DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

# DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization
Source: [https://arxiv.org/html/2608.17067](https://arxiv.org/html/2608.17067)
Motasem AlfarraAffiliation:Qualcomm AI Research\[0\.4em\]\{tong\.zhang\.1, carlos\.hinojosa, bernard\.ghanem\}@kaust\.edu\.sa\{malfarra, clouizos\}@qti\.qualcomm\.com†\\daggerEqual ContributionCarlos HinojosaChristos LouizosAffiliation:Qualcomm AI Research\[0\.4em\]\{tong\.zhang\.1, carlos\.hinojosa, bernard\.ghanem\}@kaust\.edu\.sa\{malfarra, clouizos\}@qti\.qualcomm\.com†\\daggerEqual ContributionBernard Ghanem\[0\.6em\] King Abdullah University of ScienceTechnology \(KAUST\)

###### Abstract

As text\-to\-image generative models advance, they raise critical safety concerns, particularly the generation of Not\-Safe\-For\-Work \(NSFW\) content such as violence and nudity, further exacerbated by red\-teaming adversarial attacks\. Existing defenses predominantly operate under white\-box assumptions, relying on text encoder optimization, weight editing, or inference\-time intervention, and fundamentally cannot scale to proprietary models\. Black\-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as thebenign adversarialproblem: prompts that are linguistically safe but still trigger harmful generation due to the model’s learned data distribution\. We propose DiSCO, a training free, strictly black\-box defense that operates entirely at the prompt level as a plug\-and\-play module, requiring no model retraining, fine\-tuning, or access to model internals\. DiSCO performs distribution\-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced\. We demonstrate that across 32 system–attack settings and five seeds, DiSCO reduces average ASR from 23\.6% to 2\.4% under NudeNet and from 8\.3% to 1\.7% under Q16, while maintaining or improving generation quality\. As a black\-box, architecture\-agnostic module, DiSCO can be readily applied to any text\-to\-image system without necessitating any changes to the model itself\. Warning:This paper contains model outputs that are offensive in nature\.††Qualcomm AI Research is an initiative of Qualcomm Technologies, Inc\.††Disclaimer\. All images presented in this paper were generated at King Abdullah University of Science and Technology \(KAUST\) using institutional computing resources, solely for the purpose of evaluating and reporting the safety behavior of text\-to\-image models\. Potentially unsafe content generated during these experiments was produced exclusively for research evaluation, was handled under institutional oversight, and is not redistributed\.

## 1Introduction

The onset of text\-to\-image generation has transformed creative workflows across industries\[[13](https://arxiv.org/html/2608.17067#bib.bib27),[19](https://arxiv.org/html/2608.17067#bib.bib26),[15](https://arxiv.org/html/2608.17067#bib.bib28),[17](https://arxiv.org/html/2608.17067#bib.bib29),[3](https://arxiv.org/html/2608.17067#bib.bib30),[22](https://arxiv.org/html/2608.17067#bib.bib31),[7](https://arxiv.org/html/2608.17067#bib.bib32)\], enabling users to synthesize photorealistic imagery from natural language descriptions\. Models such as Stable Diffusion\[[20](https://arxiv.org/html/2608.17067#bib.bib11)\], SD 3\[[4](https://arxiv.org/html/2608.17067#bib.bib23)\], and Flux\[[10](https://arxiv.org/html/2608.17067#bib.bib12)\]have demonstrated remarkable generative capabilities, yet this progress has simultaneously introduced critical safety vulnerabilities\. In the realm of content safety, these models can produce Not\-Safe\-For\-Work \(NSFW\) content\[[12](https://arxiv.org/html/2608.17067#bib.bib24),[1](https://arxiv.org/html/2608.17067#bib.bib25)\], including depictions of violence, nudity, and other harmful imagery, either through undefended generation or through deliberate manipulation of input prompts, known as adversarial attacks\. The growing accessibility of open\-source text\-to\-image models has further amplified these risks, as users can freely interact with systems that lack adequate safety guardrails, raising urgent concerns for responsible deployment\.

The discovery of red\-teaming adversarial attacks has accordingly led to escalating security concerns surrounding text\-to\-image systems\. These attacks span a spectrum of threat models, from black\-box methods that craft adversarial prompts without model access\[[24](https://arxiv.org/html/2608.17067#bib.bib9),[27](https://arxiv.org/html/2608.17067#bib.bib17)\], to white\-box approaches that leverage gradients and internal representations for targeted prompt optimization\[[32](https://arxiv.org/html/2608.17067#bib.bib5),[26](https://arxiv.org/html/2608.17067#bib.bib4)\]\. More recently, LLM\-driven attacks, such as APT\[[14](https://arxiv.org/html/2608.17067#bib.bib10)\], have raised the bar further by generating human\-readable adversarial prompts that evade both automated detectors and human review\. The increasing sophistication of these attacks demands defense mechanisms that are equally robust and adaptive\.

In response, a spectrum of defenses has emerged\. White\-box methods intervene inside the generation pipeline via weight fine\-tuning\[[5](https://arxiv.org/html/2608.17067#bib.bib7),[31](https://arxiv.org/html/2608.17067#bib.bib8)\], cross\-attention editing\[[8](https://arxiv.org/html/2608.17067#bib.bib6)\], or inference\-time steering\[[21](https://arxiv.org/html/2608.17067#bib.bib1),[28](https://arxiv.org/html/2608.17067#bib.bib3)\], but they inherently do not scale to proprietary or closed\-source models\. A lightweight black\-box alternative is LLM\-based prompt rewriting\[[33](https://arxiv.org/html/2608.17067#bib.bib13),[9](https://arxiv.org/html/2608.17067#bib.bib14)\], which often neutralizes prompts that contain explicit unsafe intent; however, it exposes a more fundamental failure mode where textually benign prompts still trigger unsafe images\. We formalize this as thebenign adversarialproblem: a promptp′p^\{\\prime\}is benign adversarial with respect to a generative model𝒢\\mathcal\{G\}ifp′p^\{\\prime\}is deemed safe by language\-level assessment, yet𝒢⁡\(p′\)\\mathcal\{G\}\(p^\{\\prime\}\)produces unsafe visual content\. Recent evidence suggests this is systematic rather than anecdotal, where benign prompts can unintentionally elicit harmful generations\[[11](https://arxiv.org/html/2608.17067#bib.bib15)\], and the issue persists even under compromised model weights\[[25](https://arxiv.org/html/2608.17067#bib.bib16)\], indicating a gap in purely text space defenses\. Motivated by this, we view defending against benign adversarial prompts as a distributional alignment problem: instead of modifying𝒢\\mathcal\{G\}, optimize the prompt to shift generations from unsafe to safe regions of the model’s learned output distribution as illustrated in Figure[1](https://arxiv.org/html/2608.17067#S1.F1)\(left\)\.

![Refer to caption](https://arxiv.org/html/2608.17067v1/intro.png)Figure 1:\(Left\) Textually safe prompts do not guarantee safe generations\. DiSCO addresses this gap by optimizing prompts through distribution\-guided feedback, steering generations toward safer regions without accessing or modifying the underlying model\. \(Right\) DiSCO significantly reduces the Attack Success Rate \(ASR\) across diverse undefended and defended text\-to\-image models, serving as a plug\-and\-play black\-box safety booster without modifying the underlying model\.In this work, we study the effect of distribution\-guided prompt optimization as a black\-box defense against unsafe text\-to\-image generation\. Specifically, we explore how contrastive scoring over a target model’s own safe and unsafe outputs can be used to systematically steer benign adversarial prompts toward safe generation regions\. We present DiSCO, a training free, strictly black\-box defense that operates entirely at the prompt level as a plug\-and\-play module, requiring no model retraining, fine\-tuning, or access to model internals\. DiSCO takes the prompt with adversarial content as its starting point and optimizes it through distribution\-guided contrastive suffix expansion via beam search, with iterative adaptive feedback that modulates the optimization objective based on the severity of remaining harmful content\. We present a comprehensive empirical study assessing the impact of introducing DiSCO against state\-of\-the\-art adversaries on the I2P benchmark\[[21](https://arxiv.org/html/2608.17067#bib.bib1)\]\. Our experiments show that equipping existing undefended and defend methods with DiSCO provides consistent improvements in safety across all attacks evaluated, as shown in Figure[1](https://arxiv.org/html/2608.17067#S1.F1)\(right\)\. DiSCO is modular and versatile, and we show how it improves the robustness of state\-of\-the\-art defenses across the board, from training\-free inference\-time methods to fine\-tuning\-based approaches\. Our contributions are summarized as follows:

- •Problem:We formalize the*benign adversarial*regime in text\-to\-image safety, where prompts that are textually safe can still induce unsafe generations due to the model’s learned output distribution\.
- •Method:We introduceDiSCO, a training free,*strictly black\-box*and*plug\-and\-play*prompt\-optimization module that steers generations via distribution\-guided contrastive suffix search, requiring no retraining, fine\-tuning, or access to model internals\.
- •Results:On I2P under four red\-teaming attacks, DiSCO consistently improves safety across both undefended and defended systems\. Over five seeds and 32 system–attack settings, it reduces average ASR from23\.6% to 2\.4%under NudeNet and from8\.3% to 1\.7%under Q16, while maintaining or improving semantic fidelity and perceptual quality\.

## 2Methodology

![Refer to caption](https://arxiv.org/html/2608.17067v1/pipeline.png)Figure 2:Overview of DiSCO\.Left:Model\-specific safe and unsafe reference pools are constructed by generating images from the target model using the I2P dataset and filtering through classifier consensus \(NudeNet and Q16\)\.Right:DiSCO takes a benign\-adversarial prompt, expands it with optimized suffix tokens via contrastive beam search in CLIP embedding space, and steers the target model from unsafe to safe generation without modifying the model itself\.We study the impact of distribution\-guided prompt optimization on the safety of text\-to\-image generation as shown in Figure[2](https://arxiv.org/html/2608.17067#S2.F2)\. We observe that traditional defense approaches either modify the model’s internal parameters or operate solely at the textual level, overlooking the relationship between the input prompt and the model’s own visual output distribution\. Thus, we aim at studying the impact that introducing a prompt\-level optimization module, guided by the model’s own safe and unsafe generation regions, can have on enhancing adversarial robustness\.

### 2\.1Problem Definition and Evaluation Protocol

Let𝒫\\mathcal\{P\}be the space of text prompts and𝒳\\mathcal\{X\}the space of images\. A text\-to\-image generator is a \(possibly stochastic\) mappingG:𝒫→𝒳G:\\mathcal\{P\}\\rightarrow\\mathcal\{X\}that produces an imagex∼G⁡\(p\)x\\sim G\(p\)given a promptp∈𝒫p\\in\\mathcal\{P\}\. We study red\-teaming attacks that craft adversarial prompts to increase the likelihood of unsafe generations: an attack algorithm𝒜\\mathcal\{A\}maps an initial prompt \(or template\) topadv=𝒜⁡\(p\)p\_\{\\text\{adv\}\}=\\mathcal\{A\}\(p\)\. In many deployed black\-box pipelines, a language\-based sanitizer or LLM rewriting moduleℛ\\mathcal\{R\}is applied first, producing a rewritten promptp′=ℛ⁡\(padv\)p^\{\\prime\}=\\mathcal\{R\}\(p\_\{\\text\{adv\}\}\)that is linguistically benign, after which the system generatesx∼G⁡\(p′\)x\\sim G\(p^\{\\prime\}\)\. Our focus is the regime where language\-level sanitization is not sufficient because safety depends on the alignment betweenp′p^\{\\prime\}and the*visual*output distribution induced byGG\.

##### Benign adversarial prompts\.

LetSafeText:𝒫→\{0,1\}\\mathrm\{SafeText\}:\\mathcal\{P\}\\rightarrow\\\{0,1\\\}denote a language\-level safety assessment andSafeImg:𝒳→\{0,1\}\\mathrm\{SafeImg\}:\\mathcal\{X\}\\rightarrow\\\{0,1\\\}an image\-level safety assessment\. We say thatp′∈𝒫p^\{\\prime\}\\in\\mathcal\{P\}is*benign adversarial*w\.r\.t\.GGif it passes text\-level checks but still yields unsafe images with high probability:

SafeText\(p′\)=1andℙx∼G⁡\(p′\)\[SafeImg\(x\)=0\]≥0\.5\.\\mathrm\{SafeText\}\(p^\{\\prime\}\)=1\\quad\\text\{and\}\\quad\\mathbb\{P\}\_\{x\\sim G\(p^\{\\prime\}\)\}\\\!\\left\[\\mathrm\{SafeImg\}\(x\)=0\\right\]\\ \\geq 0\.5\.\(1\)This phenomenon motivates viewing defense as a*distributional alignment*problem: rather than modifyingGG, we optimize the input prompt so that the induced generation shifts away from unsafe regions and toward safe regions ofGG’s learned output distribution\.

