ai-research-survey

scan.json (30249B)

---

 {
   "paper": {
     "title": "Inference-Only Prompt Projection for Safe Text-to-Image Generation with TV Guarantees",
     "authors": [
       "Minhyuk Lee",
       "Hyekyung Yoon",
       "Myungjoo Kang"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.00616"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "theoretical"],
   "key_findings": "The paper formalizes the Safety-Prompt Alignment Trade-off (SPAT) in total variation, proving that any nontrivial safety gain under a fixed reference model requires distributional deviation. Building on this, it proposes an inference-only prompt projection framework using a two-stage LLM/VLM cascade that achieves 16.7-60.0% relative reductions in inappropriate percentage versus model-level alignment baselines across three Stable Diffusion backbones and four datasets, while preserving benign prompt-image alignment near the unaligned reference on COCO. The tolerance threshold τ provides monotonic control over the safety-utility trade-off.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL is provided. Appendix F mentions 'we persist the resulting index list alongside our code release' implying future release, but no working link or archive is given."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation datasets are publicly available. Appendix F provides specific HuggingFace/Zenodo URLs for CoProV2, I2P, UD, and COCO, and documents the exact subsampling protocol (seed=42) for reproducibility."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Appendix C.2 states '8 NVIDIA H100 GPUs (80GB each)' but provides no requirements.txt, Dockerfile, library versions, or framework versions. Hardware alone is insufficient to recreate the software environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The algorithms and appendices describe the method but not how to run it end-to-end."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table 1 and all other results tables report only point estimates (e.g., IP=0.04, FID=32.46) with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims its method 'achieves the lowest inappropriate percentage' and 'outperforming strong baselines' based solely on comparing raw numbers without any statistical significance tests (no p-values, t-tests, or bootstrap tests)."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports relative reductions with baseline context: '16.7–60.0% relative reductions in IP versus strong model-level alignment baselines' (abstract/§5.2), and Table 1 provides absolute values for both the proposed method and all baselines."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for dataset sizes. The COCO-3K subset is described as 'randomly sampling 3,000 safe captions' (§5.1) with no rationale for why 3,000 is sufficient. CoProV2 fitting subset of 1,000 is also unjustified."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. Appendix D.4 explicitly states 'The reported numbers correspond to a single-seed run' for the A/B ablation, and main results appear to be single-run as well."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 compares against 11 baselines on SD1.5: SLD, ESD-u, UCE, AlignGuard, VALOR, POSI, PNO, PromptGuard, SAFREE, LatentGuard, and GuardT2I. SD2.1 and SDXL compare against 3 representative baselines."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent works: AlignGuard (2025), VALOR (2025), PromptGuard (2025), SAFREE (2024), PNO (2024), LatentGuard (2024). The oldest baseline (SLD, 2023) is only 3 years old."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Appendix D.1 provides hyperparameter sensitivity ablations (log-probability threshold, α_safety, number of candidates, local search iterations). Appendix D.2 studies LLM scaling across model sizes. Appendix D.4 ablates A/B label ordering. Appendix D.5 ablates embedding model choice."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used: inappropriate percentage (IP) for safety, FID for image quality, and CLIPScore for prompt-image alignment (§5.1, Table 1)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is conducted. All safety and quality assessments use automated detectors (Q16, NudeNet, CLIP). Human evaluation would be relevant to validate whether prompt rewrites preserve meaning and whether safety classifications align with human judgment."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "CoProV2 has explicit train/test splits (15,690/8,000 pairs). §5.1 states 'All model selection (including hyperparameter tuning) is performed only on CoProV2.' I2P and UD serve as out-of-distribution test sets."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 provides category-wise IP scores across 7 safety categories (Shocking, Self-harm, Sexual, Illegal, Hate, Violence, Harassment) under four adversarial attacks."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "§4.4 explicitly discusses failure modes: 'When unsafe content is inseparable from the core intent, meaning preservation may conflict with meeting τ.' The impact statement discusses residual harms from imperfect evaluators and rewriting."