DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization
DiSCO is a black-box prompt-level defense for text-to-image models that rewrites/extends prompts with distribution-guided suffixes, using contrastive scoring over safe versus unsafe images generated by the target model to reduce NSFW outputs even when the input prompt looks linguistically benign. What’s neat is that it tackles the “benign adversarial” failure mode without model access, retraining, or weight edits and appears to preserve semantics while improving safety across attacked and defended models, though it likely pays extra inference cost from beam search and iterative image-pool feedback and its evidence is mainly benchmark-based.
Abstract
As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.