DeLeaker: Dynamic Inference-Time Reweighting For Semantic Leakage Mitigation in Text-to-Image Models
Authors: Mor Ventura
Michael Toker
Or Patashnik
Yonatan Belinkov
Roi Reichart
Venue: ICLR 2026 Poster (2026)
Keywords: text-to-image
semantic leakage
computer vision
automatic evaluation
multimodal
Primary area: generative models

Abstract: Text-to-Image (T2I) models have advanced rapidly, yet they remain vulnerable to semantic leakage, the unintended transfer of semantically related features between distinct entities. Existing mitigation strategies are often optimization-based or dependent on external inputs. We introduce **DeLeaker**, a lightweight, optimization-free inference-time approach that mitigates leakage by directly intervening on the model’s attention maps. Throughout the diffusion process, DeLeaker dynamically reweights attention maps to suppress excessive cross-entity interactions while strengthening the identity of each entity. To support systematic evaluation, we introduce **SLIM** (Semantic Leakage in IMages), the first dataset dedicated to semantic leakage, comprising 1,130 human-verified samples spanning diverse scenarios, together with a novel automatic evaluation framework. Experiments demonstrate that DeLeaker consistently outperforms all baselines, even when they are provided with external information, achieving effective leakage mitigation without compromising fidelity or quality. These results underscore the value of attention control and pave the way for more semantically precise T2I models.

Published as a conference paper at ICLR 2026
DELEAKER: DYNAMIC INFERENCE-TIME REWEIGHT- ING FOR SEMANTIC LEAKAGE MITIGATION IN TEXT- TO-IMAGE MODELS
Mor Ventura Michael Toker
Or Patashnik2
Yonatan Belinkov!
Roi Reichart
Technion Tel-Avviv University
mor venturs, tck) www.pps.techiion..oo.oo technion.ac.ii.
orporashnik@maall.cm
faelinkov, seari/@@echhion.cco
ABSTRACT
Texi-to-Image (T2I) models have advanced rapidly, yet they remain vulnerable semantic leakage, the unintended transfer of semantically related features between distinct entities. Existing mitigation strategies are often optimization based or dependent on external inputs. We introduce DeLeaker, a lightweight, optimization- free inference-time approach that mitigates leakage by directly intervening on the model's attention maps. Throughout the diffusion process, Delea dynamically reweights attention maps to suppress excessive cross-entity interactions while strengthening the identity of each entity. To support systematic evaluation, we introduce SLIM (Semantic Leakage IMages), the first dataset dedicated to semantic leakage, comprising 1,130 numan-verifeed samples spanning diverse scenarios, together with a novel automatic evaluation framework. Experiments demonstrate that DeLeaker consistently outperforms all baselines, even when they are provided with external information, achieving effective leakage mitigation without compromising fidelity quality. These results underscore the value of attention control and pave the way for more semantically precise T2I models
INTRODUCTION
Text-to-Image (T2I) models have shown continuous improvements image generation capabilities
(Ramesh et al. 2 2022 Saharia al. 2022 Black-Forest-Labs) 2024). These advances are largely driven by cestusioo-bbsed architectures, which produce high-quality images through iterative denoising (Dhariwal & Nichol 202T Ho & Salimans 202T). Recent state-of-the-art models, such as Diffusion Transformers (DiTs) (Peebles & Xie|2022 further this progress by adopting transformer- based architectures with uniform global attention, resulting in stronger image- text alignment and improved image quality. Nevertheless, these models remain vulnerable to errors in semantic fidelity, with semantic leakage emerging as a particularly persistent challenge.
Semantic leakage refers to the unintended transfer of semantically related features between entities in the generated outputs, observed in both image (Rassin et al., 2022; Dahary et al., 2025b) and text generation models (Gonen et al.) 2025). An example of this is seen in Fig. where cow's traits leak into the horse's 's ears and mouth. Although this phenomenon is a form of a broader problem of image-text misalignment in the context of image generation, it remains highly underexplored.
Prior work employed aayout-based control to mitigate semantic leakage by assigning entities (e.g.. cow and horse) to fixed regions (Dahary et al. 2025albb bb. While effective in simple scenes, these methods fail in settings that involve interactions between entities (Fig. [ examples 2-3), where rigid separation is often less natural. By relying external inputs and bounding-boxes, these methods disregard the model's 's prior knowledge, overlooking the potential to leverage its internal semantic representations. Moreover, they resort costly inference-time optimization strategies, commonly used in efforts to refine semantic alignment in T2I models (Chefer et al. 2023 Rassin et al. 2024).
"Equal contribution.
Code and data available the project website http:///eettaammmeiiiiibbalolllt

---

Published as a conference paper at ICLR 2026
a horse Form"
The dolphen and the whale cudding together"
elephant moose coe sittnng back back 30 render
bot flying high right while perched tree branch and o moth Nuthers"
D. Ristawberrry a rodish and cherry togetherr
DeLeaker (Ours)
Original (Flux)
Pains
Interactions
Interoctions with style
Multple Entities (animals)
Multple Enfitie (fruts)
DeLeaker Bottom: original outputs. Red arrows mark features affected by semantic leakage. Examples cover five subsets of the SLIM dataset ($3)
Figure I: DeLeaker Qualitative Examples. Top:
In this paper, we introduce DeLeaker, a dynamic and lightweight inference- time method designed to mitigate semantic leakage in T2I models. Unlike prior approaches that require costly optimization external guidance, DeLeaker operates by applying synergistic interventions directly to the model's attention mechanism during inference ($ First, automatically extracts entity-specifie masks from early image-text attention to localize each entity. It then uses these masks to suppress cross-entity leakage by dynamically reducing excessively high attention scores between the different entity regions in both image-text and image-image interactions. Concurrently, it strengthens each entity's 's self- identity by increasing the attention between its corresponding text and image tokens. This targeted reweighting of attention allows DeLeaker to mitigate leakage while preserving scene structure and the model's priors. Furthermore, the method remains non- non-intrusive when no leakage is present.
While developing methods to mitigate semantic leakage is crucial, rigorously evaluating them remains major hurdle due to the absence of dedicated benchmarks and the limitations of VI.M- based automatic evaluation (Dahary al.) 2025a). To address this gap, we introduce a comprehensive evaluation framework, centered around a new dedicated dataset ($3). Our dataset, the Semantic Leakage in IMages (SLIM) dataset, comprises 1,130 (prompt, seed, image) samples capturing diverse leakage scenarios, including prompts describing visually similar entities, spatial interactions, and multi-entity compositions. SLIM is constructed from large pool of images generated by the FLUX. 1-dev model FBllcc--ooest-LLbbs 2024), using prompts automatically produced by GPT-4o. The images are rigorously filtered through an extensive human filtering process.
Next, we develop an evaluation framework ($4) to assess semantic leakage mitigation. We adopt comparative evaluation setup in which images from before and after the mitigation process are compared. Importantly, our framework breaks down the challenging comparative evaluation into series of discrete logical steps. The process begins with the identification of differences between entities to detect semantic leakage, followed by the ranking of the mitigation's 's success. Additionally, we include evaluation of the image-text semantic alignment and the preservation of the original image quality and perceptual similarity. Our automatic evaluation pipeline is validated by an extensive human study (980 responses).
In experiments with FLUX (66), DeLeaker significantly outperforms all evaluated baselines in both automatic and human evaluations. This includes prompt-basse baselines and layout-based baselines (55) that require additional information, typically from external LLMs. To confirm its generalizability, we applied DeLeaker to another model, SANA (Xie et al. 2024), and found it to be similarly effective mitigating semantic leakage. To understand the source of DeLeaker's 's advantage, our ablation study ($7) reveals that DeLeaker's 's strength derives from its cross modal attention interventions, particularly the image-text strengthening that preserves self-identity.
2

---

Published as a conference paper at ICLR 2026
To summarize, contributions include: (1) DeLeaker, a dynamic, lightweight inference- time method for mitigating semantic leakage in T2I models while preserving image quality and perceptual similarity, (2) the first dedicated dataset explicitly designed to evaluate semantic leakage, and (3) an automated evaluation pipeline for large-scale assessment supported by a human study. We hope this work will inspire further research toward more controlled and reliable generative models.
donkey di gerily lappng heass Togethe
Attention Map egend
Doe Tocsus
Oiffuson Process
DOUSEM
DOUEEN
Hee
Sted
1EAt
DELEAKED
COM
(MAce (
MAGGE-TEET E
FIND ERTITH MASKS
LEAAAEE SUPPRESSION
(eP SELF IDEUIITY
STRENCTHEWING
Figure 2: DeLeaker Scheme. Our method applies attention- based interventions during the diffusion process: (A) automatically extracting entity-specific masks from early image-text attention maps; (B) mitigating cross-entity leakage by suppressing attention across entities in both image-text and image-image interactions; and (C) strengthening self-identity by increasing attention from each entity's 's text tokens to its own image tokens. The attention map legend (left) shows how entities interact, where colors denote different interaction regions. The final output (right) presents the image output with Dekeaker compared to the original image, when DeLeaker is not applied.
DeLeaker
Our method, DeLeaker, aims to mitigate semantic leakage in DiT T21 models. As illustrated in Fig. [ it relies solely on dynamic rewcighting interventions at inference time in the self-attention mechanism during the diffusion process, and consists of three key steps. First, it identifies the image tokens (masks) corresponding to entities, i.e., the regions where they should appear in the generated image (22.1) Second, suppresses the connections between entities in both the text-image and image-image self-attention maps (.2)). Finally, it enhances the self-identity of each entity by strengthening the connection between its text token and the corresponding image tokens ($2.2) $7 ablation study, which demonstrates the importance of each intervention.
we present an
2.1 ATTENTION-BASE ENTITY MASKING
To mitigate semantic leakage, first localize for each textual entity e; in the prompt, the set of image tokens governs, and then manipulate the attention maps using these localizations. Specifically, we the pre-softmax attention scores, Attn, between all image tokens, I. (used queries, q) and the set of text tokens, E.s (used keys, k). The corresponding image tokens gimg are selected by averaging attention scores across heads and applying a dynamic threshold based on the mean, (4; and standard deviation, d; of the attention distribution (Eq, [T. Following prior work on UNet-based diffusion (Hertz et al. 2022 Binyamin et al. 2025), we observe that even early diffusion steps yield sufficiently accurate masks B Fig. 5). Thus, we aggregate attention maps across early steps in the diffusion process to create mask for each entity. We apply smoothing techniques on the masks:
(I) temporal smoothing by averaging over the accumulated history maps, and (2) spatial smoothing via filtering, resulting in more stable and coherent entity masks (see BB.1 Fig.
&
img
{g I Allngk 14 Br Ti, E (E n (T)
(1)
3

---

Published as a conference paper at ICLR 2026
2.2 INTENTION-BASER LEAKAGE MITIGATION
Leakage Suppression. Utilizing attention-based entity masks, we focus cross-entity atlention, which measures how the image tokens of one entity, 6,, attend to the text or image tokens of another entity, ej. While cross-entity relations are a primary source of semantic leakage, they are also essential for creating meaningful interactions, such as shared actions and poses. Therefore, our goal is not to eliminate these connections entirely, but selectively suppress only those causing leakage while preserving beneficial ones. We hypothesize that high attention values in image-image relations (Eq. 2) represent unwanted semantic transfer (akin to high-frequency noise), while lower values reflect desirable, meaningful interactions (the core signal). Specifically, we apply a unified suppression mechanism by zeroing out attention scores (Eq, 3 first two cases). This involves fully suppressing all cross- cross-entity image-text attention scores while also suppressing image-image attention scores that exceed one standard deviation, multiplied by a coefficient, 32. above their mean. This intervention is applied only after the initial, ireention-based entity masks have been formed.
H Hing inn
={qgk) Attggk Mij + B2 o.j. k E EI}
(2)
Strengthening Self-Identity Alignment. Finally, we introduce a third intervention to strengthen the connection between each entity's 's text tokens and its corresponding image tokens (Eq. 3 third case). This enhancement improves the self-identity of each entity. We apply this by multiplying the relevant attention scores by a coefficient > 1 (a ablations in BB. Fig. 7 The coefficients empirically chosen based on qualitative review of a few samples external to the SLIM dataset.
if E eime, k E eing and (g, k) H ging-ing
0
if q E e,m,, k E E
Attnig
a Alttgk Attngk
if q E e k E Et else
Here Attigk is the single pre-softmax attention score between the tokens q and k. The terms μ4, and a are respectively the mean and standard deviation (std) of attention scores for entity i's image tokens. Similarly, Pij and oi are the mean and std for attention between the image tokens of entities i and j.
Having established the method, we next turn to the dataset design that enables a systematic evaluation of its effectiveness. See for DeLeaker's s full equations and hyperparameter values.
3 THE SLIM DATASET: SEMANTIC-LEAKAGH IN IMAGES
Prior efforts mitigate semantic leakage (Dahary al., 20256 and improve semantic alignment Feng et al. (2022) have relied on general-purposss purpose benchmarks such as DrawBench (Saharia et al.. 2022) and MS-COCO (Lin et al., 2014). These benchmarks, however, do not specifically target semantic leakage. This is because the phenomenon is mainly associated with the visual similarity of entities (Dahary et al. (025b), condition that rarely appears in their general-purpose prompts. Consequently, prior work has often drawn conclusions from evaluating extremely small subsets of these datasets, sometimes only few dozen samples (Chefer et al. 2023 Dahary et al. 2025b).
To fill this gap, we introduce SLIM, which is, to the best of our knowledge, the first dataset explicitly designed to study and evaluate visual semantic leakage at scale. It contains 1,130 samples, each with prompt, generation seed, and a corresponding image exhibiting semantic leakage, all generated using FL.UX
Forest-Frrstt--aaa 2024). SL.M is organized into five subsets, as detailed below (examples in Fig. D and was curated through a two-step process: large-scale generation followed by human-guide gundnd- filtering. To validate that DeLeaker's performance is not limited to FLUX, we create an additional test set using SANA (Xie et al. 2024). Due to the extensive data filtering required, this supplementary set contains 370 samples.
Large-Scale Generation & Dataset Design. Building on the finding that semantic leakage is associated with visual similarity (Dahary 2025b). find the effect particularly acute within fine-grained categories (c.g.. dog breeds). Motivated by this, we focus on animals and fruits for controlled evaluation. Starting from curated list of 90 animals (Banerjee 2023), we use GPT-4o
4

