When safety conflicts: resolving multi-category harmful conflicts in text-to-image diffusion models with adaptive safety guidance

Existing multi-category safety-guidance synthesizes incompatible safety directions into one, which the authors call harmful conflict.

• Scenario: Open-source T2I diffusion (the paper cites Stable Diffusion, Hunyuan-DiT) can generate images of hate, sex, violence, illegal activity, etc. The authors believe that accessibility combined with generation capability increases concerns about harmful content.
• Existing practice: safety-guidance represented by SLD compares prompt guidance with guidance from predefined harmful keywords, pushing generation away from the harmful zone without changing weights. For multiple categories, all keywords are typically concatenated to derive a single safety direction. The authors believe this assumes all categories of harm can be suppressed together.
• Observation: Each category has its own, often incompatible, safety direction. Direction inconsistency corresponds to Safety Misalignment Degradation; aggregation canceling each other out corresponds to Safety Averaging Degradation. In Table 1 (SLD, baseline SD 1.5), for a sexual prompt, no guidance is 67.2%, matched sexual content is 3.2%, mismatched hate is 72.4%, and all category is 48.8%. In the same table, for a violence prompt, all mismatched categories are below the baseline 52.8%. The table does not state the dataset or sample size.
• This paper's method: Training-free CASG. CaCI selects the most aligned category based on the current generation state, and CrGA corrects only along that category, and can be attached to SLD (latent) and SAFREE (text). The authors claim this is the first plug-and-play framework of its kind.
• Threat model:
  • Outcome to suppress: Multi-category harmful images triggered by prompts; the authors also care about prompt semantics and benign generation.
  • Victim system: Denoising in T2I diffusion. Defense is in latent or text-embedding, without modifying model weights.
  • Input: The paper does not formalize an attacker. The written inputs are user prompts, and predefined keywords such as hate, harassment, violence, self-harm, sexual content, shocking images, illegal activities, etc.
  • Knowledge: The paper does not state white-box or black-box. CASG uses per-step noise prediction or embedding projection, without training an additional classifier or calling external APIs.

Section 2 of the paper divides related work into diffusion models and safety mechanisms; the introduction uses SLD to illustrate multi-category aggregation. The authors separate this work from safety-guidance that "concatenates keywords."

Text-to-image diffusion

• DDPM (Ho et al., 2020): adds Gaussian noise in the forward process and gradually denoises in the reverse process, learning the data distribution with a Markov chain.
• Latent Diffusion / Stable Diffusion (Rombach et al., 2022): trains diffusion in a low-dimensional latent space and then reconstructs the image with a decoder. The paper states this reduces computational complexity while maintaining generation quality.

Filtering and model editing

• Filtering methods (Rando et al., 2022): remove unsafe concepts from prompt embeddings (pre-hoc) or generated content (post-hoc). The paper states they are effective in controlled settings but remain affected by jailbreaks that exploit filtering weaknesses.
• ESD, UCE, RECE (Gandikota et al., 2023, 2024; Gong et al., 2024): modify weights via fine-tuning or unlearning-based concept erasure. The paper states they may reduce image quality in both safe and unsafe domains.

Safety-guidance

• SLD (Schramowski et al., 2023): uses directional guidance in latent space to move away from the harmful zone.
• SAFREE (Yoon et al., 2024): projects representations onto the orthogonal complement of the harmful subspace in text space.
• The same paragraph also cites Koulischer et al., 2024, which is not elaborated in the main text. The paper states these methods typically handle only a single category, or simply concatenate keywords for multiple categories, ignoring interactions between categories.

Baselines and datasets

• Baseline methods: ESD, UCE, RECE, SafetyDPO, SLD, SAFREE; Table 3 additionally includes GPT-4o or QwenGuard for classification followed by SLD.
• Benchmarks: I2P, T2VSafetyBench, Unsafe Diffusion, CoProv2; benign quality uses 1,000 captions from COCO-30k.

The authors' positioning is that conflicts appear in both latent and text space, and multi-category aggregation itself causes safety degradation; CASG requires no training, selects a category-consistent direction according to the generation state, and remains compatible with the original SLD and SAFREE.

