Inference-Only Prompt Projection for Safe Text-to-Image Generation with TV Guarantees

TL;DR

This work addresses the risk of unsafe outputs in open-ended text-to-image diffusion by formulating a total variation (TV) based Safety-Prompt Alignment Trade-off (SPAT) and proposing an inference-only prompt projection that safely constrains high-risk prompts without retraining the generator. The method localizes intervention to the prompt space via a two-stage cascade (LLM-based surrogate and safeguard VLM verifier) and defines a τ-safe target through a projection kernel, ensuring minimal disruption to benign prompts. Empirically, the approach achieves substantial reductions in inappropriate content (IP) across multiple backbones and datasets while preserving benign prompt-image alignment (e.g., on COCO) and demonstrating robustness to adversarial prompts. The work provides a principled, scalable framework for deploying safe T2I systems with TV guarantees and a practical projection-based pipeline suitable for real-world safety stacks.

Abstract

Text-to-Image (T2I) diffusion models enable high-quality open-ended synthesis, but their real-world deployment demands safeguards that suppress unsafe generations without degrading benign prompt-image alignment. We formalize this tension through a total variation (TV) lens: once the reference conditional distribution is fixed, any nontrivial reduction in unsafe generations necessarily incurs TV deviation from the reference, yielding a principled Safety-Prompt Alignment Trade-off (SPAT). Guided by this view, we propose an inference-only prompt projection framework that selectively intervenes on high-risk prompts via a surrogate objective with verification, mapping them into a tolerance-controlled safe set while leaving benign prompts effectively unchanged, without retraining or fine-tuning the generator. Across four datasets and three diffusion backbones, our approach achieves 16.7-60.0% relative reductions in inappropriate percentage (IP) versus strong model-level alignment baselines, while preserving benign prompt-image alignment on COCO near the unaligned reference.

Figures (14)

• Figure 1: (a) $\tau=0.1$, (b) $\tau=0.3$, (c) $\tau=0.5$, (d) $\tau=0.7$, and (e) $\tau=0.9$. As $\tau$ increases, the levels of sexuality and violence in the generated images increase.
• Figure 2: (a) IP score vs. $\tau$. (b) LDA projection of original/projected prompt embeddings with per-$\tau$ centroids. Sweeping $\tau$ yields monotonic trends: IP increases with $\tau$, and centroid drift from the original prompt increases as $\tau$ decreases (in LDA 2D).
• Figure 3: SPAT diagnostic. IP Scores versus FID-to-reference(ref) proxy on COCO-safe prompts for SD1.5/SD2.1/SDXL. Colors denote datasets (UD/I2P/CoProV2), markers denote methods, and dashed lines are per-dataset linear fits, showing a consistent negative trend.
• Figure 4: Projection diagnostics. (a) COCO: our centroid shift is smaller than POSI (cf. \ref{['eq:identity']}). (b) CoProV2: centroid drift saturates beyond $R{=}2$ and re-run fixed-point ratios increase (cf. \ref{['eq:idempotent']}).
• Figure 5: Stage-1 routing effectiveness at $\tau=0.05$ (diagnostic computed on original prompts; images are realized with SD1.5). We sort $n$ paired samples by the prompt-only score $P$ (ascending) and forward only the lowest-$P$ fraction $f$ to the Stage-2 verifier. The resulting subsets are strongly enriched for Stage-2 acceptance events ($Q\le\tau$), showing that $P$ is an effective routing signal that concentrates costly Stage-2 evaluations on candidates more likely to pass, while the acceptance rule itself remains unchanged and fully image-conditioned.

Theorems & Definitions (28)

• Theorem 3.1: Safety--prompt alignment trade-off (SPAT)
• proof
• Theorem 3.3: Existence of a measurable $\tau$-safe projection
• proof
• Theorem 3.4: Kernelized SPAT and a $\tau$-controlled floor
• proof
• Lemma 1.1: TV controls expectation gaps for bounded functionals
• proof
• proof : Proof of Theorem \ref{['thm:spat-maintext']}
• Lemma 1.3: Continuity of the reference risk map