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experiment shows the method performing well. The hyperparameter ablation (Appendix D.1) shows only minor sensitivity variations. No configurations that failed or approaches that were tried and abandoned are reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims '16.7–60.0% relative reductions in IP versus strong model-level alignment baselines' which is supported by Table 1 across SD1.5/SD2.1/SDXL. The claim of 'preserving benign prompt–image alignment on COCO near the unaligned reference' is supported by FID/CLIP numbers in Table 1."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims ('prompt projection reduces IP') are supported by controlled comparisons (same backbone, different alignment methods) and ablation studies that vary individual components (§D.1, D.2, D.5). The theoretical framework (SPAT) provides principled justification."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'Safe Text-to-Image Generation' in general, but experiments test only Stable Diffusion variants (SD1.5, SD2.1, SDXL) — all from the same model family. No other T2I architectures (DALL-E, Imagen, Midjourney) are tested. The broad framing outpaces the experimental evidence."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for its results. For example, whether improvements come primarily from the VLM's conservatism rather than the projection mechanism, or whether the additional compute (LLM+VLM) rather than the specific method explains the gains. §4.4 discusses limitations but not alternative explanations."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper defines IP explicitly via Q16 and NudeNet detectors (§5.1), acknowledges detector dependence in §4.4 ('Behavior therefore depends on the safety taxonomy, the conservatism of the safeguard VLM'), and the impact statement discusses 'false negatives/positives, unequal error rates across user groups.'"
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Diffusion models are versioned (SD1.5, SD2.1, SDXL). LLM scaling experiments in Appendix D.2 provide exact HuggingFace checkpoint names. However, the default LLM used for the main experiments (Table 1) is not specified, and the Stage-2 VLM is referenced only as 'a safeguard VLM (Lee et al.)' without an exact model version."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The A/B scoring protocol token sets are shown in Table 4, and edit-preserving instructions are described in natural language (§4.2). However, the actual full prompt templates sent to the LLM for rewrite proposal and to the VLM for scoring are not provided — only their purpose is described."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.1 reports: 'τ = 0.05, α_safety = 20, a log-probability threshold of 20, a maximum escalation of 2, 3 local search steps, and 16 candidates.' Top-K=20 for logprob extraction is stated in §4.3."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The two-stage cascade is described in detail: Algorithm 1 (local search projection) and Algorithm 2 (projected-reference sampling) provide pseudocode. §4.1-4.3 describe the LLM-based surrogate proposal, VLM-based verification, and the scoring protocol."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix F documents dataset sources with specific URLs, download procedures, the CoProV2 train/test split protocol, COCO-3K subsampling procedure (shuffle with seed=42, select first 3,000), and the 1,000-pair fitting subset construction."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "§4.4 'Scope and limitations' provides a dedicated subsection, and the Impact Statement further discusses residual harms, false negatives/positives, and deployment recommendations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "§4.4 provides specific threats: 'no global-optimality claim for metric projection onto C_safe,τ,' 'Stage-2 provides sample-level acceptance, not a distributional guarantee,' and behavior depends on 'the safety taxonomy, the conservatism of the safeguard VLM, and the re-sampling budget R.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "§4.4 states specific scope boundaries: the method provides sample-level rather than distributional guarantees, prompt metric and edit-preserving guidance are not formal invariants, and meaning preservation may conflict with τ when unsafe content is inseparable from core intent."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Source datasets are publicly available (CoProV2, I2P, UD, COCO). However, the paper's own generated images, computed scores, and intermediate results are not released for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix F describes the source and acquisition of each dataset with specific URLs, version information, and subsampling protocols."