##### Defense setting \(strictly black\-box, prompt\-level\)\.

We consider a prompt\-level defense𝒟:𝒫→𝒫\\mathcal\{D\}:\\mathcal\{P\}\\rightarrow\\mathcal\{P\}that transforms the \(typically rewritten\) promptp′p^\{\\prime\}into an optimized promptp∗=𝒟⁡\(p′\)p^\{\*\}=\\mathcal\{D\}\(p^\{\\prime\}\), after which the generator runs unmodified:

x∗∼G⁡\(p∗\),p∗=𝒟⁡\(p′\)\.x^\{\*\}\\sim G\(p^\{\*\}\),\\qquad p^\{\*\}=\\mathcal\{D\}\(p^\{\\prime\}\)\.\(2\)The defense has no access toGG’s parameters, gradients, attention maps, or intermediate activations; it may only queryGGto obtain generated images\. At a high level, we seek to reduce unsafe generations while preserving the user intent ofp′p^\{\\prime\}:

min𝒟𝔼p′\[ℙx∼G⁡\(𝒟⁡\(p′\)\)\[SafeImg\(x\)=0\]\]s\.t\.Sem\(𝒟\(p′\),p′\)≥τ,\\min\_\{\\mathcal\{D\}\}\\ \\mathbb\{E\}\_\{p^\{\\prime\}\}\\Big\[\\mathbb\{P\}\_\{x\\sim G\(\\mathcal\{D\}\(p^\{\\prime\}\)\)\}\\big\[\\mathrm\{SafeImg\}\(x\)=0\\big\]\\Big\]\\quad\\text\{s\.t\.\}\\quad\\mathrm\{Sem\}\(\\mathcal\{D\}\(p^\{\\prime\}\),p^\{\\prime\}\)\\geq\\tau,\(3\)whereSem⁡\(⋅,⋅\)\\mathrm\{Sem\}\(\\cdot,\\cdot\)measures semantic fidelity \(e\.g\., text\-image or text\-text alignment\) andτ\\tauis a fidelity threshold\. An example toSem⁡\(⋅,⋅\)\\mathrm\{Sem\}\(\\cdot,\\cdot\)is the celebrated CLIP Score\[[18](https://arxiv.org/html/2608.17067#bib.bib2)\]\.

##### Evaluation protocol and metrics\.

We report robustness using*Attack Success Rate*\(ASR\): the fraction of evaluated prompts that produce unsafe images under the tested system \(undefended, baseline\-defended, or defense\-enhanced\):

ASR=1\|𝒬\|∑q∈𝒬𝕀\[SafeImg\(xq\)=0\],xq∼G\(pq\),\\mathrm\{ASR\}\\;=\\;\\frac\{1\}\{\|\\mathcal\{Q\}\|\}\\sum\_\{q\\in\\mathcal\{Q\}\}\\mathbb\{I\}\\\!\\left\[\\mathrm\{SafeImg\}\(x\_\{q\}\)=0\\right\],\\qquad x\_\{q\}\\sim G\(p\_\{q\}\),\(4\)where𝒬\\mathcal\{Q\}is the evaluated prompt set andpqp\_\{q\}is the corresponding input prompt to the generator\. We compute ASR using two complementary image safety classifiers \(e\.g\., NudeNet and Q16\), and report semantic fidelity / generation quality metrics \(e\.g\., CLIP\-based alignment and ImageReward\) to verify that safety gains do not come from excessive semantic drift or degraded output quality\. Unless stated otherwise, reported ASR values are measured under NudeNet, the standard evaluator in prior work, which allows direct comparison with previously published numbers\.

### 2\.2Distribution\-Guided Contrastive Suffix Optimization

Given the problem formulation, we are now ready to present our defense: Distribution\-Guided Contrastive Suffix Optimization \(DiSCO\)\. DiSCO is a strictly black\-box, prompt\-level module that steers a target generatorGGtoward safe generations by optimizing the*prompt*using feedback obtained only from*observable outputs*ofGG\. In a nutshell, given a \(potentially sanitized\) input promptp′p^\{\\prime\}, DiSCO performs autoregressive*suffix expansion*and selects the suffix that maximizes a distribution\-guided contrastive score computed in a model\-agnostic embedding space\.

##### Safe and unsafe reference pools\.

To obtain a robust reference signal under a black\-box constraint, we construct two*model\-specific*image pools by queryingGGon non\-adversarial prompts from the I2P dataset\. Let𝒫safe=\{xi\+\}i=1N\+\\mathcal\{P\}\_\{\\text\{safe\}\}=\\\{x\_\{i\}^\{\+\}\\\}\_\{i=1\}^\{N\_\{\+\}\}and𝒫unsafe=\{xj−\}j=1N−\\mathcal\{P\}\_\{\\text\{unsafe\}\}=\\\{x\_\{j\}^\{\-\}\\\}\_\{j=1\}^\{N\_\{\-\}\}denote the resulting pools of safe and unsafe images, respectively\. We enforce an unambiguous selection rule: an image is added to𝒫safe\\mathcal\{P\}\_\{\\text\{safe\}\}only if*both*NudeNet and Q16 classify it as safe, and added to𝒫unsafe\\mathcal\{P\}\_\{\\text\{unsafe\}\}only if*both*classify it as unsafe; ambiguous cases \(disagreement\) are discarded\. An alternative confidence\-based construction of the two pools is discussed in Appendix[A\.6](https://arxiv.org/html/2608.17067#A1.SS6)\. Because the pools are generated by the target modelGG, they reflectGG’s own learned visual manifold and require no external unsafe corpora or internal access\.

##### Distribution\-guided contrastive objective\.

Given a candidate promptp^\\hat\{p\}, we query the target model to obtainx^∼G⁡\(p^\)\\hat\{x\}\\sim G\(\\hat\{p\}\)and embed the image using a frozen CLIP image encoderϕ⁡\(⋅\)\\phi\(\\cdot\)\. At each optimization step, we randomly sampleRRreferences from each pool, yielding𝒫~safe⊂𝒫safe\\tilde\{\\mathcal\{P\}\}\_\{\\text\{safe\}\}\\subset\\mathcal\{P\}\_\{\\text\{safe\}\}and𝒫~unsafe⊂𝒫unsafe\\tilde\{\\mathcal\{P\}\}\_\{\\text\{unsafe\}\}\\subset\\mathcal\{P\}\_\{\\text\{unsafe\}\}with\|𝒫~safe\|=\|𝒫~unsafe\|=R\|\\tilde\{\\mathcal\{P\}\}\_\{\\text\{safe\}\}\|=\|\\tilde\{\\mathcal\{P\}\}\_\{\\text\{unsafe\}\}\|=R\(defaultR=8R=8\)\. We scorep^\\hat\{p\}by the contrastive alignment of its generated image with these two reference sets:

J⁡\(p^\)=1R​∑xi\+∈𝒫~safecos⁡\(ϕ⁡\(x^\),ϕ⁡\(xi\+\)\)−1R​∑xj−∈𝒫~unsafecos⁡\(ϕ⁡\(x^\),ϕ⁡\(xj−\)\),J\(\\hat\{p\}\)\\;=\\;\\frac\{1\}\{R\}\\sum\_\{x\_\{i\}^\{\+\}\\in\\tilde\{\\mathcal\{P\}\}\_\{\\text\{safe\}\}\}\\cos\\\!\\big\(\\phi\(\\hat\{x\}\),\\phi\(x\_\{i\}^\{\+\}\)\\big\)\\;\-\\;\\frac\{1\}\{R\}\\sum\_\{x\_\{j\}^\{\-\}\\in\\tilde\{\\mathcal\{P\}\}\_\{\\text\{unsafe\}\}\}\\cos\\\!\\big\(\\phi\(\\hat\{x\}\),\\phi\(x\_\{j\}^\{\-\}\)\\big\),\(5\)wherecos⁡\(⋅,⋅\)\\cos\(\\cdot,\\cdot\)denotes cosine similarity\. MaximizingJJsimultaneously attracts generations toward safe regions and repels them from unsafe regions in the embedding space\. Re\-sampling references at every step exposes the optimizer to diverse views of the two distributions while keeping the per\-step cost bounded\. In practice, a single optimization pass already yields strong robustness gains; a preference\-based optimization variant for deployment, formulated under a unified objective, is detailed in Appendix[A\.7](https://arxiv.org/html/2608.17067#A1.SS7)\.

We optimize prompts by expanding a suffix token\-by\-token using a suffix generator language modelMM\(LLaMA\-3\-8B\)\. Starting fromp′p^\{\\prime\}, we maintain a beamℬ\\mathcal\{B\}of sizeKK\(defaultK=4K=4\)\. At stept∈\{1,…,T\}t\\in\\\{1,\\dots,T\\\}\(defaultT=16T=16\), for each candidate prompt in the beam we propose next\-token continuations viaMM, queryGGfor each continuation, compute its score via Eq\. \([5](https://arxiv.org/html/2608.17067#S2.E5)\), and retain the top\-KKcandidates\. AfterTTsteps, the final optimized prompt is selected as

p∗=arg⁡maxp^∈ℬ⁡J⁡\(p^\)\.p^\{\*\}\\;=\\;\\arg\\max\_\{\\hat\{p\}\\in\\mathcal\{B\}\}J\(\\hat\{p\}\)\.\(6\)The complete procedure is given in Algorithm[1](https://arxiv.org/html/2608.17067#alg1)\(Appendix[A\.1](https://arxiv.org/html/2608.17067#A1.SS1)\), and a quantitative analysis of semantic drift is provided in Appendix[A\.8](https://arxiv.org/html/2608.17067#A1.SS8)\.

##### Compatibility and deployment\.

DiSCO operates entirely upstream ofGG: it transforms the input prompt and then invokesGGunchanged\. Thus, it can be prepended to undefended generators as well as to systems already equipped with safety mechanisms, without requiring retraining, fine\-tuning, architectural changes, or access to internal representations\.

##### Computational Overhead\.

DiSCO induces an additional computation during inference\. Under the default beam search configuration, each prompt requiresT×b×KT\\times b\\times Kcandidate image generations\. Further, and to minimize the computational overhead that DISCO adds, DiSCO is applied selectively rather than to every incoming prompt\. For each target model, we first generate an image under the model’s existing configuration and invoke DiSCO only when a textually benign prompt still produces an unsafe image, which we define as a benign\-adversarial case in Section[2\.1](https://arxiv.org/html/2608.17067#S2.SS1)\. Prompts whose initial generations are safe pass through unmodified\. At last, we note that in Appendix[A\.4](https://arxiv.org/html/2608.17067#A1.SS4)we further show that even when DiSCO*is*applied to safe prompts that do not generate harmful content, generation quality is not degraded relative to leaving those prompts unmodified\.

## 3Related Work

##### Adversarial Robustness of Text\-to\-Image Models\.

Red\-teaming has become the standard way to stress\-test text\-to\-image safety, and recent work shows that adversarial prompting can reliably elicit NSFW generations under both black\-box and white\-box threat models\. Black\-box attacks craft prompts without accessing the generator internals, e\.g\., Ring\-A\-Bell\[[24](https://arxiv.org/html/2608.17067#bib.bib9)\]and SneakyPrompt\[[27](https://arxiv.org/html/2608.17067#bib.bib17)\]search for token substitutions that evade prompt\-side safeguards\. White\-box attacks are more targeted, leveraging gradients and internal representations to directly optimize for unsafe outputs, as in UnlearnDiffAtk\[[32](https://arxiv.org/html/2608.17067#bib.bib5)\]and MMA\-Diffusion\[[26](https://arxiv.org/html/2608.17067#bib.bib4)\]\. More recently, LLM\-driven attacks further raise the bar by producing fluent, human\-readable prompts \(often via search over adversarial suffixes\) that bypass heuristic filters and remain difficult to flag at the text level, e\.g\., APT\[[14](https://arxiv.org/html/2608.17067#bib.bib10)\]\. Collectively, these results highlight that robustness must be assessed against increasingly natural\-looking prompts that can appear benign while still inducing unsafe generations\.

##### Defending Text\-to\-Image Models\.

Defenses span a spectrum of model access and intervention\. Weight\-modifying and fine\-tuning approaches can suppress unsafe concepts but require parameter access and may need repeated updates as new failure modes emerge, e\.g\., ESD\[[5](https://arxiv.org/html/2608.17067#bib.bib7)\], AdvUnlearn\[[31](https://arxiv.org/html/2608.17067#bib.bib8)\], RECE\[[8](https://arxiv.org/html/2608.17067#bib.bib6)\], and external rectification modules such as SafePatch\[[16](https://arxiv.org/html/2608.17067#bib.bib18)\]\. Inference\-time methods avoid permanent edits but still depend on internal representations, limiting portability across architectures \(e\.g\., SLD\-Max\[[21](https://arxiv.org/html/2608.17067#bib.bib1)\], SAFREE\[[28](https://arxiv.org/html/2608.17067#bib.bib3)\], DTVI\[[23](https://arxiv.org/html/2608.17067#bib.bib19)\], PromptGuard\[[29](https://arxiv.org/html/2608.17067#bib.bib20)\]\)\. Complementarily, LLM\-based rewriting provides a lightweight, model\-agnostic safeguard by sanitizing prompts before generation \(e\.g\., VALOR\[[33](https://arxiv.org/html/2608.17067#bib.bib13)\], PromptSafe\[[9](https://arxiv.org/html/2608.17067#bib.bib14)\]\), but can fail when linguistically safe prompts still map to unsafe regions of a model’s visual distribution\. DiSCO targets this gap with a strictly black\-box, prompt\-level optimization that uses the target model’s own safe/unsafe output distributions as guidance, and can be prepended to both undefended systems and existing defenses without changing the generator\.

## 4Experiments

Models\.We evaluate DiSCO across multiple text\-to\-image generators spanning both major architecture families\. Our study includes UNet\-based diffusion models \(SD v1\.4, SD v2\.0\[[20](https://arxiv.org/html/2608.17067#bib.bib11)\]\) and DiT\-based models \(Flux\[[10](https://arxiv.org/html/2608.17067#bib.bib12)\], SD 3\[[4](https://arxiv.org/html/2608.17067#bib.bib23)\]\), allowing us to assess whether prompt\-level distributional steering generalizes across architectures and model scales\.

Attacks\.We benchmark adversarial robustness under a diverse set of red\-teaming attacks covering both black\-box and white\-box threat models\. Ring\-A\-Bell\[[24](https://arxiv.org/html/2608.17067#bib.bib9)\]crafts adversarial prompts without access to the generator internals\. UnlearnDiffAtk\[[32](https://arxiv.org/html/2608.17067#bib.bib5)\]and MMA\-Diffusion\[[26](https://arxiv.org/html/2608.17067#bib.bib4)\]represent stronger white\-box attacks that optimize prompts using model\-side signals \(e\.g\., gradients/representations\), while Prompting4Debugging \(P4D\)\[[2](https://arxiv.org/html/2608.17067#bib.bib22)\]targets deployed safety mechanisms by searching for prompts that bypass defense behavior\. Together, these attacks probe complementary failure modes and produce prompts that can remain linguistically fluent yet induce unsafe generations\.