---

Published as a conference paper at ICLR 2026
to expand it to 200 animals and generate 200 descriptive prompts, each pairing visually similar animals. We then produce corresponding images using five seeds per prompt. We leverage the animal pairs subset create increasingly complex scene configurations, hypothesized to be associated with stronger leakage (see Table 3 including interactions (e.g., hugging), shared visual styles (e.g., comics), and multiple entities (triplets). To probe semantic leakage in different domain, we similarly expand our dataset to include fruits & vegetables subset based on an existing list of 36 fruits (Seth) 2019), where leakage is rare in pairs but emerges in triplets. Notably, subsets with multiple entities tend to present challenges beyond semantic leakage, as they are also prone to entity count errors (i.e., missing or added entities).
Human-Guided Filtering Semantic Leakage. We filter the large-scale set to include only images that exhibit detectable semantic leakage. This is achieved through two-stage process: an initial large-scale filtering using noisy automatic pipeline, followed by second round of manual verification through human annotation 2 We designed rigorous structured human annotation protocol for detecting semantic leakage, detailed in FF. See S for subset sizes through the filtering and prompt examples.
4 EVALUATION
A foucan hits beak, woodpecken pecks furously bank
GENEML KUOWLEDGE-
coind tole, and
"What the visucl dfferences between foucan and woodpecker?
VLM
cnd shone (ring
toucon
woodpecker
REFEREUCE IMACE MACE-BASEE
VISUAL DYFFEREAIES
Tuck Cake. hoot
VLM
boo wolk festher.
"What are the visua dffeernces between toucan woodpecker!
CALOIATIC
"How visually typical is the fentify? each image?
TYPICALITY ASSESSMEUT
VLM
"Oveaal. how visually typical are the toucan and the woodpecker in the second image nathen in the first image? First explain.
121
COMPARATIVE RADCING
Finaly. rank the overal relative typicality"
VLM
Image I- Meven Mingoler
Figure 3: Our Automatic Evaluation Framework for Assessing Semantic Leakage Mitigation. The framework consists of three main steps: (1) visual difference extraction, (2) typicality assessment, and (3) comparative ranking. Step is divided into two parts: one based solely on the input prompt (top) and the other employing reference images generated for each entity (bottom). The VLM generates and then merges two independent descriptions into a unified description. Step consists of four typicality questions, one for each entity in each image, guided by the unified differences identified in Step I. Step 3 employs the outputs of Step 2 to compare both images. It produces a classification indicating the preferred image (Image Image 2) and the magnitude of change (minor or major).
Evaluating semantic leakage mitigation in T2I models is major challenge. Prior efforts have often relied on seneral-purposs metrics (e.g., CLIP score (Radford et al., 2021)) or qualitative judgments, which lack the specificity required for systematic analysis and are often insensitive subtle, fine- grained errors that characterize semantic leakage (Dahary et al. 2025a). To address this, we introduce a novel automatic evaluation framework centered on a comparative setup, which directly contrasts a
SSpecifically, authors of this paper manually reviewed the images.
5

---

Published as a conference paper at ICLR 2026
(OURS)
DELEAKER DESC. (OURS)
PROMPT
[NAGE-CONDITON PROMPT
DIFFUISU
3015
RPF
I gug anele stile Hoppopotonus and rinoccres pently puriing olher
eiienaar dog fox ore jersing own eochathen coclemant.
zebrn ond hanse hegeffirr covoring thenseives in dust
Figure 4: Qualitative comparison across baselines (columns) and three examples (rows).
candidate (mitigated) image against the original. Automating comparative analysis, however, is non- trivial due to limitations in the visual modality of challenge, our evaluation pipeline decomposes the complex visual comparison into discrete logical steps, thereby leveraging the more robust reasoning capabilities of the text modality in VLMs (Ventura eet al., 2024a; Nikankin et al. (025). To ensure its reliability, the framework is validated against extensive human assessments. Our evaluation covers two critical dimensions: leakage mitigation, which measures the reduction of cross-entity interference, and preservation, described next.
VLMs (see $B.2). To overcome this
Automatic Evaluation for Leakage Mitigation. Our framework decomposes the evaluation into three interpretable steps, performed by an external VLM (Gemini 1.5: Team et al. 2024a), as shown in Fig. The process requires four inputs: (1) a prompt, (2) an original image exhibiting semantic leakage, generated by the base model M, rorig; (3) a candidate image, / generated by model M* as corrected version of the original image; and (4) reference images, generated independently by M, REF The reference images act as auxiliary cues, ensuring the evaluation isolates leakage effects rather than the information encoded in the VLM about each of the entities.
The pipeline first identifies key visual differences between the entities by combining the VLM's general knowledge with the specific insights from the reference images. Second, it assesses the typicality of each entity in both the original and candidate images, measuring how well each matches its expected appearance, based judgment to determine which image better preserves the distinct identity of all entities. To mitigate sensitivity image order in VLMs (Ventura et al. 2024a), the images are presented in a random order.
the key visual differences. Finally, it performs comparative
The evaluation's 's output is a single discrete label, c A IM Iorie). ). which represents the change between the two images. This label combines the change's direction (improvement/degradel
and magnitude (major/minor). along with a 'no change' option, resulting in five possible outcomes.
Preservation Metrics. In addition to leakage mitigation, we evaluate three preservation aspects: alignment with the original prompt (VQAScore (Lin et al. 2024)), image quality (KID (Jayasumanal et al. 2024)), ) and perceptual similarity to the original image (LPIPS (Zhang et al. 2018)).
Human Assessment of Leakage Mitigation (User Study). To establish human baseline prefer- ences and validate the reliability of our automatic evaluation, we conduct user study on Amazon Mechanical Turk (AMT), resulting in a total of 980 individual responses (see AMT questionnaire in F.2).. Since evaluating leakage with multiple entities confounded by the difficulty of assessing each entity pair separately, we focus our evaluation on the pair subsets of the SLIM dataset. We randomly sample 60 prompts from these subsets, ensuring equal distribution across the subsets. Each task presents a candidate image generated by one of six baselines representing range of methods, the original image, and two reference images (one per entity), following the structure of the automatic pipeline. The questionnaire includes two questions that assess the typicality of each entity using five-point scale aligned with the automatic evaluation. Each task is completed by three annotators, and responses are combined via majority vote. The inter-annotator agreement is 0.52 (quadratic

---

Published as a conference paper at ICLR 2026
Table I: Automatic and Human Assessment Scores of Semantic Leakage Mitigation. We compare our method, DeLeaker (bottom rows), against layout-based (top) and prompt-based (middle) baselines. The main scores, summarized by stacked bar visualization, represent the percentage of samples labeled as Mitigation (Major/Minor), No Change, or Degradation (Major/Minor), where wider portion indicates better performance. The automatic scores are calculated on the SLIM pair subsets (840 samples), while the human scores are gathered from the user study of 60 random samples from that same subset. These are presented alongside preservation metrics (VQAScore, LPIPS, and KID (-10 )). Arrows (t/L) indicate the desired direction for improvement.
Semantic Lankage (Autematic)
(Human)
Preservation
Method
Viualization
Mitigation
Degradation Majoc
Visaaizztioon
VQAScore
LPIPS
Major
Minor
No Change
Minur
RAGiDDiflision
17.55%
4.17%
5.03%
8.34%
64.91%
0.42
0.72
0.09
RPF
20.74%
9.06%
16.57%
15.26%
38.38%
0,63
0.64
0.53
3DIS
29.08%
8.10%
10.13%
QwenFLUX
17.28%
7.51%
15.85%
12.75%
46.60%
0.49
0.61
0.46
Instraction Prompt
23.92%
11.54%
35,35%
9.28%
19.88%
0.64
0.33
0.00
Entity Description Promge
35.60%
11.07%
25.71%
9.17%
18.45%
0,62
0.41
0.00
46.07%
9.76%
12.98%
DeLeaker Description
53.57%
8,57%
15.95%
6.55%
15.36%
0.65
0.43
0.01
weighted Fleiss' k), which validates the correlation between human judgments and our automatic evaluation (Spearman's 's p=0.432) as meaningful proxy. We observe difference in model- sensitivity: both typically agree on the change's direction (mitigation vs. degradation) but differ on its magnitude (minor vs. major).
5 EXPERIMENTAL SETUP
Base DIT T21 Models. We primarily experiment with the state-of-the-art open-source DiT T21 model FLUX. 1 1-DEV (Black-Forest-L.. 2024), while also applying DeLeaker to SANA (Xie et al. 2024) to validate our findings. Unlike earlier UNet-based models (Ronneberger et al. 2015) such as Stable Diffusion (Rombach al.. (2022), where textual information is injected through spatial cross-attention layers at multiple resolutions during denoising, DiT's employ a transformer-based backbone (Vaswani al., 2017) that processes image and text tokens jointly. This architectural shift promotes capturing complex cross- modall dependencies and achieving more consistent global semantics. The differing text encoders and attention mechanisms in FLUX and SANA are relevant for studying semantic leakage, as these components control how unintended information propagates between modalities. To the best of our knowledge, this setup represents the first exploration of semantic leakage in DiT T2I models. For brevity, the following setup focuses on FLUX, while the full experimental details for SANA are available in IE.I
Baselines. We evaluate Deleaker against layout-based and prompt-based baselines. Layout-based methods provide explicit priors on image structure to improve compositional control (Chen et al. 2024a b). making them relevant for semantic leakage their structure reduces content mixing. Additionally, we include several zero-shot, prompt-based baselines, which are common for improving image-text alignment (Yang al. 2024). To maintain fair comparison, all methods are built upon the FLUX base model, as our SLIM dataset is created using FLUX- --U--eeneatted images.
For sayout-based baselines, we utilized baseline (Dahary et al. (025b), specifically RPF (Chen et al. 2024a). RAG-Diffusion (Chen et al.) 2024b), and 3DIS (Zhou et al. 2025). These baselines differ their inputs and conditioning strategies. The first, RPF, leverages regional prompts within bounding boxes while eliminating cross-boo boss-bounndig- box attention. The second, AAG-Diffusion, constrains self-attention to local text descriptions within each box, but only during the initial steps of the diffusion process. Finally, 3DIS conditions bounding boxes to generate a depth map as an additional input. It is important to note that all three baselines rely external LLMs additional models guidance (SH.I.
parallel implementations of an existing UNet
For prompt-based baselines, we employ three methods. The first is an implicit instruction to generate an image without semantic leakage between entities, referred as the Instruction Prompt. Since
7

---

Published as a conference paper at ICLR 2026
Table DeLeaker Ablation Study. Configurations are divided into two types: (1) W/O rows (top four) represent the removal/addition of a specific component, while (2) On.ly rows (bottom three) isolate each component independently. Ratios are reported relative to the full DeLeaker scores baseline, with values closer to 1.0 indicating similarity. Darker hues indicate stronger contributions, Signs indicate attention suppression (-) strengthening (+).
color-coded positive and negative
Leakage Mitigation (Relative to DeLeaker)
Configuration
Improvement f Major
No Change
Degradation Minor
Minor
Major
DeLeaker
1.00
1.00
1.00
1.00
1.00
W/C Image-Image Image (-)
1.01
1.04
1.05
0.73
0.97
W/O Image- Text (-)
0.93
0.78
1.10
1.04
1.18
W/C Image-Tert Text (+)
0.54
0.82
1.73
1.20
1.24
With Texi-Texi (-)
0.91
0.91
1.08
1.20
1.16
Only Image-Image (-)
0.26
0.61
2.44
1.35
0.96
Only Image- (-)
0.54
0.88
1.88
1.00
0.99
Only Image-Text (+)
0.90
0.99
1.23
0.88
0.96
T2I models are not trained for cnttruction-followiiii
also experiment with explicitly describing each entity and its appearance, referred to as the Entity Description Prompt. To illustrate, the prompt "A zebra and horse are riding the sand logether... (Fig. 4 is enriched with LLM-generated entity attributes, such as "the zebra has dense black-and-white stripes, while the horse has white fur and a blond tail..". ". The final method is the Image- Conditioned Instruction Prompt, where the model (Qwen2VL-Fluxx Lu 2024) is instructed to mitigate leakage based on the original image.
RESULTS
Table I presents the automatic and human evaluation of leakage mitigation across all baselines the SLIM pair subsets, and Fig. presents qualitative examples (see additional examples in $D). Complementary results are in including SANA's scores and results with multiple entities.
DeLeaker outperforms baselines in mitigating semantic leakage. Our automatic evaluation shows that DeLeuker achieves the highest rate semantic leakage mitigation with minimal degradation. Human evaluation strongly confirms these findings, with annotators judging that DeLeaker improved the image in a clear majority of cases (67.8% total improvement), outperforming all other methods. DeLeaker (similar the 'Entity Description Prompt'
Furthermore, adding entity descriptions baseline) offers only minor gains, indicating that DeLeaker is highly effective on its own. Among the other baselines, the text prompt-based methods have combined degradation rate of just 24.2%, which is significantly lower than the rates for layout-based methods, all of which are over 50%.
DeLeaker preserves fidelity and quality. Beyond leakage mitigation, DeLeaker excels at preserv- ing image fidelity and quality. It achieves the lowest LPIPS score (0.22), meaning best preserves the original image, which indicates that the method effectively leverages the model's internal knowl- edge and priors, applying only minimal, necessary interventions. DeLeaker also attains the highest VQAScore (0.68), signifying strong image-text aligmment. Moreover, it achieves the lowest KID score (0.00) alongside the prompt-base based baselines, demonstrating that strong leakage reduction is achieved without sacrificing original image quality. Notably, when applied to images without leakage ($D Fig. 12). DeLeaker induces negligible changes, thereby remaining non-intrusive.
ABLATION STUDY & ANALYSIS
Table 2 presents an ablation study assessing the contribution of each DeLeaker component. It includes two configurations: (1) W/O ablations, where components removed from added to the full method while the others are applied, and (2) Only ablations, where components are tested isolation. Results reported ratios relative to the full automatic leakage mitigation scores of DeLeaker.
8

