate to 0.046 (vs. at least 0.161 for prior erasure methods we test), while mostly preserving benign generation quality.

Figures & tables

Family	Variant	NudeNet $\downarrow$	NudeNet@5 $\downarrow$	SD $\downarrow$	SD@5 $\downarrow$
SD3.5	Large (teacher)	0.2432	0.5240	0.5416	0.8150
SD3.5	Turbo (student)	0.3232	0.5870	0.6646	0.8670
FLUX	Dev (teacher)	0.2562	0.5570	0.6108	0.8570
FLUX	SCFM (student)	0.3282	0.6390	0.7074	0.9020

TABLE I: Few-step student vs. full-step teacher safety comparison. We report mean NudeNet and SD-Checker unsafe generation rates with their @5 counterparts over NSFW-1k. Lower ( boldfaced ) values indicate safer models.

Fig. 1: SD-Checker severity distribution for SD3.5 Large vs. SD3.5 Turbo, with a box-plot summary.

Fig. 2: CLIP similarity of generated images to “nudity”, by number of inference steps. We show 8-50 steps for full-step models at the top, and 1-8 steps for few-step models at the bottom.

Model	Defended	Steps	NudeNet $\downarrow$	NudeNet@5 $\downarrow$	SD $\downarrow$	SD@5 $\downarrow$
SD3.5 Large	✗	28	0.2432	0.5240	0.5416	0.8150
SD3.5 Large	✗	16	0.2492	0.5390	0.5570	0.8370
FLUX Dev	✗	50	0.2562	0.5570	0.6108	0.8570
FLUX Dev	✗	16	0.2808	0.5890	0.6122	0.8420
SD3.5 Large +	✓	28	0.0822	0.2650	0.3888	0.7190
ESD	✓	16	0.0862	0.2850	0.4068	0.7140

TABLE II: Unsafe generation rates as a function of inference-step count over NSFW-1k. For each base and defended full-step model we contrast its default step count against a reduced 16-step setting. Reducing the number of steps increases unsafety for almost all metrics. Higher values indicate less safe models.

Method	Family	Variant	NudeNet $\downarrow$	SD-Checker $\downarrow$	HPSv2 $\uparrow$
Undefended	SD3.5	Large (teacher)	0.2432	0.5416	0.2905
	SD3.5	Turbo (student)	0.3232	0.6646	0.2874
	FLUX	Dev (teacher)	0.2562	0.6108	0.2938
	FLUX	SCFM (student)	0.3282	0.7074	0.2781
ESD	SD3.5	Large (teacher)	0.0822	0.3888	0.2877
	SD3.5	Turbo (student)	0.1504	0.5692	0.2845

TABLE III: Safety and quality of erasure methods across baseline and few-step models. NudeNet and SD-Checker report unsafe generation rates over NSFW-1k (lower is better); HPSv2 reports benign generation quality (higher is better). Within each teacher-student pair, the better value (lowest for NudeNet and SD-Checker, highest for HPSv2) is boldfaced .

Fig. 3: NudeNet rates on NSFW-1k for EraseAnything using post-distillation erasure, pre-distillation erasure, and Teacher-LoRA transfer erasure application methods. Grouped by model family, FLUX SCFM is tested as FLUX Dev’s student and SD3.5 Turbo as SD3.5 Large’s student. For SD3.5, we do not provide the pre-distillation erasure due to the heavy compute requirements of ADD.

$t$ Bin	FLUX Dev	SD3.5 Large
$[0.66,1.00]$	$-0.0024\pm 0.0419$	$+0.0106\pm 0.0810$
$[0.33,0.66]$	$-0.0158\pm 0.0949$	$-0.0150\pm 0.0743$
$[0.00,0.33]$	$-0.0043\pm 0.0440$	$+0.0027\pm 0.0520$

TABLE IV: Cosine similarity between the SCFM (speed) and ESD (erasure) gradients on the shared LoRA parameters, reported as mean

\pm

std over gradient iterations and grouped by noise-level (

\sigma_{t}

) timestep bin (early, mid, late). Near-zero values at every phase indicate the two objectives are close to orthogonal rather than conflicting, on both FLUX Dev and SD3.5 Large.

Family	Variant	Median ratio $\mathrm{lip}_{z}$	Median ratio $\mathrm{lip}_{\theta}$
FLUX	Dev vs. Schnell	4.78	4.37
FLUX	Dev vs. SCFM	1.01	1.07
SD3.5	Large vs. Turbo	1.81	2.32

TABLE V: Median few-step-to-full-step velocity-field Lipschitz ratios per model family, for the input-space (

z

) and parameter-space (

\theta

) estimators of § IV-B . Each ratio is the median over the LAION-Pop samples of the per-image few-step Lipschitz divided by its family full-step reference’s; values above

1

indicate the few-step model is more sensitive than its full-step reference.

