InGuard：在生成管线内部实现文生图安全防护
InGuard: Towards Generalized Inner Guardrail for Safe Text-to-Image Generation
一个把安全检查搬进文生图管线内部的框架，能中途叫停生成，还能把有风险的提示改写成安全图，论文里基准数据挺扎实。
论文提出 InGuard，一个作用于模型自身表征的文生图安全框架，不改动基座模型参数。其风险分类器基于文本编码器嵌入将提示分为 unsafe、risky、benign 三级，SAGE 模块会改写有风险提示的嵌入以返回安全图像而非直接拒绝，潜在检测器在去噪中途检查单步干净潜像以提前终止生成。作者还构建了包含 10,000 条提示的 RevGen Safety Benchmark，覆盖分级色情/血腥风险、IP 角色风险和良性负例。在五个开源文生图模型上，InGuard 安全率达 97.9-98.8%，良性干扰减少 57.5-73.5%，参数量约为外置防护的 1/3.7，并可跳过 50-55.6% 的去噪步骤。
InGuard: Towards Generalized Inner Guardrail for Safe Text-to-Image Generation
Modern text-to-image (T2I) models generate high-quality images from arbitrary user prompts, yet they can just as easily produce not-safe-for-work (NSFW) content. Conventional outer guardrails consist of two components: a prompt classifier that checks for risk before generation, and a post-hoc image classifier that checks the fully generated image. In this design, both classifiers operate outside the generation pipeline and do not use the model's own representations. This separation can limit prompt-screening accuracy, while the image-side check runs only after the full generation cost has been spent. Moreover, a flagged prompt can only be rejected, even when it could be adjusted to produce a safe image. In this work, we propose the Inner Guardrail (InGuard), a safety framework that works inside the pipeline on the model's own representations, leaving base-model parameters untouched. First, a risk classifier grades each prompt as unsafe, risky, or benign based on the text encoder's embeddings, with no external language model. Second, SAGE (Soft-gated Asymmetric Guardrail for Embeddings) modifies the embeddings of risky prompts, aiming to return a safe image instead of a refusal. Third, a latent detector checks the one-step clean latent estimate midway through denoising, reaching nearly image-level performance and halting generation when risk is detected. We also construct the RevGen Safety Benchmark to evaluate T2I safety under realistic conditions: 10,000 prompts built through real-image reverse generation, with a rewriting step that supplies controlled intellectual-property (IP) characters, covering graded porn/gore risks, categorical IP risks, and benign negatives. Across five open-weight T2I models, InGuard reaches 97.9-98.8% safety rate, matching or exceeding the outer guardrail, with 57.5-73.5% less benign disturbance, ~3.7x fewer parameters, and 50-55.6% of denoising steps skipped.
