Title: Training-Free Safe Text Embedding Guidance for Text-to-Image Diffusion Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: diffusion model

safe generation
Abstract: Text-to-image models have recently made significant advances in generating realistic and semantically coherent images, driven by advanced diffusion models and large-scale web-crawled datasets. However, these datasets often contain inappropriate or biased content, raising concerns about the generation of harmful outputs when provided with malicious text prompts. We propose Safe Text embedding Guidance (STG), a training-free approach to improve the safety of diffusion models by guiding the text embeddings during sampling. STG adjusts the text embeddings based on a safety function evaluated on the expected final denoised image, allowing the model to generate safer outputs without additional training. Theoretically, we show that STG aligns the underlying model distribution with safety constraints, thereby achieving safer outputs while minimally affecting generation quality. Experiments on various safety scenarios, including nudity, violence, and artist-style removal, show that STG consistently outperforms both training-based and training-free baselines in removing unsafe content while preserving the core semantic intent of input prompts. Our code is available at https://github.com/aailab-kaist/STG.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Safe Text Embedding guidance (STG) as a safeguard mechanism against image outputs that involve undesired or inappropriate content, that is subjective to the user. The proposed method extends Safe Data Guidance (SDG), that targets the diffusion model weights in its optimization objective by only targeting the text embedding that is going to be fed to the model. Given a guidance function $g$ that assesses the image outputs $x_0$ based the desired image behavior, STG applies the optimization objective that SDG defines as updates to the text embedding representation that guides the generation. Addressing the fact that the updates to the diffusion model can result in disturbed model behavior, STG only targets the embeddings and claim to preserve the generation properties. Experiments on concepts such as nudity, violence demonstrate the effectiveness of the method across competing approaches.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- The paper proposes an extension of SDG that promises improved preservation properties of the properties of the model.\n- The proposed method demonstrates its effectiveness in preserving model behavior while preventing the generation of the undesired concepts (e.g. nudity)\n- The paper is well experimented, where the motivation is clear as well as the quantitative improvements.\n- Technical details are sufficiently explained, where the claims are coupled with proofs.\n\n**Weaknesses**\n- The GPU consumption of the method is significant which limits the applicability of the method to larger models.\n- The method addresses the source of undesired concepts to be determined in the embedding space. This narrows the applicability of the method to tasks such as bias removal, that is also related with the cross-attention and self-attention weights.\n-  The proposed method serves as an incremental update on top of SDG. While it is significant that the model properties are preserved better, as only the embedding space is targeted, the technical novelty of the work is questionable and can be considered as an incremental update on top of the previous methods.\n- The method requires updates on the text embeddings fed into the generative model. Does the method generalize to approaches that uses more than one text embeddings for generation, as such approaches are more frequently used (FLUX, SDXL, SD3)?\n\nQUESTIONS:\n- Does the method generalize to generative models that uses multiple text encoders? This is an important concern as it determines the types of generative models that the proposed approach can be applied to.\n- Does the proposed method be applied to tasks such as bias mitigation? In addition to unpleasant concepts like violent content and nudity, biased representations such as gender imbalances across occupations is also a problem that safety methods address (like UCE). It is an important clarification that if STG can be extended to such tasks.\n\nLIMITATIONS:\n- The paper does not have an explicit discussion on the limitations. However, since the work explicitly addresses the embedding space rather than the overall model, a limitations section on the concepts that can be mitigated and which cannot be mitigated would benefit the paper, to determine its applicability. The overall societal impact of the paper is positive, where discussions on the broader impact is provided in the supplementary material.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

comments: SUMMARY:
The paper proposes a training-free method for text-to-image diffusion models and introduces safe text embedding guidance (STG) to dynamically adjust the text embedding during sampling to suppress unsafe content. At each diffusion step, STG computes the safety score on the expected denoised image and uses the first-order Taylor approximation to show the equivalent to injecting a “safe guidance” term into the score function. Extensive experiments demonstrate that STG consistently outperforms both training-based and training-free baselines.

STRENGTHS AND WEAKNESSES:
Strengths:
1. Zero-training operates entirely at inference time, avoiding costly retraining or curated datasets. 
2. Theoretical derivation via Tweedie’s formula and explicit decomposition into original score + safe guidance provides clear interpretability.

Weakness:
1. The method effectiveness depends on the accuracy and bias of the external classifier.
2. The gradient computations and safety evaluations at each sampling step reduces the efficiency.
3. What about the generalization on other models?

QUESTIONS:
1. What about the safety performance on more categories?
2. What about the generalization on other models?