---

Published as a conference paper at ICLR 2026
The most influential intervention is self-identity (image-text) strengthening. When applied alone, it achieves a 0.90 ratio in the "major improvement" (leftmost column). Conversely, when removed, the original score drops by 46% (to 0.54), confirming its key role in leakage prevention. The second most influential intervention is cross-entity image-text suppression. Omitting it causes a 29% reduction in improvement (major and minor). Furthermore, when applied in isolation, it accounts for 0.54 (second-to-las) row) of the total major improvement with almost no degradation, demonstrating its significant contribution. While cross-modality interventions are found to be effective, self- modality interventions have only a limited impact. Suppressing text-text interactions degrades performance by 9% 20%, suggesting that leakage in DiT T2I models is primarily due to cross- modal misalignment. Similarly, weakening image-image interactions has small and inconsistent impact (see absolute values in (E.3). Taken together, our analysis pinpoints the root of semantic leakage not to weaknesses within each modality, but to the faulty alignment between them, suggesting a promising direction for future research.
Finally, we analyze mitigation performance across the SLIM subsets. As shown in 3 the rate of successful mitigation increases dramatically with subset complexity. The total im- provement rate (major and minor) rises from 42.4% for simple Animal Pairs 62.6% for Animal Interactions, and further to 66.4% for the most complex Animal Interactions + Style subset. This provides clear evidence for our hypothesis: more complex prompts elicit stronger semantic leakage. This validates their use in SLIM as stress tests for semantic leakage.
Table 3: SLIM Subset Analysis with DeLeaker.
Subset
Visualization
Animal Puirs
Animal Interactions
Animal Interactions + Style
8 RELATED WORK
Alignment in T2I models. Ensuring alignment between the text prompt and the generated image fundamental objective in T21 models, serving both as a generation condition and as an evaluation goal (Xie et al. 2019 Hu et al. 2023; Yarom et al. 2024 Gordon et al. (002)). Many approaches rely on encoding- based methods, such as joint image-text embeddings (e.g.. CLIP), which were found
to be ineffective for fine-grained details between modalities (Liang et al. 2022, Yuksekgonul et al.,
2022; Koishigarina al. (025) (see şB.2). While recent work has employed VLMs as alignment 3, they are unsuitable for detecting semantic leakage. VLMs struggle with
evaluators (Li et al. (023).
the fine-grained details (Tong et al. 2024 Yu al., (025) and complex reasoning required for multi- image comparisons (Ventura et al. 2024b). This means a direct approach is insufficient, highlighting the need for more guided, step-by-step evaluation process. To the best of our knowledge, no evaluation method explicitly targets semantic leakage, despite its prevalence in T2I models (see I Table 17p. Addressing this gap is a central focus of our work, in which we introduce a dedicated method to mitigate semantic leakage and corresponding evaluation framework.
Semantic Leakage in T21 models. Leakage in T2I models was first identified by Rassin et al. (2022) in UNet-based T2I models, though direct mitigation was not proposed. While subsequent research has addressed related visual artifacts such as attribute binding (see for a distinction from semantic leakage: Feng al. 2022; Rassin al. 2024), composition errors, and missing entities (Binyamin et al.) 2025) by modifying the attention mechanism, these works do not directly address semantic leakage. To the best of our knowledge, [Dahary et al. (2025a b) were the only ones to explicitly tackle this problem. However, their solutions rely on external layout guidance or costly optimization. In contrast, we introduce DeLeaker, lightweight, training-frees free, guidance-frr free semantic leakage mitigation method.
Semantic Leakage Language Models. Semantic leakage has only recently been recognized as an issue in state-of-the-art language models like GPT-4o, where prompt information unintentionally biases the output (Gonen et al. 2025). While progress has been made in diagnosing semantic leakage, with one cause identified as leakage between lexical items in the text encoder (Kaplan et al.) 2025), effective mitigation remains an open problem. Therefore, our work focuses on developing a novel mitigation strategy while also investigating the origins of leakage through our method's ablations.
9

---

Published as a conference paper at ICLR 2026
CONCLUSIONS
This work introduces DeLeaker, a lightweight inference-tine approach that effectively mitigates semantic leakage in DiT-based T2I models without relying on external information such as bounding boxes. By directly modulating attention patterns during inference, DeLeaker mitigates leakage while preserving image-text alignment and image quality. outperforms existing baselines across diverse scenarios. Complemented by the first dedicated SLIM dataset and comparative evaluation framework, this work provides both a practical solution and a comprehensive foundation for systematic study of semantic leakage T2I models.
Future research could expand the SLIM dataset into new domains to explore cross-domain leakage scenarios. Furthermore, SLIM could be used to train leakage classifiers or, when paired with DeLeaker outputs, to fine-tune models to inherently avoid semantic leakage. While DeLeaker specifically targets T2I models, extending our work address semantic leakage in other modalities, such as 3D or video, is a natural next step. We hope this work stimulates further progress new methods, systematic evaluations, and dedicated datasets to address key problems in T2I generation.
REPRODUCIBILITY STATEMENT
To ensure reproducibility, all code and the newly introduced SLIM dataset will be made publicly available. Our experiments are based open-source T21 models, FLUX.I-dev and SANA, with all baselines and their configurations clearly documented in $H.I Key hyperparameters for DeLeaker, such attention reweighting coefficients and the specific diffusion step ranges for interventions, are detailed in SC} T Moreover, our automated evaluation framework is thoroughly described, with exact VLM prompts provided Fo allow for complete replication of our evaluation process.
ETHICS STATEMENT
In this work, we utilized AI models for several tasks. For grammar improvement, we used Gemini 2.5 Pro. For code completion, used Claude 4 Sonnet. In all instances, every suggestion or line of code generated by model was carefully reviewed by the authors to ensure it aligned with our original intentions before being accepted. Finally, detailed in $ and SF] we also used LLMs and VLMs for data creation and evaluation.
ACKNOWLEDGEMENTS
Mor Ventura and Roi Reichart partially supported by the MOST grant Advancing Human- Context Reasoning in "Vision-Language Models".. Michael Toker is supported by the Azrieli Graduate Studies Fellowship. Yonatan Belinkov funded by Coefficient Giving, the Israel Science Foundation (grant No. 2942/25), and the European Union (ERC, Control-LM, 101 165402)..
REFERENCES
Sourav Banerjee. Animal image dataset: 90 different animals. Lamsouravbanez www.waawweeeeaaaeeeeeeeeeeeeeeee animal ohw.://aaaaaaaaooooooooooaaaaaaa
2023.
cessed: 2025-09-14.
Lital Binyamin, Yoad Tewel, Hilit Segev, Eran Hirsch, Royi Rassin, and Gal Chechik. Make it count: Text-to- image generation with an accurate number of objects. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 13242-13251, 2025.
Faakk-orrest,Lass
2024.
Hila Chefer. Yuval Alaluf, Yael Vinker, Lior Wolf, and Daniel Cohen-Or. Attend-andeexitt:: Attention-bast semantic guidance for text-to-image diffusion models. ACM Iransactions on Graphics (TOG), 42(4):1-10, 2023.
Anthony Chen, Jianjin Xu, Wenzhao Zheng, Gaole Dai, Yida Wang. Renrui Zhang, Haofan Wang, and Shanghang Zhang. Training-free regional prompting for diffusion transformers. arXiv preprint 1..v:2411.00.999 2024a.
10

---

Published as a conference paper at ICLR 2026
Zhennan Chen, Yajie Li, Haofan Wang. Zhibo Chen, Zhengkai Jiang, Jun Li, Qian Wang, Jian Yang, and Ying Tai. Region-aware text-to-image generation via hard binding and soft refinement. arXiv preprint arXiv:2411.06558, 2024b.
Omer Dahary. Yehonathan Cohen, Or Patashnik, Kfrr Aberman, and Daniel Cohen-Or. Be decisive: Noise- induced layouts for multi-subject generation. In Proceedings of the Special Interest Group on Computer Graphics and Interactive Techniques Conference Conference Papers, pp. 1-12, 2025a.
Omer Dahary, Or Patashnik, Kfir Aberman, and Daniel Cohen-Or. Be yourself: Bounded attention for multi- subject text-to-image generation. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol (eds.), Computer Vision ECCV 2024, pp. 432-448, 448, Cham, 2025b. Springer Nature Switzerland. ISBN 778-3-031-72660--
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs on image synthesis. In A. Beygelz- imer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, 2021. URL
net/ net/ AWW
Weixi Feng, Xuehai He, Tsu-Jui Fu, Varun Jampani, Arjun Reddy Akula, Pradyumna Narayana, Sugato Basu, Xin Eric Wang. and William Yang Wang. Training-free structured diffusion guidance for compositional text-to-image synthesis. In The Eleventh International Conference on Learning Representations, 2022.
Yarden Frenkel, Yael Vinker, Ariel Shamir, and D. Cohen-Or. Implicit style-content separation using b- lora. ArXiv. abs/2403. 14572, 2024. URL
268553753
Hila Gonen, Terra Blevins, Alisa Liu, Luke Zettlemoyer, and Noah A. Smith. Does liking yellow imply driving school bus? semantic leakage in language models. Luis Chiruzzo, Alan Ritter, and Lu Wang (eds.), Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguisties: Human Language Technologies (Volume 1: Long Papers), pp. 785 798, Albuquerque, New Mexico, April 2025. Association for Computational Linguistics. ISBN 979-8- 89176--899 URL htttt:////a/ antho anthology...o....oooooooooooomom . oog. naacl 1ong
6. doi: 1825://112025.mmallleee 35/
Brian Gordon, Yonatan Bitton, Yonatan Shafir, Reopal Garg, Xi Chen, Dani Lischinski, Daniel Cohen Aaeen-Or,aa and Idan Szpektor. Mismatch quest: Visual and textual feedback for image-text misalignment. arXiv preprint vrXiv:2312.03766 2023.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yacl Pritch, and Daniel Cohen-Or. Prompt-to-prompt image editing with cross attention control. arXiv preprint arXiv:2208.0/e) 0/626, 2022.
Jonathan Ho and tim Salimans. Classifier-free diffusion guidance. In NeurIPS 202/ Workshop on Deep Generative Models and Downstream Applications, 2021.
Yushi Hu, Benlin Liu, Jungo Kasai, Yizhong Wang. Mari Ostendorf, Ranjay Krishna, and Noah A Smith. Tifa: Accurate and interpretable text-to-image faithfulness evaluation with question answering. In Proceedings of the IEFF/CVF International Conference Computer Vision, pp. 20406-20417, 2023.
Sadeep Jayasumana, Srikumar Ramalingam, Andreas Veit, Danicl Glasner, Ayan Chakrabarti, and Sanjiv Kumar. Rethinking fid: Towards a better evaluation metric for image generation. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9307-9315. IEEE, 2024.
Guy Kaplan, Michael Toker, Yuval Reif, Yonatan Belinkov, and Roy Schwartz. Follow the flow: On information flow across textual tokens in text-to-image models. arXiv preprint 13 2022.
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloc Rolland, Laura Gustafson, Tete Xiao, Spencer Whitchead, Alexander C Berg, Wan-Yer Yen Lo, et al. Segment anything. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 4015-4026, 2023.
Darina Koishigarina, Amas Uselis, and Scong Joon Oh. Clip hehaves like bag-of-words model cross- but not uni-modally. arXiv preprint 25X2:25502.03566, 2025.
Black Forest
Labs.
Flux.1
URL ---epth--eey Accessed: 2025-09-12 12.
depth [dev],
2024.
Yifan Li, Yifan Du, Kun Zhou, Jinpeng Wang, Wayne Xin Zhao, and Ji- Ji-Rong Wen. Evaluating object halluci- nation in large lasionnl models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 292-305, 2023.
11