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks (CoProV2, I2P, UD, COCO)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix F documents the full pipeline: dataset sources, download methods, subsampling with fixed seeds, train/test splitting, and the fitting subset construction (1,000 pairs from CoProV2 training split, disjoint from evaluation)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, grant number, or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: Department of Mathematical Sciences (SNU), Interdisciplinary Program in AI (SNU), and Research Institute of Mathematics (SNU). No commercial product is being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of funding disclosure is itself a gap."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state training data cutoffs for the LLMs used in the pipeline or for the diffusion models (SD1.5, SD2.1, SDXL). The LLM could have seen CoProV2/I2P/UD prompts during training."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the LLM used for rewriting or the VLM used for scoring may have been trained on the evaluation benchmark prompts."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "CoProV2 and I2P are public datasets that could appear in LLM training data. If the LLM has seen these prompts and knows they are tagged as 'unsafe,' it could trivially rewrite them. This contamination concern is not addressed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 7 (Appendix C.2) reports per-device runtimes per dataset/backbone. Appendix B.2 reports per-prompt wall-clock times (0.38–0.58s for cascade vs 1.82–2.51s for VLM-only). Appendix D.3 ablates per-image time under different hyperparameters."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.2 states: 'All experiments are conducted on a single node equipped with 8 NVIDIA H100 GPUs (80GB each).' Per-dataset runtimes are provided in Table 7."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No seed sensitivity analysis is performed. The COCO-3K uses a fixed seed for subsampling, and Appendix D.4 mentions 'single-seed run,' but no results across multiple seeds are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of runs for the main results (Table 1) is not stated. Only Appendix D.4 states 'The reported numbers correspond to a single-seed run' for one specific ablation."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No information on how many configurations were tried before arriving at the default hyperparameters. Appendix D.1 shows sensitivity analysis but not the search procedure."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "§5.1 states 'All model selection (including hyperparameter tuning) is performed only on CoProV2,' with train/test splits (15,690/8,000). This separates selection from evaluation. Appendix D.1 shows sensitivity to different hyperparameter choices."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many pairwise comparisons across 12 methods, 3 backbones, and 4 datasets without any correction for multiple comparisons (no Bonferroni, Holm, or Benjamini-Hochberg)."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own system against baselines without acknowledging author-evaluation bias. It is unclear whether baseline results were re-run or taken from original papers."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The proposed method uses strictly more compute at inference (LLM + VLM + diffusion model) than baselines that only use the diffusion model. While Appendix B.2 reports the cascade speedup vs VLM-only, no comparison is made at matched compute budgets against baselines."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether CoProV2, I2P, or UD actually measure 'safety' as intended. The paper uses these benchmarks without questioning their construct validity or discussing how well automated detectors (Q16, NudeNet) align with human safety judgments."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The method uses an additional LLM+VLM pipeline on top of the base generator, while baselines modify only the generator. This architectural difference is a confound — the improvement could partly be attributed to the additional inference-time compute and models rather than the projection mechanism. This confound is not addressed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the LLM and VLM used in the pipeline were trained on data that includes CoProV2, I2P, or UD prompts, which would give them prior knowledge about which prompts are unsafe."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of feature leakage. The LLM in Stage-1 is explicitly asked whether a prompt is safe/unsafe, which could benefit from having seen benchmark prompt labels during training."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between the 1,000-pair CoProV2 fitting subset and the test split. While they state the subsets are 'disjoint' (Appendix F), structural similarities (same LLM-generated prompts) are not addressed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. No canary strings, membership inference tests, or decontamination pipelines are used."
