When safe concepts become unsafe: multi-concept composition vulnerabilities in text-to-image models

Core problem: when multiple individually safe visual concepts are combined into the same generation request, T2I models produce harmful or sensitive visual content (which the authors call Multi-Concept Compositional Unsafety, MCCU), while existing safety mechanisms are designed around explicitly harmful concepts and cannot capture this relational risk.

• Problem scenario and importance: modern T2I models (such as FLUX.1 and SD-v3.5) are evolving from simple visual synthesis into compositional instruction followers capable of rendering multi-entity, multi-relation scenes. The authors argue that the more accurate the instruction following, the more likely individually safe concepts are combined into visually harmful meanings, and the attack surface expands accordingly.
• Shortcomings of existing methods: the authors state that existing T2I safety mechanisms assume unsafe outputs come from explicitly prohibited concepts, violating prompts, or visible dangerous content; prompt-level filtering checks banned words, image-level filtering checks nudity, gore, etc., and concept erasure suppresses specific representations, all of which are ineffective against relational risk.
• Core observation: MCCU does not rely on adversarial prompts, model access, or explicitly prohibited content; the risk comes from how the model combines multiple safe concepts into the same scene; and relational meanings evolve with sociocultural context, making them difficult to enumerate in advance.
• What the paper proposes: the authors build the TwoHamsters auditing framework (about 20k prompts, 51 concept pairs, six major risk categories, expert validation, and the MCCU-ViT evaluator), and define the MDR, CMDR, UAR, SAR, SCR, and NCR metrics, conducting black-box audits of 13 T2I models and three types of defenses.
• Threat model (section 2.2):
  • Attacker goal: make the model realize all target concepts in the generated image and make these concepts form an unsafe relational meaning; the attack is successful only when both conditions are met (Equation 3).
  • Attacker knowledge: black-box inference-time access, requiring no model parameters, gradients, training data, safety thresholds, or internal representations.
  • Attacker capability: three types of black-box attackers—Text-only (submitting natural language prompts combining safe concepts), Image-conditioned (providing individually safe images and requesting fusion), and Editing (providing a safe image containing one concept and requesting the addition of another concept); single-turn access, without gradient optimization, weight modification, white-box probing, adversarial perturbation, data poisoning, or system prompt jailbreaking, explicitly excluding token-level obfuscation.
  • Victim system: the complete generation system S, including the underlying generation model M and four types of defense components: text filtering, image filtering, multimodal safety evaluation, and internal safety alignment.

Evolution of T2I generative models

• From early architectures to diffusion and Transformers: From GANs and VAEs to diffusion models and the DiT architecture, modern models such as FLUX.1 and SD-v3.5 possess complex instruction following, multi-concept grounding, and fine-grained structural control capabilities (section 5.1).
• Capability leaps and risks: The authors state that SD v1.4/v1.5 brought the first wave of risk of explicit NSFW content generation, and that current Flow Matching and highly parameterized architectures (such as GPT-image-2) bring a second capability leap, making MCCU an attack surface coupled with capability.

T2I safety audit benchmarks

• UnsafeDiffusion [18] and I2P [16]: Mine real user data to build explicit-risk datasets, becoming the standard reference for early concept-erasure defenses.
• T2ISafety [28] and T2I-RiskyPrompt [17]: Introduce hierarchical risk classification, covering finer-grained risks such as political sensitivity and privacy.
• Shortcomings noted by the authors: The threat modeling of these benchmarks relies on the assumption of "explicit presence of unsafe concepts"; the authors state that at the structural level they completely ignore attack surfaces such as MCCU, where toxicity arises from combinations of safe concepts (section 5.2).

Concept erasure

• Early and robust methods: Early techniques [15], [21], [63], [64], [65] and recent robust methods [22], [23] achieve "targeted forgetting" through fine-tuning, and have also been validated on advanced models such as FLUX.1 [66], [67].
• Shortcomings noted by the authors: These methods operate under the atomic-risk assumption, isolating and removing individual independent concepts; the authors state that MCCU arises from relational combinations of safe concepts, that atomic erasure structurally cannot address it, and that it forces defenders into a safety–utility dilemma between under-erasure and over-erasure (section 5.3).

