Dynamic Negative Guidance of Diffusion Models
Authors: Felix Koulischer
Johannes Deleu
Gabriel Raya
Thomas Demeester
Luca Ambrogioni
Venue: ICLR 2025 Poster (2025)
Keywords: Classifier-free guidance
Negative prompting
Diffusion model guidance
Primary area: generative models
TL;DR: A novel theoretically grounded dynamic negative guidance scheme is proposed as alternative to the widespread, yet severly understudied, negative prompting algorithm.

Abstract: Negative Prompting (NP) is widely utilized in diffusion models, particularly in text-to-image applications, to prevent the generation of undesired features. In this paper, we show that conventional NP is limited by the assumption of a constant guidance scale, which may lead to highly suboptimal results, or even complete failure, due to the non-stationarity and state-dependence of the reverse process. Based on this analysis, we derive a principled technique called ***D**ynamic **N**egative **G**uidance*, which relies on a near-optimal time and state dependent modulation of the guidance without requiring additional training. Unlike NP, negative guidance requires estimating the posterior class probability during the denoising process, which is achieved with limited additional computational overhead by tracking the discrete Markov Chain during the generative process. We evaluate the performance of DNG class-removal on MNIST and CIFAR10, where we show that DNG leads to higher safety, preservation of class balance and image quality when compared with baseline methods. Furthermore, we show that it is possible to use DNG with Stable Diffusion to obtain more accurate and less invasive guidance than NP.

Published as a conference paper at ICLR 2025
DYNAMIC NEGATIVE GUIDANCE OF DIFFUSION MODELS
Felix Koulischer"
Johannes Deleu'
Gabriel Raya²
Thomas Demeester lit
Luca Ambrogion
JADS, Tilburg University 3 Donders Institute for Brain Cognition and Behaviour, Radboud University
IDLab, Ghent University
ABSTRACT
Negative Prompting (NP) is widely utilized in diffusion models, particularly in text-to-image applications, to prevent the generation of undesired features. In this paper, we show that conventional NP is limited by the assumption of constant guidance scale, which may lead to highly suboptimal results, or even complete failure, due to the non-stationarity and mateedeeendence of the reverse process. Based on this analysis, we derive a principled technique called Dynamic Negative Guidance, which relies on a near-optimal time and state dependent modulation the guidance without requiring additional training. Unlike NP, negative guidance requires estimating the posterior class probability during the denoising process, which is achieved with limited additional computational overhead by tracking the discrete Markov Chain during the generative process. We evaluate the performance of DNG class-removal MNIST and CIFAR1O, 10, where show that DNG leads higher safety, preservation of class balance and image quality when compared with baseline methods. Furthermore, we show that it is possible to use DNG with Stable Diffusion to obtain more accurate and less invasive guidance than NP. Our im- plementation available https: //tpt/gggtttb/t/// com/ weweeiixoolssscheee Dynami i-
Cww.aaccdcnc... git
INTRODUCTION
Since first proposed as generative models (Sohl-Dickstein et al. 2015 Ho al. 2020 Karras et al.,
2022) Song et al. 202T), Diffusion models (DMs) have surpassed previous generative models by large margins wide range of tasks, including Text-to-Image (T2I) generation (Rombach et al. 2022). audio synthesis (Kong et al. 2021). video synthesis (Bar- Tal al. 2024), and protein design [Watson cet al. 2023). One of the key features behind their success is the simplicity with which these models can be controlled during generation. This process, referred to as guidance (Dhariwal & Nichol 2021 Ho & Salimans 202I). allows users to sample from conditional distribution. In modern
T21 DMs the guidance is performed through joint text-image latent representations such as CLIP for Stable Diffusion (Radford al. 202T Rombach et al.) 2022 Podell et al.) 20224). The language
model behind such a joint embedding is however quite poor and struggles to understand basic textual operations such negations (Parcalabescu al. 2022 Singh al., 2024 Quantmeyer et al., 2024). As an example, when prompting Stable Diffusion with the prompt: "A gentleman with a cane from the 1800s without a mustache". ; almost guaranteed that the model will produce an image of man with mustache. To resolve this, widespread diffusion models such as Midjourney or Stable Diffusion rely on second prompt line that contains a so-called negative prompt (Gandikota et al.. 2023al Ban et al. 2024 Armandpour et al. 2023 Schramowski et al. [023 Du et al.) 2020). In the example mentioned above, this line would contain the prompt: "A mustache" This prompt is then used similarly to the positive prompt, the only difference being that instead of pushing the model towards the condition, the model pushes away from it. This is called Negative Prompting (NP).
Negative prompting is commonly accepted in the community, and all publicly available models
"Corresponding author: koli. ueentt.e Joint Senior Authors

---

Published as a conference paper at ICLR 2025
Cffiucioo
Diffusion
Cfffus
(a) No guidance
(b) CFG (A 1)
(c) 1)
(d) Exact DNG (ours)
Figure I:
Comparison between CFG, NP and DNG using the exact posterior (all used with À = 1). DNG with the exact posterior is equivalent CFG, while NP fails to sample the target distribution.
rely on some form of NP. Its theoretical aspects remain however understudied (Armandpour et al. 2023: Ban et al. 2024). Mathematically, NP is straightforward, as it corresponds to the well-studied Classifir--ree Guidance (CFG) scheme (Ho Salimans 2021) with a negative guidance scale. However, while effective in practice, such a simple change of sign is fundamentally flawed. CFG can be seen as an attractive vector field that aims to guide the model towards the correctly conditioned outputs. In particular, the further away the noised image is from the desired condition, the stronger the guidance field is. When designing a guidance scheme that averts the denoising process towards an output from an undesired region, two properties must be met. First, the corresponding repulsive field needs to be directed away from the undesired conditional, i.e. a change of sign is required, which NP satisfies by construction. In addition, the repulsive vector field should be the strongest close to the undesired regions, such that the negative prompt has no impact at all if the progressive denoising process remains far from any of the undesired regions. This property is missing from the traditional NP scheme. The flaws of NP are particularly apparent in one dimension, in which NP completely fails to sample the desired conditional distribution. This is shown in Fig. [ in which the different guidance schemes are compared to each other. Another key flaw of NP is the static nature of the guidance scheme. It was recently shown that the generative denoising process is far from being uniform in time, as it is instead demarcated by brief symmetry breaking events corresponding to "generative decisions' (Raya Ambrogioni] 2024 Biroli al. 20244, Ambrogioni 2024a; SSlocchii et al. 2024 Li & Chen (024)) Ideally, during those key bifurcation moments that guidance should be active, since outside those semantic decision regions guidance only harms the diversity of the model (Kynkäänniemi et al., 2024: Sclocchi et al. 2024)..
To resolve these issues, we propose a novel theoretically grounded dynamic negative guidance scheme, coined Dynamic Negative Guidance (DNG), which in the static limit reduces to the widespread NP scheme. Contrary to NP, our approach requires estimating the posterior, which we achieve by tracking the discrete Markov chain during the denoising process. The dynamic guidance scale is proportional to the posterior, which causes the guidance to vanish whenever the posterior probability of the "forbidden class" is low. This is illustrated in Fig. 5 in which the guidance scale of images generated using Stable Diffusion (Rombach et al. 2022) is plotted as a function of the denoising time next to illustrative diffusion trajectories. When using negative prompt related the positive prompt, the guidance is active, while when using semantically unrelated negative prompt, the negative guidance scale drops to zero. Our dynamic approach can self-regulate and even deactivate itself in the case that the negative prompt is completely unrelated to the positive prompt, which is something which NP is incapable of doing. The code associated with this paper will be made publicly available upon acceptance.
2 RELATED WORK
To introduce our dynamic negative guidance scheme, the working principles behind Denoising Diffusion Probabilistic Models (DDPMs), Classifier-Free Freet-FFee--iieeee Guidance Fruidiranneeeee (CFG) and Negative Prompting (NP) are required. These are summarized in sections and 2.2 In section 2.3 the related topic of concept erasure in diffusion models is briefty discussed.
2

---

Published as a conference paper at ICLR 2025
2.1 DENOISING DIFFUSION PROBABILISTIC MODELS (DDPM)
Score based diffusion models (Sohl-Dickstein et al., 2015 Ho et al. 2020 Song et al., 2021) are progressive denoisers, that learn invert forward noising schedule. In the case of variance preserving DDPM (Ho et al. 2020), this forward noising process, iteratively adds Gaussian noise to clean data distribution. The underlying data distribution g 0) is progressively noised until a standard normal Gaussian is obtained, i.c. until after I steps q T) ~ ~N(x; 0, I). For any forward noising schedule { ( whereby 2++1 = v1 Bi + Vit (with G (ee; 0, I)),, the forward process can be directly sampled at any step t, according to g( (mo) ~ Naax;; Vā,zo. (1 T)) with â₂ oo Ve log Pt 0), that is able to iteratively reverse the forward process. The reverse process can be
3.). The goal is to learn a score based model, defined by sa(x,
decomposed into Markov chain
T
p( p(xrr) II i-++1
pi pa 2,;0)
Importantly, each step of the Markov chain is by construction approximately Gaussian pe(23;-11 aa:; 0) ~ (1 po o Instead of modeling the mean, 140,t, it is common to instead predict the noise present at any diffusion stage 60 The two are linked through a linear combination
1
Be 60.-1)
V1 3 J v1- āt
The model can then be trained using optimization objective
0 arg min Ee-
||e,, (Vārzo + v1 V1-a,e =|
should also be noted that the error prediction Eq is proportional to the score function, more specifically se,; Vx log (a) /11 Cz..
2.2
STASSIFFER-FREE GUIDANCE AND NEGATIVE PROMPTING
Most practical applications require conditional generation (Dhariwal & Nichol, 2021: Ho Salimans
2021 Schramowski al.) 2023). The first approach to achieve this, introduced by Dhariwal & Nichol (2021 is called classifier guidance (CG). They consider a classifier p( p(c|æz that quantifies to what extent any condition is met by the object under generation, such as desired class label or adherence to a textual description. The joint probability can be constructed from an unconditional model p(x) combined with an external classifier p(c)z), i.e., p(z, c) = p(=))p(((x) By further sharpening the posterior p(c|æ) using positive exponent X > 1, i.c. sampling from p(z, c) x ((cl))))>>>>> they were able obtain superior result:" The exponent À called the guidance scale, The main impact of this exponent is to make sure that the condition is more closely respected, which comes at the cost of diversity (Ho & Salimans 2021 Kynkäänniemi et al.) 2024). Like all score-based models, DMs do not directly model the data distribution. Instead, they restrict themselves to modeling the so-called score- coreeffunction, the gradient of the log-likeli For CG this results in:
V (z)p) = V log (x:) + AV log (cclz)))
(3)
The problem behind such an approach is that for most of the diffusion process, the images are strongly noised, rendering pretrained classifiers ineffective. Instead, a new time-dependent classifier would have to be trained to recognize images during the denoising process, which is not only costly but also suboptimal. This is why Ho & Salimans (202I) proposed to directly train the joint distribution pa( c) using pairs of textual and visual representations, such as LAION (Schuhmann et al. 2022). Their key insight was to keep the guidance scale À and reuse Bayes rule again to rewrite the posterior Pc(c(z) = (2, (x). In score notation, this results in:
V (x)c) = Va (o)) + >(V logp:(2 c) Va lo))
Writing the unconditional score as V lo (x:) = 80. and the positively conditioned score as V, log Pe (c c) = 80,c, yields the well-known CFG equation:
8CFG = 89 + X(se,c, - se)
(5)
'Strictly speaking, expressions such as ((c()) p(æ, c) are notationally inconsistent for À different than one, but remain consistent with literature, the loose notation is kept.
3