Fig. 4: Empirical local sensitivity of the velocity field with respect to latent

z

perturbations in FLUX Dev and FLUX Schnell, plotted by noise level

\sigma_{t}

. Error bars denote the standard deviation of the constant across image samples.

Fig. 5:

||\delta||

by t-bin. Compared to full-step models, the norm of the erasure direction

\|\delta\|

is significantly higher in few-step models. The effect is strongest in high noise regions where

\sigma_{t}\sim 1

Model	Method	NudeNet $\downarrow$	NudeNet@5 $\downarrow$	SD-Checker $\downarrow$	SD-Checker@5 $\downarrow$	HPSv2 (1-step) $\uparrow$	HPSv2 (4-step) $\uparrow$
SD3.5 Turbo	Undefended	0.3232	0.5870	0.6646	0.8670	0.2551	0.2874
	EraseAnything	0.2992	0.5720	0.6626	0.8700	0.2453	0.2754
	ESD	0.1504	0.3700	0.5692	0.8210	0.2467	0.2845
	UCE	0.2254	0.4810	0.5806	0.8260	0.2547	0.2865
	SPEED	0.2894	0.5460	0.6362	0.8480	0.2551	0.2874
	DICE	0.0324	0.1230	0.4308	0.7530	0.2425	0.2830

TABLE VI: NSFW-1k safety and HPSv2 quality across the few-step model families. Lower NudeNet and SD-Checker values indicate safer models; higher HPSv2 values indicate better generation quality. The best value in each column, within each model, is in bold .

Fig. 6: Examples of DICE outputs using the prompt “A nude girl with beautiful hair.” Black rectangles are added by the authors for censorship. Fig. 8 provides qualitative comparisons with existing erasure methods.

Fig. 7: Qualitative examples showing how DICE preserves the original model’s benign generational quality across diverse models and prompts. A qualitative comparison vs. existing erasure methods is supplied in App. B-I .

Model	Variant	NudeNet $\downarrow$	NudeNet@5 $\downarrow$	SD-Checker $\downarrow$	SD-Checker@5 $\downarrow$	HPSv2 (1-step) $\uparrow$	HPSv2 (4-step) $\uparrow$
SD3.5 Turbo	DICE (full)	0.0324	0.1230	0.4308	0.7530	0.2425	0.2830
	$-$ straight-path re-noising	0.0266	0.1190	0.2340	0.5860	0.2219	0.2652
	$-$ self-distilled preservation	0.1254	0.3540	0.5268	0.8250	0.2317	0.2772
FLUX Schnell	DICE (full)	0.0456	0.1700	0.2690	0.5680	0.2838	0.2887
	$-$ straight-path re-noising	0.0802	0.2837	0.2792	0.6031	0.2811	0.2794
	$-$ self-distilled preservation	0.1026	0.3260	0.3854	0.6990	0.2831	0.2884

TABLE VII: DICE ablation results across base models. We remove one DICE component at a time. Lower NudeNet and SD-Checker values indicate safer models; higher HPSv2 values indicate better generation quality. The best value in each column, within each model, is in bold .

Attack	Model	Undefended	EA	ESD	UCE	SPEED	DICE
Ring-A-Bell	FLUX-Schnell	0.847	0.801	0.704	0.702	0.678	0.319
	FLUX-SCFM	0.838	0.526	0.415	0.706	0.712	0.224
	SD3.5-Turbo	0.726	0.729	0.195	0.611	0.638	0.123
UnlearnDiffAtk	FLUX-Schnell	0.879	0.848	0.758	0.818	0.848	0.455
	FLUX-SCFM	0.909	0.727	0.545	0.795	0.886	0.500
	SD3.5-Turbo	0.941	0.853	0.706	0.882	0.882	0.265

TABLE VIII: NudeNet rates (

\downarrow

) of adversarial prompting. Best erasure method per row is in bold .

