mlsanityData to 14 Oct 2026

Negative Token Merging: Image-based Adversarial Feature Guidance

arXiv 2412.01339 ↗First posted 2 Dec 2024cs.CV cs.AI cs.GRcited by 4

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Text-based adversarial guidance using a negative prompt has emerged as a widely adopted approach to steer diffusion models away from producing undesired concepts. While useful, performing adversarial guidance using text alone can be insufficient to capture complex visual concepts or avoid specific visual elements like copyrighted characters. In this paper, for the first time we explore an alternate modality in this direction by performing adversarial guidance directly using visual features from a reference image or other images in a batch. We introduce negative token merging (NegToMe), a simple but effective training-free approach which performs adversarial guidance through images by selectively pushing apart matching visual features between reference and generated images during the reverse diffusion process. By simply adjusting the used reference, NegToMe enables a diverse range of applications. Notably, when using other images in same batch as reference, we find that NegToMe significantly enhances output diversity (e.g., racial, gender, visual) by guiding features of each image away from others. Similarly, when used w.r.t. copyrighted reference images, NegToMe reduces visual similarity to copyrighted content by 34.57%. NegToMe is simple to implement using just few-lines of code, uses only marginally higher (<4%) inference time and is compatible with different diffusion architectures, including those like Flux, which don't natively support the use of a negative prompt. Code is available at https://negtome.github.io

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 42 of its 50 references that are in the map. First posted on arXiv 2 Dec 2024.

Builds on

42 of 50 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models17 Jul
  2. 2024Understanding the Impact of Negative Prompts: When and How Do They Take Effect?5 Jun
  3. 2024CPR: Retrieval Augmented Generation for Copyright Protection27 Mar
  4. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar

Other references · 38

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2023GPT-4 Technical Reportcited by 18,396
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  6. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  7. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  8. 2022Classifier-Free Diffusion Guidancecited by 5,847
  9. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
  10. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,181
  11. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,614
  12. 2016Improved Techniques for Training GANscited by 2,970
26 more
  1. 2021CLIPScore: A Reference-free Evaluation Metric for Image Captioningcited by 2,424
  2. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,555
  3. 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,295
  4. 2022Token Merging: Your ViT But Fastercited by 1,021
  5. 2023Attend-and-Excite: Attention-Based Semantic Guidance for Text-to-Image Diffusion Modelscited by 702
  6. 2024Evaluating Text-to-Visual Generation with Image-to-Text Generationcited by 474
  7. 2023Emergent Correspondence from Image Diffusioncited by 446
  8. 2023Aligning Text-to-Image Models using Human Feedbackcited by 422
  9. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  10. 2023Segment Anything in High Qualitycited by 376
  11. 2023A Tale of Two Features: Stable Diffusion Complements DINO for Zero-Shot Semantic Correspondencecited by 301
  12. 2023Emu: Enhancing Image Generation Models Using Photogenic Needles in a Haystackcited by 279
  13. 2023Token Merging for Fast Stable Diffusioncited by 224
  14. 2023Re-imagine the Negative Prompt Algorithm: Transform 2D Diffusion into 3D, alleviate Janus problem and Beyondcited by 139
  15. 2023Foundation Models and Fair Usecited by 116
  16. 2023VidToMe: Video Token Merging for Zero-Shot Video Editingcited by 113
  17. 2017CAN: Creative Adversarial Networks, Generating "Art" by Learning About Styles and Deviating from Style Normscited by 96
  18. 2022How well can Text-to-Image Generative Models understand Ethical Natural Language Interventions?cited by 92
  19. 2019FairFace: Face Attribute Dataset for Balanced Race, Gender, and Agecited by 87
  20. 2023SILO Language Models: Isolating Legal Risk In a Nonparametric Datastorecited by 71
  21. 2023ITI-GEN: Inclusive Text-to-Image Generationcited by 64
  22. 2023Class-Balancing Diffusion Modelscited by 48
  23. 2023Talkin' 'Bout AI Generation: Copyright and the Generative-AI Supply Chaincited by 46
  24. 2024Evaluating Copyright Takedown Methods for Language Modelscited by 43
  25. 2023Fairy: Fast Parallelized Instruction-Guided Video-to-Video Synthesiscited by 39
  26. 2024Fantastic Copyrighted Beasts and How (Not) to Generate Themcited by 24

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2026Concept Removal Guidance: Evidence-Calibrated Negative Guidance for Safe Diffusion Sampling
  2. 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning
  3. 2025Diffusion Models with Adaptive Negative Sampling Without External Resources
  4. 2023Degeneration-Tuning: Using Scrambled Grid shield Unwanted Concepts from Stable Diffusion
  5. 2024AdvAnchor: Enhancing Diffusion Model Unlearning with Adversarial Anchors
  6. 2024Probing Unlearned Diffusion Models: A Transferable Adversarial Attack Perspective
  7. 2026Certifying Concept Unlearning in Text-to-Image Diffusion Models
  8. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models