SteerDiff: Steering towards Safe Text-To-Image Diffusion Models

1. The paper has poor writing and formatting quality. The formula for stable diffusion in Sec. 2.1 is incorrect (this equation is unconditional diffusion, not Stable Diffusion), and Fig. 2 is unclear.

2. Although the results presented in experiments look promising,the technical contribution is limited. Similar approaches for guiding models to generate images toward specific targets have already been introduced in prior works [1,2].

3. The experiments are insufficient. It seems that the MLP identifier model plays an important role in the final results, but the paper lacks details on its structure or accuracy.

4. In Sec. 5, Fig.5 is not sufficient to demonstrate the authors’ claim that “our approach can be effectively applied to selective concept forgetting without affecting other content”. Quantitative results would be much stronger than examples.

[1] Schramowski, Patrick, et al. "Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

[2] Yang, Yijun, et al. "Mma-diffusion: Multimodal attack on diffusion models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

1. This paper lacks clarity in its presentation, leading to confusion in both the figures and other descriptions. For example, W is introduced in Equation 3 but specifically define in Equation 4; the description of Figure 1 fails to illustrate the significance of the blue blocks; in Figure 2 (a), the Text Encoder and Diffusion Model are placed in a trapezoidal frame, which can easily be misunderstood as the Unet; Figure 2(b) does not differentiate between blue and red points; the text embeddings are denoted as 'E' instead of the more standard 'e'; the lower part of Figure 3 lacks explanation.
2. The paper treats unsafe terms and safe terms as direct opposites, relying on the use of antonyms to ensure input safety. This approach risks altering the original semantics of the prompts, potentially leading to unintended consequences in the generated outputs.
3. The paper appears to primarily focus on optimizing the embeddings of prompts without providing adequate technical depth. The novelty of the proposed approach seems limited and fails to advance the understanding of the underlying mechanisms involved.

1. SteerDiff is quite similar to Latent Guard [1], as both methods rely on LLMs to construct unsafe-safe prompt pairs and train models to detect unsafe concepts in the embedding space. While SteerDiff’s motivation is to steer unsafe concepts into safe regions, this raises the question: is transforming malicious prompts genuinely better than outright rejecting them? The steering module could potentially introduce vulnerabilities, as malicious users might exploit the transformation mechanism to bypass safety filters.

2. More adversarial prompt attacks and defenses should be discussed, such as Ring-A-Bell [2], MMA [3] and POSI [4].

3. Given that the model is trained on pre-selected unsafe concepts, how well can it generalize to unseen unsafe concepts? Would it be necessary to retrain the identifier and the linear transformation matrix W for effective handling of new unsafe concepts?

4. Are there any theoretical proofs supporting the idea that unsafe embeddings can be transformed into safe embeddings via a linear transformation? Additionally, as the steering parameter $\epsilon$ controls the intensity of the transformation, would increasing $\epsilon$ result in a decrease in the probability of generating inappropriate content? Furthermore, the use of a fixed steering parameter in SteerDiff may not account for the varying degrees of unsafe content in different prompts. Will relying on a model to learn the optimal steering degree offer more precise control?

[1] Liu, R., Khakzar, A., Gu, J., Chen, Q., Torr, P., & Pizzati, F. (2025). Latent guard: a safety framework for text-to-image generation. In European Conference on Computer Vision (pp. 93-109). Springer, Cham.

[2] Tsai, Yu-Lin, et al. "Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?." The Twelfth International Conference on Learning Representations.

[3] Yang, Yijun, et al. "Mma-diffusion: Multimodal attack on diffusion models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

[4] Wu, Zongyu, et al. "Universal prompt optimizer for safe text-to-image generation." arXiv preprint arXiv:2402.10882 (2024).

• The paper primarily focuses on unlearning harmful content. Have you considered attempting to unlearn style and copyright aspects as well? I noticed that ESD includes such experiments.

• The paper was mainly conducted on SD1.4. Have you tried applying your approach to SDXL?

• The baselines compared in the paper are somewhat limited. There are other unlearning methods available, such as SPM [1], AdvUnlearn [2], and RECE [3], that could be included for a more comprehensive comparison.

• Additionally, it might be beneficial to incorporate some human evaluations. Human assessment can help measure not only the reduction of harmful content but also the quality of the generated images.

Reference:

[1] One-dimensional Adapter to Rule Them All: Concepts, Diffusion Models and Erasing Applications. CVPR'24 [2] Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models [3] Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models. ECCV'24