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Family	Variant	Config	Method	NudeNet $\downarrow$	NudeNet@5 $\downarrow$	SD $\downarrow$	SD@5 $\downarrow$	HPSv2 $\uparrow$
SD3.5	SD3.5 Large (teacher)	28-step, CFG 3.5	Undefended	0.2432	0.5240	0.5416	0.8150	0.2905
			ESD	0.0822	0.2650	0.3888	0.7190	0.2877
			EraseAnything	0.1480	0.4190	0.4710	0.7940	0.2821
			UCE	0.1850	0.4610	0.4648	0.7660	0.2894
			SPEED	0.2236	0.5050	0.5136	0.7970	0.2907
	SD3.5 Turbo (student)	4-step	Undefended	0.3232	0.5870	0.6646	0.8670	0.2874

Appendix

TABLE IX: Full safety and quality results across all base models and erasure methods. Safety metrics (NudeNet, SD-Checker; mean and the Unsafe@k repeated-sampling variants, which flag a prompt unsafe if any of its

k=5

seeds is flagged) are lower-is-safer; the quality metric (HPSv2) is higher-is-better. Within each model, the best value among the erasure methods (ESD, EraseAnything, UCE) is in bold (lowest NudeNet/SD-Checker, highest HPSv2); the undefended baseline is shown for reference and excluded from bolding.

Space	Sweep	$k$	$\epsilon$	Paired p50
$z$	$k$ ( $\epsilon{=}10^{-3}$ )	$4$	$10^{-3}$	$4.70$
		$\mathbf{8}$	$\mathbf{10^{-3}}$	$\mathbf{4.76}$
		$16$	$10^{-3}$	$4.79$
	$\epsilon$ ( $k{=}8$ )	$8$	$10^{-4}$	$4.88$
		$\mathbf{8}$	$\mathbf{10^{-3}}$	$\mathbf{4.76}$
		$8$	$10^{-2}$	$3.72$

Appendix

TABLE X: Cross-family paired Lipschitz ratio

\mathrm{Lip}_{\text{Schnell}}/\mathrm{Lip}_{\text{Dev}}

under variation of the number of perturbation directions

k

and the relative radius

\epsilon

, for the input-space (

z

) and parameter-space (

\theta

) estimates. Main-text operating points are in bold . The ratio is mostly insensitive to

k

and

\epsilon

		$\lVert v(z,c)\rVert$						$\lVert v(z,\varnothing)\rVert$
$t$ -bin	$t$ range	Large	Turbo	Dev 1.0	Dev 3.5	Schnell	SCFM 5.0	Large	Turbo	Dev 1.0	Dev 3.5	Schnell	SCFM 5.0
0	$[0,100)$	681.9	701.7	729.2	721.9	661.2	707.5	681.5	700.3	728.0	721.3	665.6	707.2
1	$[100,200)$	695.9	722.7	669.9	675.5	773.9	669.8	695.6	721.8	670.5	675.5	776.6	669.9
2	$[200,300)$	726.8	747.9	684.3	693.6	704.6	693.2	726.2	746.8	685.2	693.7	704.9	693.4
3	$[300,400)$	750.2	765.3	701.8	712.2	700.2	710.8	749.5	764.7	702.8	712.9	698.9	710.8
4	$[400,500)$	758.5	772.7	708.5	722.6	657.0	717.4	758.3	772.3	710.0	723.1	655.0	717.9

Appendix

TABLE XI: Conditional and unconditional velocity-prediction norms

\lVert v(z,c)\rVert

and

\lVert v(z,\varnothing)\rVert

per timestep bin for every model. The two norms are nearly identical within each model and comparable across all models.

Model	Train $\omega$	NudeNet $\downarrow$	SD $\downarrow$	HPSv2 $\uparrow$
FLUX Dev	$3.5$	0.0816	0.4554	0.2936
FLUX Dev	$1.0$	0.1376	0.5152	0.2943
FLUX SCFM	$5$	0.1628	0.5614	0.2787
FLUX SCFM	$1.0$	0.2634	0.6800	0.2788

Appendix

TABLE XII: EraseAnything nudity erasure: training at

\omega=1

vs. the method’s default guidance, evaluated at each model’s deployment CFG. Lowering the training guidance to

\omega=1

consistently weakens erasure at no quality benefit.

Model	Defended	Steps	Q16 $\downarrow$	Q16@5 $\downarrow$
SD3.5 Large	✗	28	0.6230	0.7974
SD3.5 Large	✗	16	0.6416	0.8131
FLUX Dev	✗	50	0.5458	0.7690
FLUX Dev	✗	16	0.5554	0.7640

Appendix

TABLE XIII: Unsafe generation rates as a function of inference-step count over the violence subset of T2I-RiskyPrompt.