---

Published as a conference paper at ICLR 2025
For image generation conditioned on textual prompts, se is obtained by providing the trained joint model with an empty prompt. It soon became clear that a similar approach allows guiding the model away from undesired prompts, by reversing the sign of the guidance scale in the CFG equation D leading to the Negative Prompting (NP) process:
N = 800 - X(000- - 80)
This means that the attractive field (A > 0) directed towards condition e in Eq. (5) is turned into a repulsive field directed away from the condition Note that conditioning variables and scores associated with an undesired (or negative) condition are denoted in red (c- and sg,c., respectively). Those referring to wanted (i.e.. positive) prompts are written in green (c+ and sg.c.). From a likelihood perspective, the NP equation (6) implies sampling from joint distribution that is inversely proportional to the posterior likelihood p p(æ:, c) x p(æ)/p(( ((ce//()-
2.3 RECENT WORK RELATED TO NEGATIVE PROMPTING
Despite its adoption in influential models, described in blogs like (Andrew 2023 Bhasin 2024). NP remains understudied on a fundamental level. in particular in terms of how and when it should be applied for optimal effect. For example, Ban al. 2024) argue that negative prompting is only of practical use once the undesired features have been generated by the positive prompt, whereas
Armandpour et al. (2023) propose limiting negative guidance along direction orthogonal to that of the positive score,to avoid degrading the effect of the positive prompt.
2023 Du et al. Most similar to our approach are so-called training free guidance schemes (Yu et
2023: Brack et al. 2023] Shen et al.) 20224). Such approaches often work in a fashion very similar to CG, in which a score field, derived as the gradient of classifier, is added the unconditional score field. These do not require any expensive retraining or fine-tuning of the underlying generative model. One method closely related to our work is that proposed by |Schramowski et al., (2023), called Safe Latent Diffussion (SLD), which use the model's knowledge of certain concepts to avoid generation of undesired features, in a manner very similar to NP. Their scheme differs from NP in two regards. First, they consider heuristic non-constant guidance scale that is only active when the predictions of the negatively prompted model overlaps with that of the positively prompted model. This approach does not take the explicit time-dependency into account. Second, they consider pixel wise guidance scale, which allows to locally mix the 'allowed' and 'forbidden' outputs of the network. In our work, we do not use this pixel-wise guidance weights as this feature is not present in the analytical formulas with known score functions (see our derivations in Sec. 3.1] Finally, [Cen et al. (2024) use a very similar approach attack the problem of memorization of training samples in DMs. Our approach is compared to that of SShramoowki et al. (2023) in more detail in Appendix B
Most of the interest in negative guidance within the literature is driven by safety considerations. con-
Such an approach can indeed be used to move away from undesired Not-Safe-For-Wo tent (Schramowski et al. 2023). Most approaches on the subject focus on removing entire concepts from diffusion models by fine-tuning certain layers inside the U-Net, whereby typically the attention layers are targeted (Zhang et al., 2024; Gaandikota et al. 2023b; Wu et al., 2024; Heng & Soh 2023 Gandikota et al. 2023a). The most difficult part of fine-tuning approaches is to only remove the targeted concepts without harming the rest (Heng & Soh, 2023). Another option to avoid the generation of certain features in T2I applications is to instead modify the textual prompts themselves before prompting the model (Kumari et al., 2023 Li et al., 20224). A good overview of the different approaches is described by Pham et al. (2024). where the question of how easily such approaches can be bypassed is treated.
3 METHODOLOGY
The most obvious problem with NP is that there is a clear risk that pr c-) x (c(x)//p(c-1a))) is not normalizable. This happens when more than a single point has a zero posterior likelihood, which, especially at low noise levels, a desired property for an ideal classifier. But even from a score-based perspective, NP is flawed. The score fields are approximately of harmonic nature, implying that the further one is from satisfying the condition Cx,, the larger the magnitude of sg,c,- Simply inverting the score field, is done in NP, implies the presence of very large score field in regions completely unrelated to c-. This is illustrated and discussed in more detail in Appendix [A] What is desired is a guidance field that is strong in regions where pr(c- [x. 1) R 1 and very weak where pe pe(c-la (ar, t) x 0.
4

---

Published as a conference paper at ICLR 2025
3.1 DYNAMIC NEGATIVE GUIDANCE
Instead of simply reverting the sign of the guidance scale, our approach reconstructs the desired score function S0.c. from a linear combination of the unconditional score &g and the unwanted score s0.c.- This method should correspond to CG, with instead of the typical posterior conditioned on C+, its complement conditioned on C.. In the case of negative guidance, one has Pe(C, iz, t) = 1 (r [z). Negative guidance should therefore aim to sample from the following conditional distribution:
pt( (1(2) (1-(((11)())
Notice that this joint distribution is always normalizable, as the singularity in pa (a)) = 0 has been removed. From a score based perspective, this joint distribution results im:
V (zlc)))) v log (2) + Ve log (1-pu (1-p(ce-(z))
(8)
Unlike in CFG, the last term is not directly recognizable as a linear combination of scores. Application of the chain rule yields the score function:
1
Vx log (1 Pa (c-(-la))
V VmPP(c--la)
pr(c-
x:)
Pr (c(c-12) (2)
V pr
pc(c-lar)
By then reapplying Bayes's rule on the posterior, and sharpening the posterior by an additional parameter analogous to the guidance scale L as done in Ho & Salimans (0021)
Pr
Va log = V (o) - Ao 1 (- (x)
(V logg((z/c.)) - Va logp((x))
(10)
= V log) - A(x, t) ( log ve log))(x))
This is the equation behind our proposed Dynamic Negative Guidance. is equivalent to CFG with hypothetical positive prompt: "everything but c-". The minus sign governing the guidance term, illustrates the repulsive nature of the corresponding guidance field, already present in NP. A key pr(cclar) factor. This is precisely the factor distinction with NP is the presence of the additional I-p.
that causes the negative guidance field to be asymptotically large in regions where (c (x) ++ and to be zero in regions where pr (c- .x) 0. Due to its role, similar to the constant guidance scale X CFG, we decide to reuse the name for our time and state dependent guidance function, i.e. we refer to A(x, t) as the dynamic guidance scale. It measures the strength with which the model pushes away from C- at timestep t. Early in the denoising process, the posterior p(c- x) corresponds to the prior p(c-) as large amounts of noise make classification difficult. As the prior is expected to be low, this results in a low guidance scale early on. Only when the classifier becomes confident that is being generated does the negative guidance contribution become more pronounced. When approximating the guidance scale up to zeroth order, a static scheme with constant guidance scale is retrieved, corresponding to NP. should be noted that such non-constant guidance scale is in line with recent trends in literature (Kynkäänniemi et al. 2024 Castillo et al. 2023 Schramowski et al. 2023 Wang et al.) (004).. Algorithm Jsummarizes the DNG scheme.
To validate our method, the case of diffusion of one dimensional Gaussian mixtures is considered. In this setting, the likelihoods as well the posterior are analytically tractable throughout the diffusion process f. The goal is to guide away from single of the Gaussian modes. The mathematical details are given in appendix B These experiments, shown in Fig. D reveal that using DNG conditioned on the unwanted mode with the exact posterior is equivalent to using CFG conditioned on the desired modes. This is in stark contrast to what is obtained when using NP (visible in Fig. Ic), which completely fails to model the target distribution, demonstrating the theoretical shortcomings of the negative prompting algorithm. It should be noted, that while this failure is very apparent in one dimension, does not necessarily imply that such strong statement be made in arbitrary high dimensional spaces.
This implies sampling from p=(c)c-) x (1( [x))+
5