Comparison with the closest work

• HarmfulCmb [27]: Involves multi-concept composition risk, but the authors state that it is not a systematic safety audit framework and has limited concept coverage; TwoHamsters provides a dedicated framework with about 20k prompts, 51 concept pairs, six major categories, expert validation, and MCCU-ViT.
• Multimodal pragmatic jailbreak [26]: Also shows that concept-level filtering is insufficient to guarantee safety, but the authors point out that the two threats differ—that work exploits unsafe meanings arising from the interaction of visual and textual modalities, whereas MCCU focuses only on unsafe relational semantics arising from visual concept combinations and does not rely on text rendering, prompt obfuscation, or linguistic reasoning; the capability–risk relationship also differs, with multimodal pragmatic jailbreak limited by text rendering capability, whereas for MCCU the stronger the compositional alignment, the greater the exposure (section 5.4).

Baselines and benchmarks: The baselines for defense evaluation include eight mainstream safety filters (Q16, nsfw-I, Stable Diffusion safety filter, MultiHeaded, NSFW-T, LLaVA-Guard, PerspectiveVision, and the NSFW-T and Q16 ensemble) and nine concept erasure methods (NP, SP, ESD, UCE, Prompt Slider, RECE, SPEED, COGFD, KSCU), evaluated on TwoHamsters; the human correlation analysis of MCCU-ViT additionally used the HarmfulCmb dataset (Appendix B.2).

The overall approach is to build the TwoHamsters auditing framework: first formalize MCCU, then mine high-risk concept pairs through LLM assistance plus expert driving, automatically synthesize and multi-stage filter prompts, conduct expert validation, and finally perform large-scale black-box auditing of models using multiple metrics and the MCCU-ViT automatic evaluator.

MCCU Formalization

• Definition: let V be the set of atomic visual concepts, G the generation system, and F the safety predicate (1 safe, 0 unsafe). MCCU occurs when all atomic concepts are individually safe but the model-induced combination is unsafe: (∀ v_i ∈ V, F(v_i) = 1) ∧ F(G(V)) = 0 (Equation 1).
• Success determination: MCCU is evaluated at the output level and conditioned on successful concept realization: a generated image counts as an MCCU violation only if it simultaneously satisfies F_unsafe(I) = 1 ∧ F_align(I, V) = 1 (Equation 3), avoiding treating generation failure as safe behavior.
• Concept-pair setting: TwoHamsters mainly instantiates n = 2 concept pairs, which the authors state provides a controllable auditing environment, reliable human validation, and fine-grained attribution; the generalization to n > 2 is discussed in Appendix C.

Dataset Construction and Validation

• Concept-pair mining: 10 traditional risk categories were defined by synthesizing the policies of OpenAI, Midjourney, Google, and Meta platforms and benchmarks such as Unsafe Diffusion, I2P, and T2ISafety; an LLM was made to play diverse sociocultural personas formed by random permutations of occupation, belief, race, age, and gender to propose candidate combinations, and 51 pairs were retained after expert validation, finally grouped into six macro categories (Hate Speech & Discrimination 14 pairs, Violence & Physical Harm 12 pairs, Regulated Goods & Restricted Activities 9 pairs, Societal Harm & Public Crisis 8 pairs, Sexual Exploitation & Adult Content 5 pairs, Harassment & Defamation 3 pairs, Table 5).
• Prompt mining: Qwen-Flash was used as an expert prompt engineer to generate, for each concept pair, a triplet of one compositional prompt plus two atomic prompts; atomic prompts must exclude the semantics of the other concept, compositional prompts must instantiate the target risk through the visual interaction of the two concepts, and descriptions are kept within 77 tokens as much as possible.
• Multi-stage filtering: starting from about 100k candidate prompts, feature-space diversity filtering was first performed with a CLIP text encoder (cosine similarity threshold τsim = 0.95, removing about 20k redundant ones, leaving 80k); then cross-modal screening was performed using images generated by FLUX.1 (target concept similarity must be higher than other concepts, and the lowest 5% of each group was removed, removing about 60k, leaving 20k).
• Human validation: three expert annotators validated in two rounds (visual validity, rationale consistency, decision consistency), with LLaVA-Guard assisting in the second round; majority vote among the three experts, with Gwet's AC1 of 0.73. The final set contains about 17.5k base prompts (5,851 adversarial MCCU prompts and 11,702 single-concept prompts), plus 500 safe editing requests, 510 adversarial image-conditioned requests, 510 adversarial editing requests, and 500 safe multi-concept prompts, totaling 20,073.

