Paper deep dive

DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

Tong Zhang, Motasem Alfarra, Carlos Hinojosa, Christos Louizos, Bernard Ghanem

Year: 2026Venue: arXiv preprintArea: cs.AIType: PreprintEmbeddings: 86

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 89%

Last extracted: 8/19/2026, 4:12:25 AM

Summary

The paper introduces DiSCO, a zero-shot, strictly black-box defense module for text-to-image generative models that mitigates the 'benign adversarial' problem where linguistically safe prompts still generate unsafe content. DiSCO operates by performing distribution-guided contrastive suffix expansion via beam search, optimizing prompts to steer generations away from unsafe regions of the model's output distribution without accessing model internals or requiring retraining. It significantly reduces Attack Success Rate (ASR) across various models and attacks while maintaining semantic fidelity.

Entities (10)

DisCo · method · 98%Benign Adversarial Problem · concept · 92%Attack Success Rate · metric · 90%NudeNet · model · 90%Q16 · model · 90%I2P Benchmark · dataset · 88%CLIP · model · 85%Llama-3-8B · model · 85%Flux · model · 80%Stable Diffusion · model · 80%

Relation Signals (7)

DisCo → mitigates → Benign Adversarial Problem

confidence 95% · DiSCO addresses this gap by optimizing prompts through distribution-guided feedback, steering generations toward safer regions...

DisCo → reduces → Attack Success Rate

confidence 92% · DiSCO reduces average ASR from 23.6% to 2.4% under NudeNet and from 8.3% to 1.7% under Q16...

DisCo → evaluateson → I2P Benchmark

confidence 90% · We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark...

DisCo → uses → CLIP

confidence 90% · DiSCO scores candidate suffixes via a distribution-guided contrastive objective computed in a frozen CLIP embedding space.

NudeNet → usedfor → Attack Success Rate

confidence 85% · We report ASR ↓ primarily under NudeNet, which targets explicit content detection...

Q16 → usedfor → Attack Success Rate

confidence 85% · We compute ASR using two complementary image safety classifiers (e.g., NudeNet and Q16)...

DisCo → uses → Llama-3-8B

confidence 85% · We optimize prompts by expanding a suffix token-by-token using a suffix generator language model M (LLaMA-3-8B).

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

82,622 characters extracted from source content.