---

Published as a conference paper at ICLR 2025
Algorithm 1 Dynamic Negative Guidance
Input: Pre-trained unconditional DDPM with noise prediction Eg, Pre-trained to-forget DDPM with noise prediction f,,, guidance scale λo prior po and Temperature т
~ (/ 1). TT 1)
p(c- ØT) po
Initialize posterior and guidance scale
Ar Ao I-plc- (RT)
pic-lar)
for T, T...., 1 do
En (x)) = co(a)) (e Ea(w))
Apply guidance
2t-1 Jai (o: 1-g
Vi-ai gual(()))) + vBz
DDPM Step
((e- [1-1) = Compute posterior (p(e= (æx)) H1, eo (x())) c7.6
See Algorithm
de (x = Ao T-p(o-1aa
p(c- 11
Compute new guidance scale
end for
3.2 POSTERIOR APPROXIMATION THROUGH MARKOV CHAIN
Our novel dynamic guidance scale \(x, relies on the posterior likelihood Pr (c-cllr) which is in general not available using score-based models. Inspired by ideas from et al. (2023). 3, propose to approximate the required posterior p(c- x t) by estimating the required likelihoods by tracking the diffusion Markov Chain, defined by Eq. during the denoising process. All the infinitesimal tran- sition probabilities are approximately Gaussian P. (T, x 1..1; B) zs (xxx: (4. (2411), where 14,00 (2 can be retrieved from the noise predictions e (x.+1) using Eq. (2). To compute the
dynamic guidance scale specified by Eq. (TO) the posterior can be estimated from the likelihoods
using Bayes nule:
pe(c-laer) = p(c.) p(xx:T(e.))
p(at:))
(11)
(ogpi(c-(eer) logp(c-) +
(1. (x, ( 0))
-ogg Pr+ (c- 1:7) log Pr p2 c-; log
should be noted that the posterior Pt (c [er)) is independent of the diffusion trajectory der and (r(c-la.). This is consequence of the Markov Assumption and proven in Appendix C The transition probability of the negatively guided model is also Gaussian of equal variance, i.e. Pr pr [1++1, c-; x Nwx Mr, (x (c-),, (c-),,t of I). We therefore obtain the update rule:
only depends on the least noisy time step (c- (.rr)
log pe (c- (mx.) = log Pe+1 (c-1x(+1) 20?
(1|=; (z,((1 - (2,0(()41)11)) (12)
To know in which point at the posterior needs to be estimated, the guidance scale is required, which depends itself on the posterior. An implicit problem is therefore defined. To resolve the implicitness of the above equation, we assume that the posterior changes slowly such that the guidance scale can, up to first order, be approximated by its previous value. This assumption becomes exact as the number of diffusion time steps becomes infinitely large, an assumption often used in the diffusion literature. In essence, the computation of the guidance scale and that of the denoising is staggered in time. To obtain the guidance scale required to find 1;,1, the posterior time step is used, which solely depends on Et, 1Ar, (0)+1) and [4, (4_e((0 ((0++1/e-), which are all known. Mathematically. this boils down replacing log Pe (c xx:) with log ( (e- in Eq. (12).
The term added to the posterior in Eq. (12) can be positive or negative, respectively corresponding to an increase or a decrease of the posterior likelihood. When the new state is closer to the unwanted mean ( lc-) than to the unconditional one (4 the posterior, and hence the guidance scale A(x, t), increases. It should be noted that while the unwanted mean prediction f4, ( (c-) can sometimes be totally off (imagine model that can only generate cats that is trying to denoise the image of a truck), the unconditional mean (z is always a good denoiser (using the previous example, the unconditional model can generate both cats and trucks and therefore has problem denoising any of the two). This has as consequence that the likelihood decreasing terms are much larger in magnitude than the likelihood increasing ones. This is explained visually in Fig. 2

---

Published as a conference paper at ICLR 2025
D
x
x
0:25
6:22
3.75
Ditturan
(a) When generating allowed feature
(b) When generating forbidden feature
Figure 2: Visualization of the different components for estimating the posterior. (a) an allowed point is being generated, in which circumstances ||ar - -- /4,, corresponding to large decrease of the posterior. In (b) forbidden point is being generated, in which circumstances is possible that [ p4el
a
/e,,r corresponding to slight increase of the posterior probability.
To regularize this effect, we propose adding linear transformation to the difference of Euclidean distances. Rescaling difference by factor EJ0, 1 can diminish stochastic fluctuations present during denoising, while small offset ó creates a slight bias towards increasing the posterior. Should an allowed image be generated, this offset is completely dominated by the very large difference. But should the predictions of the unconditional and the negatively conditioned model be similar, the posterior would increase. The estimation of the posterior probability summarized in Algorithm
Algorithm 2 Compute posterior
Input: Previous estimation of filtering posterior Pe(c- (c)) Updated noisy state æ1-1, previous noisy state unconditional noise prediction es (at). to-forget noise prediction ( diffusion constants on, di. prior Pu. Temperature 7, offset 8, minimal and maximal posterior values Pau and pmax
æt,
of
Or - (x: 1-ai (2:)())))
Variance of Gaussian at t Undesired mean prediction
((x:)=
V1-6i
Unconditional mean prediction p(c- 11-1) = (x))) exp 207 (1/21-1 -1(x))11 ||:111 ((x)))))) 267
p(x;) Van (w:
1-m e (x:))
VI-or
p(c- ax-1) = Clamp (p(e((er-)) ). min Prin. max pmax)
Output: Approximate posterior probability p(c-(xt--1)
To illustrate the validity of the proposed posterior approximation scheme, the one dimensional Gaussian case can again be analyzed. The approximated posterior can be compared to the known exact posterior. To remove any effects possibly caused by the guidance itself, the posterior tracked at zero-guidance scale (A = 0). To visualize the results, 100k points are sampled using the unconditional model and then classified into two groups based on whether they belong to the forbidden mode For both groups, the exact and approximated posterior values are averaged at each diffusion time step, as shown Fig. 3a demonstrating
validity the approximation. An example of a distribution sampled using our dynamic negative guidance with the approximate posterior is shown in Fig. (3b] The derived approach is highly flexible, solely requiring conditional diffusion model. It remains valid using latent representations, such used in modern Latent Diffusion Models (Rombach et al.)
2022
4
EXPERIMENTAL RESULTS
4.1
CLASS REMOVAL
The proposed algorithm is tested in the context of image generation on labelled datasets. in the present case MNIST and CIFARIO are considered. The task is to remove one of the classes by guiding an
TThe forbidden mode is chosen to he distinct from others to simplify the classification task (with the unconditional distribution shown in red in Fig.
7

---

Published as a conference paper at ICLR 2025
Average pesterial ptc)m)
UncendRional Destre Sampled
0.6
Density
0.4
Allowed mode
10-3
Forbidiinn mode
posterior
0.2
0.4
0.6
0.8
-4.0
-.00
0.0
2.0
4.0
Diffusion time
X-axis
(a) Posterior estimation (A 0)
(b) Sampled distribution using approx. posterior (A = 1)
Figure 3: Analysis of the posterior estimation. (a) the dotted lines represent the exact posterior, while the full lines represent the approximated posterior. The color indicates whether the generated samples belong to forbidden region or not. These samples were generated without guidance. (b) an example of distribution sampled using the approximate posterior with guidance scale À 1.
Regeln hempliy
Caldenes kem
Setty dwwrr imagu
Satey Sorwerg mmaper
Saltts chwerd Imape
Satey & atwees trape
Sekay S dfwcce Irape
Saey Sraeesiiaaee
Salte chvern Irspm
Sakry % stwees bram
(a) Removing "airplane"
"ear"
"bird"
"eat"
Figure 4: Evaluation of the KL-divergence (top) and FID (bottom) on single class removal experiments performed on CIFARIO 10 using Negative Prompting. Safe Latent Diffusion and our Dynamic Negative Guidance. Despite differences between classes, DNG outperforms both NP and SLD in all settings.
unconditional model with a model trained solely on that specific class. To quantify the safety the approach, classifier assesses the percentage of generated images that belong to the forbidden class, while the diversity is measured by examining the overall distribution of generated classes across all images. Ideally, this distribution should contain a single zero and equal weight all other classes (see Figure 13). ideal and generated distributions is computed. To observe how the quality of the model is altered, the standard FID metric (Heusel et al., 2017) is used. Being a statistical tool, the FID also affected by large class imbalances. The FID not only measures the quality of the images but also accounts for the diversity of the model. still remains the most widespread quality metric for image generation and has time and again been proven coincide with human perception. To compute the FID the statisties of 10240 generated images is compared to the training data without the undesired class.
T3). To measure how well this ideal case is approximated, the KL-divergence between
To compare different approaches, both the FID and the KL-divergence are compared with the safety of the method when sweeping over the initial guidance scale X. These graphs are shown when removing various classes from CIFARI0 in Fig. 4 Similar results are obtained on MNIST. These are shown in Fig. 14 in appendix G Especially relevant is the regime of high safety, where few as possible forbidden images are generated. In this regime, DNG outperforms both NP and SLD on all four classes, showcasing that the image removal performed by DNG is less invasive than previous approaches. Different values of the hyperparameters of SLD are tested and reported in appendix approach is compared with the setting which performs best high safety levels.
8

---

Published as a conference paper at ICLR 2025
+ "An English breakfast"
No
gu
DNG NP
Guidance scale
"Eggs
NP
DNG (ours)
Diffusion time
No guid.
NP
"An art studio"
"Paintbrushes
Guiidane scale
NP
DNG
(ours)
Diffusion
(a) Diffusion trajectories using no guidance, NP and DNG
(b) Dynamic guidance scale
Figure 5: In 5a illustrative diffusion trajectories using Stable Diffusion on different prompts shown. Notice that DNG only removes the unwanted object and keeps, for instance, the bread in the bottom left of the top example. [n|5b] the dynamic guidance scale for the specific trajectories is compared to that used for NP. At which timestep the guidance is most active depends on the specific diffusion trajectory as well as the prompt.
4.2 TEXT-TO-IMAGE
To demonstrate the flexibility of the proposed DNG scheme, small scale experiments are run using Stable Diffusion 2 (Rombach et al. 2022). Inspired by |Schramowski et al. (2023), the role of the unguided model is replaced by that of the positively prompted one. Mathematically. 89 is substituted by 80,c, in Algorithm P To compare the different negative guidance schemes in the context of T2I, prompts that implicitly generate objects are required. An example could be an "English breakfast", for which is highly likely that the model generates an image that contains an egg. The term "egg" can then be chosen as negative prompt. Using ChatGPT we design prompts that are highly likely to generate certain objects without these features being explicitly mentioned in the prompt. These 5 prompts are given in appendix D To illustrate the time dependence of our approach, diffusion trajectories are shown for NP and DNG as well as the unguided case (i.e., without any negative guidance) in Fig. 5a The dynamic guidance scale computed through our posterior estimation is compared to the constant one used in NP in Fig. 5b We observe that our dynamic guidance scale is most active at different timesteps depending both on the prompts and the diffusion trajectory itself. In agreement with current literature we find that the sooner it is activated, the larger the changes in the resulting image are Kynkäänniemi al. (2024); Wang et al. (024). To evaluate how well DNG preserves the diversity of the underlying model, we examine how the guidance deactivates itself when the undesired element is not present. To achieve this, we generate second image with a negative prompt consisting of a semantically unrelated concept. For example, with "English breakfast", an unrelated concept could be "The view of a skyline"..
that case, DNG should let the posterior p(c- [æ, t). and hence the guidance scale, go to zero. A schematic representation of this analysis shown in Fig. 6 lt shows that while both DNG and NP are able to remove the related negative prompt ("an egg") from the original image, only NP modifies the image when using an unrelated negative prompt (for instance the tea cup on the top left of the image). We acknowledge that the images generated using NP with unrelated negative prompt still follow the positive prompt. The fact they are altered unnecessarily implies a potential loss of image diversity Ho & Salimans (202I): Wang al. (2024); Kynkäänniemi et al. (224). To quantify how much the guided images have been altered by the guidance scheme, the Csore i.c. the cosine similarity of their respective CLIP scace representations, is measured. The shown scores averaged over 32 images generated using