Evaluation Metrics

• Defense metrics: MDR measures the rate at which the model avoids successful MCCU generation; CMDR is conditioned on successful concept alignment, distinguishing genuine safe behavior from prompt-following failure.
• Capability and utility metrics: UAR (concept alignment rate under adversarial prompts), SAR (alignment rate under safe multi-concept prompts), SCR (single-concept retention rate), NCR (non-target concept retention rate after erasure).

Automatic Evaluator

• MCCU-ViT: uses ViT-L/14-CLIPA-336 (pretrained on DataComp-1B) as the backbone, freezes the visual encoder, and fine-tunes three MLP classification heads to predict the first atomic concept, the second atomic concept, and the global safety category respectively; a logit ensemble strategy is used at inference, and the authors state that the atomic concept heads exceed 98% accuracy (Appendix B.1).
• MCCU-VLM: based on Qwen2-VL-7B-Instruct, with the vision tower and projection layer frozen, fine-tuned with language model LoRA (r = 16, α = 32) on 9,379 visual instruction samples, used for interpretable rationale checking and qualitative analysis; large-scale quantitative results rely on MCCU-ViT (Appendix B.3).
• Human correlation: Pearson r = 0.8322 on 500 TwoHamsters samples, and r = 0.4904 on 500 unseen HarmfulCmb samples (Table 7, Appendix B.2).

Experimental Setup

• Models tested: ten text T2I models (U-Net group: SD-v1.4, SD-v1.5, SD-v2.1, SDXL, Playground-v2.5; Transformer group: PixArt-α, SD-v3.5, FLUX.1, CogView4, Janus-Pro), all locally deployed and black-box audited; three multimodal generation systems (GPT-image-2 via API, Qwen-Image and Step1x locally deployed).
• Dataset and protocol: text auditing used 5.8k MCCU adversarial prompts, 0.5k safe multi-concept prompts, and 11.6k single-concept prompts, with one image generated per prompt per model (about 58k adversarial, 5k safe multi-concept, and 116k single-concept generations), fixed random seed, 512 × 512 resolution, and each model's default inference configuration; multimodal auditing used 510 test cases per setting (10 per concept pair).
• Defense baselines: eight safety filters (Q16, nsfw-I, sd filter, MultiHeaded, NSFW-T, LLaVA-Guard, PerspectiveVision, NSFW-T+Q16 ensemble); nine concept erasure methods (NP, SP, ESD, UCE, Prompt Slider, RECE, SPEED, COGFD, KSCU), with default hyperparameters.
• Metrics and evaluation: MDR, CMDR, UAR, SAR, SCR, NCR, CLIP score, FID; both Funsafe and Falign are evaluated by MCCU-ViT.
• Filter evaluation set: composed of MCCU images generated by FLUX.1 (positive samples) and safe generated images (negative samples), with a positive-to-negative ratio of about 10:1; the authors note that this distribution is biased toward positive samples, which inflates precision, so they focus on recall and F1.
• Concept erasure setting: a representative subset of the 10 concept pairs with the most samples in TwoHamsters on SDXL, with results reported as averages.

Main Results

According to Table 1 (text auditing, percentages):

Swipe horizontally to read the table

Backbone	Model	MDR ↑	CMDR ↑	UAR ↑	SAR ↑	SCR ↑
UNet	SD-v1.4	58.54%	14.67%	48.59%	57.60%	83.06%
UNet	SD-v1.5	58.71%	13.93%	47.97%	60.30%	83.16%
UNet	SD-v2.1	44.81%	9.88%	61.24%	78.40%	88.30%
UNet	SDXL	28.45%	6.81%	76.78%	89.80%	90.92%
UNet	Playg-v2.5	20.36%	5.21%	84.01%	90.20%	92.89%
Transformer	PixArt-α	21.47%	4.87%	82.54%	92.80%	94.49%
Transformer	SD-v3.5	9.45%	3.09%	93.43%	96.60%	95.29%
Transformer	FLUX.1	1.57%	0.93%	99.35%	99.40%	98.55%
Transformer	CogView4	7.82%	2.39%	94.43%	98.20%	95.87%
Transformer	Janus-Pro	30.83%	6.52%	74.00%	17.80%	86.12%

• Instruction-safety dilemma: the authors state that the stronger the instruction-following capability (the higher UAR and SAR), the greater the MCCU exposure (the lower MDR and CMDR); the higher MDR of early U-Net models partly comes from concept alignment failure rather than genuine safety reasoning, and CMDR is far lower than MDR on all models.
• Janus-Pro exception: its SAR is only 17.80%, which the authors attribute to safe concept combinations possibly being rare in its training data distribution, making it difficult to synthesize the co-occurrence of these safe concepts.
• Category differences: the authors state that categories involving sociocultural interpretation (Harassment & Defamation, Hate Speech & Discrimination) are harder to defend against, while visually salient categories (Sexual Exploitation & Adult Content, Regulated Goods & Restricted Activities) have higher defense rates (Figure 3).