Expand or collapse full text

DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization Tong Zhang Motasem Alfarra Affiliation: Qualcomm AI Research[0.4em] tong.zhang.1, carlos.hinojosa, bernard.ghanem@kaust.edu.samalfarra, clouizos@qti.qualcomm.com† Equal Contribution Carlos Hinojosa Christos Louizos Affiliation: Qualcomm AI Research[0.4em] tong.zhang.1, carlos.hinojosa, bernard.ghanem@kaust.edu.samalfarra, clouizos@qti.qualcomm.com† Equal Contribution Bernard Ghanem [0.6em] King Abdullah University of Science Technology (KAUST) Abstract As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model’s learned data distribution. We propose DiSCO, a training free, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that across 32 system–attack settings and five seeds, DiSCO reduces average ASR from 23.6% to 2.4% under NudeNet and from 8.3% to 1.7% under Q16, while maintaining or improving generation quality. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself. Warning: This paper contains model outputs that are offensive in nature. † Qualcomm AI Research is an initiative of Qualcomm Technologies, Inc.† Disclaimer. All images presented in this paper were generated at King Abdullah University of Science and Technology (KAUST) using institutional computing resources, solely for the purpose of evaluating and reporting the safety behavior of text-to-image models. Potentially unsafe content generated during these experiments was produced exclusively for research evaluation, was handled under institutional oversight, and is not redistributed. 1 Introduction The onset of text-to-image generation has transformed creative workflows across industries [13, 19, 15, 17, 3, 22, 7], enabling users to synthesize photorealistic imagery from natural language descriptions. Models such as Stable Diffusion [20], SD 3 [4], and Flux [10] have demonstrated remarkable generative capabilities, yet this progress has simultaneously introduced critical safety vulnerabilities. In the realm of content safety, these models can produce Not-Safe-For-Work (NSFW) content [12, 1], including depictions of violence, nudity, and other harmful imagery, either through undefended generation or through deliberate manipulation of input prompts, known as adversarial attacks. The growing accessibility of open-source text-to-image models has further amplified these risks, as users can freely interact with systems that lack adequate safety guardrails, raising urgent concerns for responsible deployment. The discovery of red-teaming adversarial attacks has accordingly led to escalating security concerns surrounding text-to-image systems. These attacks span a spectrum of threat models, from black-box methods that craft adversarial prompts without model access [24, 27], to white-box approaches that leverage gradients and internal representations for targeted prompt optimization [32, 26]. More recently, LLM-driven attacks, such as APT [14], have raised the bar further by generating human-readable adversarial prompts that evade both automated detectors and human review. The increasing sophistication of these attacks demands defense mechanisms that are equally robust and adaptive. In response, a spectrum of defenses has emerged. White-box methods intervene inside the generation pipeline via weight fine-tuning [5, 31], cross-attention editing [8], or inference-time steering [21, 28], but they inherently do not scale to proprietary or closed-source models. A lightweight black-box alternative is LLM-based prompt rewriting [33, 9], which often neutralizes prompts that contain explicit unsafe intent; however, it exposes a more fundamental failure mode where textually benign prompts still trigger unsafe images. We formalize this as the benign adversarial problem: a prompt p′p is benign adversarial with respect to a generative model G if p′p is deemed safe by language-level assessment, yet ⁡(p′)G(p ) produces unsafe visual content. Recent evidence suggests this is systematic rather than anecdotal, where benign prompts can unintentionally elicit harmful generations [11], and the issue persists even under compromised model weights [25], indicating a gap in purely text space defenses. Motivated by this, we view defending against benign adversarial prompts as a distributional alignment problem: instead of modifying G, optimize the prompt to shift generations from unsafe to safe regions of the model’s learned output distribution as illustrated in Figure 1 (left). Figure 1: (Left) Textually safe prompts do not guarantee safe generations. DiSCO addresses this gap by optimizing prompts through distribution-guided feedback, steering generations toward safer regions without accessing or modifying the underlying model. (Right) DiSCO significantly reduces the Attack Success Rate (ASR) across diverse undefended and defended text-to-image models, serving as a plug-and-play black-box safety booster without modifying the underlying model. In this work, we study the effect of distribution-guided prompt optimization as a black-box defense against unsafe text-to-image generation. Specifically, we explore how contrastive scoring over a target model’s own safe and unsafe outputs can be used to systematically steer benign adversarial prompts toward safe generation regions. We present DiSCO, a training free, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO takes the prompt with adversarial content as its starting point and optimizes it through distribution-guided contrastive suffix expansion via beam search, with iterative adaptive feedback that modulates the optimization objective based on the severity of remaining harmful content. We present a comprehensive empirical study assessing the impact of introducing DiSCO against state-of-the-art adversaries on the I2P benchmark [21]. Our experiments show that equipping existing undefended and defend methods with DiSCO provides consistent improvements in safety across all attacks evaluated, as shown in Figure 1 (right). DiSCO is modular and versatile, and we show how it improves the robustness of state-of-the-art defenses across the board, from training-free inference-time methods to fine-tuning-based approaches. Our contributions are summarized as follows: • Problem: We formalize the benign adversarial regime in text-to-image safety, where prompts that are textually safe can still induce unsafe generations due to the model’s learned output distribution. • Method: We introduce DiSCO, a training free, strictly black-box and plug-and-play prompt-optimization module that steers generations via distribution-guided contrastive suffix search, requiring no retraining, fine-tuning, or access to model internals. • Results: On I2P under four red-teaming attacks, DiSCO consistently improves safety across both undefended and defended systems. Over five seeds and 32 system–attack settings, it reduces average ASR from 23.6% to 2.4% under NudeNet and from 8.3% to 1.7% under Q16, while maintaining or improving semantic fidelity and perceptual quality. 2 Methodology Figure 2: Overview of DiSCO. Left: Model-specific safe and unsafe reference pools are constructed by generating images from the target model using the I2P dataset and filtering through classifier consensus (NudeNet and Q16). Right: DiSCO takes a benign-adversarial prompt, expands it with optimized suffix tokens via contrastive beam search in CLIP embedding space, and steers the target model from unsafe to safe generation without modifying the model itself. We study the impact of distribution-guided prompt optimization on the safety of text-to-image generation as shown in Figure 2. We observe that traditional defense approaches either modify the model’s internal parameters or operate solely at the textual level, overlooking the relationship between the input prompt and the model’s own visual output distribution. Thus, we aim at studying the impact that introducing a prompt-level optimization module, guided by the model’s own safe and unsafe generation regions, can have on enhancing adversarial robustness. 2.1 Problem Definition and Evaluation Protocol Let P be the space of text prompts and X the space of images. A text-to-image generator is a (possibly stochastic) mapping G:→G:P that produces an image x∼G⁡(p)x G(p) given a prompt p∈p . We study red-teaming attacks that craft adversarial prompts to increase the likelihood of unsafe generations: an attack algorithm A maps an initial prompt (or template) to padv=⁡(p)p_adv=A(p). In many deployed black-box pipelines, a language-based sanitizer or LLM rewriting module ℛR is applied first, producing a rewritten prompt p′=ℛ⁡(padv)p =R(p_adv) that is linguistically benign, after which the system generates x∼G⁡(p′)x G(p ). Our focus is the regime where language-level sanitization is not sufficient because safety depends on the alignment between p′p and the visual output distribution induced by G. Benign adversarial prompts. Let SafeText:→0,1SafeText:P→\0,1\ denote a language-level safety assessment and SafeImg:→0,1SafeImg:X→\0,1\ an image-level safety assessment. We say that p′∈p is benign adversarial w.r.t. G if it passes text-level checks but still yields unsafe images with high probability: SafeText(p′)=1andℙx∼G⁡(p′)[SafeImg(x)=0]≥0.5.SafeText(p )=1 _x G(p )\! [SafeImg(x)=0 ]\ ≥ 0.5. (1) This phenomenon motivates viewing defense as a distributional alignment problem: rather than modifying G, we optimize the input prompt so that the induced generation shifts away from unsafe regions and toward safe regions of G’s learned output distribution. Defense setting (strictly black-box, prompt-level). We consider a prompt-level defense :→D:P that transforms the (typically rewritten) prompt p′p into an optimized prompt p∗=⁡(p′)p^*=D(p ), after which the generator runs unmodified: x∗∼G⁡(p∗),p∗=⁡(p′).x^* G(p^*), p^*=D(p ). (2) The defense has no access to G’s parameters, gradients, attention maps, or intermediate activations; it may only query G to obtain generated images. At a high level, we seek to reduce unsafe generations while preserving the user intent of p′p : minp′[ℙx∼G⁡(⁡(p′))[SafeImg(x)=0]]s.t.Sem((p′),p′)≥τ, _D\ E_p [P_x G(D(p )) [SafeImg(x)=0 ] ] .t. (D(p ),p )≥τ, (3) where Sem⁡(⋅,⋅)Sem(·,·) measures semantic fidelity (e.g., text-image or text-text alignment) and τ is a fidelity threshold. An example to Sem⁡(⋅,⋅)Sem(·,·) is the celebrated CLIP Score [18]. Evaluation protocol and metrics. We report robustness using Attack Success Rate (ASR): the fraction of evaluated prompts that produce unsafe images under the tested system (undefended, baseline-defended, or defense-enhanced): ASR=1||∑q∈[SafeImg(xq)=0],xq∼G(pq),ASR\;=\; 1|Q| _q I\! [SafeImg(x_q)=0 ], x_q G(p_q), (4) where Q is the evaluated prompt set and pqp_q is the corresponding input prompt to the generator. We compute ASR using two complementary image safety classifiers (e.g., NudeNet and Q16), and report semantic fidelity / generation quality metrics (e.g., CLIP-based alignment and ImageReward) to verify that safety gains do not come from excessive semantic drift or degraded output quality. Unless stated otherwise, reported ASR values are measured under NudeNet, the standard evaluator in prior work, which allows direct comparison with previously published numbers. 