Search papers, labs, and topics across Lattice.
This paper introduces DiSCO, a novel black-box defense mechanism for text-to-image generative models that addresses the benign adversarial problem, where linguistically safe prompts still lead to harmful outputs. By employing distribution-guided suffix expansion through beam search and contrastive scoring, DiSCO iteratively refines prompts to ensure the generation of safe content without requiring model retraining or access to internal parameters. The results demonstrate a significant reduction in attack success rates, achieving 37.7% and 25.13% reductions in adversarial success rates for undefended and defended models, respectively, while preserving semantic fidelity and improving image coherence.
A black-box defense that reduces harmful outputs in text-to-image models by 37.7% without needing any model retraining or internal access.
As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.