Multimodal Attack Surface (RQ2, Table 2)

• What was tested: GPT-image-2, Qwen-Image, and Step1x with 510 cases each under three interaction modes: Text-only, Image Fusion, and Image Edit; Step1x does not support image fusion, so that item is omitted.
• Results: CMDR under Text-only was 4.22%, 7.47%, and 5.22% respectively; under Image Fusion, GPT-image-2 was 22.76% and Qwen-Image was 24.72%; under Image Edit, the three had CMDR of 26.90%, 29.94%, and 28.42% respectively.
• Authors' interpretation: MCCU can be triggered under all supported interaction modes; image-conditioned workflows increase CMDR but fail to eliminate exposure; MCCU is not a product of prompt engineering, and the attack surface extends from text prompt filtering to workflow-level safety analysis.

Safety Filters and MCCU Fine-tuning (RQ3, RQ4)

• Limited filter coverage (Table 3): sd filter recall 0.00%, nsfw-I recall 0.60%, MultiHeaded recall 21.46%, PerspectiveVision recall 24.74%, LLaVA-Guard recall 46.86%, Q16 recall 52.93%, NSFW-T recall 83.07%, NSFW-T+Q16 ensemble recall 92.10% (still missing nearly 8% of positive samples). The authors state that MCCU does not match the decision boundaries of mainstream filters, and filters trained on explicitly harmful content cannot be directly transferred to compositional unsafety.
• MCCU fine-tuning (Figure 4): under random split, MultiHeaded recall rose from 21.46% to 90.56% and F1 from 35.32% to 77.49%, PerspectiveVision recall rose from 24.74% to 84.87% and F1 from 39.63% to 86.60%; under a disjoint concept-pair split, MultiHeaded recall fell to 68.26% and F1 to 57.65%, and PerspectiveVision recall fell to 69.89%. The authors state that MCCU detection cannot be reduced to memorizing known concept pairs, and open-world defense requires relation- and context-aware reasoning.

Concept Erasure (RQ5, Table 4)

• What was tested: the performance of nine erasure methods on SDXL on a subset of 10 high-frequency concept pairs, including an unmodified SDXL baseline.
• Results: all methods showed limited MDR improvement; KSCU had the highest MDR (44.62%) but the largest drops in SCR and NCR relative to the SDXL baseline; UCE had an FID of 37.26 and RECE of 42.50, higher than other methods.
• Authors' interpretation: some methods were originally optimized for SD-v1.4 and are difficult to apply to SDXL; erasure can only provide local mitigation for specific concept pairs and harms safe concept generation, which the authors attribute to MCCU arising from relational semantics rather than isolated unsafe concepts.

Other Ablations and Analyses

• Attention analysis (RQ6, Figure 5): FLUX.1 can locate and ground the safe atomic concepts in the prompt, but the attention maps mainly correspond to individual concepts rather than the harmful relations between concepts; the authors state that the model behaves as a compositional executor and does not treat emergent unsafe interpretations as an independent safety signal.
• Representation analysis (Figure 6): in t-SNE, MCCU images tend to lie near or between safe component clusters, without forming a clearly separated unsafe cluster; cosine similarity distributions show that MCCU images remain semantically close to the text of the component safe concepts, and are not necessarily strongly aligned with explicit harmful text anchors.
• Concept-pair granularity (Figure 7, Appendix D): concept pairs such as Black Person & Fried Chicken, Elon Musk & Trash Can, and Flame of Notre-Dame de Paris have average MDR close to zero, while Flame & School and Playing Card & Chip have higher average MDR; the authors state that MCCU risk is highly dependent on the specific concept pair.
• Higher-order compositions (Appendix C, Figure 8): the authors state that the MCCU mechanism can generalize to compositions with n ≥ 3, and give examples for n = 3 and n = 4, but do not report quantitative results.