---

Published as a conference paper at ICLR 2026
Zongming Li. Lianghui Zhu, Haocheng Shen, Longjin Ran, Wenyu Liu, and Xinggang Wang. Translight: Image-guide customized lighting control with generative decoupling. ArXiv, abs/2508. 14842400818884,, 2025. URL
Victor Weixin Liang, Yuhui Zhang. Yongchan Kwon, Serena Yeung, and James Y Zou. Mind the gap: Under- Standing the modality gap in multi-mode contrastive representation learning, Advances in Neural Information Processing Systems, 35: 1 1-16625, 2022.
Tsung- Yi Lin, Michacl Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitmick. Microsoft coco: Common objects context. European conference on computer vision, pp. 740- 755. Springer, 2014.
Zhiqiu Lin, Drepak Pathak, Baiqi Li, Jiayao Li, Xide Xia, Graham Neubig, Pengchuan Zhang, and Deva Ramanan, Evaluating text-to-visual generation with image-to-text generation. In European Conference on Computer Vision, pp. 366-384. Springer, 2024.
Penggi Lu. Qwen2vi-flux: Unifying image and text guidance for controllable image generation, 2024, URL https:// cow wtt.//cm//eee.e wttp://///ww///////e/o//oc
Yaniv Nikankin, Dana Arad, Yossi Gandelsman, and Yonatan Belinkov. Same task, different circuits: Disentan- gling modality-specific mechanisms vlms, arXiv preprint arXiv:2506.09947 2025.
William Peebles and Saining Xic. Scalable diffusion models with transformers. Proceedings of the IEEE/CVF international conference on computer vision, pp.
2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferahle visual models from natural language supervision. In International conference on machine learning, pp. 8748-8763. PmI.R, 2021.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lec, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21 (1144))11677, 2020.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Iyya Sutskever. Zero-shot text-to-image generation. In International Conference Machine Learning, pp. 8821-8831. PMI.R, 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hicrarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 2022.
Royi Rassin, Shauli Ravfogel, and Yoav Goldherg. DALLE-2 is seeing double: Flaws in word-to-concept mapping in Text2Image models. In Jasmijn Bastings, Yonatan Belinkov, Yanai Elazar, Dieuwke Hupkes, Naomi Saphra, and Sarah Wiegreffe (eds.), Proceedings of the Fifth BlackhoxNI.P Workshop Analyzing and Interpreting Neural Networks for NLP, pp. 335-345, Abu Dhabi, United Arab Emirates (Hybrid), December 2022. Association for Computational Linguistics. doi: 10.18632v1/2022.12 black22ol 1.288. URL https: / //ac ac
www.kkoww.accccbo.......... 1.287
Royi Rassin, Eran Hirsch, Daniel Glickman, Shauli Ravfogel, Yoav Goldberg, and Gal Chechik. Linguistic binding in diffusion models: Enhancing attribute correspondence through attention map alignment. Advances in Neural Information Processing Systems, 36, 2024.
Tianhe Ren, Qing Jiang. Shilong Liu. Zhaoyang Zeng. Wenlong Liu, Han Gao, Hongjie Huang, Zhengyu Ma. Xiaoke Jiang, Yihao Chen, et al. Grounding dino 1.5: Advance the" edge" open-set object detection. CoRR, 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffuusion models. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10674 10685. IEEE, 2022.
Olaf Ronneberger. Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In International Conference on Medical image computing and computer-assisted intervention, pp. 234-241. Springer, 2015.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, S. Sara Mahdavi, Rapha Gontijo Lopes. Tim Salimans, Jonathan Ho, David J Flect, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding, 2022. URI htt..///s.///ar...orr//////////s
1487
12

---

Published as a conference paper at ICLR 2026
Kritik Seth. Fruits and vegetables image recognition dataset, 2019. URL http:: /www http:///wwwwwwgwg...aa/ www.kaaaggleecoooo com/
Aviv Slobodkin, Hagai Taitelbaum, Yonatan Bitton, Brian Gordon, Michal Sokolik, Nitzan Bitton Guetta, Almog Gueta, Royi Rassin, Dani Lischinski. and Idan Szpektor. Refvali: Towards scalable evaluation of subject-driven text-to-image generation. arXiv preprint arXiv:2504. /7502, 2025.
Gabriela Ben Melech Stan, Diana Wofk, Scottie Fox, Alex Redden, Will Saxton, Jean Yu, Estelle Aflalo, Shao Yen Tseng. Fabio Nonato, Matthias Muller, et al. Ldm3d: Latent diffusion model for 3d. arXiv preprint arXiv:2305. 2023.
Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, et al. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context, 2024, URL https://orxxi. org/abs/2403.05550 2024a.
Gemma Team, Morgane Riviere, Shreya Pathak. Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léónnrd Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, et al. Gemma 2: Improving open language models at practical size. arXiv preprint arXiv:2408.00 001 18, 2024b.
Shengbang Tong. Zhuang Liu, Yuexiang Zhai, Yi Ma. Yann LeCun, and Saining Xie. Eyes wide shut? exploring the visual shortcomings of multimodal llms. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9568-9578, 2024.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
Mor Ventura, Michael Toker, Nitay Calderon, Zorik Gekhman, Yonatan Bitton, and Roi Reichart. Nl-eye: Abductive nli for images. arXiv preprint arXiv:2410.02M: 2024a.
Mor Ventura, Michael Toker, Nitay Calderon, Zorik Gekhman, Yonatan Bitton, and Roi Reichart. Nl-eye: Abductive nli for images. In The Thirteenth International Conference on Learning Representations, 2024b.
Enze Xie, Junsong Chen, Junyu Chen, Han Cai, Haotian Tang, Yujun Lin, Zhekai Zhang, Muyang Li, Ligeng Zhu, Yao Lu, ct al. Sana: Efficient high-resolution image synthesis with linear diffusion transformers. arXiv preprint arXiv:2410. 10629, 2024.
Ning Xie, Farley Lai, Derek Doran, and Asim Kadav. Visual entailment: novel task for fine-grained image 2019.
understanding. arXiv preprint
Fei Yang, Shiqi Yang, Muhammad Atif Butt, Joost van de Weijer, et al. Dynamic prompt learning: Addressing cross-attention leakage for text- based image editing. Advances in Neural Information Processing Systems, 36: 26291-26303, 2023.
Ling Yang, Zhaochen Yu, Chenlin Meng, Minkai Xu, Stefano Ermon, and Bin Cui. Mastering text-to-image dif- fusion: recaptioning, planning, and generating with multimodal llms. In Proceedings of the 41st International Conference on Machine Learning, pp. 56704-56721, 2024.
Michal Yarom, Yonatan Bitton, Soravit Changpinyo, Roee Aharoni, Jonathan Herzig, Oran Lang, Eran Ofek, and Idan Sypektor. What you see what you read? improving text-image alignment evaluation. Advances Neural Information Processing Systems, 36, 2024.
Hong-Tao Yu, Xiu-Shen Wei, Yuxin Peng, and Serge Belongie. Benchmarking large vision-language models on fine-grained image tasks: A comprehensive evaluation. arXiv preprint arXiv:2504.1 /4988, 2025.
Mert Yuksekgonul, Federico Bianchi, Pratyusha Kalluri, Dan Jurafsky, and James Zou. When and why vision- language models behave like bags-of-words, and what to do about it? The Eleventh International Conference on Learning Representations, 2022.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018.
Dewei Zhou, Ji Xic, Zongxin Yang, and Yi Yang. 3dis: Depth-driven decoupled instance synthesis for text-to- image generation. arXiv preprini arXiv:2410.12669) 2024.
Dewei Zhou, Ji Xie, Zongxin Yang, and Yang. 3dis-flux: simple and efficient multi-instanee generation with dit rendering. arXiv preprint arXiv:2501.051 2025.
13

---

Published as a conference paper at ICLR 2026
A SEMANTIC LEAKAGE: CONCEPTUAL CLARIFICATION AND SCOPE
A.1 DISTINCTION FROM ATTRIBUTE BINDING
Semantic leakage and attribute binding (Rassin et al. 2024) represent two related but distinet challenges in T2I generation (see Table Attribute binding refers to the failure to correctly associate explicitly mentioned attributes with their intended entities the input prompt. For instance, in prompts such as "a yellow flamingo and pink sunflower" or "a red frog and blue rabbit", models may misplace attributes (e.g., rendering the rabbit as red or the frog as blue), resulting in incorrect color-to- color-to-entity tottntttytyytttene assignments. The source of the enror is thus misalignment between the linguistic specification of attributes and their grounding in the image.
In contrast, semantic leakage arises not from the wrong binding of attributes explicitly stated in text, but from the unintended transfer of semantically related features between entities. This phenomenon is primarily driven by the visual similarity of the entities, making it more likely to occur between horse and a donkey than between a cow and a parrot. On the other hand, attribute binding can also occur between visually dissimilar entities (e.g.. "a red cow and a white parrot"). Here, features attend their semantically similar counterparts across entities, for example, the ears of one animal influencing the ears of another, or the shape of a mouth blending between two species. This leads cross-entity entanglement of features that are not even explicitly mentioned in the textual prompt, but emerge due to the semantic proximity of visual parts (e.g., cow ears leaking into horse's 's ears).
Table 4: Comparison between Attribute Binding and Semantic Leakage.
Aspect
Attribute Binding
Semantic Leakage
Definition
Misalignment between textual attributes and their intended entities.
Unintended transfer of semantically re- lated features between entities.
Source
Explicit attributes in the text prompt (e.g.. colors, shapes).
Implicit similarity between visual features (e.g., cars, eyes, mouths).
Primary Cause
Confusion over explicit attributes, regard- less of entity similarity (e.g., "a red cow and a white parrot").
Visual/semantic proximity the entities themselves (e.g., more likely between a horse and donkey).
Example Prompt
"A yellow flamingo with pink sun- flower": "A red frog and a blue rabbit."
"A cow a horse in farm."
Error Manifestation
Attributes swapped misplaced (e.g.. a blue frog instead of red frog).
Feature entanglement across entities (e.g.. cow traits appearing in the horse's 's ears).
Commonality
Both result in semantically inconsistent outputs that reduce fidelity to the intended meaning.
A.2 DIFFERENTAATINN FROM LEAKAGE IN MAGE-TO-IMAGE GENERATION
More recently, leakage has also been discussed in the context of style-content entanglement in image-to-image generation using reference images (Frenkel et al. 2024 Li et al. 2025). This line of work, however, focuses on different type of leakage that occurs between style and content, rather than on the internal semantic leakage between entities within the same image, which is the focus of our study. Image-to-image editing frameworks offer another possible direction for addressing this challenge. However, they involve computationally expensive double inference and rely on external inputs, prompt optimization (Yang et al. 2023) adapters optimizations often resulting in identity preservation issues (Slobodkin et al. 20255 In contrast, our method is both training-free and guidance-free free. It achieves high semantic consistency with the original image without requiring prior generation or post hoc correction.
14

---

Published as a conference paper at ICLR 2026
B FURTHER ANALYSIS & ABLATIONS
B.1 DeLeaker COMPONENTS ABLATIONS
cheetah are splashing each
with water
cheetah
érectsh
eagle are sitting with their tals wrapoed around each other
bat cagl
butterfly and Ful around a light source thenr wings cosling intricale shotows
math
butterfly
butherfly
ENTITY MASKS DURING DIFFERENT DIFFUSION PROCESS
Figure 5: Entity masks are accurate even in the first diffusion step (50 blocks; green frame). This is particularly evident in semantic leakage cases, where these initially clear masks begin to blend by a middle step (660 blocks; frame). The full process consists of 20 diffusion steps (1 (1140 blocks total).
15

---

Published as a conference paper at ICLR 2026
(1) Mask History
C0W
Del eaker with mask histryy
horse graze peacefully in postune"
eaker without mask history
150
250 Diffusion steps blocks
350
450
(2) Smoothing
DeLecker with smoothing
Original
.OW
harse
Deke without smoothing
COW
horse
Figure 6: Ablation study of DeLeaker's smoothing techniques on entity masks. The figure demonstrates the impact of two components: (Top) temporal smoothing and (Bottom) spatial smoothing.
Ten and horse seccel dyy posture
hogatheri oerfl drakky"
hanging From
1.2
1.6
Orignnl
Used DeLeaker
Different Self- Self-Identty (a) Values
Figure 7: Effect of varying the self-identity strengthening coefficient (a) in DeLeaker. Multiplying the image-text representation by a helps mitigate semantic leakage. This coefficient was empirically optimized small set of images, where we found 1.2 effectively mitigates semantic leakage. Whereas, higher values, such as a 2.0, introduces visual artifacts.
16

---

Published as a conference paper at ICLR 2026
Analysis: Attention Differences between DeLeaker and Original To further analyze the contribu- tion of DeLeaker's 's erostt components (image-image and image-text), we track the progression of semantic leakage across model (FLUX-devv blocks and diffusion steps. We compute the average proportion of tokens attending to the other entity, exceeding the dynamic leakage threshold, relative the number of tokens in the entity mask. For each entity pair, we measure leakage in both directions and take the maximum, as leakage typically occurs in only one direction (e; + ez). The analysis is performed under two conditions: standard inference (original) and inference with DeLeaker. Figure 8 shows the relative mean difference in leakage progression between the two settings. While the image-image component's effect is bounded a high value, partially explaining its smaller apparent change, the data still suggests this intervention has lower impact on mitigating semantic leakage.
DELEAKER INDIRECT EFFECT ATTEUTION SCORES:
IDELEAKER- DDINEALLDIINNALLLIIIIIAI TEATE-TEXT
0.30
0.00
-8.05
-0.10
-0.20
-0.25
IMAGE-IMAGE
-0.1
-2.3
-0.4
Bend
200
400
1800 10002
Figure 8: Analysis of Leakage Mitigation Progression. The figure shows how DeLeaker's cross- entity components mitigate semantic leakage throughout the FLUX diffusion process (steps x blocks). The y-axis represents the relative change in cross-entity attention between the Dekea run and the original run. The top and bottom plots show the effects for the image-text and image-image components, respectively.
B.2 AUTOMATIC EVALUATION BASED ON PREVIOUS EFFORTS
Evaluating the success of semantic leakage mitigation fundamentally requires comparative analysis between the original and the corrected image. Automating this comparison is non-trivial, however, as state-of-the -he---rrttt-ttttt art methods suffer from critical limitations. Vision- Languug Models (VLMs), for instance, exhibit order sensitivity where their judgment is biased by image presentation order, and possess unreliable visual encodings that fail in zero-shot comparisons (Ventura et al., 2024a). Similarly, joint-encoding models like CLIP are unreliable due significant cross-modal alignment gaps, often failing to correctly match text with visual information (Liang et al.) 2022). These limitations highlight the need for more robust, step-by-step evaluation pipeline, simple proxies are insufficient for this nuanced task.
We investigated whether standard metrics from joint-encoding models like CLIP and BLIP could
serve as a proxy for our evaluation pipeline. To test this, we examined two conditions for both models: self-identity check, which compares an entity's image crop with its name (e.g..
17

