Wukong Framework for Not Safe For Work Detection in Text-to-Image systems
On the map: Diffusion models → Robustness, privacy and adversarial aspects
Abstract (arXiv)
Text-to-Image (T2I) generation is a popular AI-generated content (AIGC) technology enabling diverse and creative image synthesis. However, some outputs may contain Not Safe For Work (NSFW) content (e.g., violence), violating community guidelines. Detecting NSFW content efficiently and accurately, known as external safeguarding, is essential. Existing external safeguards fall into two types: text filters, which analyze user prompts but overlook T2I model-specific variations and are prone to adversarial attacks; and image filters, which analyze final generated images but are computationally costly and introduce latency. Diffusion models, the foundation of modern T2I systems like Stable Diffusion, generate images through iterative denoising using a U-Net architecture with ResNet and Transformer blocks. We observe that: (1) early denoising steps define the semantic layout of the image, and (2) cross-attention layers in U-Net are crucial for aligning text and image regions. Based on these insights, we propose Wukong, a transformer-based NSFW detection framework that leverages intermediate outputs from early denoising steps and reuses U-Net's pre-trained cross-attention parameters. Wukong operates within the diffusion process, enabling early detection without waiting for full image generation. We also introduce a new dataset containing prompts, seeds, and image-specific NSFW labels, and evaluate Wukong on this and two public benchmarks. Results show that Wukong significantly outperforms text-based safeguards and achieves comparable accuracy of image filters, while offering much greater efficiency.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 22 of its 42 references that are in the map. First posted on arXiv 1 Aug 2025.
Builds on
22 of 42 references.
Closest ancestors · 12
Same direction, newest first
- 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey10 Jul
- 2024Understanding the Impact of Negative Prompts: When and How Do They Take Effect?5 Jun
- 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradient24 May
- 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models24 May
- 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Erasers29 Nov
- 2023MMA-Diffusion: MultiModal Attack on Diffusion Models29 Nov
- 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?16 Oct
- 2023Degeneration-Tuning: Using Scrambled Grid shield Unwanted Concepts from Stable Diffusion2 Aug
- 2023Stable Diffusion is Unstable5 Jun
- 2023SneakyPrompt: Jailbreaking Text-to-image Generative Models20 May
- 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion29 Mar
- 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov
Other references · 10
- 2017Attention Is All You Needcited by 60,361
- 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
- 2014Microsoft COCO: Common Objects in Contextcited by 17,608
- 2020Denoising Diffusion Implicit Modelscited by 9,781
- 2022Classifier-Free Diffusion Guidancecited by 5,847
- 2024Expanding Performance Boundaries of Open-Source Multimodal Models with Model, Data, and Test-Time Scalingcited by 1,599
- 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
- 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 155
- 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 62
- 2024ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Userscited by 35
Built on by
Citing papers per year: 2026: 3.
3 papers.
- 2026FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decodingcited by 2
- 2026EDGE-Shield: Efficient Denoising-staGE Shield for Violative Content Filtering via Scalable Reference-Based Matchingcited by 0
- 2026Understanding and Exploiting Diagonal Attention Sparsity in Autoregressive Image Generationcited by 0
- 2026Understanding and Exploiting Diagonal Attention Sparsity in Autoregressive Image Generation17 Sep 2026
- 2026FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decoding9 Apr 2026
- 2026EDGE-Shield: Efficient Denoising-staGE Shield for Violative Content Filtering via Scalable Reference-Based Matching4 Apr 2026
Similar, not cited
Close in wording, no citation either way
- 2026Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation
- 2025Seeing It Before It Happens: In-Generation NSFW Detection for Diffusion-Based Text-to-Image Models
- 2026Safe Image Generation via Reinforcement Learning
- 2025Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization
- 2024AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion models
- 2025T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation
- 2025SC-Pro: Training-Free Framework for Defending Unsafe Image Synthesis Attack
- 2025Towards Safe Synthetic Image Generation On the Web: A Multimodal Robust NSFW Defense and Million Scale Dataset