Model	Method	Q16 $\downarrow$	Q16@5 $\downarrow$	HPSv2 $\uparrow$
SD3.5 Turbo	Undefended	0.5642	0.7484	0.2874
	EraseAnything	0.4324	0.6638	0.2632
	ESD	0.5150	0.7164	0.2799
	UCE	0.5285	0.7143	0.2866
	SPEED	0.5467	0.7342	0.2873
	DICE	0.2222	0.4819	0.2746

Appendix

TABLE XIV: Violence safety and 4-step HPSv2 quality across the few-step model families, measured on the violence subset of T2I-RiskyPrompt. Lower Q16 values indicate safer models.

Model	Method	NudeNet $\downarrow$	NudeNet@5 $\downarrow$	SD-Checker $\downarrow$	SD-Checker@5 $\downarrow$	HPSv2 ${}_{\text{1-step}}\uparrow$	HPSv2 ${}_{\text{4-step}}\uparrow$	FID $\downarrow$	CLIP-Sim $\uparrow$
SD3.5 Turbo	Undefended	0.0445	0.1063	0.1395	0.2785	0.2551	0.2874	23.99	0.2676
	EraseAnything	0.0473	0.1157	0.1643	0.3479	0.2453	0.2754	24.29	0.2661
	ESD	0.0181	0.0604	0.1140	0.2450	0.2467	0.2845	21.58	0.2671
	UCE	0.0344	0.0880	0.1289	0.2656	0.2547	0.2865	24.13	0.2659
	SPEED	0.0386	0.0967	0.1354	0.2709	0.2551	0.2874	23.88	0.2675
	DICE	0.0115	0.0438	0.1204	0.2745	0.2425	0.2830	21.63	0.2652

Appendix

TABLE XV: I2P safety and quality, and COCO-30k FID and CLIP-similarity, across the guidance-distilled few-step families. Lower NudeNet and SD-Checker values (mean and the @5 repeated-sampling variant) on I2P indicate safer models; higher HPSv2 values indicate better generation quality, reported at one-step and four-step inference. FID (lower is better) and CLIP-Sim (higher is better) are computed on COCO-30k. The best value in each column among the erasure methods, within each model, is in bold ; the undefended baseline is shown for reference and excluded from bolding.

Fig. 8: Qualitative comparison of DICE against existing erasure methods (ESD, EraseAnything, UCE) on FLUX Schnell, using shared prompts and seeds. Black rectangles are added by the authors for censorship.

T2I Generation

Text-to-image generation creates images from natural-language prompts using generative models, with research focused on fidelity, control, efficiency, and safety.

See all 299 papers

Introspective Attention Modulation for Safe Text-to-Image Generation
Jul 16, 2026Basim Azam, Hossein Rahmani, Naveed AkhtarDiffusion Transformer T2I Generation
The University of Melbourne, Australia · Lancaster University, United Kingdom
No Safe Dose: How Training Data Drives Unsafe Image Generation
May 27, 2026Felix Friedrich, Lukas Helff, Niharika Hegde +2Safe T2I Generation Data Contamination
1Black Forest Labs · 2TU Darmstadt & hessian.AI · 3DFKI +1
Pristine Models
Oct 8, 2026Anirudh Sundara Rajan, Krishna Kumar Singh, Richard Zhang +1Safe T2I Generation
University of Wisconsin–Madison · Adobe Research

Jul 16, 2026J/K move · Enter open · S save

Introspective Attention Modulation for Safe Text-to-Image Generation

Basim Azam, Hossein Rahmani, Naveed Akhtar

The University of Melbourne, Australia · Lancaster University, United Kingdom

Diffusion Transformer T2I Generation Safe T2I Generation Attention Control in Diffusion Models Controllable Image Generation T2I Diffusion Models+1

Open paper AskPDF arXiv

State-of-the-art flow based text-to-image (T2I) models exhibit remarkable generative abilities but remain vulnerable to producing unsafe content. Prior safety efforts range from concept erasure and prompt filtering to classifier-based gating. However, simple techniques like parameter efficient adaptations of the models easily bypass such guardrails. We introduce a unique principled approach that achieves safety by regulating the model's attention dynamics through inference-time introspection, exhibiting intrinsic robustness. Our method analyzes and rebalances attention activations throughout image synthesis, steering generations away from unsafe concepts while preserving semantic alignment. This introspective control ensures safety of deployed models. Across standard and adversarial safety benchmarks, our approach achieves remarkable safety scores while maintaining or even improving alignment and perceptual quality. Our results reveal that attention-space regulation offers a considerably more promising path to safer diffusion transformer based image generation than the existing concept erasing mechanism.Our code can be accessed at https://basim-azam.github.io/iam/

Abstract

T2I Generation

Explore similar work

Introspective Attention Modulation for Safe Text-to-Image Generation

No Safe Dose: How Training Data Drives Unsafe Image Generation

Pristine Models