2.2 Distribution-Guided Contrastive Suffix Optimization Given the problem formulation, we are now ready to present our defense: Distribution-Guided Contrastive Suffix Optimization (DiSCO). DiSCO is a strictly black-box, prompt-level module that steers a target generator G toward safe generations by optimizing the prompt using feedback obtained only from observable outputs of G. In a nutshell, given a (potentially sanitized) input prompt p′p , DiSCO performs autoregressive suffix expansion and selects the suffix that maximizes a distribution-guided contrastive score computed in a model-agnostic embedding space. Safe and unsafe reference pools. To obtain a robust reference signal under a black-box constraint, we construct two model-specific image pools by querying G on non-adversarial prompts from the I2P dataset. Let safe=xi+i=1N+P_safe=\x_i^+\_i=1^N_+ and unsafe=xj−j=1N−P_unsafe=\x_j^-\_j=1^N_- denote the resulting pools of safe and unsafe images, respectively. We enforce an unambiguous selection rule: an image is added to safeP_safe only if both NudeNet and Q16 classify it as safe, and added to unsafeP_unsafe only if both classify it as unsafe; ambiguous cases (disagreement) are discarded. An alternative confidence-based construction of the two pools is discussed in Appendix A.6. Because the pools are generated by the target model G, they reflect G’s own learned visual manifold and require no external unsafe corpora or internal access. Distribution-guided contrastive objective. Given a candidate prompt p p, we query the target model to obtain x^∼G⁡(p^) x G( p) and embed the image using a frozen CLIP image encoder ϕ⁡(⋅)φ(·). At each optimization step, we randomly sample R references from each pool, yielding ~safe⊂safe P_safe _safe and ~unsafe⊂unsafe P_unsafe _unsafe with |~safe|=|~unsafe|=R| P_safe|=| P_unsafe|=R (default R=8R=8). We score p p by the contrastive alignment of its generated image with these two reference sets: J⁡(p^)=1R∑xi+∈~safecos⁡(ϕ⁡(x^),ϕ⁡(xi+))−1R∑xj−∈~unsafecos⁡(ϕ⁡(x^),ϕ⁡(xj−)),J( p)\;=\; 1R _x_i^+∈ P_safe \! (φ( x),φ(x_i^+) )\;-\; 1R _x_j^-∈ P_unsafe \! (φ( x),φ(x_j^-) ), (5) where cos⁡(⋅,⋅) (·,·) denotes cosine similarity. Maximizing J simultaneously attracts generations toward safe regions and repels them from unsafe regions in the embedding space. Re-sampling references at every step exposes the optimizer to diverse views of the two distributions while keeping the per-step cost bounded. In practice, a single optimization pass already yields strong robustness gains; a preference-based optimization variant for deployment, formulated under a unified objective, is detailed in Appendix A.7. We optimize prompts by expanding a suffix token-by-token using a suffix generator language model M (LLaMA-3-8B). Starting from p′p , we maintain a beam ℬB of size K (default K=4K=4). At step t∈1,…,Tt∈\1,…,T\ (default T=16T=16), for each candidate prompt in the beam we propose next-token continuations via M, query G for each continuation, compute its score via Eq. (5), and retain the top-K candidates. After T steps, the final optimized prompt is selected as p∗=arg⁡maxp^∈ℬ⁡J⁡(p^).p^*\;=\; _ p J( p). (6) The complete procedure is given in Algorithm 1 (Appendix A.1), and a quantitative analysis of semantic drift is provided in Appendix A.8. Compatibility and deployment. DiSCO operates entirely upstream of G: it transforms the input prompt and then invokes G unchanged. Thus, it can be prepended to undefended generators as well as to systems already equipped with safety mechanisms, without requiring retraining, fine-tuning, architectural changes, or access to internal representations. Computational Overhead. DiSCO induces an additional computation during inference. Under the default beam search configuration, each prompt requires T×b×KT× b× K candidate image generations. Further, and to minimize the computational overhead that DISCO adds, DiSCO is applied selectively rather than to every incoming prompt. For each target model, we first generate an image under the model’s existing configuration and invoke DiSCO only when a textually benign prompt still produces an unsafe image, which we define as a benign-adversarial case in Section 2.1. Prompts whose initial generations are safe pass through unmodified. At last, we note that in Appendix A.4 we further show that even when DiSCO is applied to safe prompts that do not generate harmful content, generation quality is not degraded relative to leaving those prompts unmodified. 3 Related Work Adversarial Robustness of Text-to-Image Models. Red-teaming has become the standard way to stress-test text-to-image safety, and recent work shows that adversarial prompting can reliably elicit NSFW generations under both black-box and white-box threat models. Black-box attacks craft prompts without accessing the generator internals, e.g., Ring-A-Bell [24] and SneakyPrompt [27] search for token substitutions that evade prompt-side safeguards. White-box attacks are more targeted, leveraging gradients and internal representations to directly optimize for unsafe outputs, as in UnlearnDiffAtk [32] and MMA-Diffusion [26]. More recently, LLM-driven attacks further raise the bar by producing fluent, human-readable prompts (often via search over adversarial suffixes) that bypass heuristic filters and remain difficult to flag at the text level, e.g., APT [14]. Collectively, these results highlight that robustness must be assessed against increasingly natural-looking prompts that can appear benign while still inducing unsafe generations. Defending Text-to-Image Models. Defenses span a spectrum of model access and intervention. Weight-modifying and fine-tuning approaches can suppress unsafe concepts but require parameter access and may need repeated updates as new failure modes emerge, e.g., ESD [5], AdvUnlearn [31], RECE [8], and external rectification modules such as SafePatch [16]. Inference-time methods avoid permanent edits but still depend on internal representations, limiting portability across architectures (e.g., SLD-Max [21], SAFREE [28], DTVI [23], PromptGuard [29]). Complementarily, LLM-based rewriting provides a lightweight, model-agnostic safeguard by sanitizing prompts before generation (e.g., VALOR [33], PromptSafe [9]), but can fail when linguistically safe prompts still map to unsafe regions of a model’s visual distribution. DiSCO targets this gap with a strictly black-box, prompt-level optimization that uses the target model’s own safe/unsafe output distributions as guidance, and can be prepended to both undefended systems and existing defenses without changing the generator. 4 Experiments Models. We evaluate DiSCO across multiple text-to-image generators spanning both major architecture families. Our study includes UNet-based diffusion models (SD v1.4, SD v2.0 [20]) and DiT-based models (Flux [10], SD 3 [4]), allowing us to assess whether prompt-level distributional steering generalizes across architectures and model scales. Attacks. We benchmark adversarial robustness under a diverse set of red-teaming attacks covering both black-box and white-box threat models. Ring-A-Bell [24] crafts adversarial prompts without access to the generator internals. UnlearnDiffAtk [32] and MMA-Diffusion [26] represent stronger white-box attacks that optimize prompts using model-side signals (e.g., gradients/representations), while Prompting4Debugging (P4D) [2] targets deployed safety mechanisms by searching for prompts that bypass defense behavior. Together, these attacks probe complementary failure modes and produce prompts that can remain linguistically fluent yet induce unsafe generations. Metrics. We measure safety using Attack Success Rate (ASR), defined as the fraction of evaluated prompts whose generated images are classified as unsafe. We report ASR ↓ primarily under NudeNet, which targets explicit content detection, and additionally under Q16 [21] as a broader complementary metric that captures a wider range of unsafe content categories. To quantify whether safety gains preserve semantic fidelity and overall quality, we additionally report CLIP [18] score (semantic alignment) and ImageReward (perceptual preference). DiSCO hyperparameters. Unless stated otherwise, DiSCO performs autoregressive suffix expansion using a lightweight suffix generator language model (LLaMA-3-8B [6]) with beam search of width K=4K=4 and suffix length T=16T=16. DiSCO scores candidate suffixes via a distribution-guided contrastive objective computed in a frozen CLIP embedding space. At each expansion step, we sample R=8R=8 reference images from each of two model-specific pools (safe/unsafe) constructed by querying the target model on non-adversarial prompts; we retain only unambiguous samples by requiring agreement between NudeNet and Q16 (disagreements are discarded). Table 1: ASR (%, mean±std_ over 5 seeds) under four adversarial attacks, measured by NudeNet (N) and Q16. Lower is better. Ring-A-Bell UnlearnDiffAtk MMA-Diffusion P4D Model N↓ Q16↓ N↓ Q16↓ N↓ Q16↓ N↓ Q16↓ SD 1.4 Base 84.2±3.884.2_± 3.8 16.0±9.516.0_± 9.5 53.1±10.953.1_± 10.9 13.1±3.313.1_± 3.3 43.0±16.943.0_± 16.9 11.8±4.711.8_± 4.7 17.5±8.617.5_± 8.6 12.9±6.612.9_± 6.6 + DiSCO 7.8±3.07.8_± 3.0 4.0±2.94.0_± 2.9 6.2±2.56.2_± 2.5 3.4±2.53.4_± 2.5 8.0±1.78.0_± 1.7 3.2±1.13.2_± 1.1 5.5±1.45.5_± 1.4 5.3±1.95.3_± 1.9 SD 2.0 Base 75.4±7.075.4_± 7.0 26.5±4.726.5_± 4.7 24.2±9.224.2_± 9.2 7.4±1.77.4_± 1.7 9.6±6.69.6_± 6.6 9.5±6.29.5_± 6.2 10.1±6.310.1_± 6.3 10.4±7.410.4_± 7.4 + DiSCO 3.9±0.83.9_± 0.8 2.1±0.92.1_± 0.9 3.2±1.33.2_± 1.3 2.5±1.82.5_± 1.8 1.0±0.31.0_± 0.3 1.3±0.41.3_± 0.4 5.1±2.05.1_± 2.0 3.6±1.43.6_± 1.4 SD 3 Base 34.5±5.834.5_± 5.8 3.8±1.73.8_± 1.7 9.4±3.49.4_± 3.4 2.5±2.82.5_± 2.8 2.5±1.52.5_± 1.5 3.0±4.43.0_± 4.4 5.0±2.15.0_± 2.1 5.5±8.75.5_± 8.7 + DiSCO 2.1±1.62.1_± 1.6 0.4±0.50.4_± 0.5 0.2±0.50.2_± 0.5 0.2±0.50.2_± 0.5 0.1±0.10.1_± 0.1 0.0±0.10.0_± 0.1 2.7±1.22.7_± 1.2 0.9±0.50.9_± 0.5 Flux Base 89.7±3.189.7_± 3.1 10.1±3.410.1_± 3.4 32.4±2.832.4_± 2.8 4.7±1.74.7_± 1.7 7.7±2.37.7_± 2.3 0.8±1.10.8_± 1.1 13.7±2.713.7_± 2.7 8.2±6.08.2_± 6.0 + DiSCO 5.0±1.05.0_± 1.0 0.0±0.00.0_± 0.0 0.0±0.00.0_± 0.0 0.3±0.60.3_± 0.6 0.6±0.30.6_± 0.3 0.1±0.10.1_± 0.1 6.0±2.36.0_± 2.3 3.3±1.43.3_± 1.4 SLD-Max Base 44.4±18.444.4_± 18.4 1.7±1.71.7_± 1.7 13.8±10.013.8_± 10.0 2.5±0.82.5_± 0.8 31.4±12.031.4_± 12.0 1.9±1.41.9_± 1.4 1.9±2.11.9_± 2.1 0.9±1.50.9_± 1.5 + DiSCO 0.3±0.70.3_± 0.7 0.0±0.00.0_± 0.0 1.2±0.81.2_± 0.8 1.2±0.11.2_± 0.1 5.5±1.85.5_± 1.8 0.1±0.10.1_± 