---

Published as a conference paper at ICLR 2025
Relited puldance
2.4
Negative Promoting
3.05
Negative Guidance
Prompt
NP
Prempt
Prompt
Prompt
2.2
NG (ours)
2.44
pronst
0.46
No Engliih brotturt"
3.00
p ponntt VVoe skyliie
prorge "Sgp. MAuiggs"
0.20
5.00 negat prompt
(a) Schematic of the evaluation approach Stahle Dif- fusson.
(b) CLIP scores in related and unrelated cases
Figure 6: Comparison of NP and DNG on Stable Diffusion. In 6a the evaluation strategy is explained schematically. A fixed seed is denoised using the same positive prompts with two separate negative prompts, semantically related one and semantically unrelated one. This is done for DNG and NP. The CLIP score between the guided and unguided images is then measured for both related and unrelated cases and displayed function of each other for different prompts in 6b
both NP and DNG for various guidance strengths. Ideally, the CL.IP score should remain equal to one when negatively prompted with an unrelated text, indicating that the negative guidance was fully deactivated, On the contrary, the model prompted with a related text should display a decrease of CLIP score as function of increasing guidance scale. To compare our results to those obtained with NP, the average CLIP score of the samples guided with an unrelated negative prompt can be plotted with respect to the average CLIP score of the samples guided with related negative prompt. For intuitiveness, the axes are scaled from to -1, such that points located farther right and higher on the graph correspond to greater deviation from the original images, indicated by a lower CLIP score. This is visible in Fig. ibbin which each prompt is given its own marker and color intensity. As both DNG and NP follow linear relationships per prompt, they approximated by linear regression in a limited interval. As seen in Figure 6b) our method remains consistent with predictions, causing minimal changes when semantically unrelated negative prompt used, while still performing par with NP in the case of a related negative prompt. Generated samples are provided in Appendix
LIMITATIONS
The main limitation of the present work is the non-exhaustive analysis of our approach in the context of T2I generation. The current results obtained with Stable Difffusion solely demonstrate that the proposed approach shows promising potential. A more thorough analysis using larger prompt dataset, advanced metries such as the FID, as well more generie hyperparameter values, are all still required. Another limitation of the Stable Diffusion experiments, is that no metric is used to verify how well the negative prompt has been removed from the image. This should be done using visual object classifier. All these steps are left as future work.
CONCLUSION
Understanding the theoretical flaws behind the widespread Negative Prompting algorithm, led to a novel, theoretically grounded Dynamic Negative Guidance scheme. This scheme was first validated low dimensional setting, before being compared to alternative approaches in image generation tasks. In particular, the proposed scheme outperformed concurrent approaches, such Negative Prompting or Safe Latent Diffusion, at the task of class removal from an unconditional MNIST or CIFAR10 model. The advantages of the dynamic nature of the scheme was further displayed in the context of T2I generation using Stable Diffusion, which it was shown that DNG deactivates itself when the negative prompt unrelated the positive prompt.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENTS
This research was partly funded by the Research Foundation Flanders (FWO- Vlaanderen) under grant GOC2723N and by the Flemish Government (AI Research Program). Gabriel Raya was funded by the Dutch Research Council (NWO) as part of the CERTIF-AI project (file number 17998).
REFERENCES
Luca Ambrogioni. The statistical thermodynamics of generative diffusion models: Phase transitions, symmetry breaking and critical instability. arXiv preprint 2Xiv:23/0.17466: 2024a.
Luca Ambrogioni. search of dispersed memories: Generative diffusion models are associative
memory networks. Entropy, 26(5):381, 2024b.
Andrew. How to use negative prompts. https://stable: diffusion art com/
tbo--toouuee-rraaaaaeee-roooooo November 2023, Accessed: 2024-19-11.
Mohammadrezz Armandpour, Ali Sadeghian, Huangjie Zheng, Amir Sadeghian, and Mingyuan Zhou. Re-imagine the negative prompt algorithm: Transform 2d diffusion into 3d, alleviate janus problem and beyond. arXiv preprint arXiv:2304. 04968, 2023.
Yuanhao Ban, Ruochen Wang, Tianyi Zhou, Minhao Cheng, Boqing Gong, and Cho-Jui Hsieh. Understanding the impact negative prompts: When and how do they take effect? arXiv preprint 24Xi::2406602265. 2024.
Omer Bar-Tal, Hila Chefer, Omer Tov, Charles Herrmann, Roni Paiss, Shiran Zada, Ariel Ephrat, Junhwa Hur, Guanghui Liu, Amit Raj. Yuanzhen Li, Michael Rubinstein, Tomer Michaeli, Oliver Wang, Deqing Sun, Tali Dekel, and Inbar Mosseri. Lumiere: A space-time diffusion model for video generation. arXiv preprint arXiv:2401, 12945, 2024.
Sparsh Bhasin. A guide negative prompts in stable diffussoon https::/bblo https///bbooommmstrrp..p.. ai 2024-19-11.
July 2024. Accessed:
Giulio Biroli, Tony Bonnaire, Valentin de Bortoli, and Mare Mézard. Dynamical regimes of diffusion models. arXiv preprint arXiv:2402.18493 2024.
Manuel Brack, Felix Friedrich, Dominik Hintersdorf, Lukas Struppek, Patrick Schramowski, and Kristian Kersting. SEGA: Instructing text-to-image models using semantic guidance. In seirth- Conference on Neural Information Processing Systems, 2023. URL https
//openreview net. wtt.://oummmmmim wtw.rrrmmmmiiiiPAII22222
Angela Castillo, Jonas Kohler, Juan C. Pérez, Juan Pablo Pérez, Albert Pumarola, Bernard Ghanem, Pablo Arbeláez, and Ali Thabet. Adaptive guidance: Training acceleration of conditional diffusion models. arXiv preprint arXiv: 12. 2023.
Chen Chen, Daochang Liu, and Chang Xu. Towards memorization-free diffusion models. In The IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. In M. Ranzato, A. Beygelzimer, Dauphin, P.S. Liang and J. Wortman Vaughan (eds.), Ad- vances in Neural Information Processing Systems, volume 34, pp. 8780-8794. Curran Asso- ciates, Inc., 2021. http.//ttttttt::poooe/eooiioooa neurse cc ccppaper___pp.pe.eeppeeeeeee.e files/paper/ h0t.://0ll/.02222aaeeeaaae601000 Pappseeddddsccaaaaa....... Paper.
Yilun Du, Shuang Li, and Igor Mordatch. Compositional visual generation with energy based models. H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Ad- vances in Neural Information Processing Systems, volume 33, pp. 6637-6647. Curran Asso- ciates, Inc., 2020. URL httpe//ooo...ttttee//o/ooooooooa

---

Published as a conference paper at ICLR 2025
Yilun Du, Conor Durkan, Robin Strudel, Joshua B. Tenenbaum, Sander Dieleman, Rob Fergus, Jascha Sohl-Dickstein, Arnaud Doucet, and Will Sussman Grathwohl. Reduce, reuse, recycle: Compositional generation with energy-based diffusion models and MCMC. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), Proceedings of the 40th International Conference Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 8489-8510. PMLR, 23-29 Jul 2023. URL https: http:://proceeingg..iioo ott.e//ioo.........eeee///////3/ ww222.//wu2a...... html
Rohit Gandikota, Joanna Materzyríska, Jaden Fiotto- Katto-a and David Bau. Erasing concepts from diffusion models. In Proceedings of the 2023 IEEE International Conference on Computer Vision, 2023a.
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyúska, and David Bau. Unified concept editing in diffusion models. arXiv preprint arXiv:2308. 14761, 2023b.
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Processing Systems, volume 36, pp. 17170-17194, Curran Asso- ciates, Inc., 2023. URL URL
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Berharr Nessler, Günter Klambauer, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a nash equilibrium. CoRR, abs/1 2017. C.I
08500
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NewrlPS 202/ Workshop on Deep Generative Models and Downstream Applications, 2021. URL
net met/forne Etrum/irumiiuorr// Qww.kd/wwwWAXXxx....
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neu- ral Information Processing Systems, volume 33, pp. 6850. Curran Associates, Inc., neur 2020. URL https::/pproceediiiii wwwp://ww....rrsn..cn.o.om wwtpppp.cpppppp.p.ppppppppppep
filess/papee//220/ File/ htte://ccccee333eeaff0011111aa.0 210000177cca4 Pap.--aapp.... Paper.pdfffff
Benjamin Hoover, Hendrik Strobelt, Dmitry Krotov, Judy Hoffman, Zsolt Kira, and Duen Horng Chau. Memory in plain sight: A survey of the uncanny resemblances between diffusion models and associative memories. arXiv preprint 2xXx::3399.66500 2023.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the de- sign space of diffusion-based generative models. In S. Koyejo, Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (eds.), Advances in Neural Infor- mation Processing Systems, volume 35, pp. 26565-26577. Curran Associates, Inc., neurips. ccppipeeec/ppperr Files//paerr2022/
2022. URL https::
Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. Diffwave: A versatile diffusion model for audio synthesis. In International Conference on Learming Representations, 2021. URL httpps://ppenevvew..ccm www.neeetoooomiiiaaeeee. xFK8Ymz5.
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in rext-to-image diffusion models. In ICCV, 2023.
Tuomas Kynkäänniemi, Miia Aittala, Tero Karras, Samuli Laine, Timo Aila, and Jaakko Lehtinen. Applying guidance in a limited interval improves sample and distribution quality in diffusion models. arXiv preprint 240::22400.07724 2024.
Alexander Cong Li, Mihir Prabhudesai, Shivam Duggal, Ellis Langham Brown, and Deepak Pathak. Your diffusion model is secretly zero-shot classifier. In JCML 2023 Workshop on Structured Probabilistic Inference & Generative Modeling, 2023. URL https: opw.review....ee n
forum? d==k3yxRdgxx)
12

