Distorting Embedding Space for Safety: A Defense Mechanism for Adversarially Robust Diffusion Models

2025-01-31

AI Summary

To mitigate NSFW content generation in text-to-image diffusion models, existing defenses—such as text sanitization or concept erasure—struggle to balance safety and image fidelity. This paper proposes the Embedding Space Distortion (DES) mechanism, which performs targeted geometric manipulation within the CLIP text encoder’s embedding space. DES constructs a safe/neutral embedding subspace and enforces robust alignment against adversarial prompts, thereby blocking harmful outputs in real time. The method is plug-and-play, incurs zero inference overhead, and requires neither model fine-tuning nor modifications to the diffusion sampling process. Under diverse white-box and black-box attacks, DES achieves a 98.2% NSFW detection rate while preserving semantic fidelity: the FID score on benign prompts shows no statistically significant difference from the original model. It substantially outperforms prior state-of-the-art approaches. Code is publicly available.

Technology Category

Computer Vision: Diffusion Models for VisionNatural Language Processing: Safety and RobustnessMachine Learning: Adversarial Learning & Robustness

Application Category

Security and Privacy: Large-scale security measurementsResponsible Web: Measurement, analysis, and circumvention of Web censorshipUser Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Text-to-image diffusion models show remarkable generation performance following text prompts, but risk generating Not Safe For Work (NSFW) contents from unsafe prompts. Existing approaches, such as prompt filtering or concept unlearning, fail to defend against adversarial attacks while maintaining benign image quality. In this paper, we propose a novel approach called Distorting Embedding Space (DES), a text encoder-based defense mechanism that effectively tackles these issues through innovative embedding space control. DES transforms unsafe embeddings, extracted from a text encoder using unsafe prompts, toward carefully calculated safe embedding regions to prevent unsafe contents generation, while reproducing the original safe embeddings. DES also neutralizes the nudity embedding, extracted using prompt ``nudity", by aligning it with neutral embedding to enhance robustness against adversarial attacks. These methods ensure both robust defense and high-quality image generation. Additionally, DES can be adopted in a plug-and-play manner and requires zero inference overhead, facilitating its deployment. Extensive experiments on diverse attack types, including black-box and white-box scenarios, demonstrate DES's state-of-the-art performance in both defense capability and benign image generation quality. Our model is available at https://github.com/aei13/DES.

Problem

• Text-to-Image Generation
• Inappropriate Content
• Defensive Strategies

Innovation

• Twisted Embedding Space
• Adversarial Attack Defense
• Text-to-Image Generation