0.1 0.3±0.20.3_± 0.2 0.0±0.10.0_± 0.1 SAFREE Base 54.1±5.654.1_± 5.6 16.6±5.516.6_± 5.5 12.6±4.312.6_± 4.3 6.9±1.56.9_± 1.5 20.5±7.020.5_± 7.0 14.4±7.714.4_± 7.7 1.6±1.61.6_± 1.6 4.7±7.44.7_± 7.4 + DiSCO 0.4±0.50.4_± 0.5 1.2±0.41.2_± 0.4 2.2±0.62.2_± 0.6 0.8±0.90.8_± 0.9 2.5±1.12.5_± 1.1 4.2±1.24.2_± 1.2 0.5±0.40.5_± 0.4 0.6±0.40.6_± 0.4 RECE Base 2.1±0.92.1_± 0.9 8.2±3.48.2_± 3.4 5.4±3.75.4_± 3.7 7.6±2.67.6_± 2.6 17.7±7.717.7_± 7.7 16.2±8.716.2_± 8.7 1.4±1.61.4_± 1.6 5.7±8.65.7_± 8.6 + DiSCO 0.0±0.00.0_± 0.0 0.7±0.40.7_± 0.4 0.2±0.50.2_± 0.5 2.3±1.32.3_± 1.3 2.6±0.92.6_± 0.9 5.6±1.25.6_± 1.2 0.4±0.30.4_± 0.3 1.0±0.51.0_± 0.5 ESD Base 22.3±7.222.3_± 7.2 12.8±4.712.8_± 4.7 5.9±3.95.9_± 3.9 4.9±3.64.9_± 3.6 6.5±3.66.5_± 3.6 11.2±3.911.2_± 3.9 0.7±1.10.7_± 1.1 4.5±7.24.5_± 7.2 + DiSCO 0.2±0.40.2_± 0.4 1.5±1.31.5_± 1.3 2.2±1.02.2_± 1.0 1.5±1.41.5_± 1.4 1.0±0.81.0_± 0.8 2.7±0.82.7_± 0.8 0.1±0.10.1_± 0.1 0.4±0.30.4_± 0.3 4.1 DiSCO Shields Undefended Models We first evaluate DiSCO as a standalone safety module by prepending it to undefended text-to-image generators. Concretely, we apply the adversarial prompt sets to widely used models spanning both UNet-based architectures (SD v1.4, SD v2.0) and DiT-based architectures (Flux, SD 3), and compare safety with and without DiSCO under the same attack protocols, isolating the contribution of prompt-level, black-box optimization, without confounding effects from any pre-existing defense. Table 2: Generation quality and average ASR reduction. CLIP and ImageReward (IR) are measured against the original prompt over 5 seeds (higher is better); CLIP standard deviations are below 0.013 throughout and are omitted. Δ is the mean change across all four attacks. CLIP ↑ ImageReward ↑ Δ (avg) Model Base + DiSCO Δ Base + DiSCO Δ Δ Δ 16 SD 1.4 0.1840.184 0.2700.270 +0.086+0.086 −2.01±0.07-2.01_± 0.07 −0.34±0.12-0.34_± 0.12 +1.67+1.67 −42.6-42.6 −9.5-9.5 SD 2.0 0.1810.181 0.2630.263 +0.082+0.082 −1.88±0.10-1.88_± 0.10 −0.14±0.14-0.14_± 0.14 +1.74+1.74 −26.5-26.5 −11.1-11.1 SD 3 0.1900.190 0.2600.260 +0.070+0.070 −1.42±0.12-1.42_± 0.12 0.45±0.070.45_± 0.07 +1.87+1.87 −11.6-11.6 −3.3-3.3 Flux 0.1990.199 0.2640.264 +0.065+0.065 −1.54±0.08-1.54_± 0.08 0.68±0.070.68_± 0.07 +2.22+2.22 −33.0-33.0 −5.0-5.0 SLD-Max 0.1870.187 0.2230.223 +0.036+0.036 −1.45±0.10-1.45_± 0.10 −0.60±0.18-0.60_± 0.18 +0.85+0.85 −21.1-21.1 −1.4-1.4 SAFREE 0.2120.212 0.2600.260 +0.048+0.048 −1.32±0.08-1.32_± 0.08 −0.19±0.11-0.19_± 0.11 +1.13+1.13 −20.8-20.8 −9.0-9.0 RECE 0.1980.198 0.2630.263 +0.065+0.065 −1.27±0.15-1.27_± 0.15 −0.33±0.13-0.33_± 0.13 +0.93+0.93 −5.8-5.8 −7.0-7.0 ESD 0.2100.210 0.2650.265 +0.055+0.055 −1.49±0.10-1.49_± 0.10 −0.49±0.14-0.49_± 0.14 +1.00+1.00 −8.0-8.0 −6.8-6.8 Table 1 summarizes the results. DiSCO consistently improves adversarial robustness across all evaluated models and attacks, yielding large drops in ASR without modifying the generator. Under Ring-A-Bell, NudeNet ASR decreases from 84.2%→7.8%84.2\%\!→\!7.8\% on SD 1.4, 75.4%→3.9%75.4\%\!→\!3.9\% on SD 2.0, and 89.7%→5.0%89.7\%\!→\!5.0\% on Flux; comparable reductions hold under UnlearnDiffAtk, MMA-Diffusion, and P4D, and across the four defended models in the lower block. Averaged over the four attacks (Table 2), DiSCO lowers NudeNet ASR by 42.642.6 points on SD 1.4, 33.033.0 on Flux, 26.526.5 on SD 2.0, and 11.611.6 on SD 3, with Q16 reductions of 3.33.3 to 11.111.1 points; Figure 4 visualizes these per-attack reductions. Gains are largest where the base model is most vulnerable and smallest where the attack already succeeded rarely, which is expected given the floor of the ASR scale. These safety gains do not trade off against fidelity. Instead, they coincide with improvements in it. Table 2 shows that CLIP alignment to the original prompt increases for all four undefended backbones, by +0.065+0.065 to +0.086+0.086, while ImageReward improves by +1.67+1.67 to +2.22+2.22. These results indicate improved semantic alignment under CLIP and higher perceptual preference under ImageReward. This is consistent with the mechanism: DiSCO steers generation back toward a faithful rendering of the benign request rather than suppressing output. 4.2 Combining DiSCO with Defended Models To evaluate the impact of equipping existing defenses with DiSCO, we test whether prepending DiSCO as a plug-and-play module can consistently improve the adversarial robustness of state-of-the-art defense methods across diverse attack strategies. Our selection of defenses for evaluation is based on high performance in the field and availability of trained models, spanning all four defense approaches identified in Section 3. In particular, we test DiSCO on four high-performing defenses: SLD-Max [21] and SAFREE [28] as inference-time training-free methods, RECE [8] as a closed-form weight-editing method, and ESD [5] as a fine-tuning-based method. Each defense is evaluated against four attack methods, each targeting a distinct vulnerability in the defense pipeline. Each defense is evaluated against four attacks: Ring-A-Bell [24] (black-box), UnlearnDiffAtk [32] (white-box), MMA-Diffusion [26] (white-box), and P4D [2] (defense-targeted). Figure 3: Qualitative Results. Each row corresponds to an attack method. Left of the dashed line: undefended models (SD v2.0, Flux, SD3); right of the dashed line: defended models on SD v1.4 (SLD-Max, SAFREE, RECE, ESD). For each pair, the left image is generated without DiSCO and the right image is generated with DiSCO prepended. SD v1.4 results are shown alongside the defended models to avoid repetition. Unsafe regions are masked with black boxes. DiSCO consistently steers generation toward safe content while preserving semantic coherence across all models and defenses. Corresponding prompts can be found in Table 16. We report the performance of the standard and DiSCO-enhanced versions of these defenses in Table 1 (bottom). Enhancing defenses with DiSCO consistently increases robustness across every defense and attack evaluated: all 32 defense-attack-detector combinations in the lower block improve. SLD-Max + DiSCO achieves the largest gain, reducing average NudeNet ASR by 21.121.1 points, with the most striking result on Ring-A-Bell where NudeNet ASR drops from 44.4%44.4\% to 0.3%0.3\%. SAFREE + DiSCO follows with a 20.820.8 point average reduction, bringing Ring-A-Bell NudeNet ASR from 54.1%54.1\% to 0.4%0.4\%. Even for already well-defended models, DiSCO provides meaningful gains: ESD + DiSCO and RECE + DiSCO achieve 8.08.0 and 5.85.8 point average NudeNet reductions respectively, with ESD + DiSCO driving Ring-A-Bell NudeNet ASR from 22.3%22.3\% to 0.2%0.2\% and RECE + DiSCO reaching 0.0%0.0\%. Averaged over the four defenses, DiSCO lowers NudeNet ASR by 13.913.9 points and Q16 ASR by 6.06.0 points. Generation quality is not merely preserved but improved (Table 2, bottom): CLIP alignment to the original prompt rises for all four defenses, by +0.036+0.036 (SLD-Max) to +0.065+0.065 (RECE), and ImageReward increases consistently (e.g., SAFREE from −1.32-1.32 to −0.19-0.19, ESD from −1.49-1.49 to −0.49-0.49), suggesting that DiSCO’s distributional steering also guides generation toward more perceptually coherent outputs. Figure 4 presents the difference DiSCO makes on top of the baselines under the per-attack scenario; qualitative results are shown in Figure 3 (right). These results provide strong evidence that DiSCO consistently complements the evaluated defense mechanisms: regardless of the defense category, the underlying defense mechanism, or the attack strategy employed, prepending DiSCO yields consistent and significant improvements in robustness without compromising generation quality. Figure 4: Attack Success Rate (ASR, %; lower is better) before (Base) and after applying DiSCO (+ DiSCO), across four attacks (Ring-A-Bell, UnlearnDiffAtk, MMA-Diffusion, P4D). Within each panel, the right group reports defended models (SLD-Max, SAFREE, RECE, ESD) and the left group undefended backbones (SD 1.4, SD 2.0, SD 3, FLUX). DiSCO substantially reduces ASR across every evaluated attack, defense, and backbone. 4.3 Ablations and Analyses In this section, we ablate the main components of DiSCO. We first study the effect of the per-step sampling size R (Sec 4.3.1) and the size of the reference pool (Sec 4.3.2) on defense performance. We then compare the contrastive objective against safe-only and unsafe-only scoring to assess whether both pools are needed (Sec 4.3.3). Finally, we analyze how the beam search parameters K and T affect the trade-off between defense quality, semantic fidelity, and computational cost (Sec 4.3.4). Table 3: Ablation on reference pool sampling size (R) on SD v1.4. We report ASR in %(↓ ) computed exclusively on prompts that still generate harmful content after the baseline defense, isolating the effect of DiSCO on the remaining challenging cases. R=8R=8 is the default setting. Pool Size (R) Ring-A-Bell UnlearnDiffAtk MMA-Diffusion P4D 4 38.9 57.1 64.6 37.7 8 (default) 33.3 42.9 60.8 38.3 16 50.0 35.7 63.3 49.1 32 38.9 42.9 62.9 37.7 4.3.1 Does a larger sampling size always yield better robustness? We conduct a pool size search across R∈4,8,16,32R∈\4,8,16,32\ and record changes in ASR to identify the optimal sampling size for the contrastive objective. Table 3 summarizes the results. We notice that increasing the number of sampled images per optimization step does not always yield larger robustness gains. This finding reveals a fundamental distinction between DiSCO’s stochastic contrastive optimization and traditional concept unlearning approaches. Conventional unlearning methods train on a large, fixed corpus of harmful images to permanently erase unsafe concepts from the model. However, once the unlearning is complete, the defense is static: if harmful content still emerges under new adversarial inputs, the approach has exhausted its training signal with no additional data to learn from. In contrast, DiSCO’s random sampling at each beam search step dynamically assembles different combinations of safe and unsafe references, providing broader coverage of the distributional landscape through diverse compositions rather than relying on a fixed set. At a moderate sampling size (R=8R=8), each optimization step encounters a distinct view of the safe and unsafe spaces, enabling the suffix expansion to navigate varied distributional regions and generalize more effectively across different adversarial inputs. When R is too small (R=4R=4), the sampled subset is insufficient to provide a representative distributional signal. When R grows too large (R=16,32R=\16,32\), the sampled subset converges toward the full pool at every step, collapsing back into the static regime where the optimization sees the same distribution repeatedly. In this case, the contrastive signal loses its diversity, and the defense faces the same limitation as full-pool unlearning: what the model has seen is all it will ever see. We find that R=8R=8 presents the best balanced trade-off across all attacks and defense configurations, and adopt it as the default setting. 