ai-research-survey

scan-v5.json (17484B)

---

 {
   "scan_version": 5,
   "paper_type": "theoretical",
   "paper": {
     "title": "Inference-Only Prompt Projection for Safe Text-to-Image Generation with TV Guarantees",
     "authors": [
       "Minhyuk Lee",
       "Hyekyung Yoon",
       "Myungjoo Kang"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.00616",
     "doi": null
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "All abstract claims are supported: the SPAT bound is proven in Theorem 3.1, the 16.7–60.0% IP reductions appear in Table 1, and COCO FID/CLIP preservation is reported alongside every baseline.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (method causes IP reduction) are supported by controlled comparisons against 11+ baselines on standardized benchmarks plus ablations on hyperparameters, LLM scaling, and label ordering.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Claims are explicitly scoped to 'four datasets and three diffusion backbones' throughout and in the conclusion; the paper does not claim results extend to all T2I architectures.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper discusses guard-style metric distortion as an explanation for baselines' inflated utility scores, but does not explore alternative explanations for its own superiority—e.g., whether gains stem from VLM verifier conservatism rather than the projection framework.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly distinguishes ideal unsafety u(G*|c) (unobservable) from the operational proxy buVLM in §3.4 and §4.4, and acknowledges Stage-2 provides sample-level acceptance, not a distributional guarantee.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 is titled 'Scope and limitations' and the Impact Statement explicitly lists residual harms (false negatives/positives, unequal error rates, misconfiguration risks); both go well beyond a single sentence.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "§4.4 identifies specific threats: no global-optimality claim for metric projection onto Csafe,τ; sample-level (not distributional) acceptance; dependence on VLM conservatism and resampling budget R; inability to preserve meaning when unsafe content is inseparable from intent.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states it makes 'no global-optimality claim for metric projection' and that Stage-2 provides 'sample-level acceptance... not a distributional guarantee,' clearly marking what the method does not show.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding acknowledgment appears anywhere in the paper; only institutional affiliations (Seoul National University) are listed.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors' departmental affiliations at Seoul National University are disclosed in the header footnote.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funder is disclosed, making this criterion not applicable.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests or financial disclosure statement anywhere in the paper.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Total variation (Eq. 1), prompt-wise and population unsafety (Eq. 2–3), ATV (Eq. 4), τ-safe set Csafe,τ (Eq. 7), projection kernel Πτ, and the A/B scoring protocol are all formally defined before use.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The introduction lists four explicit bullet-point contributions: the SPAT bound, the inference-only projection framework, the two-stage cascade operationalization, and the empirical evaluation.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 explicitly positions this work against three categories of prior methods, noting that prior prompt-side methods 'lack an explicit projection notion' and 'rarely describe the prompt-conditioned distributional shift induced by the intervention.'",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "theoretical": {
       "formal_quality": {
         "assumptions_stated_explicitly": {
           "applies": true,
           "answer": true,
           "justification": "Assumption 3.2 (main text) and Assumption A.2 (appendix) explicitly enumerate all required conditions—standard Borel space, weak continuity of reference law, closedness of the τ-safe set—before each theorem is invoked.",
           "source": "haiku"
         },
         "proofs_complete_or_sketched": {
           "applies": true,
           "answer": true,
           "justification": "Theorems 3.1, 3.3, and 3.4 all have full measure-theoretic proofs in Appendix A.3, A.4, and A.6 respectively, with supporting lemmas (A.1, A.3–A.11) each fully proven.",
           "source": "haiku"
         },
         "bounds_tight_or_discussed": {
           "applies": true,
           "answer": false,
           "justification": "The SPAT lower bound U(G) + ATV(G) ≥ U* is proven but its tightness—whether equality is achievable and under what conditions—is never analyzed or discussed.",
           "source": "haiku"
         },
         "counterexamples_explored": {
           "applies": true,
           "answer": false,
           "justification": "Edge cases are handled by ruling them out in assumptions (e.g., Csafe,τ nonempty), but no counterexamples are constructed to show where bounds fail under relaxed assumptions.",
           "source": "haiku"
         },
         "notation_consistent": {
           "applies": true,
           "answer": true,
