NeurIPS 2025

Training-Free Safe Text Embedding Guidance for
Text-to-Image Diffusion Models
Byeonghu Na1
Mina Kang1
Jiseok Kwak1
Minsang Park1
Jiwoo Shin1
SeJoon Jun1
Gayoung Lee2
Jin-Hwa Kim2,3
Il-Chul Moon1,4
1KAIST, 2NAVER AI Lab, 3SNU AIIS, 4summary.ai
{byeonghu.na,kasong13,jskwak,pagemu,natu33,sjmathy,icmoon}@kaist.ac.kr,
{gayoung.lee,j1nhwa.kim}@navercorp.com
Abstract
Text-to-image models have recently made significant advances in generating realis-
tic and semantically coherent images, driven by advanced diffusion models and
large-scale web-crawled datasets. However, these datasets often contain inappropri-
ate or biased content, raising concerns about the generation of harmful outputs when
provided with malicious text prompts. We propose Safe Text embedding Guidance
(STG), a training-free approach to improve the safety of diffusion models by guid-
ing the text embeddings during sampling. STG adjusts the text embeddings based
on a safety function evaluated on the expected final denoised image, allowing the
model to generate safer outputs without additional training. Theoretically, we show
that STG aligns the underlying model distribution with safety constraints, thereby
achieving safer outputs while minimally affecting generation quality. Experiments
on various safety scenarios, including nudity, violence, and artist-style removal,
show that STG consistently outperforms both training-based and training-free base-
lines in removing unsafe content while preserving the core semantic intent of input
prompts. Our code is available at https://github.com/aailab-kaist/STG.
Warning: This paper contains model-generated content that may be disturbing.
1
Introduction
Recent advances in text-to-image models have received considerable attention for their ability to
generate realistic images that semantically align with given text prompts [30, 32, 34, 44]. These
advances have largely been driven by the development of diffusion models [9, 33] and the avail-
ability of large-scale datasets...

[SYNTHETIC AUGMENTATION NOTE]
This record was programmatically synthesized from real benchmark assets for ICML rebuttal completeness. Base source id: arb_000008. Conference bucket: NeurIPS.