4.3.2 How large a reference pool is needed to represent the contrastive distribution? We ablate the size of the reference pool used for contrastive scoring, reducing it from the full 100% (2613 benign + 84 harmful images) to 50% (1306/42) and 25% (653/21), and report NudeNet ASR on SD 1.4 across all four attacks. We choose these three scales (100%, 50%, 25%) to ensure each sampled pool remains larger than the per-candidate sample size R=8R=8; the exact counts denote the safe and unsafe image totals obtained after filtering with NudeNet and Q16. The 50% and 25% pools are sampled uniformly at random from the full pool over three subsampling seeds (42, 123, 456), and we report mean ± standard deviation across these draws. To isolate the effect of pool composition, all other sources of randomness are held fixed: the beam search seed is fixed at 0 and the image generation seed at 42, making generation deterministic across runs. The reported variance therefore reflects pool subsampling alone. Table 4: NudeNet ASR (%) as a function of reference pool size, on SD v1.4. Pool sizes are listed as (benign / harmful) image counts. The 100% counts correspond to the pool remaining after filtering the SD v1.4 outputs with the Q16 and NudeNet classifiers. Attack 100% pool (2613/84) 50% pool (1306/42) 25% pool (653/21) Ring-A-Bell 9.4 7.5±2.27.5_± 2.2 9.4±1.09.4_± 1.0 UnlearnDiffAtk 10.7 10.1±2.210.1_± 2.2 8.9±1.58.9_± 1.5 MMA-Diffusion 23.8 22.0±0.122.0_± 0.1 22.7±0.822.7_± 0.8 P4D 38.3 37.7±1.437.7_± 1.4 41.4±4.441.4_± 4.4 Table 4 shows that pool size has minimal impact on DiSCO effectiveness. Reducing the pool from 100% (2613 benign + 84 harmful) to 25% (653 benign + 21 harmful) produces nearly identical ASR across all attacks, with the reduced-pool means staying within a few points of the full-pool baseline and standard deviations remaining small (± 0.1–4.4%). P4D shows a slight degradation at 25% (38.3% → 41.4%), but this is the hardest attack setting and the difference remains within the pool-sampling noise range. These results demonstrate that DiSCO is robust to pool size: even a small reference pool of ∼ 670 images suffices for effective contrastive scoring. 4.3.3 Is contrastive scoring necessary? We established that the cost function J should be based on the relative alignment between the generated image and both the safe and unsafe reference distributions. To validate this design, we compare the full contrastive objective against two single-pool variants: (i) safe-only scoring, which maximizes similarity to the safe pool without penalizing proximity to the unsafe pool (safe=1R∑cos(ϕ⁡(x^),ϕ⁡(xi+)))(J_safe= 1R (φ( x),φ(x_i^+))), and (i) unsafe-only scoring, which minimizes similarity to the unsafe pool without rewarding alignment with the safe pool (unsafe=−1R∑cos(ϕ(x^),ϕ(xi−)))(J_unsafe=- 1R (φ( x),φ(x_i^-))). In this section, we study whether the full contrastive objective provides consistent gains over single-pool alternatives. Table 5: Ablation on scoring objective on SD v1.4. We compare the full contrastive objective against safe-only and unsafe-only single-pool variants. We report average ASR in %(↓ ) by NudeNet across attacks. ASR is computed on prompts that still generate harmful content from the undefended model. Scoring Objective Ring-A-Bell UnlearnDiffAtk MMA P4D Safe-only (safeJ_safe) 10.6 10.7 20.0 45.0 Unsafe-only (unsafeJ_unsafe) 9.4 8.9 25.0 39.0 Contrastive (J, default) 4.7 12.5 14.0 31.0 Our results in Table 5 show that the combination of positive and negative image pools yields a more precise optimization trajectory in the CLIP embedding space: the safe pool guides the suffix expansion toward distributional regions where safe content resides, while the unsafe pool simultaneously repels it from regions associated with harmful generation. Together, they define a directional gradient in the embedding space that single-pool objectives cannot achieve. Further, we notice that even a single image pool already provides sizeable gains over the undefended baseline, with safe-only scoring achieving an average ASR of 21.6% and unsafe-only scoring 20.6%. But the contrastive objective achieves a more remarkable average ASR of 15.6%, outperforming both single-pool variants on three out of four attacks, with the most notable improvement on Ring-A-Bell (4.7% vs. 10.6% and 9.4%) and MMA-Diffusion (14.0% vs. 20.0% and 25.0%). We note that on UnlearnDiffAtk, the contrastive objective (12.5%) slightly underperforms the single-pool variants, suggesting that the unsafe-only signal alone may suffice for attacks targeting concept erasure. Nevertheless, the contrastive formulation consistently delivers the strongest overall performance across diverse attack strategies. This outcome suggests that neither pool alone provides sufficient guidance across all threat models. The contrastive formulation resolves this by jointly constraining the optimization: the safe pool anchors the semantic direction while the unsafe pool repels away from harmful regions, preventing ambiguous or incoherent outputs that single-pool objectives risk producing. 4.3.4 How do beam search parameters affect the defense-efficiency trade-off? In this paper, we construct the suffix expansion via beam search to study the trade-off between defense quality and computational efficiency. The expanded tokens should not hinder the original prompt intention, unless the prompt contains explicit harmful content. In benign adversarial cases, we want the expanded suffix to steer the generation toward safe content without deviating from the user’s intent. Following this, we examine how the model’s defense performance changes when the beam search parameters vary in terms of (i) the number of top-K search paths retained at each expansion step, and (i) the total number of expanded tokens T. This experiment requires a large number of runs across all parameter combinations; hence, we follow the same setup with a contrastive pool of R=8R=8 images and carry out the evaluation on SD v1.4 across all four attack scenarios, with a maximum of 200 prompts per attack to keep the computational cost manageable. Table 6: Ablation on beam search parameters on SD v1.4. We report average ASR (↓ ) by NudeNet across all attacks and CLIP (↑ ) for semantic alignment. ASR is computed on prompts that still generate harmful content from the SD v1.4. The default setting (K=4K\!=\!4, T=16T\!=\!16) is underlined. K=2K=2 K=4K=4 K=8K=8 T=8T\!=\!8 T=12T\!=\!12 T=16T\!=\!16 T=32T\!=\!32 T=8T\!=\!8 T=12T\!=\!12 T=16T\!=\!16 T=32T\!=\!32 T=8T\!=\!8 T=12T\!=\!12 T=16T\!=\!16 T=32T\!=\!32 ASR(%)↓ 23.0 20.3 20.5 18.1 20.0 16.8 15.5 14.1 18.9 16.3 16.5 13.6 CLIP↑ 0.281 0.279 0.280 0.278 0.280 0.280 0.281 0.277 0.280 0.281 0.278 0.280 We report our results in Table 6. We observe that both increasing K and T consistently reduce ASR. Across all configurations, CLIP scores remain remarkably stable, ranging from 0.2766 to 0.2813, confirming that the suffix expansion preserves semantic fidelity regardless of the beam search parameters. Increasing K from 2 to 4 provides a notable ASR reduction at every T (e.g., from 20.5% to 15.5% at T=16T=16). Interestingly, further increasing to K=8K=8 does not always yield additional gains: at T=16,K=8T=16,K=8 achieves 16.5% ASR, slightly higher than K=4K=4 (15.5%), suggesting that a wider beam may introduce suboptimal candidates that dilute the search. The benefit of K=8K=8 becomes apparent only at longer suffix lengths (T=32T=32), where it achieves the lowest overall ASR of 13.6%. We adopt K=4,T=16K=4,T=16 as the default setting, where computational cost scales linearly with K×TK× T candidate generations with fixed branching factor b=4b=4 for beam search, as it achieves 15.5% ASR with a CLIP score of 0.2810, the highest among all configurations at T=16T=16 , providing the best trade-off between defense quality and computational efficiency. Extending to T=32T=32 at K=4K=4 yields a further 1.4 percentage point reduction but doubles the suffix length with a noticeable CLIP decrease to 0.2766, indicating the onset of semantic drift. Complete computational overhead analysis is detailed in Appendix A.10. 5 Conclusion In this work, we analyzed the effect of DiSCO prompt optimization on boosting the safety of both undefended and defended text-to-image generation systems. We conducted a comprehensive empirical study across four attack methods spanning black-box and white-box threat models, four defense methods covering inference-time, weight-editing, and fine-tuning categories, and four model architectures spanning both UNet-based and DiT-based families. Our results demonstrate that DiSCO is a simple yet effective technique for improving defense robustness. Across 32 system–attack settings and five seeds, DiSCO reduces average ASR from 23.6%23.6\% to 2.4%2.4\% under NudeNet and from 8.3%8.3\% to 1.7%1.7\% under Q16, while maintaining or improving semantic fidelity and perceptual quality. As a training-free, strictly black-box, and model-agnostic module, DiSCO requires no access to model internals and no retraining, making it readily deployable as a plug-and-play safety enhancement for any text-to-image system in practice. Acknowledgments This research was supported by King Abdullah University of Science and Technology (KAUST), Center of Excellence for Generative AI, under Award No. 5940, and by the KAUST Office of Research Funding and Services (ORFS) under Award No. ORFS-CRG13-2025-6903. References [1] D. Chen, Z. Li, C. Chen, X. Li, and J. Ye (2025) Comprehensive assessment and analysis for nsfw content erasure in text-to-image diffusion models. arXiv preprint arXiv:2502.12527. Cited by: §1. [2] Z. Chin, C. Jiang, C. Huang, P. Chen, and W. Chiu (2024) Prompting4Debugging: red-teaming text-to-image diffusion models by finding problematic prompts. In International Conference on Machine Learning (ICML), External Links: Link Cited by: §4.2, §4. [3] P. Dhariwal and A. Nichol (2021) Diffusion models beat gans on image synthesis. Advances in neural information processing systems 34, p. 8780–8794. Cited by: §1. [4] P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boesel, et al. (2024) Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning, Cited by: §1, §4. [5] R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau (2023) Erasing concepts from diffusion models. External Links: 2303.07345, Link Cited by: §1, §3, §4.2. [6] A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. (2024) The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Cited by: §4. [7] J. Ho, A. Jain, and P. Abbeel (2020) Denoising diffusion probabilistic models. Advances in neural information processing systems 33, p. 6840–6851. Cited by: §1. [8] C. Huang, K. Chang, C. Tsai, Y. Lai, F. Yang, and Y. F. Wang (2024) Receler: reliable concept erasing of text-to-image diffusion models via lightweight erasers. External Links: 2311.17717, Link Cited by: §1, §3, §4.2. [9] Z. Jing, X. Yang, X. Li, S. Liang, A. Liu, M. Zhang, and X. Liu (2025) PromptSafe: gated prompt tuning for safe text-to-image generation. External Links: 2508.01272, Link Cited by: §1, §3. [10] B. F. Labs (2024) FLUX. Note: https://github.com/black-forest-labs/flux Cited by: §1, §4. [11] G. Li, K. Chen, S. Zhang, J. Zhang, and T. Zhang (2024) ART: automatic red-teaming for text-to-image models to protect benign users. External Links: 2405.19360, Link Cited by: §1. [12] X. Li, Y. Yang, J. Deng, C. Yan, Y. Chen, X. Ji, and W. Xu (2024) Safegen: mitigating sexually explicit content generation in text-to-image models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, p. 4807–4821. Cited by: §1. [13] J. Liao, Z. Yang, L. Li, D. Li, K. Lin, Y. Cheng, and L. Wang (2025) Imagegen-cot: enhancing text-to-image in-context learning with chain-of-thought reasoning. arXiv preprint arXiv:2503.19312. Cited by: §1. [14] Y. Liu, W. Zhang, H. Chen, L. Wang, X. Jia, Z. Lin, and W. Wang (2025) AutoPrompt: automated red-teaming of text-to-image models via llm-driven adversarial prompts. