Patronus: Safeguarding Text-to-Image Models against White-Box Adversaries

TL;DR

Patronus addresses the vulnerability of diffusion-based T2I models to white-box adversaries by coupling an inseparable, prompt-independent output moderator embedded in the decoder with a non-fine-tunable safety mechanism. The approach uses conditional decoding and feature-space calibration to reject unsafe generations, paired with a min–min adversarial training-inspired scheme and MGDA-based adaptive weighting to resist malicious fine-tuning while preserving benign content quality. Empirical results show Patronus maintains strong safety under diverse adaptive attacks, increases the attacker cost relative to baselines, and preserves perceptual and semantic fidelity on safe prompts. The work provides a practical, open-source defense framework for robust safety in T2I systems and offers a blueprint for defending complex, multi-component generative models against white-box threats.

Abstract

Text-to-image (T2I) models, though exhibiting remarkable creativity in image generation, can be exploited to produce unsafe images. Existing safety measures, e.g., content moderation or model alignment, fail in the presence of white-box adversaries who know and can adjust model parameters, e.g., by fine-tuning. This paper presents a novel defensive framework, named Patronus, which equips T2I models with holistic protection to defend against white-box adversaries. Specifically, we design an internal moderator that decodes unsafe input features into zero vectors while ensuring the decoding performance of benign input features. Furthermore, we strengthen the model alignment with a carefully designed non-fine-tunable learning mechanism, ensuring the T2I model will not be compromised by malicious fine-tuning. We conduct extensive experiments to validate the intactness of the performance on safe content generation and the effectiveness of rejecting unsafe content generation. Results also confirm the resilience of Patronus against various fine-tuning attacks by white-box adversaries.

Figures (18)

• Figure 1: The objective of Patronus. 1) Inseparable moderation that defeats the adversary's detaching process. 2) Non-fine-tunable safety mechanism that defeats the adversary's malicious fine-tuning.
• Figure 2: Design of Patronus. Patronus mainly consists of two processes, i.e., the construction of the inseparable moderator and the non-fine-tunable safety mechanism.
• Figure 3: Defense against I2P attack.
• Figure 4: Defense against SP attack.
• Figure 5: Defense against MMA attack.