---

Published as a conference paper at ICLR 2026
horse image vs. the text "horse", and cross-entity check, which compares the image crop with the other entity's 's name (e.g., a horse image vs. the text "cow"). With CLIP, we measured the direct image-text similarity score. With BLIP, we queried the model with question (c.g., "Is this horse in the image?") and used the predicted probability of the answer being "Yes".
We then performed Spearman's 's rank correlation analysis between these CLIP and BLIP-based scores and our automatic evaluation labels (major improvement, minor improvement, no change, minor degredation, major degredation). The analysis was conducted our 821 821-sample pair subset, using our automatic labels as the ground truth, which themselves correlate moderately with human judgments.
The results, as presented in Table 5 show no statistically significant correlation across all tested metrics. The correlation coefficients were found be negligible, ranging from approximately -0.04 to 0.03, with all corresponding p-values being high (p > 0.05). This demonstrates that simple, off-the-shelf CLIP and BLIP-based measurements fail to capture the nuances of semantic leakage, reinforcing the need for our structured, multi-step evaluation pipeline.
Table 5: Spearman's 's rank correlation (p) between our automatic evaluation labels and various metrics derived from CLIP and BLIP (N 821). In all cases, the correlation statistically insignificant (p > 0.05).
Model
Metric Type Spearman's p
p-value
Self-Identity
0.010
0.773
CLIP
Cross-Entity
-0.010
0.773
Self-Identity
0.027
0.440
BLIP
Cross-Entity
-0.027
0.440
18

---

Published as a conference paper at ICLR 2026
C
DeLeaker METHOD: COMPLEMENTARY DETAILS
Table 6: Technical details of DeLeaker.
Parameter
Parameter Group
Value
Goal
Number of inference
20
steps
General T21 Parameters
Guidance scale
3.5
1.2
self-identity
strengthening entity mask
B1: Std. coefficient (text-image)
0.9
82: Std. coefficient (image-image)
image-image sup- pression
Tsuttaggregationn
12
diffusion step of start aggregating en- tity masks
Speeati Parameters
Gandagggeegtton
456
diffusion step of stop aggregating tity masks
Estut-interveation
diffusion step of start interventions (suppression and strengthening)
Land-inervemion
741
diffusion step of stop interventions (suppression and strengthening)
C.1 DeLeaker IMPLEMENTATION: TECHNICAL. DETAILS
Entity Mask The first step of DeLeaker is to find and extract the relevant image tokens of each entity in the prompt. We find, similarly to previous work UNet-based diffusion models (Binyamin et al. 2023), that early diffusion steps yield more accurate entity segmentation masks compared to later ones. Surprisingly, even within a single partial diffusion step, this method produces reliable results. Based this observation, diffusion blocks and timesteps. Specifically, from (12 to (171, where one diffusion step is consists of 57 blocks, while run 20 diffusion steps (results in total 1 1140 blocks in the diffusion process).
aggregate attention maps for each entity across selected
Due to significant variation across blocks and timesteps, we apply two smoothing techniques to improve mask quality: (1) Spatial smoothing: applying smoothing filter to fill small holes and remove isolated artifacts. In this refinement, we apply several filters. The first is morphological closing operation which fills small holes within the predicted masks. Then, apply morphological opening to eliminate spurious noise pixels, both using 3 x 3 elliptical structuring element. (2) Temporal smoothing (History): we enforce temporal coherence by averaging the attention-based masks across a constrained window of subsequent transformer blocks and time steps. This window deliberately excludes the initial block of the first time-step. These that are very noisy and limited in duration to prevent the erroncous merging of distinct object masks over time. The combined methodology yields masks that are both spatially clean and temporally stable. Together, these steps produce cleaner and more consistent segmentation masks (see Figures in $B.1).
SANA-basee DeLeaker We found that the image-image component yielded inconsistent results; while it sometimes improved leakage mitigation, it also occasionally introduced visual artifacts. Due to this unpredictable behavior, we excluded it from the final SANA configuration.
C.2 FULL MATHEMATICAL FORMULATION
The standard scaled dro-put attention mechanism is calculated as:
QKT
Attention( (,K, K,V) = softmax
(4)
Vdl.
19

---

Published as a conference paper at ICLR 2026
where Q, K, V are the Query, Key, and Value matrices, and dę is the dimension of the keys. The term Att = QK" represents the raw, unnormalized similarity scores before scaling and the softmax operation. The following sections detail process for modifying these scores.
Find Entity Masks
14
I
ERT
Atlgh QEI KEE.
(5)
Σ
(Attgk 14)2
(6)
EM
VETKES
iimg_.. E
{g Attgk > Mi B1 oi, h E.h ke,,kE
(7)
Modify Attention Scores
Σ
Σ
Atlgk
(8)
&
ein
QEE!" KEE
(Allgh pig)
(9)
|gim8| |I,
gEE," KEET"
img-img
(())k)
Attyle > p4j + 82 . Oij. k, TT
(10)
if q E gimg k E e and (q. k) E lingg-ing
-00
if q E milg k eixt
Attak
00 a Allak
(11)
if q E ging k E E else
All.g
Notation: I: set of all image tokens indices, gpx, text tokens of entity i, as score scaling factor. 31,82 82: constant std multipliers.
The cases in correspond to:
First case: Image-to-Image Leakage Suppression
Second case: Image-to-Text Leakage Suppression
Third case: Self-Identity Strengthening
C.3 LATENCY ANALYSIS
DeLeaker introduces computational overhead due to the calculation of entity masks and the statistical analysis (mean and standard deviation) of attention values required identify target locations for mitigating leakage. To quantify this overhead, we measure the average generation time over 50 instances using FLUX with 20 inference steps. We compare 3DIS (Table 9). DeLeaker generates an image in 7.68 seconds. While this represents a 44.1 1 % increase in latency compared the baseline (5.33 seconds), it remains significantly faster than competing methods such as 3DIS (9.43 seconds) and RAG-Diffusion (21.71 seconds).
approach against RAG-Diffusion and
20

---

Published as a conference paper at ICLR 2026
D QUALITATIVE COMPLEMENTARY RESULTS
Original (Flux)
DeLeaken
Acadhetus und manee preencser oher colerti
badis partly seadlry
ofche Wirlyy
A pparel foucsn see riallllyy huging the efer'
sighhinngle charing
bode seth toge hoge tangng frenc
An dhaahan ond renoceres stand co0 Eapether
Figure 9: Qualitative Examples FLUU-bbasd Del.ekerr
21

---

Published as a conference paper at ICLR 2026
ORIGMALL (SLM
DELESKER IOURS!
FOOMPT
PROMPT
het pnde cople
westing sccreter
hhe Vorgentyl
MIRND
pollick mesl ioodlly
gost stelily
najos
Aaafecoo 2001 bi wit
Figure 10: Qualitative comparison across baselines. FLUX-based DeLeaker.
DeLeaker
Original (SANA)
Figure 11: Qualitative Examples. SANA-based DeLeaker.
22

---

Published as a conference paper at ICLR 2026
ORIGINAL (WITHOUT SEMAUTIC LEAKAGE)
DELEAKER
A dolphin leaps out of the water while butterfly flutters near the shore
A zebra grazing the grass while an owl flying above
A lion roans from rocky outcrop while a penguin woddles across the ice
An elephant trumpets loudly while spider weaves its web in a nearby tree
A bear catches fish in rushing river whil parrot
perches on a tropical
Figure 12: Qualitative Examples of cases when original images do not present semantic leakage. Original images on left and DeLeaker images are right. DeLeaker preserve the image content and quality.
23

---

Published as a conference paper at ICLR 2026
EUTITY DESC PROMPT
TUSTRUCTION
PROMP1
A Acoow Hits the head
curisaly, magpie
pecks the ground and
blue Joy from free
cat strefches lozdy the sun while cheefah scors
the savannn and a lespard
lunges on free
A stt sitrowberry.oo rodish. and chenry of together
eggplant,
fig and lod out on noplán
A femato, ball papper. popréka arranged side side
Figure 13: Qualitative Examples Triplets subset (with original image without entity counting issues). Examples across best performing prompt-basee based baselines.
OR/CIAAL
DELEAKED
EUITITY PROMPT
IUSTRUCTION
bot floos through the twilght. while and on eugle soars high obove
mocow parrot and a oockafoo parch skle sile
cucumber. honeydew one omnonged tyde.
grasnss the Fiadd, while honse frois dong the fance derkey brays in the dallance
coyote moves carafuly olong the wdge of cleoiing whis fox Bilss hall and dog
avaledly"
Figure 14: Qualitative Examples of Triplets subset (with original image without entity counting issue: Missing Entity), DeLeaker mitigates the leakage in some cases while challenged in others creating the missing third entity. Examples across best performing prompt-based baselines.
24

---

Published as a conference paper at ICLR 2026
ORIGINAL
DELEAKER
An elephant and a moose sitting back to bock
A ferret and hamster leaning against each other while dozing in the sun.
A goat and a sheep graze together in field, their wooll coats blending together
hippopotamus and rhinoceros are one gently pushing the other with its nose.
koala and a sloth are entwined together whie hanging from a branch.
A penguin and puffin huddle together on an icy shore.
Figure 15: Qualitative examples from the animal interactions subset. Although DeLeaker is effective at mitigating semantic leakage, the suppression high attention values can sometimes remove desired semantic information, leading to compromised interactions. For instance, as shown in the third row, while DeLeaker correctly generates the distinct animals (a goat and a sheep), the joint grazing action is partially lost, resulting in only the goat grazing. Similarly, in the last row, while DeLeaker successfully mitigates leakage from the puffin to the penguin, the mutual huddling interaction is reduced one-sided action where only the penguin hugs the puffin. We hope that future research will address this limitation to eliminate leakage in more fine- -rained manner, while preserving intended interactions.
25

---

Published as a conference paper at ICLR 2026
MODEL / SEED
ORIGINAL
In art style. rhinoceros stands to the left. whie hippopotamus gently pushes from the right.
ORIGINAL
RAC-DIFFUSION
In 3D nender dog jumes high above wide fox nuns under it
Figure 16: Qualitative examples of explicit location instructions with RAG-diffusion. Each prompt includes an explicit location (such as "to the left") of an entity. We provide generations for five seeds. RAG-diffusion fails mitigate leakage for these prompts. These results are consistent with those observed in the SLIM dataset.
26

---

Published as a conference paper at ICLR 2026
LEAKAGE MITIGATION
QUANTITY CORRECTION
ORIGINAL
DELEAKER
Two cockatoos and playfuly wrestle, then vbrant feathers creating a flurry of color
A cheetah and two jackals dragging the other pla fight.
cow and two horses are sharing a sigle nest kned with soft feathers.
A and two owls are pressing their bodies together whil hiding burrow.
X
Two cockatoos and playfuly wrestle, their vbrant feathers creating flurny of color
cheetah and jackals one drogging the other into play fight.
X
Two cats and cheatah are splashing each other with water in shallww river
X
Figure 17: Qualitative results of leakage mitigation versus quantity correction across triplets with identical entities. This subset (additionally to SLIM subsets) includes prompts that specify two identical entities and one additional entity. We observe the following trends: when three entities generated with leakage (rows 1-2), DeLeaker effectively removes the leakage. In many cases, only two entities are initially generated. In such instances, DeLeaker partially mitigates the leakage while corrects the quantity (rows 3-5), whereas in other cases (last two rows), the leakage is mitigated but the incorrect number of entities persists.
27

---

Published as a conference paper at ICLR 2026
E QUANTITATIVE COMPLEMENTARY RESULTS
Table 7: Human Evaluation Results. Conducted MTurk over 60 randomly selected samples across six baselines, with three annotators per task. Aggregation was performed using majority vote, with the median used in case of ties. The table reports the distribution of semantic leakage mitigation, categorized by direction and magnitude of change. Spearman correlation of 0.432 with p-value <0.001 with the corresponding automatic evaluation (see Appendix Table 8
Human Evaluation: Leakage Mitigation (Distribution)
Model
Visualization
Iaprovemnnt
Degrodation
Major
Minor
No Change
Minor
Major
RAG-Diffusion
3.57%
17.86%
21.43%
21.43%
35.71%
RPF
5.26%
22.81%
26.32
21.05%
24.56%
3DIS
5.00%
16.67%
16.67%
21.67%
40.00%
QwenFLLXX
0.00%
1 11.7%%
20.00%
36.67%
31.67%
Desc Prompt
16.13%
15.16%
14.52%
17.74%
DeLeaker
13.56%
54.24%
25.42%
6.78%
0.00%
Table 8: Automatic Evaluation Results. Proportions computed over all user study samples (60)
Automatic Evaluation: Leakage Mitigation (Distribution)
Visualization
Improvement Major
Degradation Minor
Change
Major
RAG-Diffusion
16.07%
3.57%
10.71%
3.57%
66.07%
RPF
17.54%
5.26%
17.54%
28.07%
31.58%
3DIS
34.48%
6.90%
8.62%
12.07%
37.93%
QweaFLUX
16.95%
6.78%
11.86%
20.34%
44.07%
Ent. Dese Prompt
36.21%
8.62%
29.31%
10.34%
15.52%%
DeLeaker
53.57%
7.14%
16.07%
12.50%
10.71%
Table 9: Average Generation Times for Different Methods, calculated subset of 50 instances.
Method
Average Generation Time (s)
Original
5.33
RAG-Diffusion
21.71
3DIS
9.43
DeLeaker
7.68
E.1 SANA
The different designs of FLUX and SANA are highly relevant to studying semantic leakage. FLUX combines T5-XXL (Raffel 2020) and CLIP (Radford al. 202T) encoders, whereas SANA replaces them with Gemma-2 (Team et al. 2024b) and incorporates linear attention in its DiT backbone. These components are crucial, as both the text encoder and attention mechanism dictate how unintended semantic content propagates across modalities.
We evaluate DeLeaker effectiveness at mitigating semantic leakage using our human-veriffed Sana dataset. Since prompt-based baselines have been shown to be more effective for reducing semantic leakage than layeut-based methods, and as no implemented layout-based methods are available for Sana, we compare DeLeaker against two prompt-based baselines: the instruction prompt and the entity description prompt. The results, presented in Table I0, show that DeLeaker is highly effective the Sana model. It achieves 64% improvement in leakage mitigation with only 15% performance degradation. yielding 49% net improvement. This performance significantly outperforms the instruction baseline. The entity description prompt, however, achieves much better
28

