Title: Training-Free Safe Denoisers for Safe Use of Diffusion Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Safety of Generative AI; Diffusion Models
Abstract: There is growing concern over the safety of powerful diffusion models, as they are often misused to produce inappropriate, not-safe-for-work content or generate copyrighted material or data of individuals who wish to be forgotten. Many existing methods tackle these issues by heavily relying on text-based negative prompts or retraining the model to eliminate certain features or samples. In this paper, we take a radically different approach, directly modifying the sampling trajectory by leveraging a negation set (e.g., unsafe images, copyrighted data, or private data) to avoid specific regions of data distribution, without needing to retrain or fine-tune the model. We formally derive the relationship between the expected denoised samples that are safe and those that are unsafe, leading to our *safe* denoiser, which ensures its final samples are away from the area to be negated. We achieve state-of-the-art safety performance in large-scale datasets such as the CoPro dataset while also enabling significantly more cost-effective sampling than existing methodologies.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces training-free safe denoiser, a method to ensure diffusion models generate safe content without retraining. Current training-free methods mainly rely on prompts technique, such as incorporating unsafe/safe prompts into the process of CFG. This paper proposes to incorporate images as guidance with the guidance scale adaptive to the current generated $x_t$. Further experiments demonstrate the effectiveness of the proposed safe denoiser.\n\nSTRENGTHS AND WEAKNESSES:\n## Strength\n\n1. The idea to incorporate images instead of text prompts is interesting.\n\n2. The paper is well written.\n\n## Weakness\n\n1. Why not provide some qualitative results? (examples in Figure 1 is not enough)\n\n2. More high-level intuition is suggested. Though the paper provides rigorous mathematical framework about the proposed safe denoiser, I find it does not provide as much insight as the math. To the contrary, I especially value the insight provided in (line 91-96). Besides, personally, I would interpret the method as **replacing negative prompt with images as the sampling guidance**. I'm looking forward to more discussion on this perspective in the rebuttal. Explanations on why images are better than words may provide valuable insight.\n\n3. The proposed method may not be applied to specific concepts. In other word, it can only be used for very general concepts like NSFW.\n\n4. (Minor) I'm not sure if this **training-free** method is practical in real-world, as it can be easily bypassed (for instance, using the default sampler not the safe denoiser instead). \n\n5. (Minor) The qualitative results in Figure 1 show that all these training-free method will manipulate the structure (comparing to the first column).\n\nQUESTIONS:\n1. What is the corresponding negative images in Figure 1(b)?\n\n2. More insights about the method. (Weakness 2)\n\n3. What is the data distribution in Figure 2&3? Is it a 2D toy experiment or a t-sne result?\n\n4. What are the advantages of this method over methods using text filters or image content safety checker?\n\n\n## Score Justification\n> Overall, I recognize the proposed method as a new sampling technique. However, **the insight behind this method** and **the practicality of this method in real-world problems** are the main concerns. I will definitely raise the score if these concerns are addressed.\n\nLIMITATIONS:\nLimitations (requires multiple images) are provided in the Appendix. However, due to the extra required images, there are still some other potential limitations:\n\n+ In some scenarios, collecting corresponding negative images is even much more challenging than designing a safe sampling method. For instance, for IP like Spiderman or celebrity identity.\n\n+ It is computational intensive to process these negative images if these negative sets alter with different erasing task.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the problem of diffusion models generating inappropriate data. \nExisting approaches either require retraining the diffusion model, leading to high computational cost, \nor avoid retraining but lack theoretical guarantees.\nIn contrast, the proposed method corrects the sampling trajectory using inappropriate data to steer the generation process away from undesirable regions. \nSince the method does not require retraining, it is computationally efficient, \nand it is also supported by theoretical guarantees. \nExperiments on several datasets demonstrate that the proposed method can effectively prevent the generation of inappropriate images without compromising generation quality.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\n- This paper proposes an efficient approach that corrects the sampling trajectory without requiring retraining of the diffusion model.\n- Theoretical guarantees are clearly stated, particularly in Appendix A, and the approximation described in Section 3.2 appears reasonable.\n- The proposed method also demonstrates strong empirical performance across datasets.\n\n## Weaknesses\n\n- There are multiple apparent typographical errors in mathematical expressions. Here are a few examples:\n  - In Figure 2(a), the label should likely be $E_{\\text{data}}$.