DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization
DiSCO reduces unsafe content in image generation via adversarial prompt optimization, achieving a 37.7% ASR reduction.
Key Findings
Methodology
DiSCO is a zero-shot, strictly black-box defense operating entirely at the prompt level. It uses distribution-guided suffix expansion and contrastive scoring to optimize generation safety without model retraining or fine-tuning, applicable to any text-to-image system.
Key Results
- On the I2P benchmark, DiSCO reduced ASR from 23.6% to 2.4% under multiple attacks, with NudeNet ASR dropping from 84.2% to 7.8%.
- For defended models, ASR decreased from 8.3% to 1.7%, maintaining semantic fidelity and image coherence.
- Experiments show DiSCO consistently enhances safety across 32 system-attack settings.
Significance
DiSCO addresses safety issues in text-to-image generation, particularly for prompts that are linguistically safe but produce harmful content. As a black-box defense, DiSCO is widely applicable across different architectures, enhancing model safety and applicability.
Technical Contribution
DiSCO achieves adversarial defense through prompt optimization without altering the model. It uses contrastive scoring over safe and unsafe image pools generated by the target model itself, offering a new distribution alignment method.
Novelty
DiSCO is the first to address safety issues in text-to-image generation through prompt optimization in a black-box setting, differing from existing methods by not relying on internal model information.
Limitations
- DiSCO may be less effective for extremely complex adversarial prompts, which might require deeper model understanding.
- The method is computationally intensive, especially for large-scale generation tasks.
Future Work
Future research could explore DiSCO's application to other generative tasks, such as text and audio generation. Additionally, reducing computational complexity is an important direction.
AI Executive Summary
As text-to-image generative models advance, the issue of generating unsafe content becomes increasingly severe. Existing white-box defenses struggle to scale to proprietary models, while black-box methods fail with linguistically safe prompts that still produce harmful content. DiSCO offers a distribution-guided contrastive prompt optimization as a black-box defense without model retraining.
DiSCO optimizes generation safety through suffix expansion and contrastive scoring. Experiments show significant ASR reduction on the I2P benchmark while maintaining generation quality. As a modular black-box method, DiSCO can be applied to any text-to-image system.
DiSCO's innovation lies in achieving adversarial defense through prompt optimization without accessing model internals. This provides new insights into model safety and offers directions for future research, such as applications in other generative tasks and reducing computational complexity.
Deep Analysis
Background
Text-to-image generative models like Stable Diffusion and Flux have made significant advances in generative capabilities but also pose safety issues, particularly in generating unsafe content. Existing white-box defenses rely on internal model information, making them unsuitable for proprietary models, while black-box methods struggle with linguistically safe prompts that still produce harmful content.
Core Problem
The core problem in text-to-image generation safety is that linguistically safe prompts can still produce harmful content. This issue, known as the benign adversarial problem, is difficult to address as existing methods typically rely on language-level safety checks.
Innovation
DiSCO addresses safety issues in text-to-image generation through distribution-guided contrastive prompt optimization. It operates entirely at the prompt level without accessing model internals, optimizing generation safety through suffix expansion and contrastive scoring.
Methodology
- �� DiSCO operates at the prompt level, optimizing prompts through suffix expansion.
- �� Uses contrastive scoring over safe and unsafe image pools generated by the target model.
- �� Iterative feedback adjusts the optimization objective until safe content is produced.
Experiments
Experiments were conducted on the I2P benchmark, evaluating DiSCO's performance under multiple attacks. Safety was assessed using NudeNet and Q16, comparing ASR for both undefended and defended models.
Results
DiSCO reduced ASR from 23.6% to 2.4% for undefended models and from 8.3% to 1.7% for defended models. Experiments show DiSCO consistently enhances safety across 32 system-attack settings.
Applications
DiSCO can be applied to any text-to-image system as a modular black-box safety enhancement tool. It requires no changes to model architecture and is applicable across different generative model architectures.
Limitations & Outlook
DiSCO may be less effective for extremely complex adversarial prompts. Additionally, it is computationally intensive, especially for large-scale generation tasks. Future work could explore methods to reduce computational complexity.
Plain Language Accessible to non-experts
Imagine you're cooking in a kitchen. You have a recipe, but sometimes even if you follow it, the dish might not taste good. DiSCO is like a smart assistant that gives you suggestions based on your cooking process, helping you adjust ingredients and steps to ensure the final dish is both delicious and healthy. It doesn't need to know how your kitchen appliances work internally, just observes your cooking results and offers optimization advice.
ELI14 Explained like you're 14
Imagine you're playing a game where the goal is to build a safe city. You have lots of building materials, but some might be unsafe. DiSCO is like a smart assistant that helps you choose safe materials and gives suggestions during construction to ensure your city is both safe and beautiful. It doesn't need to know the game's internal rules, just observes your building process and offers optimization advice.
Glossary
DiSCO (Distribution-Guided Contrastive Prompt Optimization)
A black-box defense method that reduces unsafe content generation through prompt optimization.
Used to optimize safety in text-to-image generation.
ASR (Attack Success Rate)
Measures the proportion of unsafe content generated under adversarial attacks.
Used to evaluate DiSCO's defense effectiveness.
I2P Benchmark
A standard test set for evaluating safety in text-to-image generation models.
DiSCO's performance is evaluated on this benchmark.
NudeNet
An image classifier used to detect unsafe content.
Used to assess the safety of generated content.
Benign Adversarial Problem
The issue of linguistically safe prompts producing harmful content.
DiSCO aims to address this problem.
Open Questions Unanswered questions from this research
- 1 How to improve DiSCO's defense effectiveness without increasing computational complexity?
- 2 What is DiSCO's applicability to other generative tasks?
- 3 How to handle extremely complex adversarial prompts?
Applications
Immediate Applications
Text-to-Image Generation Safety Enhancement
DiSCO can be immediately applied to existing text-to-image generation systems to enhance safety and reduce unsafe content generation.
Long-term Vision
Cross-Domain Generative Task Defense
DiSCO's principles can be extended to other generative tasks like text and audio generation, providing cross-domain safety defenses.
Abstract
As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.