通过速度编辑实现安全少步生成
Safe Few-Step Generation via Velocity Editing
AI总结：
针对流匹配文本到图像生成中少采样步数下的安全问题，提出无训练的速度编辑方法VESFlow及其增强版VESFlow+，通过编辑速度场而非修改提示词来引导生成远离不安全内容，在保持良性提示保真度的同时显著降低攻击成功率。
摘要：
流匹配最近已成为最先进的文本到图像（T2I）生成的有力范式，能够以少量采样步骤实现高质量生成。随着这些模型越来越多地集成到实际应用中，确保安全和非敏感内容生成已成为关键要求。然而，将安全性和概念移除方法适应这一新的生成框架仍然是一个开放的挑战。具体来说，先前的方法很大程度上依赖于跨多个去噪步骤的迭代轨迹引导或基于CLIP的提示嵌入操作。这些设计假设为基于流匹配的T2I生成中的安全性带来了根本性瓶颈，其中有限的采样步骤限制了迭代校正，而现代上下文感知文本编码器降低了嵌入级别干预的有效性。在本文中，我们提出了VESFlow，一种针对具有极少采样步骤的流匹配的无训练安全方法。利用流匹配模型学习边际速度的事实，我们通过安全条件后验直接编辑速度场。VESFlow将轨迹引向安全输出，同时保持条件提示不变。基于VESFlow在良性提示下保持输出不变的观察，我们进一步引入基于风险分数的过滤，绕过速度编辑以减少计算成本，同时保持良性提示生成。基于这种过滤，我们提出了VESFlow+，VESFlow的一个更强变体，它不仅将速度编辑到安全方向，而且将其推离不安全方向。实验结果表明，VESFlow+移除了目标概念，在4步MeanFlow模型上，将Ring-A-Bell和MMA-Diffusion的攻击成功率分别降低到6.3%和6.8%（由NudeNet评估），同时保持良性提示的保真度。
英文摘要：
Flow matching has recently emerged as a strong paradigm for state-of-the-art text-to-image (T2I) generation, enabling high-quality generation with a small number of sampling steps. As these models are increasingly integrated into real-world applications, ensuring safe and non-sensitive content generation has become a critical requirement. However, adapting safety and concept removal methods to this new generation framework remains an open challenge. Specifically, prior methods largely rely on iterative trajectory steering across a number of denoising steps or on CLIP-centric prompt embedding manipulation. These design assumptions pose fundamental bottlenecks for safety in flow matching-based T2I generation, where limited sampling steps constrain iterative correction and modern context-aware text encoders diminish the effectiveness of embedding-level interventions. In this paper, we propose VESFlow, a training-free safety method tailored to flow matching with extremely few sampling steps. Leveraging the fact that flow matching models learn the marginal velocity, we directly edit the velocity field via a safe-conditional posterior. VESFlow steers the trajectory toward safe outputs while leaving the conditioning prompt unchanged. Building on the observation that VESFlow leaves outputs unchanged under benign prompts, we further introduce a risk score-based filtering that bypasses velocity editing to reduce computational cost while preserving benign prompt generation. Based on this filtering, we propose VESFlow+, a stronger variant of VESFlow that not only edits the velocity toward the safe direction, but also pushes it away from the unsafe direction. Experimental results show that VESFlow+ removes the target concept, reducing the attack success rate by NudeNet to 6.3% on Ring-A-Bell and 6.8% on MMA-Diffusion on the 4-step MeanFlow model, while preserving fidelity on benign prompts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