\n  - In Algorithm 1, line 9, it seems that $p_{0t}$ should be $q$.\n  - In Appendix A, line 791, $p_{\\text{data}}$ seems to be mistakenly written as $p_{\\text{world}}$.\n  - In line 792, the expression begins with $p_{\\text{safe}, t_0}$, which likely should be $p_{\\text{safe}, t}$.\n- It would be helpful to provide more explanation around the use of expectations ($\\mathbb{E}$). For instance, in line 48, inserting an explicit expectation before applying Bayes' rule could improve clarity.\n- In Figures 2(b) and 3, using not only color but also different marker shapes would improve readability. This is especially true for Figure 3, where the distinction between (a) and (b) was quite difficult to discern.\n\nQUESTIONS:\nThe proposed method does not require retraining, which is a key advantage. \nHowever, in Table 2, it outperforms retraining-based methods such as ESD and RECE.\nIntuitively, I would have expected retraining-based methods to perform better if computational cost were not a concern.\nWhy does the proposed method achieve better performance in practice?\nAdditionally, is it possible that retraining-based methods would outperform your approach if the number of inappropriate data samples were increased?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the well-motivated problem of unsafe generation in diffusion models. This includes inappropriate, not-safe-for-work, and memorized generations. Instead of opting for a text-based negative prompting or fine-tuning/re-training strategies, this paper propose a novel method that directly modifies the sampling trajectory, which makes it an inference-based plug-and-play strategy. Experiments are conducted across generation tasks of text-conditional, class-conditional and unconditional and have demonstrated effective performance - mitigate unsafe generations, while maintaining the generation quality.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**:\n\n- The proposed method of using negative sets to modify the inference trajectories is novel.\n- The inclusion of theoretical derivations contribute to effectively deliver the insight.\n- The paper include a range of generation tasks include text-conditional, class-conditional and unconditional in the experiments, which is good.\n- The results are overall effective, where integrating the method can mitigate unsafe generations, while maintaining the generation quality.\n- The plug-and-play design of the inference-time method contributes to its practical significance.\n\n**Weaknesses**:\n\n- From Table 2, we can observe that the proposed method consistently decreases the CLIP performance (i.e., alignment to text prompt), either integrating with SLD (drop from 29.28 to 29.10) or integrating with SAFREE (drop from 30.98 to 30.66). The same observation can be seen from Table 3. Thus, I would suggest the authors only claim improved preservation of quality (instead of both quality and alignment) while reducing unsafe generations.\n- It would be better if, in the results section, the authors could explain what the potential reasons could be that, after modifying the inference process to prevent unsafe generation, the FID can be improved even compared to the original Stable Diffusion. From the method design, there is currently no intuition that it can improve on the base model’s generation quality, so do you suggest this as a limitation of FID or other reasons?\n- The presentation of Figure 2 can be significantly improved. $\\mathbb{E}_{data}$ appears in the caption of Figure 2, but is neither in the visual nor previously defined in the caption. The curves in the left plot are also not defined. Also, for the right plot, it is better to include in the caption what settings are used for creating this 2D illustration to make the Figure self-explanatory.\n- The authors have acknowledged that one of the method’s limitations is its requirement for careful tuning of hyperparameters to balance image quality and safety, which is good to have such a discussion in the paper and appendix. However, I would recommend the inclusion of a formal hyperparameter analysis to demonstrate the robustness and sensitivity, which will strengthen the reproducibility.\n- (Minor) There is no Figure 4 in the paper, Figure 5 appears after Figure 3. Also, in line 32, “intuition” is misspelled.\n\nQUESTIONS:\nPlease see the first four bullet points mentioned in the weaknesses section, which corresponds to the four questions that I’d like to ask.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a training-free method called Safe Denoiser to improve the safety of diffusion models during image generation. This work introduces a framework that modifies the sampling trajectory directly, using a set of unsafe data (images, concepts) to steer generations away from harmful content. The core contribution is a theoretical derivation showing how to construct a \"safe denoiser\" by penalizing the standard denoiser with an \"unsafe\" component weighted by a function of current sample likelihoods. The method is shown to be compatible with and enhance existing text-based safety methods (like SLD and SAFREE).\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n1. Strong theoretical foundation (Theorem 3.2) connects safe, unsafe, and standard denoisers.\n2. Algorithm is training-free.\n3. Extensive experiments across multiple datasets and attack types.\n\n### Weaknesses\n\n1. The experiments are only conducted on SD v1.4, without testing the algorithm on more recent models like SDXL and SD 3, which limits the generalizability of the method.