DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization
06:00 · August 19, 2026 · arXiv cs.AI RSS
As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.
Summary
DiSCO addresses a persistent safety gap in text-to-image generation by targeting the benign adversarial regime, in which linguistically innocuous prompts still elicit unsafe outputs because they align with unsafe regions of the model’s learned image distribution. Existing white-box defenses require internal access or retraining and therefore cannot protect proprietary systems, while black-box LLM rewriting methods often leave these distribution-driven failures untouched.
The method operates entirely at the prompt level as a plug-and-play module. It constructs model-specific reference pools of safe and unsafe images by sampling the target generator on the I2P dataset and filtering outputs with classifier consensus. From an incoming prompt, DiSCO then performs distribution-guided suffix expansion through beam search in CLIP embedding space, scoring candidate suffixes by their contrastive alignment with the safe versus unsafe pools. An iterative feedback loop adjusts the optimization objective according to the remaining severity of harmful content until the generated image falls within the safe region.
Evaluations across 32 system–attack combinations and five random seeds show consistent reductions in attack success rate on the I2P benchmark, both for undefended models and for models already equipped with prior defenses. The approach preserves semantic fidelity and perceptual quality while remaining strictly black-box and architecture-agnostic. By formalizing the benign adversarial problem and demonstrating that prompt-level distributional steering can close the gap left by text-only sanitizers, the work supplies a practical, training-free layer that can be added to any text-to-image pipeline.
Why it matters
Directly addresses ethical AI safety and regulatory compliance needs in the Netherlands/EU; the plug-and-play black-box design is immediately actionable for Dutch SMEs and researchers working on generative models.
