Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Prompt-Based Safety Guidance Is Ineffective for Unlearned Text-to-Image Diffusion Models

Jiwoo Shin, Byeonghu Na, Mina Kang, Wonhyeok Choi, Il-Chul Moon

TL;DR

The paper tackles safety in text-to-image diffusion by comparing training-based unlearning with training-free negative-prompt guidance and identifying a fundamental incompatibility when combining them. It introduces implicit concept embeddings, obtained via diffusion-based inversion, to replace explicit negative prompts and integrate with existing training-free methods without altering their mechanisms. Across nudity and violence benchmarks, the method consistently improves defense success while preserving the semantic intent of prompts, and these concept embeddings show transferability across related unlearned checkpoints. This work suggests a practical pathway to bridge unlearning and post-unlearning safety controls, with implications for deploying safer diffusion systems in real-world settings.

Abstract

Recent advances in text-to-image generative models have raised concerns about their potential to produce harmful content when provided with malicious input text prompts. To address this issue, two main approaches have emerged: (1) fine-tuning the model to unlearn harmful concepts and (2) training-free guidance methods that leverage negative prompts. However, we observe that combining these two orthogonal approaches often leads to marginal or even degraded defense performance. This observation indicates a critical incompatibility between two paradigms, which hinders their combined effectiveness. In this work, we address this issue by proposing a conceptually simple yet experimentally robust method: replacing the negative prompts used in training-free methods with implicit negative embeddings obtained through concept inversion. Our method requires no modification to either approach and can be easily integrated into existing pipelines. We experimentally validate its effectiveness on nudity and violence benchmarks, demonstrating consistent improvements in defense success rate while preserving the core semantics of input prompts.

Prompt-Based Safety Guidance Is Ineffective for Unlearned Text-to-Image Diffusion Models

TL;DR

The paper tackles safety in text-to-image diffusion by comparing training-based unlearning with training-free negative-prompt guidance and identifying a fundamental incompatibility when combining them. It introduces implicit concept embeddings, obtained via diffusion-based inversion, to replace explicit negative prompts and integrate with existing training-free methods without altering their mechanisms. Across nudity and violence benchmarks, the method consistently improves defense success while preserving the semantic intent of prompts, and these concept embeddings show transferability across related unlearned checkpoints. This work suggests a practical pathway to bridge unlearning and post-unlearning safety controls, with implications for deploying safer diffusion systems in real-world settings.

Abstract

Recent advances in text-to-image generative models have raised concerns about their potential to produce harmful content when provided with malicious input text prompts. To address this issue, two main approaches have emerged: (1) fine-tuning the model to unlearn harmful concepts and (2) training-free guidance methods that leverage negative prompts. However, we observe that combining these two orthogonal approaches often leads to marginal or even degraded defense performance. This observation indicates a critical incompatibility between two paradigms, which hinders their combined effectiveness. In this work, we address this issue by proposing a conceptually simple yet experimentally robust method: replacing the negative prompts used in training-free methods with implicit negative embeddings obtained through concept inversion. Our method requires no modification to either approach and can be easily integrated into existing pipelines. We experimentally validate its effectiveness on nudity and violence benchmarks, demonstrating consistent improvements in defense success rate while preserving the core semantics of input prompts.

Paper Structure

This paper contains 26 sections, 4 equations, 4 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related works
  3. Two approaches of safe generation
  4. Diffusion-based inversion
  5. Method
  6. Preliminary
  7. Training-free methods
  8. Diffusion-based inversion
  9. Replacing prompt-based negative embeddings with implicit concept embeddings
  10. Experiments
  11. Experimental settings
  12. Setup
  13. Evaluation
  14. Experimental results
  15. Effectiveness of the proposed method
  16. ...and 11 more sections

Figures (4)

  • Figure 1: Generated images with training-free methods (SLD sld2023, SAFREE safree2025) and ours on the unlearned model (DUO DUO). The inappropriate content areas are masked.
  • Figure 2: Proposed framework. We replace the prompt-based negative embeddings $\mathbf{C}_n$ with negative concept embeddings $\mathbf{C}_*$ in training-free methods (Eqs. \ref{['eq:safree']} and \ref{['eq:sld']}). The inappropriate content areas are masked.
  • Figure 3: Results for existing training-free methods and ours on the unlearned model.
  • Figure 4: Demonstration of concept embedding transferability across different checkpoints in the nudity task. CE denotes concept embedding. The inappropriate content area is masked.