通过分析文本编码器特征,实现对图文模型的强安全防护且不降低生成质量。
SafeGuider: Robust and Practical Content Safety Control for Text-to-Image Models
- 利用[EOS] token嵌入差异识别恶意提示,实现攻击感知
- 攻击成功率最低降至5.48%,保持图像生成质量
- 适用于Stable Diffusion、Flux等多种模型,实用性强
文本到图像模型在根据自然语言描述生成高质量图像方面展现出强大能力。然而,这些模型极易受到对抗性提示攻击,可绕过安全机制生成有害内容。尽管已有多种防御策略,但在保持实际应用可用性的同时实现鲁棒防御仍是重大挑战。为此,我们首先对广泛使用的Stable Diffusion(SD)模型的文本编码器进行了实证研究,发现[EOS]标记在嵌入空间中呈现独特的分布模式,能区分良性与恶意提示。基于此,我们提出SafeGuider,一种两阶段框架,结合嵌入级识别模型与安全感知的特征擦除束搜索算法,可在不牺牲生成质量的前提下,有效抵御域内和域外攻击。SafeGuider在多种攻击场景下将攻击成功率最大降低至5.48%。此外,它不会拒绝生成或输出黑图,而是生成安全且有意义的图像,显著提升实用性。该方法不限于SD模型,还可有效应用于Flux等其他文本到图像模型,展现出良好的通用性与适应性。我们希望SafeGuider能为安全图文系统的实际部署提供新思路。
原文摘要 · Abstract (English)
Text-to-image models have shown remarkable capabilities in generating high-quality images from natural language descriptions. However, these models are highly vulnerable to adversarial prompts, which can bypass safety measures and produce harmful content. Despite various defensive strategies, achieving robustness against attacks while maintaining practical utility in real-world applications remains a significant challenge. To address this issue, we first conduct an empirical study of the text encoder in the Stable Diffusion (SD) model, which is a widely used and representative text-to-image model. Our findings reveal that the [EOS] token acts as a semantic aggregator, exhibiting distinct distributional patterns between benign and adversarial prompts in its embedding space. Building on this insight, we introduce SafeGuider, a two-step framework designed for robust safety control without compromising generation quality. SafeGuider combines an embedding-level recognition model with a safety-aware feature erasure beam search algorithm. This integration enables the framework to maintain high-quality image generation for benign prompts while ensuring robust defense against both in-domain and out-of-domain attacks. SafeGuider demonstrates exceptional effectiveness in minimizing attack success rates, achieving a maximum rate of only 5.48\% across various attack scenarios. Moreover, instead of refusing to generate or producing black images for unsafe prompts, SafeGuider generates safe and meaningful images, enhancing its practical utility. In addition, SafeGuider is not limited to the SD model and can be effectively applied to other text-to-image models, such as the Flux model, demonstrating its versatility and adaptability across different architectures. We hope that SafeGuider can shed some light on the practical deployment of secure text-to-image systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。