As text-to-image models become more powerful, concerns about their potential to generate Not-Safe-For-Work (NSFW) content, such as violence and nudity, have intensified. These risks are further amplified by adversarial red-teaming attacks designed to bypass safety filters. Existing defenses often rely on white-box access, which is impractical for proprietary models.
To address this, researchers from Hugging Face have introduced DiSCO, a novel defense that operates entirely at the prompt level. DiSCO is a zero-shot, black-box module that requires no retraining, fine-tuning, or access to model internals, making it a plug-and-play solution for any text-to-image system.
The method works by expanding prompts with distribution-guided suffixes using beam search, then optimizing them through contrastive scoring over safe and unsafe image pools generated by the target model itself. This iterative process continues until safe content is produced, effectively countering what the authors call the 'benign adversarial' problem—prompts that are linguistically safe but still trigger harmful generation.
In experiments on the I2P benchmark under multiple red-teaming attacks, DiSCO reduced the Attack Success Rate (ASR) by 37.7% for undefended models and 25.13% for defended models, while maintaining semantic fidelity and improving image coherence. The approach is architecture-agnostic and can be readily applied to any text-to-image system without necessitating changes to the model itself.