透過速度編輯的安全少步生成

摘要

流匹配近來已成為最先進文本到圖像（T2I）生成領域中的一個強大範式，能以少量取樣步驟實現高品質生成。隨著這類模型日益融入實際應用，確保生成內容安全且無敏感資訊已成為一項關鍵需求。然而，將安全與概念移除方法適應至這個新生成框架，仍是一項未解挑戰。具體而言，先前方法大多依賴於在多次去噪步驟中進行迭代軌跡導引，或是以CLIP為核心的提示嵌入操作。這些設計假設為基於流匹配的T2I生成安全性帶來了根本瓶頸：有限的取樣步驟限制了迭代修正，而現代上下文感知的文字編碼器則降低了嵌入層級干預的效果。為此，本文提出VESFlow，一種專為極少取樣步驟的流匹配設計的免訓練安全方法。利用流匹配模型學習邊際速度的特性，我們透過安全條件後驗直接編輯速度場。VESFlow在保持條件提示不變的情況下，將軌跡導引至安全輸出。基於VESFlow在良性提示下輸出保持不變的觀察，我們進一步引入基於風險評分的過濾機制，跳過速度編輯以降低計算成本，同時維持良性提示的生成。以此過濾機制為基礎，我們提出VESFlow+，一個更強的VESFlow變體，不僅將速度編輯至安全方向，更將其推離不安全方向。實驗結果顯示，在4步MeanFlow模型上，VESFlow+能移除目標概念，將Ring-A-Bell的NudeNet攻擊成功率降至6.3%，MMA-Diffusion降至6.8%，同時在良性提示上保持生成保真度。

English

Flow matching has recently emerged as a strong paradigm for state-of-the-art text-to-image (T2I) generation, enabling high-quality generation with a small number of sampling steps. As these models are increasingly integrated into real-world applications, ensuring safe and non-sensitive content generation has become a critical requirement. However, adapting safety and concept removal methods to this new generation framework remains an open challenge. Specifically, prior methods largely rely on iterative trajectory steering across a number of denoising steps or on CLIP-centric prompt embedding manipulation. These design assumptions pose fundamental bottlenecks for safety in flow matching-based T2I generation, where limited sampling steps constrain iterative correction and modern context-aware text encoders diminish the effectiveness of embedding-level interventions. In this paper, we propose VESFlow, a training-free safety method tailored to flow matching with extremely few sampling steps. Leveraging the fact that flow matching models learn the marginal velocity, we directly edit the velocity field via a safe-conditional posterior. VESFlow steers the trajectory toward safe outputs while leaving the conditioning prompt unchanged. Building on the observation that VESFlow leaves outputs unchanged under benign prompts, we further introduce a risk score-based filtering that bypasses velocity editing to reduce computational cost while preserving benign prompt generation. Based on this filtering, we propose VESFlow+, a stronger variant of VESFlow that not only edits the velocity toward the safe direction, but also pushes it away from the unsafe direction. Experimental results show that VESFlow+ removes the target concept, reducing the attack success rate by NudeNet to 6.3% on Ring-A-Bell and 6.8% on MMA-Diffusion on the 4-step MeanFlow model, while preserving fidelity on benign prompts.