---

Published as a conference paper at ICLR 2026
results due to the additional description of the entities in the prompt, resulting in score that is only slightly behind DeLeaker. We attribute these results to SANA's use of the Gemma model as its text encoder, leading to superior performance whether Dekea can achieve even hetter results using this information, we test Deleaker with the entity descriptions. The results are even stronger: DeLeaker gains an additional 14% improvement, resulting in a 78% improvement in leakage mitigation and only a 15% degradation, beating the entity description baseline significantly.
the prompt description baseline. To see
Table 10: SANA Main Results. Distribution of semantic leakage mitigation across models, cate- gorized by direction and magnitude of change. Arrows (t or L) indicate the improvement direction. Evaluated on 368 samples, filtered from SLIM large scale with SANA model images.
Leakage Mitigation (Distribution)
Preservation
Model
Visualization
Imprevement
Degradation
VQAScore
LPIPS
Major
Minor
Change
Minor 1 Major
Instruction Prompt (SANA)
21.45%
11.07%
40.14%
11.76%
15.57%
0.75
0.33
Fnt. Desc. Prompt (SANA)
56.55%
7,59%
20.00%
5.86%
10.00%
0.72
0.70
DeLeaker (SANA)
55.36%
8.65%
17.30%
5.54%
13.15%
0.79
0.35
DeLeaker With Ent. Desc. (SANA)
66.35%
12.07%
5.52%
4.83%
11.03%
0,73
0.69
E.2 MULTIPLE ENTITIES
To evaluate DeLeaker effectiveness with more than two entities, tested it two distinct subsets: one featuring prompts including three distinct animals and another containing prompts of three vegetables or fruits. We compared DeLeaker performance against two prompt-based baselines: the Instruction Prompt and the Entity Description Prompt. The results, summarized in [Tl clearly show that DeLeaker outperforms both baselines in both the animal and the fruit & vegetable sets.
We observed that DeLeaker performance was notably higher on the fruits & vegetables dataset. This likely because DeLeaker is better equipped to handle the generation of duplicate entities, issue prominent in that particular subset. Its strength lies in a smoothing mechanism across steps and across image tokens, which effectively resolves extra objects that arise from mask duplication. Conversely, the model struggled more with the animal dataset, where the primary challenge was missing entities. Deleaker is less adept at handling this issue because of its design; it cannot create a new mask for an entity if one was not formed in the early stages from the attention maps. Overall, DeLeaker is an effective for scenarios with multiple entities, particularly when correcting for duplicates, but future work could focus on improving its performance in cases where entities are missing.
Table 11: Results on Animal and Fruits & Veg Triplet Subsets (FLUX):
We evaluate leakage mitigation on the triplets subsets across the best performing prompt- baselines (based on the results on the pair subsets). The main scores represent the percentage of samples labeled as Mitigation (Major/Minor). No Change, or Degradation (Major/Minor), summarized by a stacked bar visualization. These presented alongside Preservation metries (VQAScore and LPIPS). Arrows (T/L) indicate the desired direction for improvement for each metric.
Semontic Leakage
Preservation
Subset
Model
Visualization
Mittgotion 1
Degrasdotion J Major
VQAScore
LPIPS
Major
Minor
No Change
Minor
Instruction Prompr
39.66%
3.45%
19.83%
0.86%
36.21%
0.67
0.45
Animal Triplets
Ent. Desc Prompt DeLeaker
38.79%
2.59%
13.79%
6.90%
37.93%
0.67
0.49
43.97%
7.76%
19.83%
8.62%
19.83%
0.70
0.25
Instraction Prompt
35.06%
10.34%
15.52%
3.15%
35.63%
0.67
0.11
Veg Triplets
Dess Pronnt
51.72%
8.05%
8.08%
7.47%
24.71%
DeLeoker
59.20%
6.90%
9.77%
4.02%
20.11%
0.70
0.34
E.2.1 MULTIPLE ENTITIES: ENTITY COUNTS ANALYSIS
An entity counts error in image generation happens when the T2I model fails to create the correct number of entities or items specified in the text prompt. For instance, prompt asking for "a photo
29

---

Published as a conference paper at ICLR 2026
of dog and cat" might incorrectly generate image showing for example only one dog two dogs and a cat (Binyamin et al. 2025). This phenomenon signals a failure to maintain alignment between text and image. In many cases, observe that missing additional entities severe semantic leakage. This can happen when an entity "disappears" due to leakage, or when two entities fuse into one, creating a blended entity with features from both. Alternatively, T2I model can generate an additional entity, which complicates the attention relationships among all entities and increases the chance of semantic leakage.
related to
To enrich our analysis, we supplement the main SLIM dataset with an additional set of 222 samples (Table [2]. This new subset was specifically filtered include images with entity count errors, that is, where entities are either missing or added relative to the prompt. The counting is done by prompting Gemini 1.5 pro. Our goal to use this subset to investigate the link between semantic leakage and these counting errors. We achieve this by assessing whether leakage mitigation techniques also correct the number of entities in these images.
Table 12:
Entity Counts Subset. This table shows the number images with missing or extra entities. This additional subset contains 222 samples.
Group
Subset Name
Additional Eatities (Extra)
Missing
Animal Pairs
Pairs
Animal Pairs (Interaction)
3
9
Animal Pairs (Interaction Style)
5
11
13
29
Triplets
Animal Triplets
12
116
Fruit Vegetablee Tripless
25
27
Total Triplets 180
37
143
Based on Table 12 we first observe that entity count errors become more frequent as the number of entities in a prompt increases. The FLUX base model exhibits a notable bias: it tends to generate fewer animals than requested but adds extra items the fruit and vegetable subset. We hypothesize this bias originates from the training data, where fruits and vegetables are often depicted in groups, while animals are more commonly shown individually.
Figure 18]and Tables 12 and 13 present the results for the entity counts subset, focusing on the pairs subsets and triplets in SLIM, respectively. The results are shown in the form of transitions, tracking the entity count state (missing, same, extra) from the original image to the candidate image. Figure isolastss only the successful transitions (highlighted in green columns of Table 18b]. where the model correctly adjusted the number of entities).
When analyzing the baselines on images with the successful entity count, layout-based methods show divergent behaviors: RAG-Diffusion tends to omit entities (56% of cases), whereas 3DIS and RPF tend to add extra ones (21% % and 14%, respectively). In contrast, DeLeaker is the most stable, preserving the correct number of entities 97% of the time. For cases with missing entities, 3DIS and DeLeaker+Desc are most effective at correcting the error. Conversely, when presented with extra entities, most baselines perform well, successfully omitting the surplus items with success rates ranging from 61% 51%%o to 100%.
Table 13
focuses on the entity count transitions in the Triplet subsets. DeLeaker demonstrates better performance in fixing "Missing" entity cases than "Extra" entity cases. We hypothesize that the reason for this the method's 's reliance on the generated entity masks; if an entity mask is mistakenly generated, DeLeaker continues to intervene based on this incorrect mask rather than omitting it. This presents an interesting direction for future work.
we observe that transitions toward the correct entity count are more frequent than transitions that worsen the error. This suggests that semantic Icakage mitigation methods generally have positive effect entity count errors. This finding indicates that semantic leakage is a direct cause of entity count issues.
Focusing on the "Missing" and "Extra" columns in both Table 12 and Table 13
To further examine multiple entity scenarios in more complex setups, we present Figure 17 which shows qualitative results comparing leakage mitigation and quantity correction across triplets contain- ing identical entities. These examples, which additional to the SLIM samples, include prompts that specify two identical entities and one additional entity. We observe the following trends: when three entities are generated with leakage (rows 1-2), DeLeaker effectively removes the leakage. In
30

---

Published as a conference paper at ICLR 2026
103
13-
DASTO Arddeto
Dett pereng
Oftedaor
(a) Counts Analysis. Entity quantity transitions between original image + candidate image. The bar graph presents only the successful transitions (green column of the table below).
Baseline
Original: Missing
Original: Same
Original: Extra
Missing
Missing
RAG
0.00%
34.49%
56.60%%
57.55%
5.77%
100.00%
0.009
0.00%
RPF
0.00%
34.48%
65. 51%1%
3.81%
62.48%
13.71%
69 2313
50.77%
0.00%
3D1S
0.00%
24 14%
75 8668
4.77%
74.37%
20.866
61. 61.54%
30.77%
7.00%
QwenPLUXX
96.21%
$4.62%
84.62%
7.00%
Prompt
Eat. Dese Prompt
0.00%
48.28%
51.72%
2.20%
96.79%
0.95%
100.00%
0.00%
0.005
DeLeaker
0.00%
41.38%
58. 62.62%
0.48%
98.81%
0.71%
$4.62%
15.38%
0.0%%
Desenker-Dese
0.00%
27.59%
72.41%
1.90%
97.14%
0.95%
100.00%
0.003
0.09%
Correct model behavior per ground-truth; X Incorrect.
(b) Entity Quantity Transitions: Percentage of Examples per Baseline.
Figure 18: Visual and tabular analysis of entity count transitions in pairs subsets. The SLIM distribution is: Same: 839, Missing: 29, Extra: 13. (a) Bar graph summarizing the desired transitions
across baselines: Same Same, Missing ~> Extra and Extra - Missing. (b) Detailed transition matrix showing the percentage of outcomes (Missing, Same, Extra) for each original state.
Table 13: Entity Quantity Transitions for Animal and Fruit Veg Triplets Subsets: Percentage of Examples per Baseline. Animal Triplets (244 samples: 116 Same, 116 Missing, 12 Extra). Fruits & Veg Triplets: 175 samples: 123 Same, 27 Missing, 25 Extra
Sabvel
Baseline
Missing
Original: Mioing Same
Extra
Miedng
Original: Same
Same
Fatra
Missing
Original: Extra
Samaa
Rxtra
Instrctioon Piempt
BUPS5
37.15
62 2015
15.18%5
20. 7352
3338%%
73.33%
2000016
E.671
Animal Triplets
Eat. Dese Pronpt
0.85%
47.01%
52 14%
16.05%
75.59%
7.14%
66,677%
33.33%
ELO0S
DeLeaker
0.00%
63.25%
36.75%
3.36%
83.93%
10.71%
36,67%
66.67%
6.675
Proept
Neg Tripless
Prompt
Correct model behavior per ground-truth; Incorrect.
many cases, only two entities are initially generated; in such instances, DeLeaker sometimes corrects the quantity (rows 3-5) while removing leakage, whereas in other cases (last two rows), the leakage mitigated but the incorrect number of entities persists.
31

---

Published as a conference paper at ICLR 2026
E.3 ABLATION STUDY: COMPLEMENTARY RESULTS
Table 14: Automatic Evaluation Scores of Semantic Leakage Mitigation: Subset Analysis (De- Leaker). The main scores represent the percentage of samples labeled as Mitigation (Major/Minor), No Change, or Degradation (Major/Minor), summarized by stacked bar visualization.
Leakage Mitigation (Distribution)
Subset
Visualization
Improvement
Degradation
Major
Minor 1
No Change
Minor
Major
Animal Pairs
31.71%
10.67%
40.24%
6.10%
11.28%
Animal Interactions
54.72%
7.92%
17.36%
6.04%
13.96%
Animal Interactions + Style
55.87%
10.53%
14.17%
5.26%
14.17%
Table 15: DeLeaker Ablation Study. Configurations are divided into two types: (1) W/O rows (top four) represent the removal/addition of specific component, while (2) Only rows (bottom three) isolate each component independently. Absolute scores of are DeLeaker are reported, with values closer to the regular configuration of DeLeaker (first row) indicating similarity.
Visualization
Improvement
No Change
Degrudation
Configuration
Major
Minor
Minor
Major J
DeLeaker
46.07%
9.76%
25.36%
5.83%
12.98%
W/O Image-Image(-)
46.31%
10.12%
26.67%
4.29%
12.62%
W/O Image-Textt-)
42.98%
7.62%
27.98%
6.07%
15.36%
W/O Image-Text(()
25.00%
7.98%
43.93%
7.02%
16.07%
With Text-Text(-)
41.79%
8.93%
27.26%
7.02%
15.00%
Only Image-Image(-)
11.90%
5.95%
61.90%
7.86%
12.38%
Only Image-Text(()
25.12%
8.57%
47.62%
5.83%
12.86%
Only Image-Tennt Texte))ext(+))
41.55%
9.64%
31.19%
5.12%
12.50%
Table 16: DeLeaker Ablation Study (Relative Change). Configurations are divided into two types: (1) W/O rows (top four) represent the removal/addition of specific component, while (2) Only rows (bottom three) isolate each component independently. Percentage change in semantic leakage mitigation distribution relative to DeLeaker. Positive values indicate improvement over DeLeaker, and negative values indicate degradation. Darker hues indicate stronger effect, color-coded positive and negative
Relative Change in Leakage Mitigation (% vs. DeLeaker)
Configuration
Improvement
No Change
Degradation
Major t Minor
Minor
Major 1
DeLeaker
W/O Image-Image(+
+0.52%
+3.66%
+5.16%
-26.53%
-2.75%
W/O image-Text()
-6.72%
-21.95%
+10.33%
+4.08%
+18.35%
W/O (mage-Texi(+)
-45.74%
-18.29%
+73.24%
+20.41% %
+23.85%
With Texi-Text(-)
-9.30%
-8.54%
+7.51%
+20.41%
+15.60%
Only
-74.16%
-39.02%
+ +144.13%
+34.69%
-4.59%
Only -exi(-
-45.48%
-12.20%
+87.79%
0.00%
-0.92%
Only Image-Tex((+)
-9.82%
-1.22%
+23.00%
-12.24%
-3.67%
32