       }
     }
   },
   "claims": [
     {
       "claim": "Any nontrivial reduction in unsafe generations under a fixed reference model necessarily incurs TV deviation from the reference distribution (SPAT bound).",
       "evidence": "Theorem 3.1 provides a formal proof: U(G) + ATV(G) ≥ U*, showing that safety gains require larger departures from reference conditionals. Proof in Appendix A.3.",
       "supported": "strong"
     },
     {
       "claim": "The method achieves 16.7–60.0% relative reductions in inappropriate percentage versus strong model-level alignment baselines across four datasets and three diffusion backbones.",
       "evidence": "Table 1 shows IP reductions: on SD1.5, IP drops to 0.04/0.06/0.04 on CoProV2/I2P/UD vs. next-best baselines at 0.06-0.07. On SDXL, IP reaches 0.03/0.04/0.02. Consistent improvements across SD2.1 as well.",
       "supported": "moderate"
     },
     {
       "claim": "The method preserves benign prompt-image alignment close to the unaligned reference on COCO.",
       "evidence": "Table 1: SD1.5 FID 32.46 vs 32.34 (no alignment), CLIP 33.36 vs 33.42. SD2.1 FID 32.85 vs 32.78, CLIP 34.92 vs 34.95. SDXL FID 32.45 vs 32.36, CLIP 36.01 vs 36.05. Differences are minimal.",
       "supported": "strong"
     },
     {
       "claim": "The tolerance parameter τ provides monotonic control over the safety level.",
       "evidence": "Fig. 2a shows IP increases monotonically from ~0.04 to ~0.14 as τ increases from 0.05 to 0.5. Fig. 1 provides qualitative visualization of safety-content trade-off across τ values.",
       "supported": "strong"
     },
     {
       "claim": "The method is robust to adversarial prompt attacks, with IP rising only from 0.04 to at most 0.06.",
       "evidence": "Table 2 shows category-wise IP under four attacks (MMA, Ring-A-Bell, SneakyPrompt, P4D). Total IP stays at 0.05-0.06 across all attacks. However, only tested on one backbone (SD1.5) with single-seed runs.",
       "supported": "moderate"
     },
     {
       "claim": "Larger LLMs yield lower IP, with scaling gains largely saturating between 3B-8B.",
       "evidence": "Fig. 7 shows IP curves for LLaMA and Qwen model families across sizes. LLaMA: 0.06→0.03 (CoProV2) from 1B to 70B. Qwen: 0.12→0.02 from 0.5B to 72B. Evaluated on three benchmarks with fixed SD1.5 backbone.",
       "supported": "moderate"
     },
     {
       "claim": "97.70% of COCO prompts are left unchanged by the projection, demonstrating near-identity behavior on safe prompts.",
       "evidence": "Table 3a reports 97.70% unchanged-prompt ratio on COCO (with lowercase/whitespace canonicalization) vs 25.90% for POSI. Fig. 4a shows LDA projection confirming minimal centroid shift.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or multi-seed experiments",
       "detail": "All results appear to be single-run (Appendix D.4 explicitly states 'single-seed run' for ablations). With no variance estimates, it is impossible to assess result stability or whether observed differences are significant."
     },
     {
       "flag": "Unfair compute comparison",
       "detail": "The method uses LLM + VLM + diffusion model at inference time, while most baselines only modify the diffusion model. The additional compute and model capacity is a confound. The 4.3-5.1x speedup reported is against their own VLM-only variant, not against baselines."
     },
     {
       "flag": "No human evaluation of safety or meaning preservation",
       "detail": "All safety assessments rely on automated detectors (Q16, NudeNet). Whether prompt rewrites preserve the user's benign intent and whether the automated detectors agree with human safety judgments is unknown."
     },
     {
       "flag": "Guard-style baseline metric distortion acknowledged but not corrected",
       "detail": "The paper notes that LatentGuard and GuardT2I abort 13.53% and 32.87% of COCO captions, creating selection bias in FID computation. Despite acknowledging this, the paper still presents these numbers in the same table without adjusted comparisons."
     }
   ],
   "cited_papers": [
     {
       "title": "Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models",
       "authors": ["Patrick Schramowski", "Manuel Brack", "Björn Deiseroth", "Kristian Kersting"],
       "year": 2023,
       "relevance": "Key baseline for T2I safety alignment via latent-space guidance; introduced the IP metric used in this paper's evaluation."
     },
     {
       "title": "Erasing concepts from diffusion models",
       "authors": ["Rohit Gandikota", "Joanna Materzynska", "Jaden Fiotto-Kaufman", "David Bau"],
       "year": 2023,
       "relevance": "Model-editing approach to T2I safety (ESD-u); demonstrates risks of model-level concept removal for safety alignment."