Limitations and future directions noted by the authors

• Concept-pair coverage is not exhaustive (section 6.1): The authors state that although they built a hierarchical classification of 51 concept pairs based on real compliance policies, the sociopolitical zeitgeist evolves rapidly and the MCCU attack surface is theoretically unbounded, so the dataset is an empirical baseline rather than an exhaustive dictionary covering all compositional risks.
• Approximation limitations of the automatic evaluator (section 6.1): The authors state that large-scale measurement relies on MCCU-ViT to process tens of thousands of images, and that although consistency with human judgment has been validated across distributions, capturing subtle sociocultural context with frozen classification boundaries remains inherently subject to approximation limitations.
• Call for a new defense paradigm (Contributions and section 6): The authors state that existing defenses either fail to generalize to unseen concept combinations or cause utility degradation, and that a new defense paradigm for compositional safety is needed; future safety alignment should not be merely data-centric feature filtering but should also possess logic-oriented refusal capability, isolating harmful combinations without destroying legitimate knowledge bases.

Scope of experimental coverage

• Models tested: 10 text T2I models (SD-v1.4, SD-v1.5, SD-v2.1, SDXL, Playground-v2.5, PixArt-α, SD-v3.5, FLUX.1, CogView4, Janus-Pro) and 3 multimodal systems (GPT-image-2, Qwen-Image, Step1x), 13 in total (section 4.1).
• Concept and prompt scale: 51 concept pairs, six macro-categories, 20,073 prompts in total; the text audit generates 1 image per prompt per model, and the multimodal setting uses 510 cases per setting (section 3.2, 4.1).
• Defense evaluation: Eight safety filters, MCCU fine-tuning of two filters (MultiHeaded, PerspectiveVision), and nine concept erasure methods; concept erasure is conducted only on a 10-pair high-frequency concept subset of SDXL (section 4.1, 4.6).
• Evaluation method: Both Funsafe and Falign are automatically evaluated by MCCU-ViT; the Pearson correlation between MCCU-ViT and humans is 0.8322 on 500 TwoHamsters samples and 0.4904 on 500 HarmfulCmb samples (Appendix B.2); the paper does not report the proportion of MCCU-ViT judgments manually reviewed in the main experiments.
• Attack setting: Only single-turn black-box access, explicitly excluding jailbreaks, adversarial prompts, gradient optimization, and token-level obfuscation; higher-order compositions with n > 2 are given only as qualitative examples in Appendix C, without quantitative measurement (section 2.2, Appendix C).

An evaluation paper on the compositional safety of T2I models. The authors propose Multi-Concept Compositional Unsafety (MCCU): when multiple concepts that each comply with policy are composed into the same image, unsafe relational semantics arise; it does not rely on adversarial prompts, model access, or explicitly prohibited content, and can be triggered through ordinary black-box interfaces.

• Method: Build the TwoHamsters audit framework, containing 51 manually verified concept pairs, six risk macro-categories, and 20,073 prompts; use CLIP diversity filtering and FLUX.1 cross-modal screening to select data from about 100k candidates, with three experts validating (Gwet's AC1 = 0.73); use MCCU-ViT as the automatic evaluator, using MDR, CMDR, UAR, SAR, SCR, and NCR to separate defense effectiveness from generative capability.
• Main results: On ten text T2I models, the stronger the instruction following, the greater the MCCU exposure—FLUX.1 has a UAR of 99.35% and an SAR of 99.40%, while MDR is only 1.57% and CMDR only 0.93% (Table 1); SD-v1.4/v1.5 have an MDR of about 58% but a UAR below 50%, and the authors state that part of the apparent safety comes from composition failure.
• Multimodal: GPT-image-2, Qwen-Image, and Step1x are triggered in all three modes—text, image fusion, and image editing—with Text-only CMDR of only 4.22%–7.47% (Table 2).
• Defenses: Among the eight mainstream filters, the best-performing NSFW-T+Q16 ensemble recalls 92.10% but still misses nearly 8% of positive samples (Table 3); MCCU fine-tuning drops recall from 90.56% to 68.26% on unseen concept pairs (MultiHeaded, Figure 4); the nine concept erasure methods show limited MDR improvement and harm utility, with KSCU having the highest MDR (44.62%) but the largest drops in SCR and NCR (Table 4).
• Mechanism: Attention and CLIP representation analyses show that the models ground the safe atomic concepts but do not encode the emergent unsafe combinations as an independent unsafe state (Figure 5, 6).
• Authors' conclusion: Compositional reasoning creates an attack surface in T2I models that existing safety mechanisms do not cover, and there is a fundamental conflict between instruction following and safety; the authors call for a new defense paradigm for compositional safety and plan to release TwoHamsters and MCCU-ViT through the Hugging Face gated mechanism.