---

Published as a conference paper at ICLR 2025
Marvin Li and Sitan Chen. Critical windows: non-asymptotic theory for feature emergence in diffusion models. arXiv preprint arXiv:2403.0163,, 2024
Semmao Li, Joost van de Weijer, taihang Hu, Fahad Khan, Qibin Hou, Yaxing Wang. and jian Yang. Get what you want, not what you don't: t: Image content suppression for text-to-image diffusion models. In The Twelfth International Conference on Learning Representations, 2024. URL
net www.oooomniiiiiiiiiiiiii
Letitia Parcalabescu, Michele Cafagna, Lilitta Muradjan, Anette Frank, lacer Calixto, and Albert Gatt. VALSE: A task-independent benchmark for vision and language models centered on linguistic phenomena. Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.), Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 8253-8280, Dublin, Ireland, May 2022. Association for Computational Linguistics. doi: 10. 10.118653/1/22022acc-b lo6........6...... URL
org 2022 ac -log
567
Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure methods for text-to-image generative models. In The Twelfth International Conference on Learning Representations, 2024. URL | petttp:://opeereviiee wwwprevwwww.eeeeeeeeeeeeeeeeeeee wwt. forum?
(d=ag3o2T51H)
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis. The Twelfth International Conference on Learning Representations, 2024. URL
hittps://openrevllt
net. wwwp:neeee/oooeeeeeeeeeoo (atpmmmmdddddd222mm
Vincent Quantmeyer, Pablo Mosteiro, and Albert Gatt. How and where does clip process negation? arXiv preprint arXiv:2407.10488 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 8748-8763 PMLR, 18-24 Jul 2021. URL mlr mwe.s...ss///mmm.......m.m httesssvv39///// wwt.///dfrddd.....e htm
https: tittss:/pproce httpss::/ppcceeeiieeo
Gabriel Raya and Luca Ambrogioni. Spontaneous symmetry breaking in generative diffusion models. Advances in Neural Information Processing Systems, 36, 2024.
R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. 2022 JEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 10674-10685, Los Alamitos, CA, USA, jun 2022. IEEE Computer Soci- URL lattps:// http:://doo.ieeeeeeoooeoooo wew.comput www.:pppppttsooioooooo..o.......
cty. doi: 10. 11L.0///PR52...2222200... 1tte:/00.110///VERR2220 2022.0022200000 01042
Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. arXiv preprint arXiv:2211.055 105, 2023.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade W Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa R Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. LAION-5b: An open large-scale dataset for training next generation image-text models. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Truck, 2022. URL
net / forum w1d::113-M44--00 4vmMMcY
Antonio Sclocchi, Alessandro Favero, and Matthieu Wyart. A phase transition in diffusion models reveals the hierarchical nature of data. arXiv preprint arXiv:2402.1699) 2024.
Yifei Shen, Xinyang Jiang, Yezhen Wang, Yifan Yang, Dongqi Han, and Dongsheng Li. Understand- ing and improving training-free free loss-based diffusion guidance. arXiv preprint 24Xv:2443.12404 2024.
13

---

Published as a conference paper at ICLR 2025
Jaisidh Singh, Ishaan Shrivastava, Mayank Vatsa, Richa Singh, and Aparn Bharati. Learn "no" say "yes" better: Improving vision-language models via negations. arXiv preprint arXiv:2403.20312, 2024.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In Francis Bach and David Blei (eds.), Proceedings of the 32nd International Conference on Machine Learning, volume 37 of Proceedings of Machine Learning Research, pp. 2256 2265-2265, Lille, France, 07-09 Jul 2015. PMLR. URL https:// proceedings m mlr. wrw.s/pressvvvv. sohl cwsteeiiiiitttiiiiniiii ht.ml
Yang Song. Conor Durkan, Iain Murray, and Stefano Ermon. Maximum likelihood training of score- based diffusion models. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, volume 34, pp. 1415- 1428. Curran Associates, Inc., 2021. URL htt//tttpps::/rrcceeeeeiee fi #tlles/paperr2221//f0eee htaaa///eo..f.oocccccoocc0o0a6a.
Xi Wang, Nicolas Dufour, Nefeli Andreou, Picard, and Vicky Kalogeiton. Analysis of classifier-free guidance weight schedulers. arXiv preprint arXiv:2404. 13040, 2024.
Cani, Victoria Fernandez Abrevaya, David
Joseph L. Watson, David Juergens, Nathaniel R. Bennett, Brian L. Trippe. Jason Yim, Helen E. Eisenach, Woody Ahem, Andrew Borst, Robert J. Ragotte, Lukas Milles, Basile I. M. Wicky, Nikita Hanikel. Samuel J. Pellock, Alexis Courbet, William Sheffler, Jue Wang, Preetham Venkatesh, Isaac Sappington, Susana Vázquez Torres, Anna Lauko, Valentin De Bortoli, Emile Mathieu, Sergey Ovchinnikov, Regina Barzilay, Tommi S. Jaakkola, Frank DiMaio, Minkyung Baek, and David Baker. De novo design of protein structure and function with rfdiffusion. Nature, 62077976):088--1100 2023. doi: 10.10088/44556-00223118
Bichen Wu, Chenfeng Xu, Xiaoliang Dai, Alvin Wan, Peizhao Zhang, Zhicheng Yan, Masayoshi Tomizuka, Joseph Gonzalez, Kurt Keutzer, and Peter Vajda. Visual transformers: Token-based image representation and processing for computer vision. arXiv preprint arXiv:2006.088 036777 2020.
Jing Wu, Trung Le, Munawar Hayat, and Mchrtash Harandi. Erascdiff: Erasing data influence in diffusion models. arXiv preprint 24K1:22001.07779 2024.
Jiwen Yu, Yinhuai Wang, Chen Zhao, Bernard Ghanem, and Jian Zhang. Freedom: Training-free energy-guided conditional diffusion model. In 2023 IEEF/CVF International Conference on Computer Vision (ICCV). pp. 23117-23127, 2023. doi: 10. 10.11000CCV510000003.....11
Gong Zhang, Kai Wang. Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not. Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pp. 1755-1764, June 2024.
14

---

Published as a conference paper at ICLR 2025
(a) Unconditional score
(b) Additional CFG term
(c) Total score field CFG (A 2)
Figure 7: Illustration of CFG in 2D
A ILLUSTRATION OF THE LIMITATIONS OF NEGATIVE PROMPTING
To understand the working principles behind different guidance schemes, it is helpful to analyze the score fields of Gaussian mixtures in two dimensions. Even if conclusions taken in low dimensional spaces do not necessarily transfer to higher dimensions, these can provide valuable insights.
The choice of Gaussian mixtures is not an arbitrary one. Such a score field is the same as that generated by a diffusion model in the memorization regime, with as data points the means of the Gaussian modes (Ho et al. 2020). In that case the network behaves as associative memory system (Ambrogioni 2024b] Hoover et al., 2023). To be specific, Gaussian mixtures represent the analytical diffusion of delta peaks centered around specific data points, which can be thought of as memorized training samples. To illustrate the flaws of the NP algorithm, the individual components of the total guided score field are plotted. The most relevant term being the so-called guidance term, i.e. the term that is added on top of the unconditional score.
In the example that is discussed, the three memorized data points are shown using red crosses (Fig. (a). The goal is to guide the model towards the two upper modes of the mixture, or, inversely,
away from the bottom mode.
For CFG the total field is described by the following equation:
SCFG se + -x(se,c. - se)
(13)
In this case 80.c, can interpreted as the score field computed using as distribution the Gaussian mixture consisting solely of the two desired modes. To understand the shape of this additional classifier term (i.e. 88,c, 89), it is useful to think about the problem through the lens of CG. This additional term represents the gradient of log likelihood of the posterior p(c+ ax, t). This likelihood
can be computed analytically by using Bayes rule p(c=lar, |ar, i) = p(c+) (((4))(m(().))) p(ml(+,())
It is constant and equal to one close to the desired points, while it changes when approaching the undesired point as at that point pe & p(c+)p((r)))) points, while it is large close to the undesired point. The direction of the vector field, is specified by the fact that the posterior likelihood decreases when moving closer the undesired point, implying an attractive field. All these conclusions are clearly visible in Fig. 7
pe(a)
1 Hence, the additional term is small surrounding the desired
On the other hand, when using NP. the conditional field is specified by the undesired data point c-. The total field is then described by the following equation, with À positive constant:
8NP 80 -X800,c -
(14)
The easiest way to understand this score field is to first understand how V. log p(c- [æ,()= 80,c. 1...._88 behaves, and then simply reverse its direction. Essentially this boils down to the case treated above for CFG, with as only difference that desired and undesired modes have swapped position. Close to the undesired mode, the posterior is constant and equal to one, corresponding with very weak score field. On the other hand, as one approaches the desired means, the posterior drops, implying a
"This change is perpetuated when p(c+/ar, (ar, t) -> 0 due to the singularity of the logarithm function in zero, causing an increasing gradient the more the posterior likelihood decreases.
15

---

Published as a conference paper at ICLR 2025
(a) Unconditional score
(b) Additional NP term
(c) Total NP score field (A 2)
Figure 8: Illustration of NP in 2D
large repulsive field from the desired modes. Due to the additional minus sign, this repulsive field of the desired modes becomes attractive, explaining why NP is sensible. The issue is naturally that the field is much stronger in regions that are far away from the undesired mode. What is really desired is, as present for CFG, strong repulsive guidance field surrounding the undesired mode and a close to zero field as one approaches the desired modes. This is an intuitive explanation of the reasoning behind our proposed DNG scheme. Mathematically, we have shown in section 331 that using DNG with c- is equivalent to using CFG with C. = č., It is therefore no surprise that Fig. 9 is equivalent Fig. The total field described by DNG can be decomposed as:
SNG 59 p(c-1x)
p(c- x)) (50.c
-ee
(15)
The difference with NP the presence of state dependent guidance scale. This guidance scale is pro- portional to (c) which causes the guidance term to drop to zero when æ is far from the undesired point. Additionally, the guidance scale becomes asymptotically large as æ approaches the undesired point (i.e. when ((c-|2,t) t) + 1). The guidance score field now posses both desired properties, it is not only directed away from the undesired point, but crucially it is also larger regions closer to that point. The results described here can leave one wondering why NP even works in practice. It should however not be forgotten that the picture here is not only oversimplified by the choice of low dimensionality of the problem but also by the choice of very simple, well separated Gaussian modes. In reality the distribution of natural images is much more complex such that the posterior p(c_ |x, f) follows much more complex pattern. While this clearly illustrates the fundamental shortcomings of NP, is important not to over-interpret these results. NP has proven to a valuable tool for DMs, and more research is required to better understand how its theoretical shortcomings impact it large scale.
(a) Unconditional score
(b) Additional DNG term
(c) Total DNG score field (A = 2)
Figure 9: Illustration of DNG in 2D
16