CASG is a training-free framework inserted into existing defenses: CaCI identifies the dominant harmful category, and CrGA corrects only along that category. The two instances are CASG+SLD and CASG+SAFREE. The paper states CASG+SLD updates the category at each timestep; it does not state whether the text-space process reselects at each step.

Formalization of Conflict

• Definition 1: When multiple categories H=(h1,...,hk) are used simultaneously, safety directions in latent or text space may be inconsistent, partially overlapping, opposite, or canceling; the authors call this harmful conflict.
• The authors argue guidance must align with the current harmful tendency to push the trajectory out of the harmful subspace. Matching prompts with a classifier or LLM requires extra training or external APIs and cannot follow conflicts that change during denoising (Sections 3.2, 5.2).
• Appendix A.1 defines CDRR: the signed projection of the aggregated direction onto each normalized category direction, divided by the aggregated direction norm, used to indicate whether that category is retained, near zero, or reversed.

Latent: Conflict-Aware Safety Steering

• For each hi, the harmful conditional noise is ε̂_i=ε_θ(z_t, c_{h_i}), and the harmful guidance is g_i=ε̂_i-ε_θ(z_t). The prompt guidance is g_p=ε_θ(z_t, c_p)-ε_θ(z_t).
• Alignment is measured with cosine: cosθ_i=(g_i· g_p)/(|g_i||g_p|). The larger the cosine, the more likely the authors consider that category to influence the current trajectory. The dominant category is h^∗=h_{argmaxicosθi}.
• Only that category's direction is fed into SLD; the rest of SLD's mechanisms and hyperparameters remain as originally designed. Algorithm 1 gives this process; Appendix B has the full algorithm including the text branch.

Text: Conflict-Aware Orthogonal Projection

• Each category has a subspace projection P_{h_i}. The residual p^⊥_{h_i}=(I-P_{h_i})p represents the prompt embedding after removing the component aligned with that category.
• The smaller the residual norm, the more the authors consider the prompt to lie in that category's harmful subspace. The dominant category is argmin_i ||p^⊥_{h_i}||.
• Only P_{h*} is used for SAFREE's orthogonal projection; all other SAFREE settings remain unchanged.

Judgment and Integration

• An image is counted as harmful if flagged by either Q16 or NudeNet. NudeNet: flagged if any nudity element's probability exceeds 0.5. Benign data uses CLIP score and FID.
• Main experiments are on Stable Diffusion v1.5, with the same keyword set as SLD, and SLD uses SLD-max. The paper does not list SLD-max's numerical threshold in the main text.

Experimental Setup

• Models: Main results use Stable Diffusion v1.5. The degradation comparison in Appendix A.3 additionally uses SDv3. LLM variants use GPT-4o or QwenGuard to classify prompts.
• Data: I2P 4,703 entries, 7 categories; T2VSafetyBench selected 3,443 entries, 7 categories; Unsafe Diffusion 904 user prompts; CoProv2 random 1,000 entries (Appendix C.1). Benign data is 1,000 captions from COCO-30k. The degradation experiment additionally samples 500 each of sexual and violence from T2VSafetyBench.
• Baselines: ESD, UCE, RECE, SafetyDPO, SAFREE, SLD, as well as GPT+SLD, QwenGuard+SLD. Weight-modification methods are shaded gray in Table 2.
• Metrics: Harmful Rate, lower is better; parentheses show change relative to SD-v1.5. An image is counted as harmful if flagged by either Q16 or NudeNet. On COCO, lower FID is better, higher CLIP score is better. Appendix D.2 reports ASR for keyword variants.
• Protocol: guidance scale 7.5, with 10.0 also tested in the appendix; 50 denoising steps; keyword set same as SLD; baselines use official implementations and default hyperparameters.
• Not specified: The paper does not report the number of generated images per prompt, repetition counts, or agreement between classifiers and human judgment.

Main Results

According to Table 2, SD-v1.5, guidance scale 7.5. Values in the table are Harmful Rate (%).