           "justification": "Notation is consistent throughout: G* for reference, u for prompt-wise unsafety, U for population unsafety, Πτ for projection kernel, tilde for kernel-projected conditionals, and the A/B scoring protocol uses identical symbols in both stages.",
           "source": "haiku"
         },
         "constructive_vs_existence_noted": {
           "applies": true,
           "answer": true,
           "justification": "The paper explicitly states 'Theorem 3.3 is primarily an enabling result: it guarantees (a.e.) existence and measurability, but does not assert uniqueness,' and Algorithm 2 provides the constructive practical approximation.",
           "source": "haiku"
         }
       },
       "connections": {
         "connection_to_practice_discussed": {
           "applies": true,
           "answer": true,
           "justification": "The entire §4 and §5 translate the theoretical SPAT result into a practical two-stage algorithm; the theory directly motivates each design choice (selectivity, projection kernel, τ-control).",
           "source": "haiku"
         },
         "relationship_to_prior_work_clear": {
           "applies": true,
           "answer": true,
           "justification": "Section 2 explicitly contrasts this work with three prior method families, citing specific gaps; §3 formalizes the distributional phenomenon AlignGuard observed empirically but did not explain theoretically.",
           "source": "haiku"
         },
         "computational_complexity_discussed": {
           "applies": true,
           "answer": true,
           "justification": "The paper notes exact projection is 'infeasible' (§4.2), uses a finite local-search approximation with explicit budgets T and N, and reports per-image wall-clock times in Table 7 and the runtime ablation in Figure 8.",
           "source": "haiku"
         },
         "limitations_of_formal_model_stated": {
           "applies": true,
           "answer": true,
           "justification": "§3.4 and §4.4 explicitly acknowledge that the formal model uses ideal unsafety u(G*|c) which 'is not directly observable in practice,' and treat Πτ as a 'procedure-induced kernel' that only approximately satisfies the formal support restriction.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "Any nontrivial reduction in unsafe generations under a fixed reference model necessarily incurs TV deviation from the reference conditionals (SPAT).",
       "evidence": "Theorem 3.1 proven via Lemma A.1 (TV controls bounded functional gaps); Theorem 3.4 extends to the kernelized setting.",
       "supported": "strong"
     },
     {
       "claim": "The method achieves 16.7–60.0% relative reductions in inappropriate percentage (IP) vs. strong model-level alignment baselines.",
       "evidence": "Table 1 reports IP scores across CoProV2/I2P/UD on SD1.5, SD2.1, SDXL; relative reductions computed against AlignGuard and other baselines.",
       "supported": "strong"
     },
     {
       "claim": "The method preserves benign prompt-image alignment (FID/CLIP) near the unaligned reference on COCO.",
       "evidence": "Table 1: COCO FID=32.46/CLIP=33.36 (ours) vs. 32.34/33.42 (no alignment) for SD1.5; similar near-parity on SD2.1 and SDXL.",
       "supported": "strong"
     },
     {
       "claim": "Adversarial prompt attacks raise IP from 0.04 to at most 0.06 across all four attack methods.",
       "evidence": "Table 2 reports category-wise IP under MMA, Ring-A-Bell, SneakyPrompt, and P4D attacks on CoProV2.",
       "supported": "strong"
     },
     {
       "claim": "Guard-style methods abort 13.53% and 32.87% of benign COCO captions, inflating their reported FID/CLIP metrics.",
       "evidence": "§5.2 explicitly reports these abort rates and explains the selection bias in utility measurement.",
       "supported": "strong"
     },
     {
       "claim": "Larger LLMs yield lower IP scores, with gains mostly saturating between 3B–8B parameters.",
       "evidence": "Figure 7 shows IP vs. LLM parameter count for LLaMA and Qwen families across three benchmarks; mild non-monotonicity at high end noted.",
       "supported": "moderate"
     },
     {
       "claim": "τ provides monotonic, predictable control over the operating safety level.",
       "evidence": "Figure 2a shows IP increases monotonically with τ on a four-point sweep; Figure 1 shows qualitative image progression across τ values.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "theoretical",
     "benchmark-eval"
   ],
   "key_findings": "The paper proves the Safety-Prompt Alignment Trade-off (SPAT): under total variation, any nontrivial reduction in unsafe image generations from a fixed reference model necessarily deviates from the reference conditional distribution, providing a formal lower bound that explains why model-level alignment degrades benign prompt fidelity. The proposed inference-only prompt projection framework rewrites only high-risk prompts via a two-stage LLM+VLM cascade without retraining the diffusion backbone, achieving 16.7–60.0% relative IP reductions vs. strong baselines while keeping COCO FID/CLIP near the unaligned reference. Guard-style methods inflate reported utility metrics due to 13–33% prompt refusal rates on benign COCO captions, a confound not previously documented. The method is robust to adversarial attacks (IP rises from 0.04 to at most 0.06) and the safety level can be continuously controlled via the tolerance parameter τ.",
   "red_flags": [
     {
       "flag": "No funding disclosed",
       "detail": "The paper contains no acknowledgment of funding sources, making potential conflicts of interest impossible to assess."
