Sparse Repellency for Shielded Generation in Text-to-Image Diffusion Models

Many thanks for your encouraging comments and for praising our presentation with a score of 4. We are grateful for your many questions which we try to answer within the timeline of this rebuttal.

The core issue for this paper is the soundness in terms of the superior effectiveness compared to other similar methods. In Fig. 4, there is only comparisons on recall-precision, converage-density, and vendi-clip trade-off, while other concerning metrics in Tab. 1, such as FID, FIDINOv2, are not included. I also failed to find reasoning on why only these three metric-pairs are selected.

This is a great point. The reason we have used these metric pairs is that they are popular diversity (y-axis) vs. quality (x-axis) pairs. But following your request, we have added a fourth plot in Fig.2, with FD_DINOv2 vs CLIP Score. We have also added Table 4, with all metrics, to provide an exhaustive view of all metrics.

This discussion of the fundamental methodology difference towards Particle Guidance on Page 5 is not convincing, as it seems SPELL can be treated as a special case of Particle Guidance when the energy potential ϕt is simply calculating the difference.

Thanks for this comment. We agree that we were not clear enough in this section, starting with the title (Intra-batch) SPELL as Particle Guidance which was, in retrospect, confusing. We have corrected this section in the paragraph you reference. Given more space we can expand a bit further the discussion. To be more detailed:

• PG was proposed for intra-batch diversity following principles from the literature on interacting particles (not to protect generation away from a reference set). We believe this viewpoint has guided two important choices: casting modifications of the trajectories as gradients of an interaction potential + use of a soft-decaying kernel that considers exhaustively all interactions. This means that intra-batch similarity in PG is always guiding / modifying the sampling of particles, throughout time and w.r.t. samples.

• By contrast, SPELL is not defined as an energy minimizing principle, but follows instead from geometric principles (Fig. 1) which cannot, to our current knowledge, fit into such a “gradient” based perspective (we tried but experimental evidence suggests that SPELL interventions in Eq. 8 are not conservative). By doing away with this “interaction energy” principle we lose PG’s mathematical interpretation, but we gain efficiency and the ability to simply state our goal of making sure the trajectories almost always flow normally, and are only “bumped” when strictly needed (both w.r.t. batch but also in time, see Fig. 5(b), Fig. 9~16). In our view, that sparsity w.r.t samples and time is crucial to scale in our application to image protection, but also to get unperturbed trajectories, and our experiments validate this intuition.

This paper could benefit from more concrete visual evidences.

This is a great suggestion. We are getting the computational resources to generate further example images, and will come back to you very soon.

As it is difficult to show all possible trade-offs, a better way of giving concrete comparisons would be adding detailed tables for each of the methods. Each table shows all results with rows to be parameters, and columns to be all the metrics. Adding such tables would surely address my core concern, but due to limited time, it is also promising if the reasoning of choosing these trade-offs are persuasive and convincing.

Thanks for the suggestion! We have added Table 4. We hope that this addresses your core concern.

I'm generally not quite sure if SPELL could be treated as a special case of Particle Guidance in terms of intra-batch diversity. A brief explanation would be sufficient.

We hope our answer above assuages your concerns.

To recapitulate, the two fundamental differences with PG lie in (i) adding guidance terms that are not grad-potentials (ii) designing specifically very sparse repellence terms, with sparsity in two senses:

• They act on trajectories rarely over time, and most interventions happen early and then vanish, see Fig. 5b. This is thanks to our focus, from the start, on expected generation and not location at time $x_t$.
• They only add sparse terms, to the extent that most of them are 0, when comparing to points in the reference set (either self-reference in intra-batch, or external reference for protection). This makes our method scale to 1.2M points as a reference set and leaves dynamics unperturbed when perturbations are not needed.

This paper would also benefit from providing more diversity results, but it is understandable if this is infeasible considering the limited time for rebuttal.

This is a great point. As mentioned above, we are getting access to resources needed to generate these examples. We will get back to you soon.

MINOR

Thanks for spotting these! We addressed these points in the revision.