LIMITATIONS:
See the above weakness.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nTo address the problem of unsafe and undesired generations of T2I models, the paper proposes a training-free guidance approach that steers a pre-trained model using a signal from an external safety classifier. Specifically, the method builds on the Universal Guidance framework and defines a time-dependent safety function using classifier feedback over intermediate denoised images. The core idea is to adjust the text embedding at each diffusion step to nudge the generation toward safer outputs. The authors evaluate their approach on three tasks, namely nudity, violence, and artist-style removal on Stable Diffusion v1.4, and compare against both training-free and training-based safety methods.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n- The proposed method is well-motivated and clearly introduced, offering a lightweight solution that does not require model fine-tuning.\n- Comprehensive comparisons to current state-of-the-art training-free (e.g., SLD, SAFREE) and training-based (e.g., ESD, DUO) methods are provided.\n- Ablations analyze the impact of key hyperparameters such as the step ratio (ρ) and threshold (τ).\n- Further, the authors present that their approach can be combined with training-based methods, resulting in further enhanced safety.\n\n**Weaknesses**\n\n- Unlike SLD or SAFREE, which make use of textual representations of undesired content to guide the safe generation, the proposed method requires an external classifier, reducing its generality and flexibility. Unfortunately, this dependency is not discussed as a limitation.\n\n- Overall, the limitations of the method, besides computational overhead, are not well addressed.\n\n- The experimental setup lacks clarity. While the authors state that the strength of guidance is controlled via the hyperparameters ρ and τ, the specific values used in the experiments and how they were selected are not detailed. Similarly, hyperparameter settings for baseline methods are not well described. For instance, it is only mentioned in the appendix that the SLD variant SLD-M is used, which is the weakest configuration the original paper reports. Further reported DSR values for SAFREE do not match the original reported values. Specifically, the original SAFREE paper reports an ASR (Attack Success Rate) of 0.114 on the Ring-A-Bell benchmark, while the present paper reports a DSR (1-ASR) of 0.36.\n\n- Unclear suitability of evaluation metrics: For nudity, the same classifier is used both to guide generation and to evaluate output safety, raising questions about metric bias. For violence, GPT-4o is used, but its reliability in detecting violent content is unclear and not further investigated.\n\nQUESTIONS:\n- In Figure 3, several methods (e.g., SLD, SAFREE, STG) are represented by multiple data points. Could you clarify what these points correspond to? Do they reflect different hyperparameter settings (τ, ρ), in case of STG, or variants in case of SLD (e.g., SLD-M, SLD-S, SLD-Max)?\n- Can you explain the gap in reported values for SAFREE between your results and the original paper (e.g., ASR of 0.114 vs. DSR of 0.36)? \n- For the violence detection task, could you elaborate on why GPT-4o was chosen and whether its performance was validated in this specific context?\n\nLIMITATIONS:\nLimited discussion. Next to the computational overhead, compared to other approaches, the introduced methods rely on \"safety functions\" which may reduce flexibility.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the safety concerns of text-to-image (T2I) diffusion models, which are often trained on large-scale web-crawled datasets and thus susceptible to generating biased or harmful content, especially when prompted with malicious inputs. To mitigate this, the authors propose Safe Text Embedding Guidance (STG), a training-free method that adjusts text embeddings at inference time using a safety function. Theoretically, the method aligns the model’s output distribution with safety constraints while minimizing degradation in image quality. Empirical results demonstrate that STG outperforms both training-based and training-free baselines across various safety scenarios, showing strong performance in terms of safety, alignment, and generation quality.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1) The paper is well-structured and clearly written, making it accessible even to readers unfamiliar with safety in generative models.\n2) The motivation is well-grounded, and the proposed method is logically and theoretically supported.\n3) Despite being training-free, STG achieves competitive or superior performance compared to more complex training-based methods, which is a notable contribution to the community.\n4) The experimental section is comprehensive, including ablations and hyperparameter sensitivity analyses that strengthen the empirical claims.\n\nWeaknesses:\n\n1) The scalability of the method is somewhat unclear. Most experiments are conducted on relatively outdated settings (e.g., Stable Diffusion 1.4 with DDIM). Although the appendix includes results on PixArt-α and DPM-Solver, these are still not state-of-the-art.\n2) While the paper acknowledges its limitations, the increased sampling time introduced by STG is a significant drawback.\n\nQUESTIONS:\n1) The proposed method is closely tied to the denoising process. How sensitive is STG to the choice of sampler? For example, would it behave differently under schedulers?\n2) Is STG compatible with recent fast-generation methods such as Latent Consistency Models (LCMs)? If not, what are the main challenges in adapting it to such frameworks?\n3) Most experiments are conducted on older models and samplers. Could the authors provide more evidence or discussion on how STG would scale to more recent architectures and pipelines?\n4) Table 4 appears to contain a directional error in the PP column (arrow direction). Could the authors clarify or correct this?\n5) While the paper acknowledges the increased sampling time, this remains a critical limitation. Are there any strategies to mitigate this cost except for update frequency?\nIf the authors can provide convincing responses to the concerns above, especially regarding scalability to modern architectures and compatibility with fast generation methods, I would be open to increasing my score.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-03"}