提出Dark Miner方法,有效消除文本到图像模型的不良生成。
Dark Miner: Defend against undesirable generation for text-to-image diffusion models
- 三阶段循环机制:挖掘、验证、绕过,精准定位并压制不良概念
- 在多种对抗攻击下仍保持良好防御效果,且不损害正常生成能力
- 适用于内容安全防护,尤其适合应对恶意文本攻击的场景
文本到图像扩散模型因使用未经过滤的大规模训练数据,存在生成不当内容(如色情图像、版权内容)的问题,亟需消除不良概念。现有方法主要通过修改含目标概念文本的生成概率来实现,但无法保证未见文本(尤其是恶意攻击文本)的生成概率最小化。本文分析了消除任务,指出现有方法在总不良生成概率最小化上存在不足。为此,提出Dark Miner,采用循环的三阶段流程:挖掘、验证与绕过。该方法贪婪地挖掘目标概念生成概率最高的嵌入向量,更有效地抑制其生成。实验评估了其在不当内容、物体和风格概念上的表现。相比先前方法,Dark Miner在多种对抗攻击下均实现更优的消除与防御效果,同时保持模型原有生成能力。代码将开源于GitHub。
原文摘要 · Abstract (English)
Text-to-image diffusion models have been demonstrated with undesired generation due to unfiltered large-scale training data, such as sexual images and copyrights, necessitating the erasure of undesired concepts. Most existing methods focus on modifying the generation probabilities conditioned on the texts containing target concepts. However, they fail to guarantee the desired generation of texts unseen in the training phase, especially for the adversarial texts from malicious attacks. In this paper, we analyze the erasure task and point out that existing methods cannot guarantee the minimization of the total probabilities of undesired generation. To tackle this problem, we propose Dark Miner. It entails a recurring three-stage process that comprises mining, verifying, and circumventing. This method greedily mines embeddings with maximum generation probabilities of target concepts and more effectively reduces their generation. In the experiments, we evaluate its performance on the inappropriateness, object, and style concepts. Compared with the previous methods, our method achieves better erasure and defense results, especially under multiple adversarial attacks, while preserving the native generation capability of the models. Our code will be available on GitHub.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。