Swipe horizontally to read the table

Method	I2P	T2VSafetyBench	UD	CoProv2
SD-v1.5	42.2	58.3	52.3	28.2
RECE	21.5	18.9	22.3	8.6
SafetyDPO	13.7	24.0	16.7	4.2
SAFREE	20.0	41.5	24.2	14.2
CASG+SAFREE	18.9	37.5	17.5	11.8
SLD	12.7	25.2	15.7	7.1
CASG+SLD	10.2	9.8	9.8	3.9

• In Table 2, CASG+SLD is lower than other methods in the same table across all four columns. The authors state its safety performance reaches state-of-the-art among the compared methods. Omitted rows: ESD is 42.0, 57.4, 50.6, 28.1; UCE is 26.7, 28.2, 33.0, 19.4.
• The authors state generation quality is almost unchanged. On COCO, CASG+SLD has FID 52.00 and CLIP 29.36, while SLD has 52.11 and 29.22; CASG+SAFREE has 46.25 and 30.35, while SAFREE has 43.78 and 30.53. SD-v1.5's FID cell is "-", CLIP is 31.43.
• CASG+SAFREE's FID is higher than SAFREE's. The authors do not claim quality is better than all baselines.

Degradation from Mismatch and Aggregation

• Table 1 (SLD, baseline SD 1.5) sexual prompt: hate 72.4 (+5.2), sexual content 3.2 (-64.0), violence 59.4, illegal activity 64.6, hate+sexual 5.8, all category 48.8. The text also calls these numbers attack success rates. hate is higher than the baseline 67.2; illegal activity's 64.6 is lower than the baseline, which is not fully consistent with the authors' summary that "both 72.4% and 64.6% increase exposure."
• Same table violence prompt: matched violence is 6.2, all category is 13.6, baseline 52.8. Mismatched categories are all lower than the baseline. The table does not specify the dataset. Appendix A.3's Default column is the same as Table 1 and specifies 500 each; the paper does not state whether the two are the same experiment.
• The appendix extends the same protocol to SAFREE and SDv3. In Table 5, SAFREE, sexual prompt: sexual content 32.6, hate 72.6 (higher than baseline 67.2), all category 63.0. In Table 6, SDv3: sexual content 7.8, baseline 51.0, all category 18.2, hate 50.2 (-0.8). The authors state the degradation still appears across different keyword granularities, defenses, and base models.

LLM Classification Followed by SLD

• Table 3: GPT+SLD on I2P, T2VSafetyBench, UD is 11.6, 12.3, 20.1; QwenGuard+SLD is 14.0, 21.1, 23.3; SLD is 12.7, 25.2, 15.7; CASG+SLD is 10.2, 9.8, 9.8.
• GPT+SLD on UD, and QwenGuard+SLD on I2P and UD, are higher than SLD; both are lower than SLD on T2VSafetyBench.
• The authors attribute the limited performance to: LLMs misclassify mixed or ambiguous prompts; categories are fixed at the start and cannot update during denoising. CASG+SLD updates categories at each timestep.

Keyword Variants and Category Decomposition

• Table 8, T2VSafetyBench ASR: on Default, CASG+SLD is 9.8 (relative to SLD -15.4), Synonyms 10.6 (-4.2), Abstract 18.9 (-8.0), Detailed 7.9 (-11.2). CASG+SAFREE's parentheses relative to SAFREE are -4.0, -3.9, -8.7, -4.3. The authors state robustness to keyword settings. The abstract says the highest reduction is 15.4%, matching the Default row's -15.4.
• Table 9, I2P: parentheses are relative drops relative to SAFREE or SLD. CASG+SLD ranges from harassment's 10.1 (-1.0) to sexual content's 6.1 (-61.2); CASG+SAFREE ranges from harassment's 15.3 (-0.7) to illegal activities' 13.8 (-16.9). The authors state harassment's harmful zone overlaps heavily with the aggregation zone, so improvement is smaller.