Metrics\.We measure safety using Attack Success Rate \(ASR\), defined as the fraction of evaluated prompts whose generated images are classified as unsafe\. We report ASR↓\\downarrowprimarily under NudeNet, which targets explicit content detection, and additionally under Q16\[[21](https://arxiv.org/html/2608.17067#bib.bib1)\]as a broader complementary metric that captures a wider range of unsafe content categories\. To quantify whether safety gains preserve semantic fidelity and overall quality, we additionally report CLIP\[[18](https://arxiv.org/html/2608.17067#bib.bib2)\]score \(semantic alignment\) and ImageReward \(perceptual preference\)\.

DiSCO hyperparameters\.Unless stated otherwise, DiSCO performs autoregressive suffix expansion using a lightweight suffix generator language model \(LLaMA\-3\-8B\[[6](https://arxiv.org/html/2608.17067#bib.bib21)\]\) with beam search of widthK=4K=4and suffix lengthT=16T=16\. DiSCO scores candidate suffixes via a distribution\-guided contrastive objective computed in a frozen CLIP embedding space\. At each expansion step, we sampleR=8R=8reference images from each of two model\-specific pools \(safe/unsafe\) constructed by querying the target model on non\-adversarial prompts; we retain only unambiguous samples by requiring agreement between NudeNet and Q16 \(disagreements are discarded\)\.

Table 1:ASR \(%, mean±std\{\}\_\{\\pm\\text\{std\}\}over 5 seeds\) under four adversarial attacks, measured by NudeNet \(NN\) and Q16\. Lower is better\.Ring\-A\-BellUnlearnDiffAtkMMA\-DiffusionP4DModelNN↓\\downarrowQ16↓\\downarrowNN↓\\downarrowQ16↓\\downarrowNN↓\\downarrowQ16↓\\downarrowNN↓\\downarrowQ16↓\\downarrowSD 1\.4Base84\.2±3\.884\.2\_\{\\pm 3\.8\}16\.0±9\.516\.0\_\{\\pm 9\.5\}53\.1±10\.953\.1\_\{\\pm 10\.9\}13\.1±3\.313\.1\_\{\\pm 3\.3\}43\.0±16\.943\.0\_\{\\pm 16\.9\}11\.8±4\.711\.8\_\{\\pm 4\.7\}17\.5±8\.617\.5\_\{\\pm 8\.6\}12\.9±6\.612\.9\_\{\\pm 6\.6\}\+ DiSCO7\.8±3\.0\\mathbf\{7\.8\_\{\\pm 3\.0\}\}4\.0±2\.9\\mathbf\{4\.0\_\{\\pm 2\.9\}\}6\.2±2\.5\\mathbf\{6\.2\_\{\\pm 2\.5\}\}3\.4±2\.5\\mathbf\{3\.4\_\{\\pm 2\.5\}\}8\.0±1\.7\\mathbf\{8\.0\_\{\\pm 1\.7\}\}3\.2±1\.1\\mathbf\{3\.2\_\{\\pm 1\.1\}\}5\.5±1\.4\\mathbf\{5\.5\_\{\\pm 1\.4\}\}5\.3±1\.9\\mathbf\{5\.3\_\{\\pm 1\.9\}\}SD 2\.0Base75\.4±7\.075\.4\_\{\\pm 7\.0\}26\.5±4\.726\.5\_\{\\pm 4\.7\}24\.2±9\.224\.2\_\{\\pm 9\.2\}7\.4±1\.77\.4\_\{\\pm 1\.7\}9\.6±6\.69\.6\_\{\\pm 6\.6\}9\.5±6\.29\.5\_\{\\pm 6\.2\}10\.1±6\.310\.1\_\{\\pm 6\.3\}10\.4±7\.410\.4\_\{\\pm 7\.4\}\+ DiSCO3\.9±0\.8\\mathbf\{3\.9\_\{\\pm 0\.8\}\}2\.1±0\.9\\mathbf\{2\.1\_\{\\pm 0\.9\}\}3\.2±1\.3\\mathbf\{3\.2\_\{\\pm 1\.3\}\}2\.5±1\.8\\mathbf\{2\.5\_\{\\pm 1\.8\}\}1\.0±0\.3\\mathbf\{1\.0\_\{\\pm 0\.3\}\}1\.3±0\.4\\mathbf\{1\.3\_\{\\pm 0\.4\}\}5\.1±2\.0\\mathbf\{5\.1\_\{\\pm 2\.0\}\}3\.6±1\.4\\mathbf\{3\.6\_\{\\pm 1\.4\}\}SD 3Base34\.5±5\.834\.5\_\{\\pm 5\.8\}3\.8±1\.73\.8\_\{\\pm 1\.7\}9\.4±3\.49\.4\_\{\\pm 3\.4\}2\.5±2\.82\.5\_\{\\pm 2\.8\}2\.5±1\.52\.5\_\{\\pm 1\.5\}3\.0±4\.43\.0\_\{\\pm 4\.4\}5\.0±2\.15\.0\_\{\\pm 2\.1\}5\.5±8\.75\.5\_\{\\pm 8\.7\}\+ DiSCO2\.1±1\.6\\mathbf\{2\.1\_\{\\pm 1\.6\}\}0\.4±0\.5\\mathbf\{0\.4\_\{\\pm 0\.5\}\}0\.2±0\.5\\mathbf\{0\.2\_\{\\pm 0\.5\}\}0\.2±0\.5\\mathbf\{0\.2\_\{\\pm 0\.5\}\}0\.1±0\.1\\mathbf\{0\.1\_\{\\pm 0\.1\}\}0\.0±0\.1\\mathbf\{0\.0\_\{\\pm 0\.1\}\}2\.7±1\.2\\mathbf\{2\.7\_\{\\pm 1\.2\}\}0\.9±0\.5\\mathbf\{0\.9\_\{\\pm 0\.5\}\}FluxBase89\.7±3\.189\.7\_\{\\pm 3\.1\}10\.1±3\.410\.1\_\{\\pm 3\.4\}32\.4±2\.832\.4\_\{\\pm 2\.8\}4\.7±1\.74\.7\_\{\\pm 1\.7\}7\.7±2\.37\.7\_\{\\pm 2\.3\}0\.8±1\.10\.8\_\{\\pm 1\.1\}13\.7±2\.713\.7\_\{\\pm 2\.7\}8\.2±6\.08\.2\_\{\\pm 6\.0\}\+ DiSCO5\.0±1\.0\\mathbf\{5\.0\_\{\\pm 1\.0\}\}0\.0±0\.0\\mathbf\{0\.0\_\{\\pm 0\.0\}\}0\.0±0\.0\\mathbf\{0\.0\_\{\\pm 0\.0\}\}0\.3±0\.6\\mathbf\{0\.3\_\{\\pm 0\.6\}\}0\.6±0\.3\\mathbf\{0\.6\_\{\\pm 0\.3\}\}0\.1±0\.1\\mathbf\{0\.1\_\{\\pm 0\.1\}\}6\.0±2\.3\\mathbf\{6\.0\_\{\\pm 2\.3\}\}3\.3±1\.4\\mathbf\{3\.3\_\{\\pm 1\.4\}\}SLD\-MaxBase44\.4±18\.444\.4\_\{\\pm 18\.4\}1\.7±1\.71\.7\_\{\\pm 1\.7\}13\.8±10\.013\.8\_\{\\pm 10\.0\}2\.5±0\.82\.5\_\{\\pm 0\.8\}31\.4±12\.031\.4\_\{\\pm 12\.0\}1\.9±1\.41\.9\_\{\\pm 1\.4\}1\.9±2\.11\.9\_\{\\pm 2\.1\}0\.9±1\.50\.9\_\{\\pm 1\.5\}\+ DiSCO0\.3±0\.7\\mathbf\{0\.3\_\{\\pm 0\.7\}\}0\.0±0\.0\\mathbf\{0\.0\_\{\\pm 0\.0\}\}1\.2±0\.8\\mathbf\{1\.2\_\{\\pm 0\.8\}\}1\.2±0\.1\\mathbf\{1\.2\_\{\\pm 0\.1\}\}5\.5±1\.8\\mathbf\{5\.5\_\{\\pm 1\.8\}\}0\.1±0\.1\\mathbf\{0\.1\_\{\\pm 0\.1\}\}0\.3±0\.2\\mathbf\{0\.3\_\{\\pm 0\.2\}\}0\.0±0\.1\\mathbf\{0\.0\_\{\\pm 0\.1\}\}SAFREEBase54\.1±5\.654\.1\_\{\\pm 5\.6\}16\.6±5\.516\.6\_\{\\pm 5\.5\}12\.6±4\.312\.6\_\{\\pm 4\.3\}6\.9±1\.56\.9\_\{\\pm 1\.5\}20\.5±7\.020\.5\_\{\\pm 7\.0\}14\.4±7\.714\.4\_\{\\pm 7\.7\}1\.6±1\.61\.6\_\{\\pm 1\.6\}4\.7±7\.44\.7\_\{\\pm 7\.4\}\+ DiSCO0\.4±0\.5\\mathbf\{0\.4\_\{\\pm 0\.5\}\}1\.2±0\.4\\mathbf\{1\.2\_\{\\pm 0\.4\}\}2\.2±0\.6\\mathbf\{2\.2\_\{\\pm 0\.6\}\}0\.8±0\.9\\mathbf\{0\.8\_\{\\pm 0\.9\}\}2\.5±1\.1\\mathbf\{2\.5\_\{\\pm 1\.1\}\}4\.2±1\.2\\mathbf\{4\.2\_\{\\pm 1\.2\}\}0\.5±0\.4\\mathbf\{0\.5\_\{\\pm 0\.4\}\}0\.6±0\.4\\mathbf\{0\.6\_\{\\pm 0\.4\}\}RECEBase2\.1±0\.92\.1\_\{\\pm 0\.9\}8\.2±3\.48\.2\_\{\\pm 3\.4\}5\.4±3\.75\.4\_\{\\pm 3\.7\}7\.6±2\.67\.6\_\{\\pm 2\.6\}17\.7±7\.717\.7\_\{\\pm 7\.7\}16\.2±8\.716\.2\_\{\\pm 8\.7\}1\.4±1\.61\.4\_\{\\pm 1\.6\}5\.7±8\.65\.7\_\{\\pm 8\.6\}\+ DiSCO0\.0±0\.0\\mathbf\{0\.0\_\{\\pm 0\.0\}\}0\.7±0\.4\\mathbf\{0\.7\_\{\\pm 0\.4\}\}0\.2±0\.5\\mathbf\{0\.2\_\{\\pm 0\.5\}\}2\.3±1\.3\\mathbf\{2\.3\_\{\\pm 1\.3\}\}2\.6±0\.9\\mathbf\{2\.6\_\{\\pm 0\.9\}\}5\.6±1\.2\\mathbf\{5\.6\_\{\\pm 1\.2\}\}0\.4±0\.3\\mathbf\{0\.4\_\{\\pm 0\.3\}\}1\.0±0\.5\\mathbf\{1\.0\_\{\\pm 0\.5\}\}ESDBase22\.3±7\.222\.3\_\{\\pm 7\.2\}12\.8±4\.712\.8\_\{\\pm 4\.7\}5\.9±3\.95\.9\_\{\\pm 3\.9\}4\.9±3\.64\.9\_\{\\pm 3\.6\}6\.5±3\.66\.5\_\{\\pm 3\.6\}11\.2±3\.911\.2\_\{\\pm 3\.9\}0\.7±1\.10\.7\_\{\\pm 1\.1\}4\.5±7\.24\.5\_\{\\pm 7\.2\}\+ DiSCO0\.2±0\.4\\mathbf\{0\.2\_\{\\pm 0\.4\}\}1\.5±1\.3\\mathbf\{1\.5\_\{\\pm 1\.3\}\}2\.2±1\.0\\mathbf\{2\.2\_\{\\pm 1\.0\}\}1\.5±1\.4\\mathbf\{1\.5\_\{\\pm 1\.4\}\}1\.0±0\.8\\mathbf\{1\.0\_\{\\pm 0\.8\}\}2\.7±0\.8\\mathbf\{2\.7\_\{\\pm 0\.8\}\}0\.1±0\.1\\mathbf\{0\.1\_\{\\pm 0\.1\}\}0\.4±0\.3\\mathbf\{0\.4\_\{\\pm 0\.3\}\}### 4\.1DiSCO Shields Undefended Models

We first evaluate DiSCO as a*standalone*safety module by prepending it to undefended text\-to\-image generators\. Concretely, we apply the adversarial prompt sets to widely used models spanning both UNet\-based architectures \(SD v1\.4, SD v2\.0\) and DiT\-based architectures \(Flux, SD 3\), and compare safety with and without DiSCO under the same attack protocols, isolating the contribution of prompt\-level, black\-box optimization, without confounding effects from any pre\-existing defense\.

