AEIOU: A Unified Defense Framework against NSFW Prompts in Text-to-Image Models
Not on the map. Why?
Abstract (arXiv)
As text-to-image (T2I) models advance and gain widespread adoption, their associated safety concerns are becoming increasingly critical. Malicious users exploit these models to generate Not-Safe-for-Work (NSFW) images using harmful or adversarial prompts, underscoring the need for effective safeguards to ensure the integrity and compliance of model outputs. However, existing detection methods often exhibit low accuracy and inefficiency. In this paper, we propose AEIOU, a defense framework that is adaptable, efficient, interpretable, optimizable, and unified against NSFW prompts in T2I models. AEIOU extracts NSFW features from the hidden states of the model's text encoder, utilizing the separable nature of these features to detect NSFW prompts. The detection process is efficient, requiring minimal inference time. AEIOU also offers real-time interpretation of results and supports optimization through data augmentation techniques. The framework is versatile, accommodating various T2I architectures. Our extensive experiments show that AEIOU significantly outperforms both commercial and open-source moderation tools, achieving over 95% accuracy across all datasets and improving efficiency by at least tenfold. It effectively counters adaptive attacks and excels in few-shot and multi-label scenarios.
Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 36 of its 58 references that are in the map. First posted on arXiv 24 Dec 2024.
Builds on
36 of 58 references.
References · 36
- 2017Attention Is All You Needcited by 60,361
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2014Microsoft COCO: Common Objects in Contextcited by 17,608
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
- 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,181
- 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
- 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,300
- 2021CLIPScore: A Reference-free Evaluation Metric for Image Captioningcited by 2,424
- 2023Erasing Concepts from Diffusion Modelscited by 539
24 more
- 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Modelscited by 513
- 2020Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlationcited by 425
- 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
- 2023Ablating Concepts in Text-to-Image Diffusion Modelscited by 317
- 2022Red-Teaming the Stable Diffusion Safety Filtercited by 264
- 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?cited by 250
- 2023Interpreting CLIP's Image Representation via Text-Based Decompositioncited by 196
- 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
- 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 189
- 2023Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Modelscited by 177
- 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Modelscited by 175
- 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Promptscited by 171
- 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 155
- 2023Editing Implicit Assumptions in Text-to-Image Diffusion Modelscited by 130
- 2024Interpreting CLIP with Sparse Linear Concept Embeddings (SpLiCE)cited by 119
- 2024Latent Guard: a Safety Framework for Text-to-image Generationcited by 71
- 2023Self-Discovering Interpretable Diffusion Latent Directions for Responsible Text-to-Image Generationcited by 69
- 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradientcited by 69
- 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 62
- 2022VL-InterpreT: An Interactive Visualization Tool for Interpreting Vision-Language Transformerscited by 53
- 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 35
- 2023SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitutioncited by 34
- 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
- 2024Moderator: Moderating Text-to-Image Diffusion Models through Fine-grained Context-based Policiescited by 15
Built on by
Citing papers per year: 2025: 4; 2026: 3.
7 papers.
- 2025PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generationcited by 2
- 2025Do Concept Replacement Techniques Really Erase Unacceptable Concepts?cited by 1
- 2025LoRAShield: Data-Free Editing Alignment for Secure Personalized LoRA Sharingcited by 1
- 2025GIFT: Gradient-aware Immunization of diffusion models against malicious Fine-Tuning with safe concepts retentioncited by 1
- 2026Beyond Text Prompts: Precise Concept Erasure through Text-Image Collaborationcited by 1
- 2026Latent Space Probing for Adult Content Detection in Video Generative Modelscited by 0
- 2026Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attackscited by 0
- 2026Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks28 Jul 2026
- 2026Latent Space Probing for Adult Content Detection in Video Generative Models25 Apr 2026
- 2026Beyond Text Prompts: Precise Concept Erasure through Text-Image Collaboration17 Apr 2026
- 2025PromptSafe: Gated Prompt Tuning for Safe Text-to-Image Generation2 Aug 2025
- 2025GIFT: Gradient-aware Immunization of diffusion models against malicious Fine-Tuning with safe concepts retention18 Jul 2025
- 2025LoRAShield: Data-Free Editing Alignment for Secure Personalized LoRA Sharing5 Jul 2025
- 2025Do Concept Replacement Techniques Really Erase Unacceptable Concepts?10 Jun 2025
Similar, not cited
Close in wording, no citation either way
- 2025TokenProber: Jailbreaking Text-to-image Models via Fine-grained Word Impact Analysis
- 2025Towards Safe Synthetic Image Generation On the Web: A Multimodal Robust NSFW Defense and Million Scale Dataset
- 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models
- 2025T2I-RiskyPrompt: A Benchmark for Safety Evaluation, Attack, and Defense on Text-to-Image Model
- 2025PromptGuard: Soft Prompt-Guided Unsafe Content Moderation for Text-to-Image Models
- 2026MacPrompt: Maraconic-guided Jailbreak against Text-to-Image Models
- 2026Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation
- 2025PLA: Prompt Learning Attack against Text-to-Image Generative Models