Other Ablations and Analyses

• guidance scale 10.0 (Table 7): CASG+SLD is I2P 12.3, T2VSafetyBench 13.3, UD 14.5, CoProv2 5.0; SLD is 15.4, 27.4, 19.0, 7.7. CASG+SAFREE is 18.0, 37.6, 18.0, 10.8.
• Efficiency (Table 10, SDv1.5, 50 steps, single H100): SAFREE 3.9 s/sample, CASG+SAFREE 3.98 (1.02×); SLD 4.0, CASG+SLD at k=7 is 10.3 (2.58×). The text writes 10.2 seconds. The authors state the latent side grows linearly with the number of categories, about 1 second per additional category.
• Table 4: Under Fine-grained, hate for sexual prompt is 67.4 (+0.2), Default is 72.4 (+5.2). All categories at three granularities on sexual prompt are 48.8, 42.9, 25.8, all higher than the corresponding single-category sexual values of 3.2, 12.2, 2.8.
• Figure 2 and Figure 7 captions state that safety directions for various categories intersect or oppose each other in the first three PCA dimensions and change with timestep. Figure 3's caption states darker color means higher retention. Figure 9: the authors state CASG+SLD's harmful cosine decreases more than SLD's; per-cell values in the figure are not given in the paper.
• Appendix E: The authors state CLIP, FID on benign requests are comparable to the base defense; content shift may occur on harmful requests, and they consider this shift acceptable when safety takes priority over content fidelity on malicious inputs. Figure 5's caption states methods marked with * require tuning or model modification; the text states CASG variants further remove weapons and blood from violent images. The original prompt text is not paraphrased.

Limitations and Future Directions Noted by the Authors

The paper does not specifically discuss limitations. Section 6 only restates harmful conflict, the CASG approach, and the authors' claim that harmful content decreased in experiments while image quality on benign prompts was maintained, without writing future directions. The two shortcomings in Section 5.2 target LLM-assisted SLD, not CASG.

Experimental Coverage

• The main results use Stable Diffusion v1.5 as the generation model (Section 5.1). SDv3 appears only in the keyword degradation comparison in Appendix A.3; the paper does not report CASG's Harmful Rate on SDv3.
• Harmful benchmarks are I2P (4,703), T2VSafetyBench (3,443), Unsafe Diffusion (904), CoProv2 (1,000); benign quality uses 1,000 captions from COCO-30k (Appendix C.1).
• Comparisons include ESD, UCE, RECE, SafetyDPO, SAFREE, SLD, as well as GPT-4o and QwenGuard first classifying then applying SLD (Table 2, Table 3). The guardrails integrated are SLD and SAFREE.
• Harmful labels are given by Q16 and NudeNet, with NudeNet's nudity element threshold at 0.5. The paper does not report repetitions, number of generated images per prompt, or agreement with human evaluation.
• Also reported are guidance scale 10.0, four keyword variants, I2P category breakdown, inference time for 50 steps on H100, and two sets of direction visualizations for latent and text (Appendices A, D).

CASG is a training-free framework that attaches to existing T2I safety-guidance, addressing the issue that multiple harmful directions cannot be directly combined.

• Problem: The authors call it harmful conflict. Table 1, on SLD and baseline SD 1.5 with a sexual prompt, reports: no guidance 67.2%, matching sexual content 3.2%, mismatched hate 72.4%, and all-category aggregation 48.8%. The table does not specify the dataset. On a violence prompt, mismatching is not higher than the baseline.
• Method: In latent space, the dominant category is selected by cosine similarity between the prompt guidance and each harmful guidance; in text space, by the residual norm of orthogonal projection; then only the original SLD or SAFREE is run along that category, with other hyperparameters unchanged. The authors state that CASG+SLD updates the category at each timestep.
• Main results: With Stable Diffusion v1.5 and guidance scale 7.5, Table 2 shows CASG+SLD's Harmful Rate as I2P 10.2%, T2VSafetyBench 9.8%, Unsafe Diffusion 9.8%, CoProv2 3.9%, all four columns lower than other methods in the same table. On COCO, FID 52.00 and CLIP 29.36, while SLD is 52.11 and 29.22.
• Not always lower comparisons: In Table 3, GPT+SLD and QwenGuard+SLD on UD are 20.1% and 23.3%, higher than SLD's 15.7%. The authors attribute this to misclassification and the category being fixed once. In Table 9, the parentheses for harassment relative to SLD is only -1.0.
• Authors' conclusion: Simply aggregating multiple harmful keywords directly causes a safety drop; selecting the alignment direction based on the current state can enhance SLD and SAFREE without changing weights, while maintaining FID and CLIP close to the original guardrail on benign prompts. The authors claim up to a 15.4% reduction relative to existing methods; Table 8 on T2VSafetyBench's Default set marks CASG+SLD relative to SLD as -15.4.