Table 2:Generation quality and average ASR reduction\. CLIP and ImageReward \(IR\) are measured against the original prompt over 5 seeds \(higher is better\); CLIP standard deviations are below 0\.013 throughout and are omitted\.Δ\\DeltaASR is the mean change across all four attacks\.CLIP↑\\uparrowImageReward↑\\uparrowΔ\\DeltaASR \(avg\)ModelBase\+ DiSCOΔ\\DeltaBase\+ DiSCOΔ\\DeltaΔ\\DeltaNNΔ\\DeltaQ16SD 1\.40\.1840\.1840\.2700\.270\+0\.086\+0\.086−2\.01±0\.07\-2\.01\_\{\\pm 0\.07\}−0\.34±0\.12\-0\.34\_\{\\pm 0\.12\}\+1\.67\+1\.67−42\.6\-42\.6−9\.5\-9\.5SD 2\.00\.1810\.1810\.2630\.263\+0\.082\+0\.082−1\.88±0\.10\-1\.88\_\{\\pm 0\.10\}−0\.14±0\.14\-0\.14\_\{\\pm 0\.14\}\+1\.74\+1\.74−26\.5\-26\.5−11\.1\-11\.1SD 30\.1900\.1900\.2600\.260\+0\.070\+0\.070−1\.42±0\.12\-1\.42\_\{\\pm 0\.12\}0\.45±0\.070\.45\_\{\\pm 0\.07\}\+1\.87\+1\.87−11\.6\-11\.6−3\.3\-3\.3Flux0\.1990\.1990\.2640\.264\+0\.065\+0\.065−1\.54±0\.08\-1\.54\_\{\\pm 0\.08\}0\.68±0\.070\.68\_\{\\pm 0\.07\}\+2\.22\+2\.22−33\.0\-33\.0−5\.0\-5\.0SLD\-Max0\.1870\.1870\.2230\.223\+0\.036\+0\.036−1\.45±0\.10\-1\.45\_\{\\pm 0\.10\}−0\.60±0\.18\-0\.60\_\{\\pm 0\.18\}\+0\.85\+0\.85−21\.1\-21\.1−1\.4\-1\.4SAFREE0\.2120\.2120\.2600\.260\+0\.048\+0\.048−1\.32±0\.08\-1\.32\_\{\\pm 0\.08\}−0\.19±0\.11\-0\.19\_\{\\pm 0\.11\}\+1\.13\+1\.13−20\.8\-20\.8−9\.0\-9\.0RECE0\.1980\.1980\.2630\.263\+0\.065\+0\.065−1\.27±0\.15\-1\.27\_\{\\pm 0\.15\}−0\.33±0\.13\-0\.33\_\{\\pm 0\.13\}\+0\.93\+0\.93−5\.8\-5\.8−7\.0\-7\.0ESD0\.2100\.2100\.2650\.265\+0\.055\+0\.055−1\.49±0\.10\-1\.49\_\{\\pm 0\.10\}−0\.49±0\.14\-0\.49\_\{\\pm 0\.14\}\+1\.00\+1\.00−8\.0\-8\.0−6\.8\-6\.8Table[1](https://arxiv.org/html/2608.17067#S4.T1)summarizes the results\. DiSCO consistently improves adversarial robustness across all evaluated models and attacks, yielding large drops in ASR without modifying the generator\. Under Ring\-A\-Bell, NudeNet ASR decreases from84\.2%→7\.8%84\.2\\%\\\!\\to\\\!7\.8\\%on SD 1\.4,75\.4%→3\.9%75\.4\\%\\\!\\to\\\!3\.9\\%on SD 2\.0, and89\.7%→5\.0%89\.7\\%\\\!\\to\\\!5\.0\\%on Flux; comparable reductions hold under UnlearnDiffAtk, MMA\-Diffusion, and P4D, and across the four defended models in the lower block\. Averaged over the four attacks \(Table[2](https://arxiv.org/html/2608.17067#S4.T2)\), DiSCO lowers NudeNet ASR by42\.642\.6points on SD 1\.4,33\.033\.0on Flux,26\.526\.5on SD 2\.0, and11\.611\.6on SD 3, with Q16 reductions of3\.33\.3to11\.111\.1points; Figure[4](https://arxiv.org/html/2608.17067#S4.F4)visualizes these per\-attack reductions\. Gains are largest where the base model is most vulnerable and smallest where the attack already succeeded rarely, which is expected given the floor of the ASR scale\.

These safety gains do not trade off against fidelity\. Instead, they coincide with improvements in it\. Table 2 shows that CLIP alignment to the original prompt increases for all four undefended backbones, by\+0\.065\+0\.065to\+0\.086\+0\.086, while ImageReward improves by\+1\.67\+1\.67to\+2\.22\+2\.22\. These results indicate improved semantic alignment under CLIP and higher perceptual preference under ImageReward\. This is consistent with the mechanism: DiSCO steers generation back toward a faithful rendering of the benign request rather than suppressing output\.

### 4\.2Combining DiSCO with Defended Models

To evaluate the impact of equipping existing defenses with DiSCO, we test whether prepending DiSCO as a plug\-and\-play module can consistently improve the adversarial robustness of state\-of\-the\-art defense methods across diverse attack strategies\. Our selection of defenses for evaluation is based on high performance in the field and availability of trained models, spanning all four defense approaches identified in Section[3](https://arxiv.org/html/2608.17067#S3)\. In particular, we test DiSCO on four high\-performing defenses: SLD\-Max\[[21](https://arxiv.org/html/2608.17067#bib.bib1)\]and SAFREE\[[28](https://arxiv.org/html/2608.17067#bib.bib3)\]as inference\-time training\-free methods, RECE\[[8](https://arxiv.org/html/2608.17067#bib.bib6)\]as a closed\-form weight\-editing method, and ESD\[[5](https://arxiv.org/html/2608.17067#bib.bib7)\]as a fine\-tuning\-based method\. Each defense is evaluated against four attack methods, each targeting a distinct vulnerability in the defense pipeline\. Each defense is evaluated against four attacks: Ring\-A\-Bell\[[24](https://arxiv.org/html/2608.17067#bib.bib9)\]\(black\-box\), UnlearnDiffAtk\[[32](https://arxiv.org/html/2608.17067#bib.bib5)\]\(white\-box\), MMA\-Diffusion\[[26](https://arxiv.org/html/2608.17067#bib.bib4)\]\(white\-box\), and P4D\[[2](https://arxiv.org/html/2608.17067#bib.bib22)\]\(defense\-targeted\)\.

![Refer to caption](https://arxiv.org/html/2608.17067v1/qualitative_merged.png)Figure 3:Qualitative Results\. Each row corresponds to an attack method\. Left of the dashed line: undefended models \(SD v2\.0, Flux, SD3\); right of the dashed line: defended models on SD v1\.4 \(SLD\-Max, SAFREE, RECE, ESD\)\. For each pair, the left image is generated without DiSCO and the right image is generated with DiSCO prepended\. SD v1\.4 results are shown alongside the defended models to avoid repetition\. Unsafe regions are masked with black boxes\. DiSCO consistently steers generation toward safe content while preserving semantic coherence across all models and defenses\. Corresponding prompts can be found in Table[16](https://arxiv.org/html/2608.17067#A1.T16)\.We report the performance of the standard and DiSCO\-enhanced versions of these defenses in Table[1](https://arxiv.org/html/2608.17067#S4.T1)\(bottom\)\. Enhancing defenses with DiSCO consistently increases robustness across every defense and attack evaluated: all 32 defense\-attack\-detector combinations in the lower block improve\. SLD\-Max \+ DiSCO achieves the largest gain, reducing average NudeNet ASR by21\.121\.1points, with the most striking result on Ring\-A\-Bell where NudeNet ASR drops from44\.4%44\.4\\%to0\.3%0\.3\\%\. SAFREE \+ DiSCO follows with a20\.820\.8point average reduction, bringing Ring\-A\-Bell NudeNet ASR from54\.1%54\.1\\%to0\.4%0\.4\\%\. Even for already well\-defended models, DiSCO provides meaningful gains: ESD \+ DiSCO and RECE \+ DiSCO achieve8\.08\.0and5\.85\.8point average NudeNet reductions respectively, with ESD \+ DiSCO driving Ring\-A\-Bell NudeNet ASR from22\.3%22\.3\\%to0\.2%0\.2\\%and RECE \+ DiSCO reaching0\.0%0\.0\\%\. Averaged over the four defenses, DiSCO lowers NudeNet ASR by13\.913\.9points and Q16 ASR by6\.06\.0points\. Generation quality is not merely preserved but improved \(Table[2](https://arxiv.org/html/2608.17067#S4.T2), bottom\): CLIP alignment to the original prompt rises for all four defenses, by\+0\.036\+0\.036\(SLD\-Max\) to\+0\.065\+0\.065\(RECE\), and ImageReward increases consistently \(e\.g\., SAFREE from−1\.32\-1\.32to−0\.19\-0\.19, ESD from−1\.49\-1\.49to−0\.49\-0\.49\), suggesting that DiSCO’s distributional steering also guides generation toward more perceptually coherent outputs\.

Figure[4](https://arxiv.org/html/2608.17067#S4.F4)presents the difference DiSCO makes on top of the baselines under the per\-attack scenario; qualitative results are shown in Figure[3](https://arxiv.org/html/2608.17067#S4.F3)\(right\)\. These results provide strong evidence that DiSCO consistently complements the evaluated defense mechanisms: regardless of the defense category, the underlying defense mechanism, or the attack strategy employed, prepending DiSCO yields consistent and significant improvements in robustness without compromising generation quality\.

Figure 4:Attack Success Rate \(ASR, %; lower is better\) before \(Base\) and after applying DiSCO \(\+ DiSCO\), across four attacks \(Ring\-A\-Bell, UnlearnDiffAtk, MMA\-Diffusion, P4D\)\. Within each panel, the right group reports defended models \(SLD\-Max, SAFREE, RECE, ESD\) and the left group undefended backbones \(SD 1\.4, SD 2\.0, SD 3, FLUX\)\. DiSCO substantially reduces ASR across every evaluated attack, defense, and backbone\.
### 4\.3Ablations and Analyses

In this section, we ablate the main components of DiSCO\. We first study the effect of the per\-step sampling sizeRR\(Sec[4\.3\.1](https://arxiv.org/html/2608.17067#S4.SS3.SSS1)\) and the size of the reference pool \(Sec[4\.3\.2](https://arxiv.org/html/2608.17067#S4.SS3.SSS2)\) on defense performance\. We then compare the contrastive objective against safe\-only and unsafe\-only scoring to assess whether both pools are needed \(Sec[4\.3\.3](https://arxiv.org/html/2608.17067#S4.SS3.SSS3)\)\. Finally, we analyze how the beam search parametersKKandTTaffect the trade\-off between defense quality, semantic fidelity, and computational cost \(Sec[4\.3\.4](https://arxiv.org/html/2608.17067#S4.SS3.SSS4)\)\.

Table 3:Ablation on reference pool sampling size \(RR\) on SD v1\.4\. We report ASR in %\(↓\\downarrow\) computed exclusively on prompts that still generate harmful content after the baseline defense, isolating the effect of DiSCO on the remaining challenging cases\.R=8R=8is the default setting\.Pool Size \(RR\)Ring\-A\-BellUnlearnDiffAtkMMA\-DiffusionP4D438\.957\.164\.637\.78 \(default\)33\.342\.960\.838\.31650\.035\.763\.349\.13238\.942\.962\.937\.7#### 4\.3\.1Does a larger sampling size always yield better robustness?

We conduct a pool size search acrossR∈\{4,8,16,32\}R\\in\\\{4,8,16,32\\\}and record changes in ASR to identify the optimal sampling size for the contrastive objective\. Table[3](https://arxiv.org/html/2608.17067#S4.T3)summarizes the results\. We notice that increasing the number of sampled images per optimization step does not always yield larger robustness gains\. This finding reveals a fundamental distinction between DiSCO’s stochastic contrastive optimization and traditional concept unlearning approaches\. Conventional unlearning methods train on a large, fixed corpus of harmful images to permanently erase unsafe concepts from the model\. However, once the unlearning is complete, the defense is static: if harmful content still emerges under new adversarial inputs, the approach has exhausted its training signal with no additional data to learn from\. In contrast, DiSCO’s random sampling at each beam search step dynamically assembles different combinations of safe and unsafe references, providing broader coverage of the distributional landscape through diverse compositions rather than relying on a fixed set\. At a moderate sampling size \(R=8R=8\), each optimization step encounters a distinct view of the safe and unsafe spaces, enabling the suffix expansion to navigate varied distributional regions and generalize more effectively across different adversarial inputs\. WhenRRis too small \(R=4R=4\), the sampled subset is insufficient to provide a representative distributional signal\. WhenRRgrows too large \(R=\{16,32\}R=\\\{16,32\\\}\), the sampled subset converges toward the full pool at every step, collapsing back into the static regime where the optimization sees the same distribution repeatedly\. In this case, the contrastive signal loses its diversity, and the defense faces the same limitation as full\-pool unlearning: what the model has seen is all it will ever see\. We find thatR=8R=8presents the best balanced trade\-off across all attacks and defense configurations, and adopt it as the default setting\.

#### 4\.3\.2How large a reference pool is needed to represent the contrastive distribution?

We ablate the size of the reference pool used for contrastive scoring, reducing it from the full 100% \(2613 benign \+ 84 harmful images\) to 50% \(1306/42\) and 25% \(653/21\), and report NudeNet ASR on SD 1\.4 across all four attacks\. We choose these three scales \(100%, 50%, 25%\) to ensure each sampled pool remains larger than the per\-candidate sample sizeR=8R=8; the exact counts denote the safe and unsafe image totals obtained after filtering with NudeNet and Q16\. The 50% and 25% pools are sampled uniformly at random from the full pool over three subsampling seeds \(42, 123, 456\), and we report mean±\\pmstandard deviation across these draws\. To isolate the effect of pool composition, all other sources of randomness are held fixed: the beam search seed is fixed at 0 and the image generation seed at 42, making generation deterministic across runs\. The reported variance therefore reflects pool subsampling alone\.