We are very grateful for your detailed review, your encouragements and your score of 4 for presentation. Here are a few answers to your concerns:

While SPELL can be used for any diffusion pipelines, the effectiveness of SPELL for smaller models or domains other than ImageNet is not fully investigated.

It was very tempting for us to use text2image as a testing ground for SPELL because this facilitates visual inspection of results and is well suited to the ICLR audience. Additionally, since one of our main claims is that our interventions are sparse (unlike PG) and can scale, considering very large reference sets (e.g. 1.2M images in ImageNet) was crucial. We believe that using our code will run into less challenges on smaller scale problems and other fields.

SPELL does not provide a very tight guarantee to avoid generations of similar images to the reference set, which can limit the applicability of SPELL for high-risk cases.

Thanks for this great point. SPELL is already the first method that is close to a perfect guarantee due to its geometric intervention rules (Eq. 5). In the protection experiment in S.4.6, we previously showed a 99.45% protection rate for EDMv2 + SPELL, compared to 92.40% for the bare EDMv2.

In fact, we can introduce a tradeoff, where the fast-NN search is more accurate (and longer) by increasing the number of searched Voronoi cells. We can reach a 99.84% success rate with a more accurate search (see updated Table 2 in revision). We have not optimized yet the parameters of the fast-NN search (currently this is run, sub-optimally, on CPU). We believe these overheads can be significantly reduced.

Applying repellency terms based on the current state x_t instead of the expected final output seems applicable for the intra-batch repellency case, providing better diversity to a batch of generated images. Can it be one of the baselines to compare SPELL for the intra-batch case?

Thanks for this great comment.

When the repellency terms only depend on the current state $x_t$ (and when the repellency terms are the grad of an interaction potential, and we restrict to intra-batch repellency) what you suggest is exactly particle guidance ([Corso et al. 24]), as detailed in lines 250~265. PG is featured prominently in our experiments (it's one of the baselines in Fig. 4, and added to Table 4 in the revised paper).

Note however that PG interactions are not sparse, and cannot therefore be realistically extended to our large scale protection experiment.

It seems like SPELL forces each trajectory to arrive near the boundary of other balls (shields).

We will clarify this, but this is not really the case.

What you describe would be somewhat our worst-case scenario, in which SPELL would fulfill the shielding requirement only when applied at the last timestep.

Instead, as depicted in Fig. 1, when SPELL detects that a generation at time $t$ is pointing towards a shield, it alters the diffusion direction to make it point outside of that shield. Ideally, these modifications happen as early as possible so that the diffusion can explore a different mode instead and perturb as little as possible the later (image-detail defining) stages of the diffusion, to avoid visual artifacts (Fig. 17).

Luckily, following our intuition, SPELL interventions occur mostly in early diffusion timesteps, as shown in the density plot in Fig. 5a, that shows many more interventions early on in diffusion at time $t=1$. This is tightly connected to the radius that is chosen (Fig. 5b) and is indeed confirmed when $r=20$. This is also extensively documents in Figures 9~16.

Can further methods (something similar to momentum or just larger overcompensation) improve the diversity of generated images?

We have not tried momentum, but this is a great suggestion. A small overcompensation of 1.6 seems to work very well. One combination we explored is to both use a lower CFG weight to increase diversity and add SPELL. In Appendix I, Figures 18 - 24, we find that even when we already increase diversity by decreasing the CFG weight, adding SPELL still boosts further diversity.

Thank you for the detailed response about my review, and sorry for the late reply.

Many thanks for taking the time to read our rebuttal. Your reply is not late at all, since the deadline for discussion has now been extended.

I have one remaining question regarding the first question. If I understand correctly, the major difference between the proposed SPELL and PG is where the distance between two points is computed (the space of the expected final output for SPELL and the space of the current value for PG). Does the sparsity property of SPELL come from this distinction or some differences in the detailed mechanism, such as one used to find neighbors to repel?

Thanks for these questions. SPELL and PG are indeed closely related as we highlight in the paper L.246.