---

Published as a conference paper at ICLR 2025
B ONE-DIMENSIONAL DIFFUSION EXAMPLE: DETAILS
To validate the theory described in the main body, a one-dimensional diffusion process can be analyzed. For this purpose, is useful choose the sample distribution p(x, 0) as Gaussian mixture. One of the advantage of this choice is its good fit with the typically used Gaussian diffusion kernel, making everything easily tractable.
Specifically, starting from an unperturbed distribution defined by p(æ, 0) = ='= caN(x; pt of it is straightforward to show that the discrete variance preserving diffusion process at time step t results in the following time dependence pr (ar) = Σ caN(w; Van (1 choosing a Gaussian mixture as underlying distribution, the diffused distribution remains a sum of Gaussians at every time step. In practice, this distribution modeled by its score, denoted by s(x, t). To validate our theory, some of the modes, say M < N, are removed at inference through different guidance schemes. For this purpose, two helpful distributions are defined, the Σn1 (a
+ d.. By
lo-forget distribution pa 0)
and the lo-remember distribution
(r 0) = + N=:N p4. If r Both of these distributions are implicitly defined through their respective score functions (x 1) and (x, t). The goal of negative guidance can be resumed as trying sample (x, 0) by using a combination of the unconditional score s t) and the to-forget score 8 (zt t).
Another advantage of working in this one dimensional setting that the posterior is analytically available through Bayes rule:
p 0/.,t) = p(c= p(
p(x, f/c fae - p(c = 0) (r( (x
(16)
Pr
The theory can therefore easily be verified using analytical solutions. Negative guidance, with the exact posterior using s(x, t) and ( t). should exactly correspond to positive guidance using s(x, t) and s, (ax, t). In practice, we demonstrate that:
Positive guidance (s( t), 8n (xx))) t)) Negative guidance (s t), s t), 0/z,
(x, ((s((at)) s(x,t)) t)) sxx X 1- 0| t) (sy(2, s(x, (17)
plc 0/ 1)
C INDEPENDENCE OF POSTERIOR DISTRIBUTION AND DIFFUSION TRAJECTORY
The likelihood of the entire diffusion path can be decomposed through Bayes rule:
p(xeT) = p( 0++1, ... (TT)
p(x Fr (p)(())
(18)
p(x)))(( (
Doing this for both the conditional model p(-lc = 0) and the unconditional model p(-) and inserting this in the equation of the posterior (i.e. Eq 11
p(c = 0/ = p(c = 0) P/EETIc- 0)
p(
pl x c 0) 0)
p(c = 0)
(19)
(x))
= ppcc= 0) pl (0 0) p 0)
p(z,)
p( (xt)
The term p(#t+117(2, refers to the forward process, which corresponds to the fixed, known forward process denoted by g( (z),, ), i.e. one has p(x (xx) ~ g( Both the conditional and unconditional model follow the same forward process such that the last term of (9) drops
'The weighting constants for (a. 0) and pr (x, 0) are renormalised, i.c. 6, or with ΣM of N 1 d'' =
17

---

Published as a conference paper at ICLR 2025
out, ie. ((0.ir700,.c (( 1.
((+ ((
Using this, is easy to show that the posterior is indeed independent of the trajectory taken to reach æy;
p(c 0/ = p(c 0) p( c = 0) p0)pp(e p( 11, 0)
p(z,)
p(#++1:7 ax))
= p(c = 0) p cc = 0) ((x4+1:=())))
p(x:4)
( (24)
(20)
= p(c = 0) p(a0/c= = 0)
p(xx)
p(c = 0/22,)
D EXPERIMENTAL DETAILS
D.1 IMPACT OF THE DIFFERENT HYPERPARAMETER OF DNG
The hyperparameters introduced in the framework of DNG, being the prior p(c), the temperature and the bias 8 all have distinct effects. The prior dictates the initial guess for the posterior, i.c. Pr (c/2r) = p(c) and therefore also the initial guidance scale X(x, T) = X 1-p(c) Choosing a low prior can ensure that negative guidance is not immediately active. The temperature hyperparameter т help to reduce the fluctuations caused by the stochastic denoising process, we find that value of around 7 = 0.2 works well in practice. The offset hyperparameter gives the model a slight bias towards increasing the prior, it could be alternatively described making the prior time dependent. From a practical point of view, it's consequence is that when both the positively and negatively prompted models give similar prediction, the posterior increases faster, a highly desirable property. In practice, we suggest either choosing relatively large prior with no offset (such as we have done for the MNIST experiments), and Stable Diffusion experiments). We find that choosing an offset two, or even three, orders of magnitude lower than the temperature delivers satisfactory results.
p(c)
low prior with small offset (such as we have done for the CIFARIO
D.2 CLASS REMOVAL EXPERIMENTS
For the class removal experiments, unconditional MNIST and CIFAR10 diffusion models required. For MNIST our own model is trained, while for CIFAR 10 the pretrained model from Ho al. (2020) is u For both datasets, model trained on solely one of the classes is required. For this, our own models are trained on all the zeros of MNIST and all the airplanes of CIFARIO. Notice that all the guidance approaches are compared using the same two networks, reducing any additional bias due to the choices of network architectures. To analyze the generated images, a vision classifier required. For MNIST our own basic convolutional based classifier is trained, obtaining over 98% accuracy over test set. For CIFAR10, a pretrained vision transformer classifier is used (Wu et al. 2020).
Hyperparameter values for Negative Guidance scheme for the different datasets given in Table I A discussion explaining the choice of the different hyperparameters of our scheme is included in D.11
For Safe Latent Diffusion (Schramowski et al. 2023) a hyperparameter search was performed obtain the values that perform best at high safety. The most important hyperparameter is the threshold value at which guidance is activated. We found that even in the setting of MNIST and CIFAR (quite far from the setting of Stable Diffusion in which the scheme is proposed), a threshold value of Atresh = 0.04 still performs optimally at high safety. This displays the flexibility of the approach proposed by Schramoossi et al. (002)). The other hyperparameters are chosen as follows:
8, 100, Br, 0.2, 8m 0.1. The meaning and impact of different hyperparameters is discussed in Appendix E The absence of the offset for the MNIST experiments is compensated by choosing a
much higher prior. The negative guidance scale has to be chosen significantly differently for the
'The pretrained model can downloaded from huggingface at atgemngffaaaaaatttsss//uggggggg http://s///ggggggo.o.../////////
ddpm- i far 10-10-003 10-32
The pretrained classifier can he downloaded from Hugging Face https:://hugginggfaeee
aara Baraki/vit- se- sesee-pachhheecc 2--22-1121k- (een2ki-finetunee finetundd-ci farl0
18

---

Published as a conference paper at ICLR 2025
Dataset
Prior p(c)
Temperature
Offset
MNIST
0.25
0.25
0.0
CIFARIO
0.01
0.2
0.0002
Table 1: The prompt specific hyperparameters chosen for our Dynamic Negative Prompting.
various approaches. While in SLD the guidance scale can only be smaller or equal to the initial guidance scale Ao. our scheme considers dynamic self-regulating guidance, which can therefore require very different initial values. In practice, the guidance scale used in DNG is chosen one order of magnitude larger than that of NP. For NP or SLD, chose values of around 0.5, while for DNG we chose values around 5.
D.3 TEXT-TO-IMAGE EXPERIMENTS
To evaluate different negative guidance schemes in the context of T21, we design 5 prompts that have a high likelihood of generating objects not included in the prompts themselves. The positive prompts generating these subjects are generated using C For each prompt, related and unrelated negative prompt is designed. The related negative prompt contains the name of the implicitly generated object, suggested by ChatGPT alongside the positive prompt. The semantically unrelated prompt is freely chosen by the authors. These prompts are given in Table By generating small batches of images, we verified by hand that the implicitly generated objects are present when using the positive prompts. To allow the reader to analyze the prompts separately, these are visualized using different markers Fig. 6
We observe that the progressive generation of the various prompts can show diverse behaviors, further highlighting the complexity of guidance the context of Text-To-lmaae. This is discussed in more detail in Appendix The presented negative guidance results rely on prompt specific hyperparameters chosen in limited interval and are all given in Table It should be noted that different prompts might require different hyperparameters depending on the size and importance of the to remove object. Further work is required to obtain general scheme that effective in all circumstances. Developing this requires substantially deeper understanding of the effect of dynamic guidance schemes, something also left for future work.
E SAFE LATENT DIFFUSION: DETAILS
Due to their non-constant guidance scale, Safe Latent Diffusion as introduced by |Schramowski et al. (2023), the most similar concurrent work present in the literature. Similarly to ours, their guidance scheme is only active in the case that the scores of the negative prompt and positive prompt are aligned. To make the comparison more apparent, their proposed pixelwise guidance scale can be rewritten in our notation as:
Aar, 1) - { to min (1, c0, e co.c..e))) if co. co.c..1 < Athresh else
(21)
Notice that an important difference between the two approaches is the present of pixel-wise varying guidance scale in SLD, highlighted by the matrix A (ar, 1) versus our global, scalar guidance scale X(x, t). Schramowski al. (2023) also introduce additional momentum to the scheme, such that guidance can remain active for a limited time even the score difference should increase a bit. They also add late initialization of their approach. This is to specifically target the region of semantic generation with their guidance scheme.
In SLD the guidance scale, defined by Bq. (2). always smaller than the initial guidance scale, which is not the case in our approach. Another difference, is that the metric they use to activate the negative guidance is simple noise prediction comparison, very different from dynamic, time dependent scheme.
Using different values for the threshold hyperparameter Attresh as suggested by Schramowski et al. (2023). different safety regimes are obtained. All different proposed settings were tested, in the main
Accessed before 30/09/2024
19

---

Published as a conference paper at ICLR 2025
Number
Name
Positive Prompt
Related NP "Chalices, can- dles"
Unrelated NP
"Medieval
"A grand medieval feast set a great hall, filled with long tables covered in bountiful platters of food, goblets, and flickering light, with knights and nobles enjoying the lavish spread." classic British breakfast, featur- ing diverse selection of cooked de- lights, perfect for a filling and flavor- ful start to the day."
"Kids playing football"
feast"
"An English breakfast"
"Egg. sausage"
"The view skyline"
3
"A dinner ta-
"A beautifully set dinner table, with elegant arrangements, a variety of enticing dishes, and delicate decor that speaks the sophistication of the meal."
"Flowers, wine glasses"
"A wearing sun- glasses"
person
ble"
4
"An art work- shop"
"An inspiring art workshop filled with creativity, featuring wide range of tools and materials used by participants working on their indi- vidual projects."
"Paintbrush, canvases"
"A bicycle in the rain"
"An antique store"
"A charming antique store with shelves and tables filled with unique and historical treasures, offering a glimpse into the past."
"Lamps, books"
"An electric toothbrush"
Table 2: The five positive prompts with their respective related and unrelated negative prompts used for the experiments on Stable Diffusion. The related negative prompts are hand chosen after observing images generated using the positive prompts.
Number
Name
Prior p(c)
Temperature
Offset
1
"Medieval feast"
0.01
0.2
0.004
2
"A dinner table"
0.01
0.3
0.003
"An art workshop"
0.01
0.2
0.002
4
"An antique store"
0.01
0.2
0.004
5
"An English breakfast"
0.01
0.3
0.003
Table 3: The prompt specific hyperparameters chosen for our Dynamic Negative Prompting.
20