Table 4:NudeNet ASR \(%\) as a function of reference pool size, on SD v1\.4\. Pool sizes are listed as \(benign / harmful\) image counts\. The 100% counts correspond to the pool remaining after filtering the SD v1\.4 outputs with the Q16 and NudeNet classifiers\.Attack100% pool \(2613/84\)50% pool \(1306/42\)25% pool \(653/21\)Ring\-A\-Bell9\.47\.5±2\.27\.5\_\{\\pm 2\.2\}9\.4±1\.09\.4\_\{\\pm 1\.0\}UnlearnDiffAtk10\.710\.1±2\.210\.1\_\{\\pm 2\.2\}8\.9±1\.58\.9\_\{\\pm 1\.5\}MMA\-Diffusion23\.822\.0±0\.122\.0\_\{\\pm 0\.1\}22\.7±0\.822\.7\_\{\\pm 0\.8\}P4D38\.337\.7±1\.437\.7\_\{\\pm 1\.4\}41\.4±4\.441\.4\_\{\\pm 4\.4\}Table[4](https://arxiv.org/html/2608.17067#S4.T4)shows that pool size has minimal impact on DiSCO effectiveness\. Reducing the pool from 100% \(2613 benign \+ 84 harmful\) to 25% \(653 benign \+ 21 harmful\) produces nearly identical ASR across all attacks, with the reduced\-pool means staying within a few points of the full\-pool baseline and standard deviations remaining small \(±\\pm0\.1–4\.4%\)\. P4D shows a slight degradation at 25% \(38\.3%→\\rightarrow41\.4%\), but this is the hardest attack setting and the difference remains within the pool\-sampling noise range\. These results demonstrate that DiSCO is robust to pool size: even a small reference pool of∼\\sim670 images suffices for effective contrastive scoring\.

#### 4\.3\.3Is contrastive scoring necessary?

We established that the cost function𝒥\\mathcal\{J\}should be based on the relative alignment between the generated image and both the safe and unsafe reference distributions\. To validate this design, we compare the full contrastive objective against two single\-pool variants: \(i\) safe\-only scoring, which maximizes similarity to the safe pool without penalizing proximity to the unsafe pool\(𝒥safe=1R​∑cos​\(ϕ⁡\(x^\),ϕ⁡\(xi\+\)\)\)\(\\mathcal\{\{J\}\_\{\\text\{safe\}\}\}=\\frac\{1\}\{R\}\\sum\\text\{cos\}\(\\phi\(\\hat\{x\}\),\\phi\(x\_\{i\}^\{\+\}\)\)\), and \(ii\) unsafe\-only scoring, which minimizes similarity to the unsafe pool without rewarding alignment with the safe pool\(𝒥unsafe=−1R∑cos\(ϕ\(x^\),ϕ\(xi−\)\)\)\(\\mathcal\{\{J\}\_\{\\text\{unsafe\}\}\}=\-\\frac\{1\}\{R\}\\sum\\text\{cos\}\(\\phi\(\\hat\{x\}\),\\phi\(x\_\{i\}^\{\-\}\)\)\)\. In this section, we study whether the full contrastive objective provides consistent gains over single\-pool alternatives\.

Table 5:Ablation on scoring objective on SD v1\.4\. We compare the full contrastive objective against safe\-only and unsafe\-only single\-pool variants\. We report average ASR in %\(↓\\downarrow\) by NudeNet across attacks\. ASR is computed on prompts that still generate harmful content from the undefended model\.Scoring ObjectiveRing\-A\-BellUnlearnDiffAtkMMAP4DSafe\-only \(𝒥safe\\mathcal\{J\}\_\{\\text\{safe\}\}\)10\.610\.720\.045\.0Unsafe\-only \(𝒥unsafe\\mathcal\{J\}\_\{\\text\{unsafe\}\}\)9\.48\.925\.039\.0Contrastive \(𝒥\\mathcal\{J\}, default\)4\.712\.514\.031\.0Our results in Table[5](https://arxiv.org/html/2608.17067#S4.T5)show that the combination of positive and negative image pools yields a more precise optimization trajectory in the CLIP embedding space: the safe pool guides the suffix expansion toward distributional regions where safe content resides, while the unsafe pool simultaneously repels it from regions associated with harmful generation\. Together, they define a directional gradient in the embedding space that single\-pool objectives cannot achieve\. Further, we notice that even a single image pool already provides sizeable gains over the undefended baseline, with safe\-only scoring achieving an average ASR of 21\.6% and unsafe\-only scoring 20\.6%\. But the contrastive objective achieves a more remarkable average ASR of 15\.6%, outperforming both single\-pool variants on three out of four attacks, with the most notable improvement on Ring\-A\-Bell \(4\.7% vs\. 10\.6% and 9\.4%\) and MMA\-Diffusion \(14\.0% vs\. 20\.0% and 25\.0%\)\. We note that on UnlearnDiffAtk, the contrastive objective \(12\.5%\) slightly underperforms the single\-pool variants, suggesting that the unsafe\-only signal alone may suffice for attacks targeting concept erasure\. Nevertheless, the contrastive formulation consistently delivers the strongest overall performance across diverse attack strategies\. This outcome suggests that neither pool alone provides sufficient guidance across all threat models\. The contrastive formulation resolves this by jointly constraining the optimization: the safe pool anchors the semantic direction while the unsafe pool repels away from harmful regions, preventing ambiguous or incoherent outputs that single\-pool objectives risk producing\.

#### 4\.3\.4How do beam search parameters affect the defense\-efficiency trade\-off?

In this paper, we construct the suffix expansion via beam search to study the trade\-off between defense quality and computational efficiency\. The expanded tokens should not hinder the original prompt intention, unless the prompt contains explicit harmful content\. In benign adversarial cases, we want the expanded suffix to steer the generation toward safe content without deviating from the user’s intent\. Following this, we examine how the model’s defense performance changes when the beam search parameters vary in terms of \(i\) the number of top\-KKsearch paths retained at each expansion step, and \(ii\) the total number of expanded tokensTT\. This experiment requires a large number of runs across all parameter combinations; hence, we follow the same setup with a contrastive pool ofR=8R=8images and carry out the evaluation on SD v1\.4 across all four attack scenarios, with a maximum of 200 prompts per attack to keep the computational cost manageable\.

Table 6:Ablation on beam search parameters on SD v1\.4\. We report average ASR \(↓\\downarrow\) by NudeNet across all attacks and CLIP \(↑\\uparrow\) for semantic alignment\. ASR is computed on prompts that still generate harmful content from the SD v1\.4\. The default setting \(K=4K\\\!=\\\!4,T=16T\\\!=\\\!16\) isunderlined\.K=2K=2K=4K=4K=8K=8T=8T\\\!=\\\!8T=12T\\\!=\\\!12T=16T\\\!=\\\!16T=32T\\\!=\\\!32T=8T\\\!=\\\!8T=12T\\\!=\\\!12T=16T\\\!=\\\!16T=32T\\\!=\\\!32T=8T\\\!=\\\!8T=12T\\\!=\\\!12T=16T\\\!=\\\!16T=32T\\\!=\\\!32ASR\(%\)↓\\downarrow23\.020\.320\.518\.120\.016\.815\.514\.118\.916\.316\.513\.6CLIP↑\\uparrow0\.2810\.2790\.2800\.2780\.2800\.2800\.2810\.2770\.2800\.2810\.2780\.280

We report our results in Table[6](https://arxiv.org/html/2608.17067#S4.T6)\. We observe that both increasingKKandTTconsistently reduce ASR\. Across all configurations, CLIP scores remain remarkably stable, ranging from 0\.2766 to 0\.2813, confirming that the suffix expansion preserves semantic fidelity regardless of the beam search parameters\. IncreasingKKfrom 2 to 4 provides a notable ASR reduction at everyTT\(e\.g\., from 20\.5% to 15\.5% atT=16T=16\)\. Interestingly, further increasing toK=8K=8does not always yield additional gains: atT=16,K=8T=16,K=8achieves 16\.5% ASR, slightly higher thanK=4K=4\(15\.5%\), suggesting that a wider beam may introduce suboptimal candidates that dilute the search\. The benefit ofK=8K=8becomes apparent only at longer suffix lengths \(T=32T=32\), where it achieves the lowest overall ASR of 13\.6%\. We adoptK=4,T=16K=4,T=16as the default setting, where computational cost scales linearly withK×TK\\times Tcandidate generations with fixed branching factorb=4b=4for beam search, as it achieves 15\.5% ASR with a CLIP score of 0\.2810, the highest among all configurations atT=16T=16, providing the best trade\-off between defense quality and computational efficiency\. Extending toT=32T=32atK=4K=4yields a further 1\.4 percentage point reduction but doubles the suffix length with a noticeable CLIP decrease to 0\.2766, indicating the onset of semantic drift\. Complete computational overhead analysis is detailed in Appendix[A\.10](https://arxiv.org/html/2608.17067#A1.SS10)\.

## 5Conclusion

In this work, we analyzed the effect of DiSCO prompt optimization on boosting the safety of both undefended and defended text\-to\-image generation systems\. We conducted a comprehensive empirical study across four attack methods spanning black\-box and white\-box threat models, four defense methods covering inference\-time, weight\-editing, and fine\-tuning categories, and four model architectures spanning both UNet\-based and DiT\-based families\. Our results demonstrate that DiSCO is a simple yet effective technique for improving defense robustness\. Across 32 system–attack settings and five seeds, DiSCO reduces average ASR from23\.6%23\.6\\%to2\.4%2\.4\\%under NudeNet and from8\.3%8\.3\\%to1\.7%1\.7\\%under Q16, while maintaining or improving semantic fidelity and perceptual quality\. As a training\-free, strictly black\-box, and model\-agnostic module, DiSCO requires no access to model internals and no retraining, making it readily deployable as a plug\-and\-play safety enhancement for any text\-to\-image system in practice\.

## Acknowledgments

This research was supported by King Abdullah University of Science and Technology \(KAUST\), Center of Excellence for Generative AI, under Award No\. 5940, and by the KAUST Office of Research Funding and Services \(ORFS\) under Award No\. ORFS\-CRG13\-2025\-6903\.

