Beyond the Safety Tax: Mitigating Unsafe Text-to-Image Generation via External Safety Rectification (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing safety defenses typically intervene internally within the generative model, but suffer from severe concept entanglement, leading to degradation of benign generation quality. |
| Approach: | They propose a structurally isolated safety module that performs external, interpretable rectification without modifying the base model. |
| Outcome: | The proposed module performs external, interpretable rectification without modifying the base model. |
Similar Papers
Multimodal Pragmatic Jailbreak on Text-to-image Models (2025.acl-long)
Copied to clipboard
Tong Liu, Zhixin Lai, Jiawen Wang, Gengyuan Zhang, Shuo Chen, Philip Torr, Vera Demberg, Volker Tresp, Jindong Gu
| Challenge: | Existing jailbreaks for diffusion-based text-to-image models generate unsafe content . experimental results show that all tested models suffer from unsafe generation . |
| Approach: | They propose a jailbreak that triggers diffusion-based text-to-image models to generate the image with visual text, resulting in unsafe content. |
| Outcome: | The proposed model generates image with visual text, but the model is unsafe under such jailbreak. |
Iterative Prompt Refinement for Safer Text-to-Image Generation (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing safety methods for text-to-image models ignore the images produced . this can result in unsafe outputs or unnecessary changes to already safe prompts . |
| Approach: | They propose an iterative prompt refinement algorithm that uses Vision Language Models to analyze prompts and generated images. |
| Outcome: | The proposed method improves safety while maintaining user intent and reliability comparable to existing methods. |
Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models (2025.findings-naacl)
Copied to clipboard
| Challenge: | Text-to-image (T2I) models can be used to generate harmful content such as sexually explicit, unfaithful, and misleading or Not-Safe-for-Work (NSFW) images. |
| Approach: | They propose a more practical and universal attack that does not require the presence of a target model. |
| Outcome: | The proposed attack bypasses both text and image safety checkers while preserving high semantic alignment with the target prompt. |
Chain-of-Jailbreak Attack for Image Generation Models via Step by Step Editing (2025.findings-acl)
Copied to clipboard
Wenxuan Wang, Kuiyi Gao, Youliang Yuan, Jen-tse Huang, Qiuzhi Liu, Shuai Wang, Wenxiang Jiao, Zhaopeng Tu
| Challenge: | Text-based image generation models, such as Stable Diffusion and DALL-E 3, hold significant potential in content creation and publishing workflows . however, considerable efforts are being made to prevent the generation of harmful content, such abusive, violent, or pornographic material. |
| Approach: | They propose a chain-of-jailbreak method which decomposes malicious queries into multiple sub-queries and iteratively edits images based on these sub-questions. |
| Outcome: | The proposed method can bypass safeguards of image generation models for over 60% cases, significantly outperforms other jailbreaking methods (14%) |
Zero-Shot Defense Against Toxic Images via Inherent Multimodal Alignment in LVLMs (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing safeguards relying on pre-filtering or fine-tuning are costly and diminish overall utility. |
| Approach: | They propose a lightweight method that leverages LVLMs’ inherent multimodal alignment for zero-shot toxic image detection. |
| Outcome: | The proposed method achieves a 66.9% defense success rate with only 3.2% false positive rate and 7.2% overhead. |
Reimagining Safety Alignment with An Image (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches to large language models face inefficiency, fragility, or architectural constraints, resulting in inefficient performance and heightened over-refusal in cross-modal tasks. |
| Approach: | They propose an optimization-driven visual prompt framework that enhances security and reduces over-refusal at the same time. |
| Outcome: | The proposed framework enhances security and reduces over-refusal while maintaining robust safety while reducing unnecessary denials. |
Universal Prompt Optimizer for Safe Text-to-Image Generation (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing studies based on image checker, model fine-tuning and embedding blocking are impractical in real-world applications. |
| Approach: | They propose a novel reward function measuring toxicity and text alignment of generated images and train the optimizer through Proximal Policy Optimization. |
| Outcome: | The proposed model reduces the likelihood of various models in generating inappropriate images, with no significant impact on text alignment. |
SAFENUDGE: Safeguarding Large Language Models in Real-time with Tunable Safety-Performance Trade-offs (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are susceptible to jailbreak attacks, or adversarial prompts eliciting high-risk behavior. |
| Approach: | They propose a safeguard that combines Controlled Text Generation and "nudging" it adds minimal latency to inference and reduces successful jailbreak attempts by up to 37.3% . |
| Outcome: | The proposed safeguard reduces successful jailbreak attempts by between 28.1% and 37.3% by guiding the LLM towards a safe response. |
ECHA: Jailbreaking LVLMs via the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing safety guardrails fail to intercept latent intent, whereas LVLMs can implicitly synthesize holistic malicious semantics from fragmented visual cues. |
| Approach: | They propose an Emoji Chain Hinting Attack (ECHA) framework that decouples sensitive concepts into semantically related emoji chains and structural text masks. |
| Outcome: | The proposed framework outperforms existing baselines and bypasses safety guardrails in over 81% of instances with a single attempt. |
Seeing No Evil: Blinding Large Vision-Language Models to Safety Instructions via Adversarial Attention Hijacking (2026.acl-long)
Copied to clipboard
| Challenge: | Existing attacks optimize image perturbations to maximize harmful output likelihood, but suffer from slow convergence due to gradient conflict between adversarial objectives and the model’s safety-retrieval mechanism. |
| Approach: | They propose a push-pull approach which suppresses attention to system-prompt tokens and anchors generation on adversarial image features to avoid collisions. |
| Outcome: | The proposed approach reduces gradient conflict by 45% and achieves 94.4% attack success rate on Qwen-VL (vs. 68.8% baseline) with 40% fewer iterations. |