---

Published as a conference paper at ICLR 2026
F EVALUATION AND ANNOTATION PROTOCOLS
F.1 SLIM HUMAN-GUIDED FILTERING: HUMAN ANNOTATION PROTOCOL FOR DETECTING SEMANTIC LEAKAGE
Human Annotation Protocol
Annotation Setup. Each image in our dataset was evaluated independently by the annotators following a multi-step process. For each original generated image, the annotators followed these steps:
1. Prompt Review: Read and understand the textual prompt used generate the image, with special attention to the entities and their intended differences (e.g., "a horse and zebra").
2. Entity Identification:
Identify all relevant entities mentioned in the prompt (e.g., animals, objects, or attributes such as "striped" or "spotted").
Use web-based image search engines (e.g., Google Images, Bing) to collect exemplar images for each entity separately. These serve as ground- ing references for typical visual features each entity class.
Reference Collection:
4. Feature Comparison: Compare the reference exemplars to identify key distin- guishing features between the entities (e.g., color, texture, morphology).
Image Inspection: Carefully examine the generated image and evaluate the appear- ance and distinctiveness of each entity.
The full process illustrated below in Figure
Labeling Criteria. Each image was assigned binary label indicating the presence (positive) or absence (negative) of semantic leakage, based on the following criteria:
Positive Label (Semantic Leakage Present):
Entity Indistinguishabiiity: If the entities appear visually indistinct interchange- able (i.e., they resemble two instances of the same entity class), the image is labeled as containing semantic leakage.
Cross-Entity Feature Leakage: If at least one entity visibly incorporates feature that is uniquely associated with the other entity (e.g., the spotted pattern of a dalmatian appearing on golden retriever), the image is labeled positive.
Hy Hybridization Effects: If the image contains hybrid fused representation that cannot be clearly attributed to either entity independently, this also qualifics as leakage.
Negative Label (No Semantic Leakage):
Independent Feature Attribution: Entities are clearly distinguishable and all major features can unambiguously attributed to the correct referents.
Non-Semantic Artifacts: Any visual inconsistency that does not reflect semantic leakage, such as color blending with the background, pixelation, blur, rendering ar- considered leakage and labeled negative. Partial Occlusion Simplification: Cases where entities simplified partially occluded, but still distinguishable based on remaining cues, are not counted as leakage.
tifacts, or lighting inconsistencies,
Figure 19: Protocol followed by human annotators for assessing semantic leakage in generated images.
33

---

Published as a conference paper at ICLR 2026
A toucan tilts its beok, while a woodpecker pecks furiously at the bark'
PROMPT
IMAGE SEARCH
SEMANTIC LEAKAGE
SEMAUTIC LEAKAGE PRESENTED
SEMAUTIC LEAKAGE
IS PRESENTED
ABSEUT
COMPARISON& é LABELING
EXAMPLE
(A)
(B)
(C)
Figure 20: Human Annotation Protocol for Detecting Semantic Leakage. The protocol begins with reading the prompt and identifying the entities involved. Annotators then search for reference images of each entity online and visually compare them to identify features uniquely associated with one entity that appear in 1he other. Examples show (A) significant leakage, (B) localized leakage, and (C) a clean case (without semantic leakage).
34

---

Published as a conference paper at ICLR 2026
F.2 HUMAN ASSESSMENT OF MITIGATED SEMANTIC LEAKAGE (AMT)
To complement the automatic evaluation and validate its outcomes, we conducted a structured human evaluation using the Amazon Mechanical Turk (AMT) platform. The purpose of this evaluation was twofold: to assess model performance based on human judgment, and to verify the accuracy and robustness of the automatic leakage detection.
Each questionnaire item included visual figure composed of five elements: two generated images for comparison (the original image suspected of semantic leakage and baseline image), two reference images (one for each entity, generated by the base (uniintervened) model), and the prompt used to generate the images. The reference images and prompt were provided to help annotators accurately identify the entities and distinguish between them, especially in cases where prior familiarity with the entities could not be assumed. This structure also aligns with the inputs used the automatic evaluation, allowing for consistent comparison between the two protocols.
Annotators were presented with two questions per item, one for each entity (see Figure 22 For each question, they were asked: "In which image does the [entity] look more typical?" The response was given on a five-point scale, indicating both the chosen image and the strength of preference, such as "Image strongly" or "Image slightly." The order of the images was randomized in each instance to mitigate positional bias. Figures 21a 2nd 21b show examples of the visual figure used in the task.
To ensure annotation quality and consistency, annotators were provided with prerequisite guidelines (Figure 2 examples, and a clear definition of typicality. The evaluation covered 60 randomly sampled prompts across six baselines, including DeLeaker. Each item was annotated by three moderate,
independent raters. This resulted in a total of 980 responses. Auue-AAnntttorAArreeeeee computed for each question (each entity) with averaged quadratic weighted Fleiss k of 0.52 (0.497 and 0.541 for the two questions).
35

---

Published as a conference paper at ICLR 2026
Reference
Entity 1: dog
Image
Image 2
Entity
Prompt: "In 3D render, dog and a fox play together field, their playful antics a display of their shared canid heritage:
(a) User Study Image Screen: Example
Reference Images
Image
Image
Entity 2: puffin
Prompt: Futurism, penguin puffin huddle together on Ico, keeping warm freezing temperatures."
(b) User Study Image Screen: Example
Figure 21: Two examples of the image screens presented our AMT user study.
36

---

Published as a conference paper at ICLR 2026
Image Comparison Evaluation Task
Definition - Typicality: How usual or expected an entity looks image.
Example: A tall giraffe is more typical than short one.
Question 1: Entityl is more typical in:
Image (strong preference)
Image (slight preference)
Equally typical in both images
Image 2 (slight preference)
Image 2 (strong preference)
*Use the reference image, your general knowledge, or online search.
Question 2: Entity2 is more typical in:
Image 1 (strong preference)
Image 1 (slight preference)
Equally typical in both images
Image 2 (slight preference)
Image 2 (strong preference)
*Use the reference image, your general knowledge, or an online search.
Note: See the guide for clarifications, examples, and important notes.
Figure 22: The questions in the user study annotation task as appear in the AMT interface for human evaluation.
37

---

Published as a conference paper at ICLR 2026
Example #1
Q1 In which Image, Entlyy More Typkss? ?
Q2 Entity2 More Typlcal?
Answara:
Image (strong preference)
Image
(slight preference)
answer many of these questions correctly, you'll need rely on reference images understand what some less familiar animals are supposed to look like. In this case, the woodpecker's beak resembles that toucan, and the toucan shouldn't have a red crown.
(a) Example guidance for annotators. The guideline here focuses typical atypical traits.
Example #2
Proeet: <ohe Eapelt-etng meneeegh www.eeggiieeeee. wiik cnlporthe
In which Image,
Q1
Q2
Entity1 Typical?
Entity2 Typical?
Anzwara:
SAME
Image
(strong preference)
many cases, Image and Image 2 may differ completely. This is expected and not relevant to the comparison.
(b) Example guidance annotators. The guideline here focuses on entity distinction.
Figure 23: Guidance materials shown annotators before the task, including examples of visual differences relevant for typicality and entity differentiation.
38

---

Published as a conference paper at ICLR 2026
G SLIM DATASET CURATION
G.1 SLIM COMPLEMENTARY DETAILS
Table 17: SLIM Subsets. This table details the curation process and the percentage of images exhibiting semantic leakage for each subset. After human-verified filtering, weighted average of 23% of the initially tested images were found to contain semantic leakage. The SLIM dataset includes 1,130 samples. Please see Table 12 for the entity count additional set.
Group
Subset Nume
Initial Images
Large Stale Filtering (% Initial)
Final & After Human Filtering of of Initial)
Anioaal Prize
1000
790 (7095)
328 (425) / 335))
Pairs
Antinal Prizs (lateraction)
1000
888 (895)
265 (30R) / 27%)
Animal Prirs (Interaction Style)
1000
828 (S315)
247 (30% / 2593
Triplets
Antmal Tripiets [FLUX]
500
361 (7255)
136((325 2255))
Fruit & Negetable Triplcs
500
414 (5355)
175 (42% / 3259)
Table 18: Subsets onSANA. Human-verified semantic leakage generated with SANA model. This table quantifies the number of images in each subset.
Group
Subset Name
Final # Images after Human Filtering
Animal Pairs (Classic)
91
Pairs
Animal Pairs (Interaction)
213
Animal Pairs (Interaction Style)
64
Total
368
Table 19: Subsets Prompt Templates and Examples: Each template defines the structure used to generate prompts in subset of SLIM.
Subset Name
Description
Example Prompt
Animal Pairs
Visually similar pairs (from the same broad family share similar traits)
"A CoM and horse in a farn"
Animal (Interaction)
perform
togecher, interaction
saccoon hugging oposaum"
or proximity
Animal Pairs (Interaction Style)
Entiiies perform actions togother, share interaction or proximity and
"A watercelor painting of cancing wita an opossum"
image style Visually similar triplets
Animal Triplets
"aconon, an opossum, and panda playing together" containing strawberry, tomato, and a cherry"
Vegetable Triplets
Visually similar triplets
Table 20: Prompts for generating the prompts in SLIM (with GPT-4o).
Prompt for Generation
Goal Subset
"From the provided 11st of animals, please create a 1ist of tuples. Rach tuple should contain pair of animals that have similar visual features. For example: (Cow, Borse), (Goat, Sheep)
pairs of similar animals
"A (animall) and a (animal2)"
Animal pairs prompt
"For each pair create, write unique, descriptive sentence. The sentence must include both animals from the pair, placing them together in a plausible scene."
Animal Pair (Interaction)
"Write unique, descriptive sentence for each pair of animals you create. The sentence must depict the two animals interacting closely within plausible scene."
Animal Pair (Interaction)
GPT-4o Animals List List of additional animals: "Aardvark, Armadillo, Baboon, Beaver, Bongo, Caracal, Cheetah, Chipmunk, Dugong, Elk, Ferret, Gazelle, Giraffe, Guinea pig, Jackal, Llama, Lynx,
39

---

Published as a conference paper at ICLR 2026
Meerkat, Mink, Mole, Moose, Platypus. Pronghorn, Quokka, Rabbit, Skunk, Sloth, Tapir, Tasmanian devil, Walrus, Weasel, Yak, Albatross, Blue jay, Cassowary, Chickadee, Cockatoo, Cormorant, Crane, Cuckoo, Dove, Egret, Falcon, Finch, Hawk, Heron, Ibis, Kingfisher. Kiwi, Kookaburra, Lark, Macaw, Magpie, Mallard, Nightingale, Osprey. Peacock, Pelican, Pheasant, Quail, Raven, Robin, Roadrunner, Stork, Toucan, Vulture, Warbler, Alligator, Anole, Basilisk, Boa, Bullfrog, Chameleon, Cobra, Crocodile, Frilled lizard, Gecko, Gila monster, Iguana, Komodo dragon, Monitor lizard, Newt, Pit viper, Python, Salamander, Skink, Snapping turtle, Terrapin, Toad, Angelfish, Archerfish, Barracuda, Bass, Blowfish, Carp. Catfish, Clownfish, Coelacanth, Cod, Cuttlefish, Eel, Flounder, Guppy. Halibut, Herring, Lionfish, Manta ray, Marlin, Monkfish, Moray eel, Nautilus, Piranha, Pufferfish, Salmon, Sawfish, Scorpionfish, Sturgeon, Swordfish, Tilapia, Trout, Tuna, Wrasse".
Fruits & Vegtabales List Fruits: Banana, Apple, Pear, Grapes, Orange, Kiwi, Watermelon, Pomegranate, Pincapple, Mango. Vegetables: Cucumber, Carrot, Capsicum, Onion, Potato. Lemon, Tomato, Radish, Bectroot, Cabbage, Lettuce, Spinach, Soybean, Cauliflower, Bell Pepper, Chilli Pepper, Turnip, Corn, Sweetcorn, Sweet Potato, Paprika, Jalapeño, Ginger, Garlic, Peas, Eggplant.
Style List In 3D render, In Futurism, Manga style, In a Pixar style, In a Van Gogh style, In a concept art, In cyberpunk aesthetic, In a digital painting, In a fantasy style, In a graffiti style, In minimalist line art, In neon glow effect, In a pixel art, In a pop art style, In a retro poster design, In a steampunk illustration, In surrealist painting, In a watercolor painting, In an Art Deco style, In an ink sketch, an oil painting,
G.2 AUTOMATIC (NOISY) FILTERING
'Raccoon clmmbng the tree winle possum walking on the ground"
Possum
Are there any Rascon featurs?
VLM
Yes
Racoon
CREATING CANDIDIATES MASKS
MATCHING MASKS
CLASSIFYING LEAKAGE
Figure 24: Noisy Automatic Filtering Pipeline Scheme
As illustrated in Figure 24 the automatic noisy filtering pipeline is composed of main stages. First, we generate segmentation masks for each entity and assign them accordingly. Then, we use a VLM (Gemini) to detect leakage between entity pairs by prompting it with questions such "This is an image of a cat. Does it contain features of a dog? Answer yes/no." In evaluating this pipeline, we observed non-negligible calse-positive rate, which motivated the need for a second-stage filtering process using human-guided filtering.
Pipeline Stages. The first stage involves generating specific mask for each entity in an image. The process begins with Grounding DINO (Ren et al. 2024) to detect entity bounding boxes, which are then refined into segmentation masks using the Segment Anything Model (SAM) (Kirillov et al. 2023). This procedure often produces multiple candidate masks for each entity. Trying increase the chance of an accurate match, we employ the Hungarian Algorithm. This method optimally assigns masks based on a cost matrix derived from CLIP similarity scores (Ramesh al.) 2022). which measure the similarity between each entity's 's textual token and its candidate masks. This matching step is necessary due to the presence leakage; when entities share similar features, they may be erroneously classified as the same object during segmentation. After generating the entity masks, the next step is to assess whether a leakage has occurred. This is achieved using Gemini, which evaluates each masked entity to determine if its visual features contain distinctive traits of another entity in the image. The model is prompted with a query of the form: "This is an image of an <opossum>. Does the image contain features unique to <raccoon>? Answer with yes/no only."
40