## References

- \[1\]D\. Chen, Z\. Li, C\. Chen, X\. Li, and J\. Ye\(2025\)Comprehensive assessment and analysis for nsfw content erasure in text\-to\-image diffusion models\.arXiv preprint arXiv:2502\.12527\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[2\]Z\. Chin, C\. Jiang, C\. Huang, P\. Chen, and W\. Chiu\(2024\)Prompting4Debugging: red\-teaming text\-to\-image diffusion models by finding problematic prompts\.InInternational Conference on Machine Learning \(ICML\),External Links:[Link](https://arxiv.org/abs/2309.06135)Cited by:[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p2.1)\.
- \[3\]P\. Dhariwal and A\. Nichol\(2021\)Diffusion models beat gans on image synthesis\.Advances in neural information processing systems34,pp\. 8780–8794\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[4\]P\. Esser, S\. Kulal, A\. Blattmann, R\. Entezari, J\. Müller, H\. Saini, Y\. Levi, D\. Lorenz, A\. Sauer, F\. Boesel,et al\.\(2024\)Scaling rectified flow transformers for high\-resolution image synthesis\.InForty\-first international conference on machine learning,Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p1.1)\.
- \[5\]R\. Gandikota, J\. Materzynska, J\. Fiotto\-Kaufman, and D\. Bau\(2023\)Erasing concepts from diffusion models\.External Links:2303\.07345,[Link](https://arxiv.org/abs/2303.07345)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1)\.
- \[6\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§4](https://arxiv.org/html/2608.17067#S4.p4.1)\.
- \[7\]J\. Ho, A\. Jain, and P\. Abbeel\(2020\)Denoising diffusion probabilistic models\.Advances in neural information processing systems33,pp\. 6840–6851\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[8\]C\. Huang, K\. Chang, C\. Tsai, Y\. Lai, F\. Yang, and Y\. F\. Wang\(2024\)Receler: reliable concept erasing of text\-to\-image diffusion models via lightweight erasers\.External Links:2311\.17717,[Link](https://arxiv.org/abs/2311.17717)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1)\.
- \[9\]Z\. Jing, X\. Yang, X\. Li, S\. Liang, A\. Liu, M\. Zhang, and X\. Liu\(2025\)PromptSafe: gated prompt tuning for safe text\-to\-image generation\.External Links:2508\.01272,[Link](https://arxiv.org/abs/2508.01272)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1)\.
- \[10\]B\. F\. Labs\(2024\)FLUX\.Note:[https://github\.com/black\-forest\-labs/flux](https://github.com/black-forest-labs/flux)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p1.1)\.
- \[11\]G\. Li, K\. Chen, S\. Zhang, J\. Zhang, and T\. Zhang\(2024\)ART: automatic red\-teaming for text\-to\-image models to protect benign users\.External Links:2405\.19360,[Link](https://arxiv.org/abs/2405.19360)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1)\.
- \[12\]X\. Li, Y\. Yang, J\. Deng, C\. Yan, Y\. Chen, X\. Ji, and W\. Xu\(2024\)Safegen: mitigating sexually explicit content generation in text\-to\-image models\.InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security,pp\. 4807–4821\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[13\]J\. Liao, Z\. Yang, L\. Li, D\. Li, K\. Lin, Y\. Cheng, and L\. Wang\(2025\)Imagegen\-cot: enhancing text\-to\-image in\-context learning with chain\-of\-thought reasoning\.arXiv preprint arXiv:2503\.19312\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[14\]Y\. Liu, W\. Zhang, H\. Chen, L\. Wang, X\. Jia, Z\. Lin, and W\. Wang\(2025\)AutoPrompt: automated red\-teaming of text\-to\-image models via llm\-driven adversarial prompts\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 17557–17566\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p2.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px1.p1.1)\.
- \[15\]Y\. Luo, T\. Hu, J\. Sun, Y\. Cai, and J\. Tang\(2025\)Learning few\-step diffusion models by trajectory distribution matching\.InProceedings of the IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 17719–17728\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[16\]X\. Meng, Y\. Dong, N\. Yu, L\. Wang, Z\. Li, and S\. Guo\(2026\)Beyond the safety tax: mitigating unsafe text\-to\-image generation via external safety rectification\.External Links:2508\.21099,[Link](https://arxiv.org/abs/2508.21099)Cited by:[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1)\.
- \[17\]A\. Q\. Nichol and P\. Dhariwal\(2021\)Improved denoising diffusion probabilistic models\.InInternational conference on machine learning,pp\. 8162–8171\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[18\]A\. Radford, J\. W\. Kim, C\. Hallacy, A\. Ramesh, G\. Goh, S\. Agarwal, G\. Sastry, A\. Askell, P\. Mishkin, J\. Clark, G\. Krueger, and I\. Sutskever\(2021\)Learning transferable visual models from natural language supervision\.External Links:2103\.00020,[Link](https://arxiv.org/abs/2103.00020)Cited by:[§2\.1](https://arxiv.org/html/2608.17067#S2.SS1.SSS0.Px2.p1.3),[§4](https://arxiv.org/html/2608.17067#S4.p3.1)\.
- \[19\]A\. Ramesh, M\. Pavlov, G\. Goh, S\. Gray, C\. Voss, A\. Radford, M\. Chen, and I\. Sutskever\(2021\)Zero\-shot text\-to\-image generation\.InInternational conference on machine learning,pp\. 8821–8831\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[20\]R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. Ommer\(2022\)High\-resolution image synthesis with latent diffusion models\.External Links:2112\.10752,[Link](https://arxiv.org/abs/2112.10752)Cited by:[§A\.10](https://arxiv.org/html/2608.17067#A1.SS10.p3.1),[§1](https://arxiv.org/html/2608.17067#S1.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p1.1)\.
- \[21\]P\. Schramowski, M\. Brack, B\. Deiseroth, and K\. Kersting\(2023\)Safe latent diffusion: mitigating inappropriate degeneration in diffusion models\.External Links:2211\.05105,[Link](https://arxiv.org/abs/2211.05105)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§1](https://arxiv.org/html/2608.17067#S1.p4.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p3.1)\.
- \[22\]Y\. Song and S\. Ermon\(2019\)Generative modeling by estimating gradients of the data distribution\.Advances in neural information processing systems32\.Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p1.1)\.
- \[23\]B\. Tan, Z\. Wang, and H\. Wang\(2026\)DTVI: dual\-stage textual and visual intervention for safe text\-to\-image generation\.External Links:2603\.22041,[Link](https://arxiv.org/abs/2603.22041)Cited by:[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1)\.
- \[24\]Y\. Tsai, C\. Hsu, C\. Xie, C\. Lin, J\. Chen, B\. Li, P\. Chen, C\. Yu, and C\. Huang\(2023\)Ring\-a\-bell\! how reliable are concept removal methods for diffusion models?\.arXiv preprint arXiv:2310\.10012\.Cited by:[§A\.10](https://arxiv.org/html/2608.17067#A1.SS10.p3.1),[§1](https://arxiv.org/html/2608.17067#S1.p2.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px1.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p2.1)\.
- \[25\]Y\. Wu, N\. Yu, M\. Backes, Y\. Shen, and Y\. Zhang\(2025\)On the Proactive Generation of Unsafe Images From Text\-To\-Image Models Using Benign Prompts\.InUSENIX Security Symposium \(USENIX Security\),Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1)\.
- \[26\]Y\. Yang, R\. Gao, X\. Wang, T\. Ho, N\. Xu, and Q\. Xu\(2024\)MMA\-diffusion: multimodal attack on diffusion models\.External Links:2311\.17516,[Link](https://arxiv.org/abs/2311.17516)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p2.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px1.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p2.1)\.
- \[27\]Y\. Yang, B\. Hui, H\. Yuan, N\. Gong, and Y\. Cao\(2023\)SneakyPrompt: jailbreaking text\-to\-image generative models\.External Links:2305\.12082,[Link](https://arxiv.org/abs/2305.12082)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p2.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px1.p1.1)\.
- \[28\]J\. Yoon, S\. Yu, V\. Patil, H\. Yao, and M\. Bansal\(2025\)SAFREE: training\-free and adaptive guard for safe text\-to\-image and video generation\.External Links:2410\.12761,[Link](https://arxiv.org/abs/2410.12761)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1)\.
- \[29\]L\. Yuan, X\. Li, C\. Xu, G\. Tao, X\. Jia, Y\. Huang, W\. Dong, Y\. Liu, X\. Wang, and B\. Li\(2026\)PromptGuard: soft prompt\-guided unsafe content moderation for text\-to\-image models\.External Links:2501\.03544,[Link](https://arxiv.org/abs/2501.03544)Cited by:[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1)\.
- \[30\]W\. Zeng, D\. Kurniawan, R\. Mullins, Y\. Liu, T\. Saha, D\. Ike\-Njoku, J\. Gu, Y\. Song, C\. Xu, J\. Zhou, A\. Joshi, S\. Dheep, M\. Malek, H\. Palangi, J\. Baek, R\. Pereira, and K\. Narasimhan\(2025\)ShieldGemma 2: robust and tractable image content moderation\.External Links:2504\.01081,[Link](https://arxiv.org/abs/2504.01081)Cited by:[§A\.2](https://arxiv.org/html/2608.17067#A1.SS2.p1.1)\.
- \[31\]Y\. Zhang, X\. Chen, J\. Jia, Y\. Zhang, C\. Fan, J\. Liu, M\. Hong, K\. Ding, and S\. Liu\(2024\)Defensive unlearning with adversarial training for robust concept erasure in diffusion models\.External Links:2405\.15234,[Link](https://arxiv.org/abs/2405.15234)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1)\.
- \[32\]Y\. Zhang, J\. Jia, X\. Chen, A\. Chen, Y\. Zhang, J\. Liu, K\. Ding, and S\. Liu\(2024\)To generate or not? safety\-driven unlearned diffusion models are still easy to generate unsafe images … for now\.External Links:2310\.11868,[Link](https://arxiv.org/abs/2310.11868)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p2.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px1.p1.1),[§4\.2](https://arxiv.org/html/2608.17067#S4.SS2.p1.1),[§4](https://arxiv.org/html/2608.17067#S4.p2.1)\.
- \[33\]X\. Zhao, X\. Chen, B\. Liu, Z\. Liu, Z\. Zhao, and X\. Gu\(2025\)Value\-aligned prompt moderation via zero\-shot agentic rewriting for safe image generation\.External Links:2511\.11693,[Link](https://arxiv.org/abs/2511.11693)Cited by:[§1](https://arxiv.org/html/2608.17067#S1.p3.1),[§3](https://arxiv.org/html/2608.17067#S3.SS0.SSS0.Px2.p1.1)\.

## Appendix ASupplementary Material

### A\.1DiSCO Algorithm

We provide the complete pseudo\-code of DiSCO in Algorithm[1](https://arxiv.org/html/2608.17067#alg1)\. The procedure takes as input a promptp′p^\{\\prime\}, the target model𝒢\\mathcal\{G\}, a suffix generatorℳ\\mathcal\{M\}, pre\-constructed safe and unsafe reference pools𝒫safe\\mathcal\{P\}\_\{\\text\{safe\}\}and𝒫unsafe\\mathcal\{P\}\_\{\\text\{unsafe\}\}, beam widthKK, suffix lengthTT, and sampling sizeRR\. At each expansion step, DiSCO proposes candidate tokens usingMM, generates an image for each candidate throughGG, scores it against randomly sampled subsets from both reference pools using the contrastive objectiveJJ, and retains the top\-KKcandidates\. AfterTTsteps, the highest\-scoring candidate is returned as the optimized promptp∗p^\{\*\}\.

Algorithm 1DiSCO: Distribution\-Guided Contrastive Prompt Optimization0:Input prompt

p′p^\{\\prime\}, target model

𝒢\\mathcal\{G\}, suffix generator

ℳ\\mathcal\{M\}, safe pool

𝒫safe\\mathcal\{P\}\_\{\\text\{safe\}\}, unsafe pool

𝒫unsafe\\mathcal\{P\}\_\{\\text\{unsafe\}\}, beam width

KK, suffix length

TT, sample size

RR
0:Optimized prompt

p∗p^\{\*\}
1:Initialize beam

ℬ←\{p′\}\\mathcal\{B\}\\leftarrow\\\{p^\{\\prime\}\\\}
2:for

t=1t=1to

TTdo

3:

ℬnew←∅\\mathcal\{B\}\_\{\\text\{new\}\}\\leftarrow\\emptyset
4:foreach candidate

p^∈ℬ\\hat\{p\}\\in\\mathcal\{B\}do

5:Propose next tokens from

ℳ⁡\(p^\)\\mathcal\{M\}\(\\hat\{p\}\), yielding candidates

\{p^1,p^2,…\}\\\{\\hat\{p\}\_\{1\},\\hat\{p\}\_\{2\},\\ldots\\\}
6:foreach extended candidate

p^j\\hat\{p\}\_\{j\}do

7:

x^←𝒢⁡\(p^j\)\\hat\{x\}\\leftarrow\\mathcal\{G\}\(\\hat\{p\}\_\{j\}\)
8:Sample

𝒫~safe,𝒫~unsafe\\tilde\{\\mathcal\{P\}\}\_\{\\text\{safe\}\},\\tilde\{\\mathcal\{P\}\}\_\{\\text\{unsafe\}\}of size

RRfrom

𝒫safe,𝒫unsafe\\mathcal\{P\}\_\{\\text\{safe\}\},\\mathcal\{P\}\_\{\\text\{unsafe\}\}
9:

𝒥⁡\(p^j\)←cos¯​\(ϕ⁡\(x^\),𝒫~safe\)−cos¯​\(ϕ⁡\(x^\),𝒫~unsafe\)\\mathcal\{J\}\(\\hat\{p\}\_\{j\}\)\\leftarrow\\overline\{\\cos\}\(\\phi\(\\hat\{x\}\),\\tilde\{\\mathcal\{P\}\}\_\{\\text\{safe\}\}\)\-\\overline\{\\cos\}\(\\phi\(\\hat\{x\}\),\\tilde\{\\mathcal\{P\}\}\_\{\\text\{unsafe\}\}\)
10:

ℬnew←ℬnew∪\{\(p^j,𝒥⁡\(p^j\)\)\}\\mathcal\{B\}\_\{\\text\{new\}\}\\leftarrow\\mathcal\{B\}\_\{\\text\{new\}\}\\cup\\\{\(\\hat\{p\}\_\{j\},\\mathcal\{J\}\(\\hat\{p\}\_\{j\}\)\)\\\}
11:endfor

12:endfor

13:

ℬ←Top\-​K​\(ℬnew\)\\mathcal\{B\}\\leftarrow\\text\{Top\-\}K\(\\mathcal\{B\}\_\{\\text\{new\}\}\)⊳\\trianglerightRetain top\-KKcandidates by𝒥\\mathcal\{J\}

14:endfor

15:

p∗←arg⁡maxp^∈ℬ⁡𝒥⁡\(p^\)p^\{\*\}\\leftarrow\\arg\\max\_\{\\hat\{p\}\\in\\mathcal\{B\}\}\\mathcal\{J\}\(\\hat\{p\}\)
16:return

p∗p^\{\*\}

### A\.2Is the Evaluation Circular?

Because NudeNet and Q16 are used both for reference\-pool construction and for the main safety evaluation, a natural concern is that DiSCO may align to their decision boundaries\. We address this directly by re\-evaluating every setting with ShieldGemma2\-4B\[[30](https://arxiv.org/html/2608.17067#bib.bib33)\], a safety classifier that plays no role in candidate scoring and that differs in kind from our reported detectors: NudeNet operates at the pixel level, detecting exposed body parts, whereas ShieldGemma2\-4B is a44B\-parameter vision\-language model that judges whether an image violates a sexually\-explicit content policy\.

Before DiSCO is applied, ShieldGemma2\-4B reports a higher ASR than NudeNet in1818of the3232model\-attack settings, with an average of35\.4%35\.4\\%against32\.9%32\.9\\%\(Table[7](https://arxiv.org/html/2608.17067#A1.T7)\)\. The disagreement is sharpest under MMA\-Diffusion, where ESD scores38\.1%38\.1\\%under ShieldGemma2\-4B but only6\.0%6\.0\\%under NudeNet, and RECE scores51\.4%51\.4\\%against32\.3%32\.3\\%\. ShieldGemma2\-4B therefore measures a distinct, only partially overlapping notion of image safety, and is not a proxy for the detector boundary that DiSCO optimizes against\.

Table 7:Attack success rate \(%\) under four nudity attacks, measured by NudeNet \(pixel\-level body\-part detection\) and ShieldGemma2\-4B \(semantic safety classification\)\. ASR is computed over all attack prompts, using the same denominator for baseline and DiSCO\. Lower is better\.Ring\-A\-BellUnlearnDiffAtkMMA\-DiffusionP4DVariantNudeNetShieldG2NudeNetShieldG2NudeNetShieldG2NudeNetShieldG2SD v1\.489\.581\.169\.161\.776\.287\.234\.145\.7\+ DiSCO8\.45\.37\.44\.911\.012\.213\.114\.5SD v2\.088\.482\.142\.039\.522\.736\.122\.631\.6\+ DiSCO4\.24\.22\.57\.42\.12\.510\.610\.2FLUX93\.770\.537\.528\.411\.918\.618\.818\.8\+ DiSCO5\.31\.10\.01\.20\.70\.98\.25\.1SD3\-medium45\.341\.116\.123\.55\.420\.98\.921\.5\+ DiSCO2\.10\.00\.01\.20\.10\.43\.32\.0SLD\-Max72\.651\.633\.322\.253\.161\.66\.27\.0\+ DiSCO2\.10\.02\.52\.57\.69\.22\.20\.0SAFREE52\.652\.621\.013\.633\.550\.24\.44\.3\+ DiSCO0\.00\.02\.50\.04\.76\.71\.10\.4RECE3\.26\.39\.912\.332\.351\.44\.47\.4\+ DiSCO0\.00\.00\.00\.04\.26\.71\.80\.0ESD23\.226\.313\.613\.66\.038\.11\.85\.9\+ DiSCO0\.00\.03\.72\.51\.25\.50\.70\.0Despite this, DiSCO reduces ASR under*all*evaluators in all3232settings\. The residual ASR after DiSCO is3\.5%3\.5\\%under NudeNet and3\.3%3\.3\\%under ShieldGemma2\-4B, a difference far smaller than the2\.52\.5\-point gap separating the two evaluators across all 32 settings\. If DiSCO were exploiting detector\-specific artifacts, we would expect the held\-out evaluator to retain substantially more unsafe generations; instead the two converge\.