     },
     {
       "flag": "Safety proxy not validated",
       "detail": "Safety is measured using Q16 and NudeNet detectors whose accuracy, false positive/negative rates, and demographic biases are not validated; IP scores may not reflect actual safety for all harmful content categories."
     },
     {
       "flag": "SPAT bound tightness not discussed",
       "detail": "The core bound U(G) + ATV(G) ≥ U* is proven but never analyzed for tightness—whether equality is achievable or the bound is loose in practice is unaddressed, limiting its practical diagnostic value."
     },
     {
       "flag": "Theory-to-practice gap unbounded",
       "detail": "§3.4 and §4.4 acknowledge that the procedure-induced kernel only 'approximately' satisfies the formal support restriction to Csafe,τ, but the approximation gap is not formally quantified."
     }
   ],
   "cited_papers": [
     {
       "title": "AlignGuard: Scalable Safety Alignment for Text-to-Image Generation",
       "relevance": "Primary motivating baseline; documents empirically that stronger alignment degrades benign COCO alignment, motivating the SPAT analysis."
     },
     {
       "title": "Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models",
       "relevance": "Introduces SLD and the IP/Q16 metric adopted by this paper; foundational model-level alignment baseline."
     },
     {
       "title": "LatentGuard: A Safety Framework for Text-to-Image Generation",
       "relevance": "Key prompt-side baseline operating in latent space; directly compared in main results and discussed for abort-rate metric inflation."
     },
     {
       "title": "SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image and Video Generation",
       "relevance": "Inference-time baseline that identifies toxic tokens and adapts diffusion timesteps; compared across all backbones."
     },
     {
       "title": "Value-Aligned Prompt Moderation via Zero-Shot Agentic Rewriting for Safe Image Generation (VALOR)",
       "relevance": "Closest prior work combining prompt rewriting with a rewrite-generate-verify loop; key design comparison for prompt-space intervention."
     },
     {
       "title": "GuardT2I: Defending Text-to-Image Models from Adversarial Prompts",
       "relevance": "Adversarial-robust guard-style baseline; also illustrates abort-rate metric inflation discussed in §5.2."
     },
     {
       "title": "Erasing Concepts from Diffusion Models (ESD-u)",
       "relevance": "Model-editing baseline that modifies diffusion weights to remove unsafe concepts; represents the model-level intervention class."
     },
     {
       "title": "Universal Prompt Optimizer for Safe Text-to-Image Generation (POSI)",
       "relevance": "Prompt-rewriting baseline used in projection diagnostic comparison (Table 3a) for near-identity behavior on safe prompts."
     },
     {
       "title": "PromptGuard: Soft Prompt-Guided Unsafe Content Moderation for Text-to-Image Models",
       "relevance": "Embedding-space prompt intervention baseline with strong in-domain performance but weaker OOD generalization compared in Table 1."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Inference-only, no-retraining approach directly deployable on existing T2I models, but requires LLM+VLM infrastructure adding per-image latency."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Formally proves that any safety improvement necessarily trades off against prompt-image alignment—an intuitively expected but previously unformalized result that reframes how safety methods should be compared."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses the safety of deployed T2I systems against harmful image generation and adversarial prompt attacks, with explicit discussion of residual harms."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Shows model-level alignment is fundamentally constrained by SPAT, but the critique of prior work is framed constructively rather than as a takedown."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Inference-only algorithm with detailed pseudocode (Algorithms 1–2) and public dataset references; reproducible without access to proprietary infrastructure."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Authors from Seoul National University mathematics department; no major industry lab or product affiliation."
     }
   },
   "hn_data": {
     "threads": [],
     "top_points": 0,
     "total_points": 0,
     "total_comments": 0
   }
 }