通过扭曲文本嵌入空间，有效防止扩散模型生成色情内容。
Mitigating Sexual Content Generation via Embedding Distortion in Text-conditioned Diffusion Models
- 在文本编码器中设计安全嵌入区域，转移危险提示对应的嵌入向量。
- 对齐'裸露'嵌入与中性嵌入，使模型对恶意攻击更鲁棒，攻击成功率降至9.47%。
- 既防住恶意生成，又保持正常图像质量，适合内容安全部署场景。
扩散模型在文本引导下表现出色，但存在生成色情内容的风险。现有方法如提示过滤、概念移除及内容抑制等，在应对对抗攻击时表现不佳且影响正常图像质量。本文提出一种基于文本编码器的防御机制——嵌入空间扭曲（DES），通过控制嵌入空间实现有效防护。DES将由危险提示提取的嵌入向量映射至预设的安全区域，同时保留原始安全嵌入；并通过将‘裸露’嵌入对齐至中性嵌入，增强对对抗攻击的鲁棒性。大量实验表明，DES在显式内容抑制与自适应攻击防御上均达当前最优性能：在FLUX.1上攻击成功率（ASR）为9.47%，在Stable Diffusion v1.5上为0.52%，相比前驱方法EraseAnything和AdvUnlearn分别降低76.5%和63.9%。此外，该方法保持了良好的良性图像质量，其弗雷谢特初始距离（FID）与CLIP得分与原始FLUX.1和Stable Diffusion v1.5相当。
原文摘要 · Abstract (English)
Diffusion models show remarkable image generation performance following text prompts, but risk generating sexual contents. Existing approaches, such as prompt filtering, concept removal, and even sexual contents mitigation methods, struggle to defend against adversarial attacks while maintaining benign image quality. In this paper, we propose a novel approach called Distorting Embedding Space (DES), a text encoder-based defense mechanism that effectively tackles these issues through innovative embedding space control. DES transforms unsafe embeddings, extracted from a text encoder using unsafe prompts, toward carefully calculated safe embedding regions to prevent unsafe contents generation, while reproducing the original safe embeddings. DES also neutralizes the ``nudity'' embedding, by aligning it with neutral embedding to enhance robustness against adversarial attacks. As a result, extensive experiments on explicit content mitigation and adaptive attack defense show that DES achieves state-of-the-art (SOTA) defense, with attack success rate (ASR) of 9.47% on FLUX.1, a recent popular model, and 0.52% on the widely adopted Stable Diffusion v1.5. These correspond to ASR reductions of 76.5% and 63.9% compared to previous SOTA methods, EraseAnything and AdvUnlearn, respectively. Furthermore, DES maintains benign image quality, achieving Frechet Inception Distance and CLIP score comparable to those of the original FLUX.1 and Stable Diffusion v1.5.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。