As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.
DiSCO:通过分布引导的对比提示优化防御文本到图像生成
AI 导读
DiSCO 提出一种零样本、严格黑盒的防御方法,完全在提示词层面运行,无需模型重训练、微调或访问内部结构。该方法通过束搜索进行分布引导的后缀扩展,并利用目标模型自身生成的图像池进行对比评分和迭代反馈,直至生成安全内容。在 I2P 基准上,DiSCO 在多种红队攻击下分别将未防御和已防御模型的 ASR 降低 37.7% 和 25.13%,同时保持语义保真度。
HuggingFace Daily Papers(社区热门论文)
56
AI 编辑部评分,满分 100DiSCO:通过分布引导的对比提示优化防御文本到图像生成
DiSCO 提出一种零样本、严格黑盒的防御方法,完全在提示词层面运行,无需模型重训练、微调或访问内部结构。该方法通过束搜索进行分布引导的后缀扩展,并利用目标模型自身生成的图像池进行对比评分和迭代反馈,直至生成安全内容。在 I2P 基准上,DiSCO 在多种红队攻击下分别将未防御和已防御模型的 ASR 降低 37.7% 和 25.13%,同时保持语义保真度。
原文 · 保持原样,未翻译原文 · 未翻译
来源:HuggingFace Daily Papers(社区热门论文)· arxiv.org