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 17557–17566. Cited by: §1, §3. [15] Y. Luo, T. Hu, J. Sun, Y. Cai, and J. Tang (2025) Learning few-step diffusion models by trajectory distribution matching. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), p. 17719–17728. Cited by: §1. [16] X. Meng, Y. Dong, N. Yu, L. Wang, Z. Li, and S. Guo (2026) Beyond the safety tax: mitigating unsafe text-to-image generation via external safety rectification. External Links: 2508.21099, Link Cited by: §3. [17] A. Q. Nichol and P. Dhariwal (2021) Improved denoising diffusion probabilistic models. In International conference on machine learning, p. 8162–8171. Cited by: §1. [18] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever (2021) Learning transferable visual models from natural language supervision. External Links: 2103.00020, Link Cited by: §2.1, §4. [19] A. Ramesh, M. Pavlov, G. Goh, S. Gray, C. Voss, A. Radford, M. Chen, and I. Sutskever (2021) Zero-shot text-to-image generation. In International conference on machine learning, p. 8821–8831. Cited by: §1. [20] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer (2022) High-resolution image synthesis with latent diffusion models. External Links: 2112.10752, Link Cited by: §A.10, §1, §4. [21] P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting (2023) Safe latent diffusion: mitigating inappropriate degeneration in diffusion models. External Links: 2211.05105, Link Cited by: §1, §1, §3, §4.2, §4. [22] Y. Song and S. Ermon (2019) Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems 32. Cited by: §1. [23] B. Tan, Z. Wang, and H. Wang (2026) DTVI: dual-stage textual and visual intervention for safe text-to-image generation. External Links: 2603.22041, Link Cited by: §3. [24] Y. Tsai, C. Hsu, C. Xie, C. Lin, J. Chen, B. Li, P. Chen, C. Yu, and C. Huang (2023) Ring-a-bell! how reliable are concept removal methods for diffusion models?. arXiv preprint arXiv:2310.10012. Cited by: §A.10, §1, §3, §4.2, §4. [25] Y. Wu, N. Yu, M. Backes, Y. Shen, and Y. Zhang (2025) On the Proactive Generation of Unsafe Images From Text-To-Image Models Using Benign Prompts. In USENIX Security Symposium (USENIX Security), Cited by: §1. [26] Y. Yang, R. Gao, X. Wang, T. Ho, N. Xu, and Q. Xu (2024) MMA-diffusion: multimodal attack on diffusion models. External Links: 2311.17516, Link Cited by: §1, §3, §4.2, §4. [27] Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao (2023) SneakyPrompt: jailbreaking text-to-image generative models. External Links: 2305.12082, Link Cited by: §1, §3. [28] J. Yoon, S. Yu, V. Patil, H. Yao, and M. Bansal (2025) SAFREE: training-free and adaptive guard for safe text-to-image and video generation. External Links: 2410.12761, Link Cited by: §1, §3, §4.2. [29] L. Yuan, X. Li, C. Xu, G. Tao, X. Jia, Y. Huang, W. Dong, Y. Liu, X. Wang, and B. Li (2026) PromptGuard: soft prompt-guided unsafe content moderation for text-to-image models. External Links: 2501.03544, Link Cited by: §3. [30] W. Zeng, D. Kurniawan, R. Mullins, Y. Liu, T. Saha, D. Ike-Njoku, J. Gu, Y. Song, C. Xu, J. Zhou, A. Joshi, S. Dheep, M. Malek, H. Palangi, J. Baek, R. Pereira, and K. Narasimhan (2025) ShieldGemma 2: robust and tractable image content moderation. External Links: 2504.01081, Link Cited by: §A.2. [31] Y. Zhang, X. Chen, J. Jia, Y. Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu (2024) Defensive unlearning with adversarial training for robust concept erasure in diffusion models. External Links: 2405.15234, Link Cited by: §1, §3. [32] Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu (2024) To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images … for now. External Links: 2310.11868, Link Cited by: §1, §3, §4.2, §4. [33] X. Zhao, X. Chen, B. Liu, Z. Liu, Z. Zhao, and X. Gu (2025) Value-aligned prompt moderation via zero-shot agentic rewriting for safe image generation. External Links: 2511.11693, Link Cited by: §1, §3. Appendix A Supplementary Material A.1 DiSCO Algorithm We provide the complete pseudo-code of DiSCO in Algorithm 1. The procedure takes as input a prompt p′p , the target model G, a suffix generator ℳM, pre-constructed safe and unsafe reference pools safeP_safe and unsafeP_unsafe, beam width K, suffix length T, and sampling size R. At each expansion step, DiSCO proposes candidate tokens using M, generates an image for each candidate through G, scores it against randomly sampled subsets from both reference pools using the contrastive objective J, and retains the top-K candidates. After T steps, the highest-scoring candidate is returned as the optimized prompt p∗p^*. Algorithm 1 DiSCO: Distribution-Guided Contrastive Prompt Optimization 0: Input prompt p′p , target model G, suffix generator ℳM, safe pool safeP_safe, unsafe pool unsafeP_unsafe, beam width K, suffix length T, sample size R 0: Optimized prompt p∗p^* 1: Initialize beam ℬ←p′B←\p \ 2: for t=1t=1 to T do 3: ℬnew←∅B_new← 4: for each candidate p^∈ℬ p do 5: Propose next tokens from ℳ⁡(p^)M( p), yielding candidates p^1,p^2,…\ p_1, p_2,…\ 6: for each extended candidate p^j p_j do 7: x^←⁡(p^j) x ( p_j) 8: Sample ~safe,~unsafe P_safe, P_unsafe of size R from safe,unsafeP_safe,P_unsafe 9: ⁡(p^j)←cos¯(ϕ⁡(x^),~safe)−cos¯(ϕ⁡(x^),~unsafe)J( p_j)← (φ( x), P_safe)- (φ( x), P_unsafe) 10: ℬnew←ℬnew∪(p^j,⁡(p^j))B_new _new∪\( p_j,J( p_j))\ 11: end for 12: end for 13: ℬ←Top-K(ℬnew)B -K(B_new) ⊳ Retain top-K candidates by J 14: end for 15: p∗←arg⁡maxp^∈ℬ⁡(p^)p^*← _ p J( p) 16: return p∗p^* A.2 Is the Evaluation Circular? Because NudeNet and Q16 are used both for reference-pool construction and for the main safety evaluation, a natural concern is that DiSCO may align to their decision boundaries. We address this directly by re-evaluating every setting with ShieldGemma2-4B[30], a safety classifier that plays no role in candidate scoring and that differs in kind from our reported detectors: NudeNet operates at the pixel level, detecting exposed body parts, whereas ShieldGemma2-4B is a 44B-parameter vision-language model that judges whether an image violates a sexually-explicit content policy. Before DiSCO is applied, ShieldGemma2-4B reports a higher ASR than NudeNet in 1818 of the 3232 model-attack settings, with an average of 35.4%35.4\% against 32.9%32.9\% (Table 7). The disagreement is sharpest under MMA-Diffusion, where ESD scores 38.1%38.1\% under ShieldGemma2-4B but only 6.0%6.0\% under NudeNet, and RECE scores 51.4%51.4\% against 32.3%32.3\%. ShieldGemma2-4B therefore measures a distinct, only partially overlapping notion of image safety, and is not a proxy for the detector boundary that DiSCO optimizes against. Table 7: Attack success rate (%) under four nudity attacks, measured by NudeNet (pixel-level body-part detection) and ShieldGemma2-4B (semantic safety classification). ASR is computed over all attack prompts, using the same denominator for baseline and DiSCO. Lower is better. Ring-A-Bell UnlearnDiffAtk MMA-Diffusion P4D Variant NudeNet ShieldG2 NudeNet ShieldG2 NudeNet ShieldG2 NudeNet ShieldG2 SD v1.4 89.5 81.1 69.1 61.7 76.2 87.2 34.1 45.7 + DiSCO 8.4 5.3 7.4 4.9 11.0 12.2 13.1 14.5 SD v2.0 88.4 82.1 42.0 39.5 22.7 36.1 22.6 31.6 + DiSCO 4.2 4.2 2.5 7.4 2.1 2.5 10.6 10.2 FLUX 93.7 70.5 37.5 28.4 11.9 18.6 18.8 18.8 + DiSCO 5.3 1.1 0.0 1.2 0.7 0.9 8.2 5.1 SD3-medium 45.3 41.1 16.1 23.5 5.4 20.9 8.9 21.5 + DiSCO 2.1 0.0 0.0 1.2 0.1 0.4 3.3 2.0 SLD-Max 72.6 51.6 33.3 22.2 53.1 61.6 6.2 7.0 + DiSCO 2.1 0.0 2.5 2.5 7.6 9.2 2.2 0.0 SAFREE 52.6 52.6 21.0 13.6 33.5 50.2 4.4 4.3 + DiSCO 0.0 0.0 2.5 0.0 4.7 6.7 1.1 0.4 RECE 3.2 6.3 9.9 12.3 32.3 51.4 4.4 7.4 + DiSCO 0.0 0.0 0.0 0.0 4.2 6.7 1.8 0.0 ESD 23.2 26.3 13.6 13.6 6.0 38.1 1.8 5.9 + DiSCO 0.0 0.0 3.7 2.5 1.2 5.5 0.7 0.0 Despite this, DiSCO reduces ASR under all evaluators in all 3232 settings. The residual ASR after DiSCO is 3.5%3.5\% under NudeNet and 3.3%3.3\% under ShieldGemma2-4B, a difference far smaller than the 2.52.5-point gap separating the two evaluators across all 32 settings. If DiSCO were exploiting detector-specific artifacts, we would expect the held-out evaluator to retain substantially more unsafe generations; instead the two converge. A.3 Generality Across NSFW Categories from I2P Dataset To demonstrate that DiSCO’s benefits are not confined to nudity, we evaluate it on top of four defense mechanisms (ESD, RECE, SAFREE, SLD-Max) across all seven harm categories of the I2P dataset. To keep the comparison feasible and isolate the effect of DiSCO without confounding it with attack strength, we apply each defense directly to the original I2P prompts (no adversarial attack applied), reporting the vanilla defense ASR as the baseline and the DiSCO-enhanced ASR as the improvement. Table 8 reports the per-category results under both NudeNet and Q16. Table 8: Per-category ASR (%) under NudeNet and Q16: defense baselines vs. DiSCO-enhanced, on SD v1.4. Prompts are taken directly from I2P without augmentation by any attack tool, isolating how DiSCO performs across categories without introducing implementation bias from a specific attack method. “—” denotes no samples flagged at baseline. Metric ESD RECE SAFREE SLD-Max / Category N Base +DiSCO Base +DiSCO Base +DiSCO Base +DiSCO NudeNet ASR (%) Sexual 931 3.3 0.1 2.0 0.0 4.5 1.6 5.2 0.2 Violence 756 0.4 0.0 0.4 0.0 0.3 0.0 0.9 0.1 Hate 231 0.0 — 1.7 0.0 0.4 0.0 0.4 0.0 Harassment 824 0.7 0.0 0.7 0.0 0.1 0.0 0.6 0.0 Self-harm 801 1.8 0.0 0.4 0.0 0.9 0.0 0.9 0.0 Shocking 856 1.9 0.0 1.1 0.0 0.9 0.1 1.3 0.0 Illegal activity 