To go back to their definition, the formulation of PG (Eq. 4 in their paper, L.249 in ours) defines an interaction potential (using RBF kernels) on particle positions $x_t$. The interventions that result from that potential are dense (the particle’s trajectories are always updated, even when they are far away, regardless of being neighbors or not) and exhaustive (all $B^2$ kernel values for a batch of size $B$ impact the trajectory).

SPELL moves away from that model in two orthogonal aspects: As you point out, SPELL (1) is defined as “future looking”, in that it considers the expected generation of these points to guide trajectory rather than $x_t$ ; and (2) SPELL uses sparse updates, by definition, in the way we set these interventions in Eq. (5). The notion of neighbours kicks in because of sparsity.

Of these two, the second factor, sparsity of interventions is the major difference, not the “future looking” aspect, as already clarified in L.261 of the revision. While PG could be used in principle with the same “future looking” approach, the crucial idea in PG is to posit that particles should be constantly re-updated, using a smooth kernel, as is common in the interacting particles literature they refer to (their Section 4). This is different from SPELL.

Our decision to use a sparse intervention model is highlighted in the title of our paper and the name of our method. This is the major difference, which leads to:

• applicability to large scale protection scenarios, where reference sets are of the order of millions (When generating a batch B, PG would need a costly computation of B x 1M Gaussian kernel values at each diffusion step if it were adapted to that task, and those 1M contributions would likely have unintended consequences for quality of generation)
• qualitative improvements, because sparse interventions result intuitively in far fewer changes in the particle trajectories. This is our analysis in Fig.5 + 9~16, as well as results in Fig. 4.

Hence, as a TL;DR summary, SParsity in SPELL is the major differentiator w.r.t. PG. Sparsity comes from geometric considerations (sketched in Fig. 2), and from the definition of our repulsive terms (our choice in Eq. 5). Sparsity does not come from the additional consideration of using “future looking” $E[X_0|X_t=x_t]$ instead of $x_t$.

Many thanks for reading our paper despite this not being your area of expertise. Still, we are very happy to see that despite this mismatch you had a positive impression of our paper overall. ICLR papers should be tailored to reach a wide readership, and we took great efforts to make our paper easy to parse, through e.g. Fig. 1 and other illustrations.

I find the issue addressed in this paper to be interesting and important.

Indeed, we believe these are core issues that appear naturally when letting end-users interact with diffusion models.

In our first application (intra-batch diversity), we were happy to advance the recent SOTA set in ICLR 2024 (https://arxiv.org/abs/2310.17347 and https://arxiv.org/abs/2310.13102) and NeurIPS 2024 (https://arxiv.org/abs/2404.07724).

As for our second application (protecting images), we are the first (to our knowledge) to propose a method for this task that works at such a scale, with an impressive reference set of more than 1 million images.

We would like to thank Reviewer EnjK for their encouraging comments and constructive review. We did our best within the time constraints to address all of the points that you have raised, and will do our best to answer other concerns.

For example, while Table 1 indicates that SPELL has a minor trade-off in precision, the authors do not compare this trade-off with the baselines. Figure 4 is the only comparative result provided, but it lacks an analysis of image quality. Specifically, I would like to know if all models in Figure 4 are capable of similar generation quality, say in terms of FID.

This is a great point, thanks for raising it. Our goal (L. 403) was indeed to contrast diversity vs quality in 3 different plots, 3 different Pareto fronts, using Precision / Density / Clip scores. Following your request, we have added a fourth plot in Fig. 4, with FD_DINOv2 vs CLIP Score, as can be seen in our updated draft. We can add other similar figures if you think they would be relevant.

We have also added the following table (Table 4, p.21 in draft), with all metrics, to provide readers with an exhaustive view.

For instance, an analysis of average wall-clock time compared with baseline methods, or testing with larger reference dataset sizes, would be helpful for readers.

When using ImageNet-1k as the reference set (L.983 in our algorithm), this is already detailed in the rightmost column of Table 2, L. 492. In that experiment with a reference set of over 1M images, using the same model, generation time goes from 3.5s to 6s using SPELL.