---

Published as a conference paper at ICLR 2026
H REPRODUCIBILITY AND RESOURCES
H.1
BASELINES
Table 21: Model Overview: Details of the baselines used in our experiments, including their language models, image generation type, and model size. DiT notes Diffusion Transformer.
Model
Language Model(s)
Image Generator Type
Size
Dakea FLUX-dev
T5-XXI, CLIP
DiT
11b
SANA RAG-Diffusion, RPF
Gemma
DiT
1.6b
T5-XXI.
DiT
lb
Qwen2vi-FLUX
Qwen2
DIT
7b
3DIS-FLUX
T5, CLIP
DIT
Table 22: Prompts of the prompt-based baselines.
Baseline
Prompt
Comments
instruction
[prompt]. Each entity main-
tains its distinct characteris-
tics: entity and entity 2. (prompt). (Entity descrip- tions).
Entity descrip- tion
where descriptions are generated by Gemini 1.5 pro: Describe the vi- sual appearance of a/an entity in sentence, focusing only its unique physical features such as face shape, colors, patterns, and body parts. Keep it short and descriptive. [Image) is the the original image by FL.UX-dev.
Image- condition instruction
The image should depict: (prompt). Make sure there no visual leakage between the animals, keep the rest of the image is. (Image).
Table 23: Technical details for the layout-based baselines.
Baseline
Layout Prior
Strategy
Layout Source
Image Gen-
erator
RPF
Chen
Bounding boxes
local prompts: the entity
LLM (Gemini 1.5 Flash) GPT-4o (originall))
FLUX- dev
2024a
the bounding box
Bounding boxes
In-bbox attention (re- ferred in the paper as
FLUX-dev
Chen et al.
and descriptions
2024b)
hard binding) inter- bhox attention (referred as soft refinement)
3DIS-FLUX
Bounding boxes & depth maps
Depth-may map conditioned generation
Stable Diffusion 2.0
FLUXI-
Zhoou al.
(depth map from bbox) 2023
depth-dev
2024
(Stan et al.
[Labs]
2024
41

---

Published as a conference paper at ICLR 2026
Table 24: Hyperparameters for the layout-based baselines used in our experiments.
Baseline
Parameter
Value
FLUX-dev steps
20
RPF
mask inject steps
10
base ratio
0.4
FLUX-dev steps
20
SR sw split ratio
0.5;0.5
RAG-Diffusion
HB replace
2.0
SR delta
1.0
Hard control steps
20
3DIS
FLUX-Deph-dev steps
20
SD steps
30
H.2 AUTOMATIC EVALUATION PROMPTS
System Prompt
Prompt(s)
Comments
Defines the overall role of the model as sensitive visual inspector.
"As experienced visual inspector, you will analyze images of entities and provide detailed insights on their visual differences and typicality. You are sensitive fine small details and differences."
Step 1.1: Knowledge-Basee Extraction
Prompt
Comments
Extracts visual differ- ences from the model's general knowledge, formatted as a simple comma-separated list. This serves as the first source of information.
prompt1 ["What the visual appearance differences between (entityl) and (entity2)? answer in a concise conma-separated list. For example neck length, head color, eyes shape, etc.")
Step 1.2: Image-Based Extraction
Prompt
Comments
Identifies visual dif- ferences by directly analyzing provided im- ages of the two entities. This provides second, evidence-based source of information.
prompt2 "Based on these images, what the visual appearance differences between (entity1) and (entity2)?" +
independent entities images
42

---

Published as a conference paper at ICLR 2026
Step 1.3: Integration
Prompt
Comments
Merges the text-based differences (from Step 1.1) and image-basee bagge-bsed ev- idence (from Step 1.2) into single, structured, and non-redundant bul- leted list.
prompt3 "List the key visual differences between (entityl) and (entity2) in bulleted list. Base your answer on synthesis of the 'Source and 'Source 2' descriptions provided below. Each bullet point should concisely compare a single visual feature. INSTRUCTIONS: 1. Synthesize Tources:Integrate the key points from BOTH the 'Soucee 1' and Soorce 2' descriptions. Do not list the same feature twice create redundant points.
2. Highlight Obvious Differences: If either the 'Source 1' or 'Source 2' descriptions explicitly highlight certain features as particularly noticeable or obvious, ensure these
differences are prominently featured in your 1ist. 3. Format: Start each bullet point with bolded feature name followed by a colon (e.g., Coat:). 4. Content Structure:After the feature name, first write (entityl: :followed by its description. Then, on the same line, write (fotloyy):followwed by its description. Keep descriptions brief.
5. Focus: The list must only contain observable, visual
ifffrrences.xAMPI...
Tail Feathers: Peacock: Long and iridescent. Peahen: Short and brown.
Coat: Zebra: Black and white stripes.
Horse:
Solid or patched color. Facial
Markings: Red Panda: White patches
muzzle and eyes. Raccoon: Black
mask across eyes. Leg Color: Flamingo:
Pink. American Coot: Grey black.
Covering: Chicken: Feathers. Cat
Fur. Tail: Red Squirrel: Long and
bushy. Pig: short and hairless.
DESCRIPTIONS FOR (entityl) AND (entity2): Source 1: (stepl prompt1 output). Source (stepl prompt2 output)" )
43

---

Published as a conference paper at ICLR 2026
Step 2: Typicality (for entity in entities)
Prompt(s)
Comments
Evaluates how typical each entity appears in the clean vs. baseline image, ignoring out-of- frame features. Used per entity.
prompt4 veGiven the fffrrnncss
between (text_entitiest How visually typical (entity) in this image? (Ignore out-of- frame features.)") + clean image
prompt5 ("Given the differences between (text_entitiesi) How visually typical (entity) in this image? Iqnore out-of-frame features.)") + baseline image
Step 3: Ranking (images random order)
Prompt(s)
Comments
prompt ven the independent. textual typicality inspection of each animal in each image and the images, overall, how visually typical the (text_entities) in the second image rather in the first image? (Ignore out-of-frame features.) Notice that both of the animals should appear in each image. If one image shows both animals, even if one looks unusual, it will be preferred over an image where one of the animals is missing. First explain, think step by step. Finally, rank the overall relative typicality: Rank: lmin (first image with minor prefrence), 1maj (first image with major prefrence), 2min (second image with minor prefrence), 2maj (second image with major prefrence), or (equally typical both). First Image Inspection: (prompt 4 answer for entity and entity 2 Second Image Inspection: (prompt answer for entity 1 and entity 2 First Image: (clean image), Second Image: (baseline image) ")
44


Reviews:
[{"review_id": "e7D0oxYM4U", "reviewer": "Reviewer_bdJX", "summary": "The paper proposes an optimisation-free, lightweight inference time control approach, DeLeaker, which reduces leakage by directly intervening on the model's attention maps. The pipeline dynamically adjusts the attention map weights to suppress cross-entity interactions while strengthening the identity of each entity. The authors also propose a FLUX-generated dataset of semantic leakage consisting of 1,130 images. The DeLeaker pipeline achieves the highest mitigation rate of Major = 46.07% and Minor = 9.76%, with the lowest degradation rates of Major = 12.98% and Minor = 5.83%.", "questions": "I require some clarification from the authors in regards to the methodology:\n\n- The exact diffusion step range and sensitivity of Beta1, Beta2, and alpha coefficients to scene complexity are briefly mentioned but not fully justified; a stability analysis across prompt types would help.\n\n- It would also help to clarify whether DeLeaker’s interventions introduce latency overhead or computational trade-offs compared to baseline inference.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The paper writing was clear and easy to follow. I have 2 strengths to highlight:\n\n- Systematic evaluation pipeline and dataset: The creation of SLIM, the first benchmark explicitly targeting semantic leakage, and its associated automatic evaluation framework represent strong empirical contributions. \n- Novel inference-time attention intervention: By distinguishing between cross-entity suppression and self-identity strengthening, it achieves a practical balance between leakage mitigation and fidelity preservation", "weaknesses": "I have mainly one weakness to highlight in the paper:\n\n-Evaluation dependence on external VLMs: The automatic evaluation framework depends heavily on Gemini outputs and textual reasoning to infer visual differences. While the authors validate it with a human study, this dependence could bias results due to VLM limitations in visual grounding and typicality judgments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0eJzunUJvu", "reviewer": "Reviewer_xvBT", "summary": "This paper proposes a training-free, guidance-free inference-time algorithm for mitigating entity-level semantic leakage in text-to-image (T2I) diffusion models.\n\nThe method, DeLeaker, constructs per-entity masks from the model’s attention maps, suppresses cross-entity attention to reduce unintended feature transfer, and strengthens self-identity through targeted reweighting of text–image attention.\n\nThe authors introduce a VLM-based automatic evaluation pipeline and demonstrate that DeLeaker consistently outperforms all baselines across both automatic and human evaluations.", "questions": "* The method seems potentially sensitive to **token neglect**, i.e., cases where an entity token receives incomplete or biased attention coverage. Is the attention quality in models like FLUX sufficiently strong that this is rarely an issue in practice?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "- **Simple and Effective**:\nThe method is conceptually simple yet highly effective. Its reliance on a single hyperparameter ($\\beta_1$) for adaptive attention thresholding is an elegant design choice that highlights its efficiency and robustness. This kind of minimalistic control mechanism is one of the method’s most appealing aspects.", "weaknesses": "* **Entity Neglection (minor).**\n  A potential limitation arises when the base model’s attention maps fail to properly attend to certain entities.\n  For instance, if an entity token receives little or no attention over image patches (“token neglection”), DeLeaker may entirely suppress or ignore that entity, as the method operates strictly on existing attention activations.\n  Consequently, its effectiveness strongly depends on the *attention quality* of the underlying base model (e.g., FLUX). In corner cases with poor attention calibration, this could produce undesirable omissions.\n\n* **Fit to Venue (minor).**\n  While the paper is solidly executed, it may be more naturally aligned with the *computer vision* community (e.g., CVPR), where readers are more accustomed to attention-based control in generative models.\n  That said, as ML and vision research continue to converge, this distinction is becoming less rigid, so I do not consider it a major concern.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "k0Qy4EpJqb", "reviewer": "Reviewer_UoR2", "summary": "This paper presents DeLeaker, an inference-time methodology designed to specifically handle cases of semantic leakage in text-to-image models. By directly injecting into the attention mechanism of the underlying generation model, DeLeaker is able to perform light-weight inference-time adjustments which results in more robustly generated images. \n\nIn addition to DeLeaker, the paper also presents both a new SLIM dataset, which is specifically curated to evaluate semantic leakage. Separately the authors also provide a set of evaluation pipeline with justification on its validity based on human assessments.", "questions": "As noted in the weaknesses, the reviewer’s main concern remains the reliance on attention maps for localization. It would be helpful if the authors could share any additional thoughts or clarifications on this point.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "The reviewer notes the following strengths:\n- The paper is well written with clearly explained motivation for all methods & datasets.\n- The presented DeLeaker method is both intuitive and showcases strong performance under human assessment.\n- The SLIM dataset marks a very relevant contribution for all future research into semantic leakage.\n- Human evaluation is presented showcasing both clear strengths in DeLeaker and justification for the sanity of the automatic evaluations.", "weaknesses": "The reviewer notes the following Weaknesses:\n- The reviewer finds some concern with the reliance on attention maps to reliably localize entities in the DeLeaker method. In particular, the reviewer would like to see specific evaluation on cases where attention miss-localization occurs.\n- The SLIM dataset could also be expanded, given semantic groupings are limited to animals and fruits.\n- The paper contains multiple components (DeLeaker, SLIM, evaluation pipeline) that sometimes overwhelms & detract from its core contributions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HJ6fqOBEiq", "reviewer": "Reviewer_pKUr", "summary": "In multiple objects generation tasks, it is well known that content or style leakage occasionally occurs. To address this issue, the proposed paper mitigates leakage in a training-free manner by suppressing or strengthening the model’s attention maps. Furthermore, to evaluate the effectiveness of this mitigation, the authors propose the SLIM Dataset and an automatic evaluation framework. The evaluation framework leverages a vision-language model (VLM) to extract differences between images and uses these as key visual difference metrics.", "questions": "- The reviewer concerns if the assumption to judge high attention values as content leakage is too strong. Is there any evidence supporting this claim?\n  - Does the method still perform well in scenarios with a larger number of objects? What if two objects are the same animal while the other is not?\n- As mentioned in the Weakness section, how can it be demonstrated that the proposed evaluation method is superior to a simpler VLM-based querying approach?\n- The previous works performance seems too bad even though they also tackle the same problem. For instance, in the case of RAG-Diffusion, adding some rough location (next to, left/right) may produce much higher-quality results.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The method does not require any additional mask nor bounding box, and it can be applied as a training-free manner, which is highly practical. This approach seems general enough to be applied to other diffusion architectures that use attention layers.\n- Proposing the SLIM dataset to systematically evaluate the content leakage problem, which has not been thoroughly studied before, and using a VLM-based automatic evaluation framework is a creative and meaningful contribution.\n- The method achieves significantly better results than previous approaches in both automatic evaluation and human preference studies.", "weaknesses": "- Although the method appears simple yet effective, many of its design choices seem heuristic. For example, the assumption that high attention values correspond to unwanted semantic transfer lacks strong theoretical justification and appears to be chosen empirically. Similarly, the thresholds and coefficients that determine this behavior are treated as hyper-parameters.\n- There could be cases where high attention values represent meaningful interactions rather than content leakage. From the visualized results, many images seem to lack strong interactions between objects. More results showing related actions between objects (e.g., playing a game together, sharing food) would strengthen the argument.\n- Experiments and comparisons related to the automatic evaluation method are insufficient. For example, how does the proposed evaluation differ from a simpler baseline, such as directly querying a VLM about whether content leakage occurred in the target image?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)