### A\.3Generality Across NSFW Categories from I2P Dataset

To demonstrate that DiSCO’s benefits are not confined to nudity, we evaluate it on top of four defense mechanisms \(ESD, RECE, SAFREE, SLD\-Max\) across all seven harm categories of the I2P dataset\. To keep the comparison feasible and isolate the effect of DiSCO without confounding it with attack strength, we apply each defense directly to the original I2P prompts \(no adversarial attack applied\), reporting the vanilla defense ASR as the baseline and the DiSCO\-enhanced ASR as the improvement\. Table[8](https://arxiv.org/html/2608.17067#A1.T8)reports the per\-category results under both NudeNet and Q16\.

Table 8:Per\-category ASR \(%\) under NudeNet and Q16: defense baselines vs\. DiSCO\-enhanced, on SD v1\.4\. Prompts are taken directly from I2P without augmentation by any attack tool, isolating how DiSCO performs across categories without introducing implementation bias from a specific attack method\. “—” denotes no samples flagged at baseline\.MetricESDRECESAFREESLD\-Max/ CategoryNBase\+DiSCOBase\+DiSCOBase\+DiSCOBase\+DiSCONudeNet ASR \(%\)Sexual9313\.30\.12\.00\.04\.51\.65\.20\.2Violence7560\.40\.00\.40\.00\.30\.00\.90\.1Hate2310\.0—1\.70\.00\.40\.00\.40\.0Harassment8240\.70\.00\.70\.00\.10\.00\.60\.0Self\-harm8011\.80\.00\.40\.00\.90\.00\.90\.0Shocking8561\.90\.01\.10\.00\.90\.11\.30\.0Illegal activity7270\.40\.00\.80\.00\.10\.00\.70\.0Average1\.20\.01\.00\.01\.00\.21\.40\.0Q16 ASR \(%\)Sexual93115\.20\.118\.90\.114\.00\.24\.30\.0Violence75639\.00\.040\.10\.034\.90\.014\.50\.0Hate23131\.2—35\.90\.423\.80\.010\.40\.0Harassment82429\.20\.031\.20\.023\.20\.010\.10\.0Self\-harm80132\.10\.137\.50\.031\.10\.08\.00\.0Shocking85644\.20\.150\.60\.043\.00\.015\.50\.1Illegal activity72731\.20\.034\.80\.024\.60\.05\.90\.1Average31\.70\.135\.60\.127\.80\.09\.80\.0DiSCO delivers near\-total suppression of unsafe generation across every category and defense\. Under NudeNet, it drives the average ASR from 1\.0–1\.4% down to≤\\leq0\.2%, reducing nearly every category to 0\.0%\. The effect is more striking under Q16, which captures a broader notion of inappropriate content: DiSCO reduces the average ASR from 9\.8–35\.6% to at most 0\.1%, collapsing categories the vanilla defenses barely address, such as violence, shocking, and self\-harm, to near zero\. Crucially, since DiSCO is training\-free and never optimizes toward any particular category, this uniform near\-zero ASR reflects genuine generality rather than category\-specific tuning, confirming that DiSCO generalizes across the full I2P harm spectrum and provides gains that stack on top of existing defenses\.

### A\.4Does DiSCO affect benign generation?

A practical concern for any safety defense is whether it inadvertently degrades generation quality on prompts that already produce safe content\. To investigate this, we randomly sample 100 benign prompts from each attack approach that generate safe images under the undefended SD v1\.4, and apply DiSCO to measure whether the suffix expansion introduces false positives, reduces semantic alignment, or affects perceptual quality\. We report ASR to quantify the false positive rate, CLIP score for semantic fidelity, and ImageReward for human preference alignment\.

Table 9:Effect of DiSCO on benign generation on SD v1\.4\. We randomly sample 100 benign prompts from each attack that already produce safe images, and report CLIP \(↑\\uparrow\) for semantic fidelity and ImageReward \(↑\\uparrow\) for perceptual quality\.CLIP↑\\uparrowImgRwd↑\\uparrowAttack Sourcew/ow/w/ow/Ring\-A\-Bell0\.230\.27\-1\.06\-0\.03UnlearnDiffAtk0\.260\.28\-0\.390\.06MMA\-Diffusion0\.240\.29\-0\.86\-0\.18P4D0\.260\.270\.570\.42Overall0\.250\.28\-0\.600\.05Table[9](https://arxiv.org/html/2608.17067#A1.T9)shows that DiSCO generally preserves generation quality on prompts that already produce safe images\. Averaged across the four prompt sources, CLIP increases from0\.250\.25to0\.280\.28, while ImageReward increases from−0\.60\-0\.60to0\.050\.05\. Although ImageReward decreases slightly for P4D, the aggregate results indicate that applying DiSCO to benign generations does not systematically degrade semantic fidelity or perceptual quality\.

### A\.5Out\-of\-Distribution Generalization to T2I\-RiskyPrompt

The main evaluation uses I2P because it is a standard benchmark for comparison with prior text\-to\-image safety defenses\. However, performance on the prompt distribution used during reference\-pool construction does not alone establish generalization to unseen prompt distributions\. We therefore evaluate DiSCO on 1,000 prompts sampled from T2I\-RiskyPrompt, which is not used for reference\-pool construction or hyperparameter selection\. Images are generated directly from these naturally occurring risky prompts without applying any additional adversarial attack\. The model\-specific safe and unsafe reference pools remain fixed, and DiSCO is applied without pool reconstruction or dataset\-specific tuning\.

Table 10:Out\-of\-distribution generalization on 1,000 T2I\-RiskyPrompt prompts\. ASR \(%\) is reported with and without DiSCO, and reduction is relative\. ASR denotes the percentage of naturally occurring risky prompts that generate unsafe images\. No additional attack is applied\.ModelBase ASR\+ DiSCO ASRReductionSD 1\.413\.46\.948\.8SD 2\.08\.53\.460\.2SD 35\.61\.965\.5FLUX11\.15\.550\.0SLD\-Max6\.21\.181\.7SAFREE4\.00\.684\.6ESD2\.70\.292\.3RECE1\.60\.193\.8##### Results\.

As shown in Table[10](https://arxiv.org/html/2608.17067#A1.T10), DiSCO reduces ASR across all eight evaluated systems\. On the four undefended backbones, the relative reduction ranges from48\.8%48\.8\\%to65\.5%65\.5\\%\. When combined with existing defenses, DiSCO achieves reductions of81\.7%81\.7\\%to93\.8%93\.8\\%, leaving only0\.1%0\.1\\%to1\.1%1\.1\\%residual ASR\.

##### Discussion\.

Because no additional attack is applied, this experiment directly evaluates transfer to naturally occurring risky prompts from an unseen dataset\. The consistent reductions obtained using the original fixed reference pools support that DiSCO captures transferable properties of each generator’s safe and unsafe output distributions, rather than overfitting to I2P or to the attack constructions used in the main evaluation\.

### A\.6Confidence\-Aware Reference\-Pool Construction

Table 11:Sensitivity to confidence thresholdsτlow\\tau\_\{\\mathrm\{low\}\}andτhigh\\tau\_\{\\mathrm\{high\}\}\. Pool size reports the number of benign, harmful, and discarded candidates\. Best results are shown in bold\.Configurationτlow\\tau\_\{\\mathrm\{low\}\}τhigh\\tau\_\{\\mathrm\{high\}\}Pool size \(benign / harmful / discarded\)NudeNet ASRQ16 ASRBinary consensus–––9\.4% \(8/85\)2\.4% \(2/85\)Strict0\.100\.801081 / 6 / 32534\.7% \(4/85\)1\.2% \(1/85\)Moderate0\.200\.601579 / 41 / 27205\.9% \(5/85\)2\.4% \(2/85\)Asymmetric harmful0\.200\.501579 / 65 / 26968\.2% \(7/85\)3\.5% \(3/85\)Asymmetric benign0\.150\.701373 / 19 / 29489\.4% \(8/85\)1\.2% \(1/85\)Relaxed0\.300\.401985 / 113 / 22428\.2% \(7/85\)3\.5% \(3/85\)The default reference\-pool construction removes samples for which NudeNet and Q16 disagree, but does not distinguish high\-confidence agreement from borderline predictions near the classifiers decision boundaries\. Consequently, an image may enter a reference pool even when both classifiers assign low confidence\.

To examine this limitation, we construct the reference pools using classifier confidence scores rather than binary labels alone\. We definesNudeNets\_\{\\mathrm\{NudeNet\}\}as the maximum confidence across NudeNet body\-part detections andsQ16s\_\{\\mathrm\{Q16\}\}as Q16’s predicted unsafe probability\. Given lower and upper thresholdsτlow\\tau\_\{\\mathrm\{low\}\}andτhigh\\tau\_\{\\mathrm\{high\}\}, each image is assigned as

harmful:\\displaystyle\\text\{harmful\}:\\quadsNudeNet≥τhigh∧sQ16≥τhigh,\\displaystyle s\_\{\\mathrm\{NudeNet\}\}\\geq\\tau\_\{\\mathrm\{high\}\}\\wedge s\_\{\\mathrm\{Q16\}\}\\geq\\tau\_\{\\mathrm\{high\}\},\(7\)benign:\\displaystyle\\text\{benign\}:\\quadsNudeNet≤τlow∧sQ16≤τlow\.\\displaystyle s\_\{\\mathrm\{NudeNet\}\}\\leq\\tau\_\{\\mathrm\{low\}\}\\wedge s\_\{\\mathrm\{Q16\}\}\\leq\\tau\_\{\\mathrm\{low\}\}\.\(8\)All remaining images are treated as ambiguous and excluded\. This rule filters both classifier disagreements and low\-confidence agreements\.

We evaluate five threshold configurations on Ring\-A\-Bell against SD 1\.4\. Among the 95 attack prompts, NudeNet identifies 85 baseline outputs as unsafe; DiSCO is evaluated on these residual failures\.

As shown in Table[11](https://arxiv.org/html/2608.17067#A1.T11), the strict configuration achieves the lowest residual ASR, reducing NudeNet ASR from9\.4%9\.4\\%to4\.7%4\.7\\%and Q16 ASR from2\.4%2\.4\\%to1\.2%1\.2\\%\. However, it retains only six harmful reference images\. We therefore use all available harmful samples in this setting, settingR=min⁡\(8,\|Punsafe\|\)=6R=\\min\(8,\|\{P\}\_\{\\mathrm\{unsafe\}\}\|\)=6, which may provide limited coverage of the unsafe output distribution\. The moderate configuration offers a more balanced operating point, retaining 41 harmful images while reducing NudeNet ASR to5\.9%5\.9\\%and matching the binary\-consensus Q16 result\.

Performance does not improve monotonically as the thresholds are relaxed\. The asymmetric\-harmful and relaxed configurations retain more harmful references but increase Q16 ASR to3\.5%3\.5\\%, suggesting that borderline samples can dilute the contrastive guidance\. Confidence\-aware consensus therefore introduces a trade\-off between reference\-pool quality and distributional coverage\. We retain binary consensus as a simple default, while confidence\-thresholded filtering provides a configurable refinement for deployments requiring stricter treatment of borderline samples\.

### A\.7Preference\-Based Safety Settings

The current experiments use a binary safe/unsafe partition to follow the standard evaluation protocol\. However, this binary partition is a property of reference\-pool construction rather than a limitation of DiSCO’s optimization mechanism\. The current contrastive objective selects a suffix by maximizing

J⁡\(p^\)=1R​∑xi\+∈𝒫~safecos⁡\(ϕ⁡\(x^\),ϕ⁡\(xi\+\)\)−1R​∑xj−∈𝒫~unsafecos⁡\(ϕ⁡\(x^\),ϕ⁡\(xj−\)\)\.J\(\\hat\{p\}\)=\\frac\{1\}\{R\}\\sum\_\{x\_\{i\}^\{\+\}\\in\\tilde\{\\mathcal\{P\}\}\_\{\\mathrm\{safe\}\}\}\\cos\\\!\\left\(\\phi\(\\hat\{x\}\),\\phi\(x\_\{i\}^\{\+\}\)\\right\)\-\\frac\{1\}\{R\}\\sum\_\{x\_\{j\}^\{\-\}\\in\\tilde\{\\mathcal\{P\}\}\_\{\\mathrm\{unsafe\}\}\}\\cos\\\!\\left\(\\phi\(\\hat\{x\}\),\\phi\(x\_\{j\}^\{\-\}\)\\right\)\.\(9\)
ForLLreference pools representing different safety levels, this objective can be generalized as

Jw​\(p^\)=∑l=1Lwl​1\|𝒫~l\|​∑x∈𝒫~lcos⁡\(ϕ⁡\(x^\),ϕ⁡\(x\)\),J\_\{w\}\(\\hat\{p\}\)=\\sum\_\{l=1\}^\{L\}w\_\{l\}\\frac\{1\}\{\|\\tilde\{\\mathcal\{P\}\}\_\{l\}\|\}\\sum\_\{x\\in\\tilde\{\\mathcal\{P\}\}\_\{l\}\}\\cos\\\!\\left\(\\phi\(\\hat\{x\}\),\\phi\(x\)\\right\),\(10\)where𝒫~l\\tilde\{\\mathcal\{P\}\}\_\{l\}denotes the reference pool for safety levelll, andwlw\_\{l\}specifies the deployment preference assigned to that level\. The current binary objective is recovered withL=2L=2and weights\(\+1,−1\)\(\+1,\-1\)for the safe and unsafe pools, respectively\.

This formulation allows deployments to encode different safety preferences without changing the beam\-search procedure\. For example, a child\-facing system could assign negative weights to borderline content that an adult\-facing system treats neutrally, whereas a more permissive deployment could reduce these penalties\. Only the construction of the reference pools and their associated weights would change\.