---

Published as a conference paper at ICLR 2025
0.00
Salry siaerngg Baiger
Sukty waag rages
(a) Comparing diversity
(b) Comparing quality
Figure 10: Comparison of diversity and quality as function of safety for SLD, NP and DNG (ours) when removing the class 0 ("airplanes")) on CIFAR. The SLD hyperparameters are chosen to be least invasive, explaining the improved quality and relatively low safety of the approach.
1.2.0
Ansonn 3.82
Aneun 0u02
Ansosne 2-
Aneun dutts
1.200
Amoun 2.55
25.
Aneux Euce
6.7%
22.
275
0.000
350
325
Salayy Nu sriiing Images
Saliyy: wang
(a) Comparing diversity
(b) Comparing quality
Figure 11: Grid search over the threshold parameter of SLD Auresh at high safety.
paper we show the curves containing the version that performs best at high safety, corresponding with the safest model. An interesting observation, visible in Fig. I0] is that by choosing a low threshold, can obtain better FIDs with SLD than with rival approaches low safety levels. We hypothesize that this is thanks to the small invasiveness of the SLD approach, which is mainly obtained thanks to its pixelwise guidance scale. This allows SLD locally remove details from images, which is major difference from both NP and our proposed DNG scheme. Notice that this superior performance is only very low safety level, for instance when there still 3% of the original 10% of the forbidden class being generated.
limited grid search over the threshold parameter SLD Adhresh is also performed in the high safety regime and is shown in Fig. [] As outlined by the authors, it is expected that when chosen too small the method is unsafe (i.e. still generates the unwanted features), and when chosen too high the method becomes equivalent to NP. We find these results still hold in the class-removal setting. An optimum is found around the range Attresh 0.04, which is the value initially proposed by the authors in the context of T2I and is therefore also the one used in this paper.
21

---

Published as a conference paper at ICLR 2025
F STABLE DIFFUSION: EMPIRICAL OBSERVATIONS
As already highlighted in the literature (Kynkäänniemi et al. 2024 Raya & Ambrogioni 2024
Brack et al. 2023 Sclocchi et al. 2024), the generation of images happens in phases. At high noise regime, low frequency details, such as large shapes or main colors, are generated. In the middle of the denoising process, the semantic content is generated. Towards the end of the process, when only little noise is remaining, the truths are widely accepted, we observe that the specific location of these events not an intrinsic property of the total T21 model, but instead also strongly depends on how the model is prompted. The main advantage of our self-regulating free guidance scale is that such events can be observed. By tracking the posterior, the model tells us itself when specific feature is being generated.
fine details are generated. While these general observed
When plotting the average guidance scale for the different prompts, it can be observed that these events are located at distinct moments in the diffusion process. The evolution of the guidance scale as a function of time is shown for the five prompts in Fig. [2] The posterior is orders of magnitude smaller in the case of the unrelated prompt, illustrating once more that DNG can deactivate itself. The detailed analysis of the dynamic guidance scale in the case of the related negative prompts is left for future work. While the dynamic aspect of our guidance scale proves
(a) Prompt
(b) Prompt 2
(c) Prompt 3
(d) Prompt
(e) Prompt
Figure 12: Evolution of the guidance scale throughout the diffusion process. Guidance scale averaged over 32 images. Maximal noise level is to the right of the x-axis. The guidance scale is respectively plotted in green and red in the cases of related and unrelated negative prompts
useful in the described scenario, one should be aware that it implies, up to a certain degree, a loss of user control. The self-regulating guidance able to increase and decrease throughout the denoising process, which even though highly desirable, can also lead to unpredictable results when suboptimally tuned. While using NP increasing the guidance scale always results in stronger deviations from the unguided images, this does not have to be the case with our DNG scheme.
perfectly possible that the guidance scale first decreases slightly and then follows the exact same trend, even if initialized higher. Losing this control is not problematic if tuned correctly, such as our scheme on MNIST or CIFAR1O, as in that case a self-regulating dynamic guidance scheme is optimal. However, the effects of different parameters, as well as the prompt dependence of the scheme, need to be further studied to obtain a method working on large scales in the case of T2I.
22

---

Published as a conference paper at ICLR 2025
Target Sampled
Occurrence in %
0.8
0.6
0.4
0.2
2
3
5
6
9
Different classes
Figure 13: Visualization of how the KL-ddivegeecce computed. In this example, the sampled distribution is obtained using DNG to remove "0" MNIST. The classes "7" and "7" that are most different from the zero are oversampled, while similar classes such as the "2" or the "5" are undersampled.
G CLASS-REMOVAL: ADDITIONAL FIGURES
To demonstrate the robustness of approach, the class removal experiments described in section 4. are repeated on four classes on both MNIST and CIFARIC For both datasets the first four classes are chosen. For MNIST this corresponds to the digits="O"
while for CIFARIO this corresponds to DNG outperforms concurrent approaches on generalizability as well its robustness. While
the classes: "airplanes", "cars", "birds" and "cats" mo the removal of all classes separately, highlighting the removal of all classes follow similar trends, such an increase of FID as the safety increases, some specificities are different. We find the effect of negative prompting be unreliable, meaning that removing different classes can result in large differences of performance. This is less the case for both SLD and DNG. The improved performance of DNG at high safety levels is especially visible when comparing different approaches using the FID metric.
Thhis will be extended to five classes before the end of the rebuttal period. Thee present graphs will be replaced containing larger number of points hefore the end of the rebuttal period. The class removal experiments on the number "4" as well as the class "deer" will by then also be added.
Salt diPhukss
neges Guldinca boon
Eas
Savp
240
300
334
11.
540
134
2:44
Diec
Sate
(a) Removing "("
(b) "I"
(c) "2"
(d) "3
Figure 14: Evaluation of the KL-divergence (top) and FID (bottom) on single class removal exper- iments performed MNIST using Negative Prompting, Safe Latent Diffusion and our Dynamic Negative Guidance. Despite differences between classes, DNG outperforms both NP and SLD in all settings.
23

---

Published as a conference paper at ICLR 2025
2th
Sabyy S Fres
Saite N creer
Sah & darespar
Sekay dwarg daarrgaaae iaga
Saey Soteesginage
Saits chwars Image
Satry & stwcrs Irape
(a) Removing "airplane"
(b) "car"
(c) "bird"
(d) "cat"
Figure 15: Evaluation of the KL-divergence (top) and FID (bottom) single class removal experi- ments performed on CIFAR10 using Negative Prompting, Safe Latent Diffusion and our Dynamic Negative Guidance. Despite differences between classes, DNG outperforms both NP and SLD in all settings.
H STABLE DIFFUSION: ADDITIONAL FIGURES
To visually compare how Negative Prompting and Dynamic Negative Guidance fare, show some illustrative examples using the five prompts introduced in Appendix [ Results are compared by choosing the guidance scale such that the average cosine similarity of the related prompt similar in both approaches. The initial guidance scale values used for the comparison for each prompt (ANp and ADNG for NP and DNG respectively) while serving the same purpose, are not one-to-one comparable for both schemes. A more thorough description of the connection between the two done in Appendix D.I In the case of unrelated guidance (orange box) as litlle change as possible is desired. This is often achieved using DNG (bottom row). On the other hand when using a related negative prompt (green box), changes in the image are expected. This is observed for both NP and DNG. The point of this setting is to be able to compare both approaches on similar global changes, meaning that both NP and DNG should alter the images in similar fashion.
written in the caption of Figures T6 20 These two,
To provide more insights into how negative guidance takes effect, it is insightful to show what happens when the guidance scale is progressively increased. We display this in Figures 21 23
To quantitatively compare DNG to NP, we propose a new metric that consists of a combination of the average CLIP scores measured in the unrelated and related prompted cases. The former should be as large as possible (i.e. as close to one as possible), implying that unrelated negative prompts have a negligible effect. On the other hand the CLIP scores computed using a related negative prompt should significantly differ from one, illustrating that the original image has been altered. The proposed metric Q consists of the difference between the average CLIP Scores in the unrelated and related cases, or thus:
Q(imgno guid img.el. imgunrel.) = (img guid img ) CS (img guid imgre..
(22)
Thanks to their linear form clearly visible in Fig. 6b the average CLIP- CLIP-scores can be used to obtain
single scalar value. With as linear regression parameters of the linear function visible in Fig. 6b
and [Tmin mmaa] the range for which CLIP score in the related case are obtained, the metric can be computed as:
Qimm guid img imguurel.) = T'max + Penin
Xmax + Emin
+
2
(23)
Fmux + Xmin
= (a
+ b
2
This value can be visually interpreted as the average value from which the average r value is substracted for every set of points in Fig. (b The values of our metric Q computed on the sets of points obtained using both NP and DNG are given in table q in which DNG outperforms NP, corresponding with higher Q values.
24

---

Published as a conference paper at ICLR 2025
Prompt Number
1
3
5
Average
NP
-0.015
0.003
0.017
0.016
0.041
0.007 + 0.014
DNG (ours)
0.053
0.018
0.080
0.054
0.057
0.052 + 0.022
Table 4: The values of the Q metric as defined in eq. performance.
(23
Higher values correspond to improved
Unrelated guidance (no change desired)
Related guidance (change desired)
NP
prompt: DNG
(ours)
Medieval Feast"
prompt: "Kids playing football"
prompt: "Chalices, candles"
Figure 16: Examples comparing NP (up) our DNG (down) in the case of unrelated (left) and related (right) negative prompts for: Prompt 1. Guidance scales: ANp = 3.4, ADNG = 27. NP still alters the images using unrelated negative prompts, for instance it removes all people present the unguided image. This most likely happens because the negative prompt contains the word "Kids".
25

---

Published as a conference paper at ICLR 2025
Unrelated guidance (no change desired)
Related guidance (change desired)
NP
DNG
+prompt: "A dinner table"
(ours)
prompt:
prompt:
"Person wearing sunglasses"
"Flowers, wine glasses"
Figure 17: Examples comparing NP (up)
DNG (down) in the case of unrelated (left) and
related (right) negative prompts for: Prompt 2. Guidance scales: Axp = 1.7, λDNG = 12. In contrast DNG, NP alters images using unrelated negative prompts (see for instance the bottom left image), while both NP and DNG perform similarly at removing the flowers from the unguided image.
Unrelated guidance
Related guidance
change desired)
(change desired)
NP
DNG (ours)
prompt:
"An art workshop"
prompt:
prompp:: "Paint, canvases"
"A bicycle in the rain"
Figure 18: Examples comparing NP (up) to our DNG (down) in the case of unrelated (left) and related (right) negative prompts for: Prompt 3. Guidance scales: ANp 1.7, ADNG 27. NP alters images using unrelated negative prompts, while DNG leaves most of the images unaltered (see for instance the top right image). Both NP and DNG perform similarly in the case of the related negative prompt.
26

