arXiv:2608.15341cs.CV2026-08

让AI图像生成更安全,能精准删除有害概念且不影响正常创作。

TEA: Text Encoder Alignment for Robust Concept Erasure in Text-to-Image Models

论文配图:TEA: Text Encoder Alignment for Robust Concept Erasure in Text-to-Image Models
图 1 · 摘自论文原文
  • 通过文本编码器对齐,让模型无法区分有害与安全提示。
  • 在Stable Diffusion v1.4上抵御黑盒白盒攻击,成功率低于5%。
  • 无需推理时额外计算,适合大规模部署,兼容多种模型架构。

文本到图像扩散模型可能被恶意提示绕过安全机制生成有害内容。现有概念擦除方法普遍存在对对抗性提示鲁棒性差、良性生成质量下降或依赖推理时干预导致持续计算开销的问题。为此,本文将概念擦除建模为文本表征空间中的域对齐问题,提出轻量级文本编码器对齐框架TEA,仅微调文本编码器而保持生成主干完全冻结。给定概念-锚点提示对,方法训练一个判别器以区分含概念提示与安全锚点提示的词元级表征,同时更新文本编码器使二者表征不可区分。TEA引入零推理时开销,仅需少量微调步骤,部署效率极高。尽管如此,其在Stable Diffusion v1.4上对黑盒与白盒对抗攻击的擦除鲁棒性达到当前最优水平,同时保留良性提示生成质量。此外,TEA具备模型无关性,在Stable Diffusion v3.5上实现最低攻击成功率,首次扩展至使用T5条件的修正流变换器架构,此前方法在此类结构上尚未探索。代码已开源。

原文摘要 · Abstract (English)

Text-to-image diffusion models can be misused to generate harmful content through adversarial or paraphrased prompts that bypass built-in safety mechanisms. Existing concept erasure methods often suffer from limited robustness against adversarial prompts, degradation of benign generation quality, or reliance on inference-time interventions that introduce persistent computational overhead. To address these limitations, we formulate concept erasure as a domain alignment problem in the text representation space. We propose a lightweight Text Encoder Alignment framework (TEA) that fine-tunes only the text encoder while keeping the generative backbone fully frozen. Given concept--anchor prompt pairs, our method trains a discriminator to distinguish token-level representations of concept-containing prompts from those of safe anchor prompts, while updating the text encoder to make these representations indistinguishable. TEA introduces zero inference-time overhead and requires only a small number of fine-tuning steps, making it highly efficient to deploy at scale. Despite this efficiency, TEA achieves state-of-the-art erasure robustness against black-box and white-box adversarial attacks on Stable Diffusion v1.4, while preserving generation quality on benign prompts. Furthermore, TEA is model-agnostic and achieves the lowest attack success rate on Stable Diffusion v3.5, extending concept erasure to a Rectified Flow Transformer architecture with T5 conditioning where prior methods remain largely unexplored. Code is available at \href{https://github.com/alirezafarashah/TEA.git}{https://github.com/alirezafarashah/TEA.git}

概念擦除文本对齐安全生成

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。