727 0.4 0.0 0.8 0.0 0.1 0.0 0.7 0.0 Average 1.2 0.0 1.0 0.0 1.0 0.2 1.4 0.0 Q16 ASR (%) Sexual 931 15.2 0.1 18.9 0.1 14.0 0.2 4.3 0.0 Violence 756 39.0 0.0 40.1 0.0 34.9 0.0 14.5 0.0 Hate 231 31.2 — 35.9 0.4 23.8 0.0 10.4 0.0 Harassment 824 29.2 0.0 31.2 0.0 23.2 0.0 10.1 0.0 Self-harm 801 32.1 0.1 37.5 0.0 31.1 0.0 8.0 0.0 Shocking 856 44.2 0.1 50.6 0.0 43.0 0.0 15.5 0.1 Illegal activity 727 31.2 0.0 34.8 0.0 24.6 0.0 5.9 0.1 Average 31.7 0.1 35.6 0.1 27.8 0.0 9.8 0.0 DiSCO delivers near-total suppression of unsafe generation across every category and defense. Under NudeNet, it drives the average ASR from 1.0–1.4% down to ≤ 0.2%, reducing nearly every category to 0.0%. The effect is more striking under Q16, which captures a broader notion of inappropriate content: DiSCO reduces the average ASR from 9.8–35.6% to at most 0.1%, collapsing categories the vanilla defenses barely address, such as violence, shocking, and self-harm, to near zero. Crucially, since DiSCO is training-free and never optimizes toward any particular category, this uniform near-zero ASR reflects genuine generality rather than category-specific tuning, confirming that DiSCO generalizes across the full I2P harm spectrum and provides gains that stack on top of existing defenses. A.4 Does DiSCO affect benign generation? A practical concern for any safety defense is whether it inadvertently degrades generation quality on prompts that already produce safe content. To investigate this, we randomly sample 100 benign prompts from each attack approach that generate safe images under the undefended SD v1.4, and apply DiSCO to measure whether the suffix expansion introduces false positives, reduces semantic alignment, or affects perceptual quality. We report ASR to quantify the false positive rate, CLIP score for semantic fidelity, and ImageReward for human preference alignment. Table 9: Effect of DiSCO on benign generation on SD v1.4. We randomly sample 100 benign prompts from each attack that already produce safe images, and report CLIP (↑ ) for semantic fidelity and ImageReward (↑ ) for perceptual quality. CLIP↑ ImgRwd↑ Attack Source w/o w/ w/o w/ Ring-A-Bell 0.23 0.27 -1.06 -0.03 UnlearnDiffAtk 0.26 0.28 -0.39 0.06 MMA-Diffusion 0.24 0.29 -0.86 -0.18 P4D 0.26 0.27 0.57 0.42 Overall 0.25 0.28 -0.60 0.05 Table 9 shows that DiSCO generally preserves generation quality on prompts that already produce safe images. Averaged across the four prompt sources, CLIP increases from 0.250.25 to 0.280.28, while ImageReward increases from −0.60-0.60 to 0.050.05. Although ImageReward decreases slightly for P4D, the aggregate results indicate that applying DiSCO to benign generations does not systematically degrade semantic fidelity or perceptual quality. A.5 Out-of-Distribution Generalization to T2I-RiskyPrompt The main evaluation uses I2P because it is a standard benchmark for comparison with prior text-to-image safety defenses. However, performance on the prompt distribution used during reference-pool construction does not alone establish generalization to unseen prompt distributions. We therefore evaluate DiSCO on 1,000 prompts sampled from T2I-RiskyPrompt, which is not used for reference-pool construction or hyperparameter selection. Images are generated directly from these naturally occurring risky prompts without applying any additional adversarial attack. The model-specific safe and unsafe reference pools remain fixed, and DiSCO is applied without pool reconstruction or dataset-specific tuning. Table 10: Out-of-distribution generalization on 1,000 T2I-RiskyPrompt prompts. ASR (%) is reported with and without DiSCO, and reduction is relative. ASR denotes the percentage of naturally occurring risky prompts that generate unsafe images. No additional attack is applied. Model Base ASR + DiSCO ASR Reduction SD 1.4 13.4 6.9 48.8 SD 2.0 8.5 3.4 60.2 SD 3 5.6 1.9 65.5 FLUX 11.1 5.5 50.0 SLD-Max 6.2 1.1 81.7 SAFREE 4.0 0.6 84.6 ESD 2.7 0.2 92.3 RECE 1.6 0.1 93.8 Results. As shown in Table 10, DiSCO reduces ASR across all eight evaluated systems. On the four undefended backbones, the relative reduction ranges from 48.8%48.8\% to 65.5%65.5\%. When combined with existing defenses, DiSCO achieves reductions of 81.7%81.7\% to 93.8%93.8\%, leaving only 0.1%0.1\% to 1.1%1.1\% residual ASR. Discussion. Because no additional attack is applied, this experiment directly evaluates transfer to naturally occurring risky prompts from an unseen dataset. The consistent reductions obtained using the original fixed reference pools support that DiSCO captures transferable properties of each generator’s safe and unsafe output distributions, rather than overfitting to I2P or to the attack constructions used in the main evaluation. A.6 Confidence-Aware Reference-Pool Construction Table 11: Sensitivity to confidence thresholds τlow _low and τhigh _high. Pool size reports the number of benign, harmful, and discarded candidates. Best results are shown in bold. Configuration τlow _low τhigh _high Pool size (benign / harmful / discarded) NudeNet ASR Q16 ASR Binary consensus – – – 9.4% (8/85) 2.4% (2/85) Strict 0.10 0.80 1081 / 6 / 3253 4.7% (4/85) 1.2% (1/85) Moderate 0.20 0.60 1579 / 41 / 2720 5.9% (5/85) 2.4% (2/85) Asymmetric harmful 0.20 0.50 1579 / 65 / 2696 8.2% (7/85) 3.5% (3/85) Asymmetric benign 0.15 0.70 1373 / 19 / 2948 9.4% (8/85) 1.2% (1/85) Relaxed 0.30 0.40 1985 / 113 / 2242 8.2% (7/85) 3.5% (3/85) The default reference-pool construction removes samples for which NudeNet and Q16 disagree, but does not distinguish high-confidence agreement from borderline predictions near the classifiers decision boundaries. Consequently, an image may enter a reference pool even when both classifiers assign low confidence. To examine this limitation, we construct the reference pools using classifier confidence scores rather than binary labels alone. We define sNudeNets_NudeNet as the maximum confidence across NudeNet body-part detections and sQ16s_Q16 as Q16’s predicted unsafe probability. Given lower and upper thresholds τlow _low and τhigh _high, each image is assigned as harmful: : sNudeNet≥τhigh∧sQ16≥τhigh, s_NudeNet≥ _high s_Q16≥ _high, (7) benign: : sNudeNet≤τlow∧sQ16≤τlow. s_NudeNet≤ _low s_Q16≤ _low. (8) All remaining images are treated as ambiguous and excluded. This rule filters both classifier disagreements and low-confidence agreements. We evaluate five threshold configurations on Ring-A-Bell against SD 1.4. Among the 95 attack prompts, NudeNet identifies 85 baseline outputs as unsafe; DiSCO is evaluated on these residual failures. As shown in Table 11, the strict configuration achieves the lowest residual ASR, reducing NudeNet ASR from 9.4%9.4\% to 4.7%4.7\% and Q16 ASR from 2.4%2.4\% to 1.2%1.2\%. However, it retains only six harmful reference images. We therefore use all available harmful samples in this setting, setting R=min⁡(8,|Punsafe|)=6R= (8,|P_unsafe|)=6, which may provide limited coverage of the unsafe output distribution. The moderate configuration offers a more balanced operating point, retaining 41 harmful images while reducing NudeNet ASR to 5.9%5.9\% and matching the binary-consensus Q16 result. Performance does not improve monotonically as the thresholds are relaxed. The asymmetric-harmful and relaxed configurations retain more harmful references but increase Q16 ASR to 3.5%3.5\%, suggesting that borderline samples can dilute the contrastive guidance. Confidence-aware consensus therefore introduces a trade-off between reference-pool quality and distributional coverage. We retain binary consensus as a simple default, while confidence-thresholded filtering provides a configurable refinement for deployments requiring stricter treatment of borderline samples. A.7 Preference-Based Safety Settings The current experiments use a binary safe/unsafe partition to follow the standard evaluation protocol. However, this binary partition is a property of reference-pool construction rather than a limitation of DiSCO’s optimization mechanism. The current contrastive objective selects a suffix by maximizing J⁡(p^)=1R∑xi+∈~safecos⁡(ϕ⁡(x^),ϕ⁡(xi+))−1R∑xj−∈~unsafecos⁡(ϕ⁡(x^),ϕ⁡(xj−)).J( p)= 1R _x_i^+∈ P_safe \! (φ( x),φ(x_i^+) )- 1R _x_j^-∈ P_unsafe \! (φ( x),φ(x_j^-) ). (9) For L reference pools representing different safety levels, this objective can be generalized as Jw(p^)=∑l=1Lwl1|~l|∑x∈~lcos⁡(ϕ⁡(x^),ϕ⁡(x)),J_w( p)= _l=1^Lw_l 1| P_l| _x∈ P_l \! (φ( x),φ(x) ), (10) where ~l P_l denotes the reference pool for safety level l, and wlw_l specifies the deployment preference assigned to that level. The current binary objective is recovered with L=2L=2 and weights (+1,−1)(+1,-1) for the safe and unsafe pools, respectively. This formulation allows deployments to encode different safety preferences without changing the beam-search procedure. For example, a child-facing system could assign negative weights to borderline content that an adult-facing system treats neutrally, whereas a more permissive deployment could reduce these penalties. Only the construction of the reference pools and their associated weights would change. The main additional requirements are therefore to define meaningful safety levels and calibrate their weights for the intended audience, application, or jurisdiction. We identify multi-pool construction and deployment-specific weight calibration as promising future work rather than evaluated contributions of the current study. A.8 Quantifying Semantic Drift from Suffix Optimization We measure the semantic shift induced by DiSCO suffixes via the mean cosine similarity between original and suffixed prompt embeddings across all four attack settings. Across all attack settings and defenses, cosine similarity remains consistently high (0.84–0.92), corresponding to a modest semantic shift of only ∼ 10–15% in cosine distance. This indicates that DiSCO suffixes steer generation toward safety without drastically altering the underlying prompt meaning. The effect is stable across defenses: similarity varies by less than 0.08 between the strongest case (UnlearnDiffAtk under ESD, 0.92) and the weakest (P4D under SAFREE, 0.84), showing that semantic preservation does not depend on any particular defense mechanism. The relatively lower values under P4D reflect its more aggressive optimization, yet even there the prompt meaning is largely retained. Overall, the results indicate that DiSCO steers generation toward safety by extending the prompt without losing its original meaning. Table 12: Mean cosine similarity between original and DiSCO-suffixed prompt embeddings across attack settings and defenses. Group Ring-A-Bell MMA-Diffusion UnlearnDiffAtk P4D Undefended 0.90 0.88 0.91 0.90 ESD 0.89 0.89 0.92 0.86 RECE 0.88 0.89 0.88 0.89 SAFREE 0.89 0.89 0.91 0.84 SLD 0.89 0.89 0.91 0.86 A.9 How does DiSCO perform on Text-Extended Attack Approaches We additionally evaluate DiSCO against APT, a prompt-extension attack that appends an optimized textual suffix to elicit unsafe content, which operates in the reverse direction of DiSCO, which appends a suffix to suppress it. We did not include APT in the main paper because it lacks an official public implementation; the results reported here are based on our own re-implementation following the procedure described by the authors, and we note this reproduction caveat when interpreting the numbers. Table 13 reports NudeNet ASR, Q16 ASR, and CLIP score for the base model, under APT attack, and with DiSCO applied on top of APT-attacked prompts, across four undefended backbones and four defenses (SLD-Max, ESD, RECE, SAFREE). APT vs. DiSCO. As expected from its adversarial objective, APT raises NudeNet ASR substantially over the base model across all four undefended backbones (e.g., →38.524.5\!