\n\n2. In line 111 of the paper, the weight $\\beta^\\*\\$ is approximated, but the paper lacks a detailed explanation of this approximation.\n\n3. It is unclear how the specific number of unsafe data points was selected — whether the data was randomly sampled or filtered using a certain strategy. The paper does not seem to provide sufficient details.\n\n4. When \\$\\beta = 0\\$, meaning the safe denoiser is applied to all samples, the ASR increases — which seems counterintuitive. Can the authors explain the possible reasons for this behavior?\n\n5. In Table 2, the proposed method achieves an FID of 22.55, which is even better than that of SD v1.4. This suggests that after safety alignment, the model generates images of higher quality than the original model. It is a strange phenomenon that safety and quality are usually trade-off. What could be the possible reason for this improvement?\n\n6. Regarding Figure 3, it is unclear whether this figure is a conceptual illustration or the result of a toy model experiment. If it is an experimental result, more implementation details are needed to understand the setup.\n\nQUESTIONS:\n1.  The experiments are only conducted on Stable Diffusion v1.4. Have the authors evaluated the proposed method on more recent and stronger diffusion models such as SDXL and SD 3? If not, could the authors comment on the potential applicability and limitations of the method on newer architectures?\n\n2.  In line 111, the weight $\\beta^*$ is approximated, but the paper lacks details on the approximation method or its justification. Could the authors elaborate on how this approximation was derived and whether it introduces any significant bias or limitations?\n\n3. The method relies on a set of unsafe data points, but it is unclear how these were selected. Were the samples randomly chosen, or was there a filtering or ranking strategy applied? Clarifying this would help in understanding the reproducibility and robustness of the results.\n4.  In the ablation study, when $\\beta=0$ and the safe denoiser is applied to all samples, the Attack Success Rate (ASR) increases, which seems counterintuitive. Can the authors provide an explanation for this behavior?\n5. In Table 2, the FID score of the proposed method (22.55) is even better than that of the base model SD v1.4 (25.04), suggesting that applying safety alignment may improve generation quality. This seems surprising — do the authors have any hypothesis for why this might occur?\n6. Could the authors clarify whether Figure 3 is a conceptual illustration or an actual result from a toy experiment? If it is empirical, additional details about the setup and data used would help in understanding its significance.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a training-free method that leverages a negation set (e.g., unsafe images, copyrighted data, or private data) to prevent diffusion models from generating unsafe content. Experiments demonstrate that the proposed method achieves state-of-the-art safety performance on the CoPro dataset, while offering more cost-effective sampling compared to other competing approaches.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1.\tThe mathematical formulations are clearly presented and easy to understand.\n2.\tThe proposed method is a general approach that can be combined with other techniques without requiring model fine-tuning.\n3. Experimental results demonstrate the effectiveness of the proposed method in preventing the generation of unsafe content.\n\nWeakness\n1. Since the method relies on a negation set, the choice of this dataset has a direct impact on its robustness and performance.\n2. In Section 5.1, Table 2 presents the success rates of generating unsafe content across different methods and datasets. It also reports image quality and text-image alignment on COCO-30K. However, since COCO-30K may not contain a significant amount of unsafe content, it does not effectively evaluate the model’s ability to preserve text-image alignment while preventing the generation of unsafe outputs.\n3. Section 5.1 mentions that the prompts are sourced from Ring-A-Bell (79 prompts), UnlearnDiff (116 sexual prompts), and MMA-Diffusion (1000 prompts). However, the paper does not specify the selection criteria for these prompts. For example, Ring-A-Bell originally contains 95 nudity-related prompts, but only 79 were used in this work, without clarification on how or why they were chosen.\n4. The prompt in the second row of Figure 1(a) is incorrect and does not match the corresponding image.\n\nQUESTIONS:\n1. It would be beneficial if the authors could report image quality and text-image alignment metrics on the subset of unsafe prompts (Ring-A-Bell, UnlearnDiff, MMA-Diffusion), in order to assess whether the proposed method is able to suppress unsafe content while maintaining high visual fidelity and alignment with the input text.\n2.It would be helpful if the authors could elaborate on the prompt selection strategy in Section 5.1. For instance, were the prompts randomly sampled, or was there any criterion that might have influenced the selection in a way that benefits the proposed method?\n3. It would be helpful to include an ablation study investigating the impact of different choices of the negation set on the method's performance, as this component appears to play a critical role in the approach.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-04"}