     },
     {
       "title": "Unified concept editing in diffusion models",
       "authors": ["Rohit Gandikota", "Hadas Orgad", "Yonatan Belinkov", "Joanna Materzyńska", "David Bau"],
       "year": 2024,
       "relevance": "Inference-time cross-attention modulation for safety alignment (UCE); represents latent-control baseline approach."
     },
     {
       "title": "Latent guard: a safety framework for text-to-image generation",
       "authors": ["Runtao Liu", "Ashkan Khakzar", "Jindong Gu", "Qifeng Chen", "Philip Torr", "Fabio Pizzati"],
       "year": 2024,
       "relevance": "Contrastive harmfulness detection in latent space above the text encoder; prompt-side guard baseline."
     },
     {
       "title": "AlignGuard: Scalable safety alignment for text-to-image generation",
       "authors": ["Runtao Liu", "I-Chao Chen", "Jindong Gu", "Jiaxu Zhang", "Renjie Pi", "Qifeng Chen", "Philip Torr", "Ashkan Khakzar", "Fabio Pizzati"],
       "year": 2025,
       "relevance": "Category-specific safety experts inserted into diffusion backbone; main evaluation protocol and CoProV2 dataset used in this paper."
     },
     {
       "title": "SAFREE: Training-free and adaptive guard for safe text-to-image and video generation",
       "authors": ["Jaehong Yoon", "Shoubin Yu", "Vaidehi Patil", "Huaxiu Yao", "Mohit Bansal"],
       "year": 2024,
       "arxiv_id": "2410.12761",
       "relevance": "Training-free safety guard that identifies toxic tokens and adapts diffusion timesteps; inference-time safety baseline."
     },
     {
       "title": "Safeguarding text-to-image generation via inference-time prompt-noise optimization",
       "authors": ["Jiangweizhi Peng", "Zhiwei Tang", "Guangyao Liu", "Charles Fleming", "Mingyi Hong"],
       "year": 2024,
       "arxiv_id": "2412.03876",
       "relevance": "Gradient-based inference-time optimization of text embeddings and noise trajectories for T2I safety."
     },
     {
       "title": "Llama guard: LLM-based input-output safeguard for human-AI conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "arxiv_id": "2312.06674",
       "relevance": "LLM-based safety classification using prompt/response analysis; foundational work for LLM guard approaches in safety pipelines."
     },
     {
       "title": "GuardT2I: Defending text-to-image models from adversarial prompts",
       "authors": ["Yingqian Yang", "Rui Gao", "Xin Yang", "Jingzhi Zhong", "Qiang Xu"],
       "year": 2024,
       "relevance": "Conditional LLM approach to defend T2I models from adversarial prompt obfuscation; guard-style baseline."
     },
     {
       "title": "Value-aligned prompt moderation via zero-shot agentic rewriting for safe image generation",
       "authors": ["Xin Zhao", "Xiang Chen", "Bo Liu", "Zekun Liu", "Zheyuan Zhao", "Xiaoguang Gu"],
       "year": 2025,
       "arxiv_id": "2511.11693",
       "relevance": "Agentic prompt rewriting with rewrite-generate-verify loop for T2I safety; closest methodological relative to this work."
     },
     {
       "title": "MMA-diffusion: Multimodal attack on diffusion models",
       "authors": ["Yijun Yang", "Ruiyuan Gao", "Xiaosen Wang", "Tsung-Yi Ho", "Nan Xu", "Qiang Xu"],
       "year": 2024,
       "relevance": "Adversarial attack method for T2I models used as robustness evaluation in this paper."
     },
     {
       "title": "PromptGuard: Soft prompt-guided unsafe content moderation for text-to-image models",
       "authors": ["Ling Yuan", "Xin Li", "Chenxi Xu"],
       "year": 2025,
       "arxiv_id": "2501.03544",
       "relevance": "Universal safety soft prompt approach for T2I moderation; embedding-space safety baseline."
     }
   ]
 }