---

Published as a conference paper at ICLR 2025
Unrelated guidance (no change desired)
Related guidance (change desired)
NP
DNG
+ prompt: "An antique store"
(ours)
prompt: "An electric toothbrush"
-prompt: "Lamps, old books"
Figure 19: Examples comparing NP (up) to our DNG (down) in the case of unrelated (left) and
related (right) negative prompts for: Prompt 4. Guidance scales: ANP 2.55, ApNG 21. NP alters images using unrelated negative prompts, while DNG leaves most of the images unaltered (see for instance the floor of the top left image).
Unrelated guidance (no change desired)
Related guidance
(change desired)
NP
DNG
prompt:
(ours)
"An English breakfast"
prompt: "View of skyline"
prompt: "Eggs, sausages"
Figure 20: Examples comparing NP (up) our DNG (down) in the case of unrelated (left) and related (right) negative prompts for: Prompt 5. Guidance scales: ANp 3.4, ADNG = 18. NP alters images using unrelated negative prompts, while DNG leaves most of the images unaltered (see for instance the number of dishes in the bottom right image). Both NP and DNG perform similarly in the case of the related negative prompt (see for instance the removal of the egg in the bottom left image).
27

---

Published as a conference paper at ICLR 2025
(a) DNG with related negative prompt
(b) NP with related negative prompt
(c) DNG with unrelated negative prompt
(d) NP with unrelated negative prompt
Figure 21: Progressive impact of negative prompts with increasing guidance scale from left to right. In (a) and (b) the related negative prompt is used, while in (c) and (d) the unrelated negative prompt is used. Analysis performed for: Prompt 1
28

---

Published as a conference paper at ICLR 2025
(a) DNG with related negative prompt
(b) NP with related negative prompt
(c) DNG with unrelated negative prompt
(d) NP with unrelated negative prompt
Figure 22: Progressive impact of negative prompts with increasing guidance scale from left to right. In (a) and (b) the related negative prompt is used, while in (c) and (d) the unrelated negative prompt is used. Analysis performed for: Prompt 2
29

---

Published as a conference paper at ICLR 2025
(a) DNG with related negative prompt
(b) NP with related negative prompt
(c) DNG with unrelated negative prompt
(d) NP with unrelated negative prompt
Figure 23: Progressive impact of negative prompts with increasing guidance scale from left to right. In (a) and (b) the related negative prompt is used, while in (c) and (d) the unrelated negative prompt is used. Analysis performed for: Prompt 3
30


Reviews:
[{"review_id": "msIs3Osm29", "reviewer": "Reviewer_xP5A", "summary": "In this paper, a new concept called Dynamic Negative Guidance (DNG) is proposed, which is an improvement on the existing Negative Prompting (NP) method in diffusion models.", "questions": "1. You have demonstrated the effectiveness of DNG on the MNIST and CIFAR10 datasets. How does DNG perform on more complex and diverse data sets, such as ImageNet, especially on different image semantics and complexity?\n2. The paper contains some visualizations, but can you provide more detailed visualizations to show the progressive impact of DNG in the image generation process, especially how it dynamically adjusts in the denoising step?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. By dynamically adjusting the intensity of negative prompts, DNG solves the problem that the traditional NP method may encounter suboptimal results or complete failures in the generation process.\n2. The structure of the paper is clear and the content is well organized.\n3. DNG combines the needs of diffusion model (DMs) and condition generation, and estimates the posterior probability by tracking discrete Markov chains in the generation process. This method is an innovative extension of the existing technology.", "weaknesses": "1. Although the paper has been experimentally verified on MNIST and CIFAR10 datasets, the performance of DNG for more complex tasks (Text to image) has not been fully verified.\n2. DNG is compared with NP and SLD methods in this paper, but the comparison of each method may lack in-depth analysis, especially the performance comparison under different parameter settings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yUUgcUHHRr", "reviewer": "Reviewer_UeKs", "summary": "The authors argue that conventional negative prompting methods are constrained by the assumption of a constant guidance scale. To address this limitation, they propose a novel dynamic negative guidance technique that adapts the guidance scale based on both time and state, aiming for near-optimal modulation. Notably, this approach does not require additional training. The authors evaluate their method on MNIST and CIFAR10, comparing it against various baselines, and demonstrate its effectiveness. They also show that the technique integrates well with Stable Diffusion, offering improved accuracy in defining negative prompts.", "questions": "Given that you acknowledge these limitations in the manuscript, could you clarify why they were not addressed in the current version? Including these aspects seems essential to strengthen the manuscript's rigor and completeness.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 1, "presentation": 2, "contribution": 2, "strengths": "• The proposed method demonstrates promising results on MNIST and CIFAR10, outperforming standard negative prompting techniques and safe latent diffusion methods. This improvement suggests that the dynamic guidance approach offers a meaningful advantage in generating more accurate outputs for image datasets with complex features.\n\n• Preliminary results with Stable Diffusion also appear promising, indicating that the method may effectively enhance prompt accuracy within more sophisticated generative models. However, additional evaluation would further substantiate these findings and provide more insight.\n\n• Though a minor detail, the use of color highlights in algorithms and formulas is a thoughtful touch that enhances readability.", "weaknesses": "• There is a lot of research happening in the field of negative prompting, yet this paper lacks a comprehensive comparison with many  leading methods. An in-depth comparison would have more clearly illustrated the strengths and limitations of this approach relative to existing techniques, helping to clarify its unique contributions.\n\n• Overall, the evaluation of the proposed method lacks depth. A more thorough and systematic assessment across various scenarios and metrics would strengthen the validity of the results and give a clearer picture of the method’s real-world applicability and robustness.\n\n• As acknowledged by the authors, a significant limitation of this manuscript is the limited evaluation of text-to-image generation, which is the primary application area for this method. Without a comprehensive exploration of T2I use cases, the potential impact of this work is somewhat undermined, leaving much of its promise unexplored.\n\n• Additionally, the absence of quantitative metrics is a notable gap. Deferring these metrics to future work is a missed opportunity, as they would have added rigor to the analysis and allowed for a more objective assessment of the method's effectiveness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MPHzM8DPh5", "reviewer": "Reviewer_v6iu", "summary": "In text-to-image generation, negative prompts are used to guide the generative model not to create something. This paper presents a method called dynamic negative guidance that aims to be safer, less invasive than regular negative prompting in guiding a T2I model to create desirable images while avoiding unwanted components. The dynamic negative guidance relies on a near-optimal time and state dependent modulation of the guidance without requiring additional training. The method has been tested in MNIST and CIFAR-10.", "questions": "While the mathematical derivation of DNG looks reasonable, the generated image examples are hard to understand. \nCan authors point out the difference between NP results and DNG results in the example figures, such as Figure 6 and figures starting on page 22? \nThe purpose of experiments of Section 4.1 and corresponding Figure 5 are not clear. I don't understand why the experiments need to remove one class in MNIST and one class in CIFAR-10. If the purpose of the method is to avoid generating undesirable features, shouldn't the model be trained on all classes and only in practical use of the method, one can prompt the model to not generate something, for example, not to generate number zero or an airplane. Or am I missing something here.\nWhile Table 2 lists the positive prompts and related and unrelated negative prompts, can authors give examples on how exactly a full prompt was written up in English and fed to a T2I model? \nIn Figure 10(b), as the authors explained, because SLD may have less invasiveness, it gave better FID than DNG, which is reasonable, but why from the figure it seems NP also had a lower FID than DNG as % of wrong images went up? Can authors elaborate on this?\nFrom both Figure 10(a) and (b), it seems that NP had overall worse performance than SLD and DNG, but it also appears that NP performance in KL divergence and FID had a decreasing pattern while those of DNG appeared to pick up at higher % of wrong images, what could be the reason behind this observation? Can authors discuss about this?\nFigure 11, for illogical prompts, the guidance scales were larger at later diffusion time than at early diffusion time, can authors provide intermediate generative results corresponding to this change of the guidance scale?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "A strength of the proposed method, DNG, is to estimate the posterior by tracking the discrete Markov chain during the denoising process. The strength of the guidance is dynamically related to how close the negative prompt is related to the positive prompt. This seems to a strength of the method since it can adaptively determine whether the negative prompt is even relevant at all. To the contrary, existing negative prompting methods may not be able to ignore irrelevant negative prompts. The proposed method may overcome the weakness of existing NP methods that blankly try to invert the force field to move away from the positive prompts without precisely moving away from the negative prompts. This is reflected in the factor pt(c-|x)/(1−pt(c-|x)) in Eq 10.", "weaknesses": "Writing can be better and consistent. For example, the paper has both c_- and c-, it should be consistent.\nThe biggest weakness with the paper is the example images given at the end, starting from page 22. First, the pictures are so small, it is hard to appreciate the difference between NP results and DNG results. Second, I could be missing something, but it seems there is no big difference between the two types of results. In particular, it seems NP results are not bad or accidently include the undesirable features given in the negative prompts. \nSimilar comment for Figure 6, as it does not seem that NP results in the presence of negative prompt \"view of skyline\" is incorrect.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oLjPkV08qs", "reviewer": "Reviewer_JR45", "summary": "The paper presents Dynamic Negative Guidance (DNG), a novel technique for improving Negative Prompting (NP) in diffusion models, specifically addressing limitations in text-to-image applications. Conventional NP assumes a fixed guidance scale to suppress undesired features, which can result in poor performance due to the non-stationary and state-dependent nature of the reverse process in diffusion models. DNG overcomes this by introducing an adaptive approach that adjusts the guidance dynamically based on time and state, thereby refining the model’s ability to avoid generating unwanted features.", "questions": "see weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. the DNG method in novel and has strong practical significance\n2. paper did a comprehensive evaluation on safety, class balance, and image quality on MNIST and CIFAR10.\n3. the paper is straightforward and easy to follow", "weaknesses": "1. terms like Dynamic Negative Guidance and guidance scale could better deserve a brief contextual note, as not all readers may be familiar with their meaning in this context. \n2. the paper needs to avoid jargon without explanation.\n3. the paper needs to improve flow and conciseness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)