The main additional requirements are therefore to define meaningful safety levels and calibrate their weights for the intended audience, application, or jurisdiction\. We identify multi\-pool construction and deployment\-specific weight calibration as promising future work rather than evaluated contributions of the current study\.

### A\.8Quantifying Semantic Drift from Suffix Optimization

We measure the semantic shift induced by DiSCO suffixes via the mean cosine similarity between original and suffixed prompt embeddings across all four attack settings\. Across all attack settings and defenses, cosine similarity remains consistently high \(0\.84–0\.92\), corresponding to a modest semantic shift of only∼\\sim10–15% in cosine distance\. This indicates that DiSCO suffixes steer generation toward safety without drastically altering the underlying prompt meaning\. The effect is stable across defenses: similarity varies by less than 0\.08 between the strongest case \(UnlearnDiffAtk under ESD, 0\.92\) and the weakest \(P4D under SAFREE, 0\.84\), showing that semantic preservation does not depend on any particular defense mechanism\. The relatively lower values under P4D reflect its more aggressive optimization, yet even there the prompt meaning is largely retained\. Overall, the results indicate that DiSCO steers generation toward safety by extending the prompt without losing its original meaning\.

Table 12:Mean cosine similarity between original and DiSCO\-suffixed prompt embeddings across attack settings and defenses\.GroupRing\-A\-BellMMA\-DiffusionUnlearnDiffAtkP4DUndefended0\.900\.880\.910\.90ESD0\.890\.890\.920\.86RECE0\.880\.890\.880\.89SAFREE0\.890\.890\.910\.84SLD0\.890\.890\.910\.86
### A\.9How does DiSCO perform on Text\-Extended Attack Approaches

We additionally evaluate DiSCO against APT, a prompt\-extension attack that appends an optimized textual suffix to elicit unsafe content, which operates in the reverse direction of DiSCO, which appends a suffix to suppress it\. We did not include APT in the main paper because it lacks an official public implementation; the results reported here are based on our own re\-implementation following the procedure described by the authors, and we note this reproduction caveat when interpreting the numbers\. Table[13](https://arxiv.org/html/2608.17067#A1.T13)reports NudeNet ASR, Q16 ASR, and CLIP score for the base model, under APT attack, and with DiSCO applied on top of APT\-attacked prompts, across four undefended backbones and four defenses \(SLD\-Max, ESD, RECE, SAFREE\)\.

##### APT vs\. DiSCO\.

As expected from its adversarial objective, APT raises NudeNet ASR substantially over the base model across all four undefended backbones \(e\.g\.,→38\.524\.5\\\!\\to\\\!38\.5on SD 1\.4,→26\.312\.3\\\!\\to\\\!26\.3on SD 2\.0,→23\.512\.6\\\!\\to\\\!23\.5on FLUX\), confirming that our re\-implementation successfully elicits unsafe content\. Interestingly, APT slightly*lowers*Q16 ASR in most cases \(e\.g\.,→13\.422\.0\\\!\\to\\\!13\.4on SD 1\.4\), indicating that its optimized suffixes concentrate on nudity\-type unsafe content rather than the broader category Q16 detects\. Applied to APT\-attacked prompts, DiSCO reduces NudeNet ASR below the unattacked baseline in seven of eight settings and substantially mitigates the remaining increase on SD 2\.0\. Q16 ASR decreases to at most4\.7%4\.7\\%across all eight systems\. CLIP decreases modestly, by0\.020\.02–0\.050\.05relative to the base configurations\.

Table 13:APT suffix\-attack stress test across four undefended backbones and four defended systems\. We report NudeNet ASR, Q16 ASR, and CLIP score for the unattacked baseline, APT\-attacked prompts, and APT\-attacked prompts followed by DiSCO\.NudeNet ASR \(%\)Q16 ASR \(%\)CLIP scoreModelBaseAPTAPT \+ DiSCOBaseAPTAPT \+ DiSCOBaseAPTAPT \+ DiSCOSD 1\.424\.538\.512\.922\.013\.42\.60\.290\.270\.25SD 2\.012\.326\.313\.622\.919\.94\.70\.270\.250\.25SD 36\.310\.43\.015\.613\.11\.00\.260\.250\.24FLUX12\.623\.56\.314\.49\.31\.90\.260\.250\.22SLD\-Max5\.211\.91\.34\.32\.10\.00\.230\.220\.19ESD3\.35\.21\.015\.211\.80\.10\.260\.250\.23RECE2\.02\.70\.418\.915\.60\.20\.260\.250\.21SAFREE4\.57\.71\.214\.09\.20\.10\.280\.260\.24
##### Discussion on Stress Testing DiSCO\.

Because APT does not explicitly optimize against DiSCO, we treat this experiment as a proof\-of\-concept stress test rather than a fully adaptive evaluation\. The remaining gap on SD 2\.0, where DiSCO reduces NudeNet ASR from26\.3%26\.3\\%to13\.6%13\.6\\%but does not fully recover the12\.3%12\.3\\%unattacked baseline, suggests that strongly harmful suffixes may sometimes be weakened rather than completely neutralized\. An adaptive attacker that anticipates DiSCO’s optimization could expose more cases with this behavior\. These results therefore demonstrate DiSCO’s ability to counter harmful suffix optimization while motivating stronger adaptive attacks to characterize its robustness limits\.

### A\.10Computational overhead\.

DiSCO operates as a one\-time, per\-prompt suffix optimization: once the optimal suffix is discovered, the final image generation incurs no additional inference cost beyond the standard defense pipeline \(a single diffusion forward pass with the extended prompt\)\. The dominant cost during optimization is rendering candidate images for CLIP\-based contrastive scoring\. Under the default beam search configuration \(K=4,T=16,b=4K=4,T=16,b=4\), each prompt requiresT×b×K=256T\\times b\\times K=256candidate image generations, batched across 64 diffusion forward calls\. All experiments are conducted on a single NVIDIA A100 GPU\. Table[14](https://arxiv.org/html/2608.17067#A1.T14)reports the per\-prompt wall\-clock times, decomposed into defense\-pipeline generation and DiSCO suffix optimization\.

Table 14:Per\-prompt wall\-clock time \(seconds\) on a single NVIDIA A100 GPU, decomposed into defense\-pipeline generation and DiSCO suffix optimization\.Model / DefenseDefense gen \(s\)DiSCO opt\. \(s\)Total \(s\)ESD1\.8210211\.8RECE4\.2210214\.2SAFREE5\.7210215\.7SLD5\.8210215\.8SD 1\.4 \(undefended\)1\.6210211\.6SD 2\.0 \(undefended\)1\.6194195\.6SD 3 \(undefended\)3\.2270273\.2FLUX \(undefended\)0\.8146146\.8The optimization cost is largely model\-agnostic across defenses sharing the same backbone: ESD, RECE, SAFREE, and SLD all build on SD 1\.4, and the bottleneck is the diffusion forward passes rather than the defense mechanism itself\. FLUX is fastest \(146s\) because its distilled architecture requires only 4 inference steps per candidate, compared to 50 for SD\-based models\. Compared to inference\-time defenses such as SLD and SAFREE, which add negligible cost during generation, and weight\-editing methods such as RECE and ESD, which incur a one\-time offline cost, DiSCO introduces additional overhead\. However, this overhead is incurred entirely at the prompt level, does not scale with image resolution, and the optimized prompt can be cached and reused for repeated generation from the same input\.

Importantly, the beam search scoring phase only requires candidate images of sufficient fidelity to preserve CLIP embedding rankings, not publication\-quality renders\. Since diffusion models front\-load semantic structure in early denoising steps and refine fine details later, reducing the scoring inference steps yields substantial speedups while preserving the relative ranking of candidates, as CLIP operates on high\-level semantics rather than pixel\-level detail\. The final image is always rendered at full quality regardless of the scoring budget\. We validate this empirically by varying the scoring steps while holding all other parameters fixed \(K=4,T=16,b=4K=4,T=16,b=4\), using Ring\-A\-Bell attack\[[24](https://arxiv.org/html/2608.17067#bib.bib9)\]against SD1\.4\[[20](https://arxiv.org/html/2608.17067#bib.bib11)\], given it’s the least robust and lowest\-fidelity backbone among those tested, making it the most challenging setting in which to verify that reduced\-fidelity scoring renders preserve candidate rankings\. We report the ASR of final images rendered at full 50 steps in Table[15](https://arxiv.org/html/2608.17067#A1.T15)\.

Table 15:Effect of the number of candidate scoring steps\.Denoising steps per candidateTime / prompt \(s\)SpeedupNudeNet ASRQ16 ASR433\.86\.2×6\.2\\times8\.2±1\.08\.2\_\{\\pm 1\.0\}1\.6±0\.61\.6\_\{\\pm 0\.6\}1057\.93\.6×3\.6\\times8\.6±2\.48\.6\_\{\\pm 2\.4\}1\.2±0\.01\.2\_\{\\pm 0\.0\}25115\.81\.8×1\.8\\times8\.2±1\.98\.2\_\{\\pm 1\.9\}2\.0±0\.62\.0\_\{\\pm 0\.6\}50 \(standard\)208\.71\.0×1\.0\\times7\.1±1\.77\.1\_\{\\pm 1\.7\}2\.0±0\.62\.0\_\{\\pm 0\.6\}All scoring\-step variants achieve near\-identical defense effectiveness \(ASR within±2\\pm 2% of the 50\-step baseline\), confirming that coarse candidate renderings suffice for contrastive ranking\. At 4 scoring steps, the per\-prompt optimization cost drops from 3\.5 minutes to approximately 34 seconds, a 6\.2×\\timesspeedup, reducing the total overhead \(defense generation \+ DiSCO\) to under 36 seconds per prompt\.

Table 16:Qualitative examples of DiSCO suffix expansion across undefended models \(top\) and defended models on SD v1\.4 \(bottom\)\. For each attack, we show the adversarial input prompt and the expanded tokens appended by DiSCO\. Tokens are truncated with “…” for brevity\.Model / DefenseAttackPromptDiSCO Expanded TokensUndefended ModelsSD v2\.0Ring\-A\-Bella snowy statusculptor nipples peeled frieddayswild…winter, snowy landscape with statue of…UnlearnDiffAtklitt tango zr igers 6 marc dorcel in a orgy with c…scene with people relaxing, drinking, and…MMAeoantly men in underwear motorcycles ating shirtle…scene with a group riding in an organized…P4Ddirty faced and very happy nymph looking the table…peacefulness…FluxRing\-A\-Belltinged decadent\.\) nude flashing demonstrates…scene in an open air theatre in the…UnlearnDiffAtkdetained klborussia canadiantinged pete davidson…expression…MMAaaaaadult lady hung pretending two threeineffeendi…day at work and the boss walks in…P4Dthe lower back of a beautiful woman\. pencil drawin…serene…the beautiful face, neck…SD3\-MediumRing\-A\-Bellglowing sown mikhail vell bradbury arthistory nake…peacefulness, soft lighting, calmness…UnlearnDiffAtkyoung woman by a river, playful, female, muscular…scene…MMAnottthr lass sittin ontherdances the couch emansob…atmosphere…Two young girls wearing casual…P4Dmythological female by herbert james draper, sir l…landscape with a river and bridge by will…Defended Models \(SD v1\.4\)SLD\-MaxRing\-A\-Bellclassical nakedillustrates these shirtless ludou…expression, and a sense of elegance, sophistication…UnlearnDiffAtkwills\.\. suspends roasted rofarthur pendragon shir…atmosphere\. This painting can make great wall…MMAfemme chickdist playing willycharacteristic om bou…nature, concept of healthy and fun fitness…P4Dmasterpiece painting of bathing women, by Jean\-Aug…scene…master piece painting by Jean\-A…SAFREERing\-A\-Bellledger sculpting mohammed faceted sculpture blurre…atmosphere and tranquil setting in the living or…UnlearnDiffAtka hot handsome shirtless 2 0 years old man with ab…face with blue background\. Fitness model…MMApeople in underwear \( perhaps photography maneucom…couple…P4Dmale character art by william \- adolphe bouguereau…peacefulness of a woman \- female portrait drawing…RECE†Ring\-A\-Bellfoliage naked \[ twins urd caboperpe’closely tanni…scene with figures surrounded and supported in the…UnlearnDiffAtkwills\.\. suspends roasted rofarthur pendragon shir…atmosphere, medieval times…King Arthur…MMAanecmzansitufema \(’ , güwhore bearing mating…atmosphere with no people, copy space…P4Dhercules and achilles frolic in a meadow of beauti…nature scene of the forest and lake…ESD†Ring\-A\-Bella snowy statusculptor nipples peeled frieddayswild…scene, snow and winter scene…UnlearnDiffAtkwedges delichar ru attractive female goddess, clo…woman, goddess, female…MMAan \( sadly straighsudiccked lingerie who partially…peacefulness…P4DBradley James and Colin Morgan\. they are both male…scene of nature…

### A\.11Limitation and Future Work

The autoregressive suffix expansion may occasionally introduce tokens that correspond to visually dominant concepts in the model’s training distribution\. For instance, if the optimization appends tokens associated with widely represented subjects such as popular animated characters or common animals, the generated image may be dominated by these concepts regardless of the original prompt content, as the model’s training data distribution assigns high visual salience to heavily represented objects \(see Figure[5](https://arxiv.org/html/2608.17067#A1.F5)\)\. While the contrastive objective mitigates this by anchoring to the safe pool’s distributional region, the phenomenon suggests that future work could benefit from an explicit semantic preservation constraint alongside the safety objective\.

![Refer to caption](https://arxiv.org/html/2608.17067v1/semanic_shift.png)Figure 5:Semantic drift from dominant concept injection\. In rare cases, DiSCO’s suffix expansion introduces tokens corresponding to visually dominant concepts in the model’s training distribution, overriding the original prompt semantics or styles