The overhead of 2.5s is mostly due to the fast nearest-neighbor (NN) search to the $K=1,281,167$ reference set images at each $t$ during generation. That time grows at most linearly with $K$ when adding more neighbors.

We have extended Table 2 with more parameters (see revision), where we control more accurately the quality of fast-NN search by increasing the number of Voronoi cells that the NN algorithm calculates distances for, which controls both accuracy and compute. As shown below, when going from 1 to 2 cells, runtime increases by ~1.4 seconds, when going from 2 to 3 another 1.7s, from 3 to 5 by 2.2s and from 5 to 10 by 3.6 seconds. Note also that with more inference runtime, we are able to guarantee even better protection rates (0.16% at 10 cells compared to 0.6% in the paper, which used 2 cells). We have not optimized yet the parameters of the fast-NN search (currently this is run, sub-optimally, on CPU). We believe these overheads can be significantly reduced.

When the reference set is a set of concurrently or previously generated samples (L.991 in our algorithm) to increase diversity, the overhead consists of calculating pairwise distances for up to 128 (expected or realized) images at each diffusion time. That computation is negligible. The runtimes of the base model, SPELL, and also CADS, IG, and PG are equal in this setup.

For example, the fourth image is repelled from the third image, and it's unclear why this image is closer to the third image than to the first or second.

This is likely due to background similarity between images 3 & 4 (top row). Note that SPELL intervenes during generation and not as a post-processing mechanism: To insist (in the spirit of L.425~), SPELL was not used because SD3 Image 4 came out as too close to Image 3; SPELL was used before that, during the generation of Image 4, because (L.463) it “was expected to come out too close to the 3rd image”.

Additionally, it would be beneficial if the authors provided examples with multiple image batches, other than a single-image batch.

Thanks for the suggestion! We plan to generate further examples (we are working to get access to compute resources) and will post these examples here very soon.

I wonder whether the L2 distance-wise nearest neighbor search was the best choice. This is because many images in the third row (EDM + SPELL) seem more similar to the second row (ImageNet neighbor for EDM) rather than the fourth row (ImageNet neighbor for EDM+SPELL).

Your question can be parsed in 2 different ways: (i) whether to use the L2 distance, and (ii) whether to use L2 of images in the MDTv2 latent space to guide SPELL.

On (i), Fast NN search (e.g. FAISS as used here) is designed to work for L2, and we are hence somewhat stuck with it.

On (ii), indeed, we are not bound to using that representation for SPELL, the user may define any other encoding of interest. In image protection, defining an encoding also defines explicitly the type of protection that is achieved.

For now, our goal in Fig. 7 was to convey clearly that SPELL avoids obvious copies (e.g. images 2 3 4 5 6 7 8) that using EDMv2 directly would output.

However, according to Table 1, isn't this actually the case for 4 out of 6 models? Please correct me if I am wrong.

We apologize for not being clear. We write The third diversity metric, coverage, is also increased in all models except SD3 (L.323). This is technically correct, because SD3-Medium is considered both in the text2image and class2image tasks. But you are also correct, this is 4/6 experiments in Table 1, we have corrected this entire part in L.358.

I deeply appreciate the authors for the additional experiments, which have significantly clarified my understanding. That said, I still have a few unresolved questions:

• Regarding Fig. 6: I understand that the 4th image is repelled from the 3rd due to the background. However, it seems that the altered trajectory of the 4th image share the same background as the original (unaltered path) image. If the 4th image in (SD3+SPELL) had a different background, I would have no doubts about SPELL’s performance. Did I misunderstand something?

• Thank you for the details on wall-clock inference time and the additional trade-off graph in Fig. 4. I now wonder if SPELL is competitive in inference speed compared to the baselines. This is because SPELL seems to be quite costly in Table 2. Could the authors provide another trade-off graph including wall-clock time? I understand this was not part of my initial questions, and I apologize for raising a new point.

• I look forward to seeing the multi-batch results.