DiSCO：透過分佈引導的對比提示優化來防禦文字生成圖像

摘要

隨著文生圖生成模型的進步，它們引發了嚴重的安全疑慮，尤其是生成如暴力與裸露等不宜工作場所（NSFW）內容的問題，而紅隊對抗攻擊更進一步加劇了此一情況。現有的防禦機制大多在白箱假設下運作，依賴於文本編碼器最佳化、權重編輯或推論時干預，從根本上無法擴展至專有模型。基於大型語言模型（LLM）提示詞改寫的黑箱替代方案提供了更廣泛的適用性，但在我們所指出的關鍵情境——良性對抗問題——中卻會失效：即提示詞在語言上安全，但因模型學到的資料分佈而仍觸發有害生成。我們提出 DiSCO，一種零樣本、嚴格黑箱的防禦機制，完全在提示詞層級運作，作為即插即用模組，無需模型重新訓練、微調或存取模型內部。DiSCO 透過束搜尋進行分佈引導的後綴擴展，並藉由對目標模型自身生成的安全與不安全圖像池進行對比評分來最佳化，同時採用迭代適應性回饋，直至產生安全內容。我們證明，DiSCO 在 I2P 基準上、多種紅隊攻擊下，能一致地提升未防禦與已防禦模型的安全性，分別達到 37.7% 與 25.13% 的攻擊成功率（ASR）降低，同時維持語義保真度並改善圖像連貫性。作為一個黑箱、與架構無關的模組，DiSCO 可輕鬆應用於任何文生圖系統，無需對模型本身進行任何修改。

English

As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.