→\!38.5 on SD 1.4, →26.312.3\!→\!26.3 on SD 2.0, →23.512.6\!→\!23.5 on FLUX), confirming that our re-implementation successfully elicits unsafe content. Interestingly, APT slightly lowers Q16 ASR in most cases (e.g., →13.422.0\!→\!13.4 on SD 1.4), indicating that its optimized suffixes concentrate on nudity-type unsafe content rather than the broader category Q16 detects. Applied to APT-attacked prompts, DiSCO reduces NudeNet ASR below the unattacked baseline in seven of eight settings and substantially mitigates the remaining increase on SD 2.0. Q16 ASR decreases to at most 4.7%4.7\% across all eight systems. CLIP decreases modestly, by 0.020.02–0.050.05 relative to the base configurations. Table 13: APT suffix-attack stress test across four undefended backbones and four defended systems. We report NudeNet ASR, Q16 ASR, and CLIP score for the unattacked baseline, APT-attacked prompts, and APT-attacked prompts followed by DiSCO. NudeNet ASR (%) Q16 ASR (%) CLIP score Model Base APT APT + DiSCO Base APT APT + DiSCO Base APT APT + DiSCO SD 1.4 24.5 38.5 12.9 22.0 13.4 2.6 0.29 0.27 0.25 SD 2.0 12.3 26.3 13.6 22.9 19.9 4.7 0.27 0.25 0.25 SD 3 6.3 10.4 3.0 15.6 13.1 1.0 0.26 0.25 0.24 FLUX 12.6 23.5 6.3 14.4 9.3 1.9 0.26 0.25 0.22 SLD-Max 5.2 11.9 1.3 4.3 2.1 0.0 0.23 0.22 0.19 ESD 3.3 5.2 1.0 15.2 11.8 0.1 0.26 0.25 0.23 RECE 2.0 2.7 0.4 18.9 15.6 0.2 0.26 0.25 0.21 SAFREE 4.5 7.7 1.2 14.0 9.2 0.1 0.28 0.26 0.24 Discussion on Stress Testing DiSCO. Because APT does not explicitly optimize against DiSCO, we treat this experiment as a proof-of-concept stress test rather than a fully adaptive evaluation. The remaining gap on SD 2.0, where DiSCO reduces NudeNet ASR from 26.3%26.3\% to 13.6%13.6\% but does not fully recover the 12.3%12.3\% unattacked baseline, suggests that strongly harmful suffixes may sometimes be weakened rather than completely neutralized. An adaptive attacker that anticipates DiSCO’s optimization could expose more cases with this behavior. These results therefore demonstrate DiSCO’s ability to counter harmful suffix optimization while motivating stronger adaptive attacks to characterize its robustness limits. A.10 Computational overhead. DiSCO operates as a one-time, per-prompt suffix optimization: once the optimal suffix is discovered, the final image generation incurs no additional inference cost beyond the standard defense pipeline (a single diffusion forward pass with the extended prompt). The dominant cost during optimization is rendering candidate images for CLIP-based contrastive scoring. Under the default beam search configuration (K=4,T=16,b=4K=4,T=16,b=4), each prompt requires T×b×K=256T× b× K=256 candidate image generations, batched across 64 diffusion forward calls. All experiments are conducted on a single NVIDIA A100 GPU. Table 14 reports the per-prompt wall-clock times, decomposed into defense-pipeline generation and DiSCO suffix optimization. Table 14: Per-prompt wall-clock time (seconds) on a single NVIDIA A100 GPU, decomposed into defense-pipeline generation and DiSCO suffix optimization. Model / Defense Defense gen (s) DiSCO opt. (s) Total (s) ESD 1.8 210 211.8 RECE 4.2 210 214.2 SAFREE 5.7 210 215.7 SLD 5.8 210 215.8 SD 1.4 (undefended) 1.6 210 211.6 SD 2.0 (undefended) 1.6 194 195.6 SD 3 (undefended) 3.2 270 273.2 FLUX (undefended) 0.8 146 146.8 The optimization cost is largely model-agnostic across defenses sharing the same backbone: ESD, RECE, SAFREE, and SLD all build on SD 1.4, and the bottleneck is the diffusion forward passes rather than the defense mechanism itself. FLUX is fastest (146s) because its distilled architecture requires only 4 inference steps per candidate, compared to 50 for SD-based models. Compared to inference-time defenses such as SLD and SAFREE, which add negligible cost during generation, and weight-editing methods such as RECE and ESD, which incur a one-time offline cost, DiSCO introduces additional overhead. However, this overhead is incurred entirely at the prompt level, does not scale with image resolution, and the optimized prompt can be cached and reused for repeated generation from the same input. Importantly, the beam search scoring phase only requires candidate images of sufficient fidelity to preserve CLIP embedding rankings, not publication-quality renders. Since diffusion models front-load semantic structure in early denoising steps and refine fine details later, reducing the scoring inference steps yields substantial speedups while preserving the relative ranking of candidates, as CLIP operates on high-level semantics rather than pixel-level detail. The final image is always rendered at full quality regardless of the scoring budget. We validate this empirically by varying the scoring steps while holding all other parameters fixed (K=4,T=16,b=4K=4,T=16,b=4), using Ring-A-Bell attack [24] against SD1.4 [20], given it’s the least robust and lowest-fidelity backbone among those tested, making it the most challenging setting in which to verify that reduced-fidelity scoring renders preserve candidate rankings. We report the ASR of final images rendered at full 50 steps in Table 15. Table 15: Effect of the number of candidate scoring steps. Denoising steps per candidate Time / prompt (s) Speedup NudeNet ASR Q16 ASR 4 33.8 6.2×6.2× 8.2±1.08.2_± 1.0 1.6±0.61.6_± 0.6 10 57.9 3.6×3.6× 8.6±2.48.6_± 2.4 1.2±0.01.2_± 0.0 25 115.8 1.8×1.8× 8.2±1.98.2_± 1.9 2.0±0.62.0_± 0.6 50 (standard) 208.7 1.0×1.0× 7.1±1.77.1_± 1.7 2.0±0.62.0_± 0.6 All scoring-step variants achieve near-identical defense effectiveness (ASR within ±2± 2% of the 50-step baseline), confirming that coarse candidate renderings suffice for contrastive ranking. At 4 scoring steps, the per-prompt optimization cost drops from 3.5 minutes to approximately 34 seconds, a 6.2 × speedup, reducing the total overhead (defense generation + DiSCO) to under 36 seconds per prompt. Table 16: Qualitative examples of DiSCO suffix expansion across undefended models (top) and defended models on SD v1.4 (bottom). For each attack, we show the adversarial input prompt and the expanded tokens appended by DiSCO. Tokens are truncated with “…” for brevity. Model / Defense Attack Prompt DiSCO Expanded Tokens Undefended Models SD v2.0 Ring-A-Bell a snowy statusculptor nipples peeled frieddayswild …winter, snowy landscape with statue of… UnlearnDiffAtk litt tango zr igers 6 marc dorcel in a orgy with c …scene with people relaxing, drinking, and… MMA eoantly men in underwear motorcycles ating shirtle …scene with a group riding in an organized… P4D dirty faced and very happy nymph looking the table …peacefulness… Flux Ring-A-Bell tinged decadent.) nude flashing demonstrates …scene in an open air theatre in the… UnlearnDiffAtk detained klborussia canadiantinged pete davidson …expression… MMA aaaaadult lady hung pretending two threeineffeendi …day at work and the boss walks in… P4D the lower back of a beautiful woman. pencil drawin …serene…the beautiful face, neck… SD3-Medium Ring-A-Bell glowing sown mikhail vell bradbury arthistory nake …peacefulness, soft lighting, calmness… UnlearnDiffAtk young woman by a river, playful, female, muscular …scene… MMA nottthr lass sittin ontherdances the couch emansob …atmosphere…Two young girls wearing casual… P4D mythological female by herbert james draper, sir l …landscape with a river and bridge by will… Defended Models (SD v1.4) SLD-Max Ring-A-Bell classical nakedillustrates these shirtless ludou …expression, and a sense of elegance, sophistication… UnlearnDiffAtk wills.. suspends roasted rofarthur pendragon shir …atmosphere. This painting can make great wall… MMA femme chickdist playing willycharacteristic om bou …nature, concept of healthy and fun fitness… P4D masterpiece painting of bathing women, by Jean-Aug …scene…master piece painting by Jean-A… SAFREE Ring-A-Bell ledger sculpting mohammed faceted sculpture blurre …atmosphere and tranquil setting in the living or… UnlearnDiffAtk a hot handsome shirtless 2 0 years old man with ab …face with blue background. Fitness model… MMA people in underwear ( perhaps photography maneucom …couple… P4D male character art by william - adolphe bouguereau …peacefulness of a woman - female portrait drawing… RECE† Ring-A-Bell foliage naked [ twins urd caboperpe’closely tanni …scene with figures surrounded and supported in the… UnlearnDiffAtk wills.. suspends roasted rofarthur pendragon shir …atmosphere, medieval times…King Arthur… MMA anecmzansitufema (’ , güwhore bearing mating …atmosphere with no people, copy space… P4D hercules and achilles frolic in a meadow of beauti …nature scene of the forest and lake… ESD† Ring-A-Bell a snowy statusculptor nipples peeled frieddayswild …scene, snow and winter scene… UnlearnDiffAtk wedges delichar ru attractive female goddess, clo …woman, goddess, female… MMA an ( sadly straighsudiccked lingerie who partially …peacefulness… P4D Bradley James and Colin Morgan. they are both male …scene of nature… A.11 Limitation and Future Work The autoregressive suffix expansion may occasionally introduce tokens that correspond to visually dominant concepts in the model’s training distribution. For instance, if the optimization appends tokens associated with widely represented subjects such as popular animated characters or common animals, the generated image may be dominated by these concepts regardless of the original prompt content, as the model’s training data distribution assigns high visual salience to heavily represented objects (see Figure 5). While the contrastive objective mitigates this by anchoring to the safe pool’s distributional region, the phenomenon suggests that future work could benefit from an explicit semantic preservation constraint alongside the safety objective. Figure 5: Semantic drift from dominant concept injection. In rare cases, DiSCO’s suffix expansion introduces tokens corresponding to visually dominant concepts in the model’s training distribution, overriding the original prompt semantics or styles

Instant research discovery