DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

DiSCO：通过分布引导的对比提示优化来防御文本到图像生成

Abstract: As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. 摘要： 随着文本到图像生成模型的进步，它们引发了严峻的安全问题，特别是暴力和裸露等不适宜工作场所（NSFW）内容的生成，而红队对抗性攻击进一步加剧了这一问题。

Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. 现有的防御措施主要在白盒假设下运行，依赖于文本编码器优化、权重编辑或推理时干预，从根本上无法扩展到专有模型。

Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model’s learned data distribution. 基于大语言模型（LLM）提示重写的黑盒替代方案提供了更广泛的适用性，但在我们确定的一个关键领域——“良性对抗”问题上却失效了：即提示词在语言学上是安全的，但由于模型学习到的数据分布，仍会触发有害内容的生成。

We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. 我们提出了 DiSCO，这是一种零样本、严格的黑盒防御方法，完全在提示词层面作为即插即用模块运行，无需模型重训练、微调或访问模型内部结构。

DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. DiSCO 通过束搜索（beam search）执行分布引导的后缀扩展，通过在目标模型自身生成的安全和不安全图像池上进行对比评分来优化，并进行迭代式自适应反馈，直到生成安全内容为止。

We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. 我们证明，在多种红队攻击下，DiSCO 在 I2P 基准测试中持续增强了未防御模型和已防御模型的安全性，分别实现了 37.7% 和 25.13% 的攻击成功率（ASR）降低，同时保持了语义保真度并提高了图像连贯性。

As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself. 作为一种黑盒且与架构无关的模块，DiSCO 可以轻松应用于任何文本到图像系统，而无需对模型本身进行任何更改。