不重训练就能让生成模型安全去记忆,抗攻击还保画质。
SafeRedir: Prompt Embedding Redirection for Robust Unlearning in Image Generation Models
- 通过嵌入空间的令牌级干预,引导不安全提示走向安全语义区。
- 在多个任务中实现高效去记忆,保持图像质量与语义一致。
- 轻量级插件式设计,适配多种扩散模型和已去记忆模型。
图像生成模型虽能创作出精彩内容,但常从训练数据中记忆大量不良概念,导致生成不当内容(如NSFW图像、受版权保护的艺术风格),在实际部署中带来持续的安全与合规风险。事后过滤机制因鲁棒性不足且缺乏细粒度语义控制,难以有效应对。现有去记忆方法需昂贵重训练,或降低良性生成质量,或无法抵抗提示改写与对抗攻击。为此,我们提出SafeRedir——一种无需修改基础模型的轻量级推理时去记忆框架,通过提示嵌入空间的令牌级干预,自适应地将不安全提示导向安全语义区域。其包含两个核心组件:基于潜在特征的多模态安全分类器,用于识别不安全生成路径;以及令牌级增量生成器,结合辅助预测器实现令牌掩码与自适应缩放,精准定位并调控干预。实验证明,SafeRedir在多个代表性去记忆任务中表现优异,兼具高效的去记忆能力、高语义与感知保真度、强健的图像质量及对对抗攻击的抵抗能力。该方法可泛化至多种扩散模型与已有去记忆模型,具备即插即用兼容性与广泛适用性。代码与数据见https://github.com/ryliu68/SafeRedir。
原文摘要 · Abstract (English)
Image generation models (IGMs), while capable of producing impressive and creative content, often memorize a wide range of undesirable concepts from their training data, leading to the reproduction of unsafe content such as NSFW imagery and copyrighted artistic styles. Such behaviors pose persistent safety and compliance risks in real-world deployments and cannot be reliably mitigated by post-hoc filtering, owing to the limited robustness of such mechanisms and a lack of fine-grained semantic control. Recent unlearning methods seek to erase harmful concepts at the model level, which exhibit the limitations of requiring costly retraining, degrading the quality of benign generations, or failing to withstand prompt paraphrasing and adversarial attacks. To address these challenges, we introduce SafeRedir, a lightweight inference-time framework for robust unlearning via prompt embedding redirection. Without modifying the underlying IGMs, SafeRedir adaptively routes unsafe prompts toward safe semantic regions through token-level interventions in the embedding space. The framework comprises two core components: a latent-aware multi-modal safety classifier for identifying unsafe generation trajectories, and a token-level delta generator for precise semantic redirection, equipped with auxiliary predictors for token masking and adaptive scaling to localize and regulate the intervention. Empirical results across multiple representative unlearning tasks demonstrate that SafeRedir achieves effective unlearning capability, high semantic and perceptual preservation, robust image quality, and enhanced resistance to adversarial attacks. Furthermore, SafeRedir generalizes effectively across a variety of diffusion backbones and existing unlearned models, validating its plug-and-play compatibility and broad applicability. Code and data are available at https://github.com/ryliu68/SafeRedir.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。