发表机构
KAIST; Samsung Electronics（韩国科学技术院; 三星电子）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对文本到图像生成中全局不安全信号移除的局限性，提出免训练的局部反事实校正方法CALM，通过提示局部调制显著提升不安全内容抑制并保持良性实用性。
AI 中文摘要
针对文本到图像生成的免训练安全防护措施通常依赖于一个可复用的安全信号，例如一个不安全方向或全局有毒子空间，并将其广泛应用于所有提示词。我们对此全局不安全假设进行了受控的几何分析，揭示了一个一致的覆盖-选择性权衡：紧凑的不安全子空间无法覆盖异构的不安全语义，而更广泛的聚合则会越来越扭曲与安全相邻的良性提示。受此发现启发，我们提出了CALM（反事实自适应局部调制），一种免训练的安全防护方法，用提示局部的反事实校正取代统一的全局移除。利用匹配的不安全-良性锚点，CALM将每个提示路由到活跃的不安全类别，仅最小限度地编辑违规的令牌表示使其朝向安全侧，并抑制正向对齐的不安全残差分量。在广泛的评估中，CALM显著提高了不安全内容的抑制效果，同时保持了良性实用性，表明局部反事实校正提供了一种比全局不安全信号移除更具选择性的替代方案。
英文摘要
Training-free safeguards for text-to-image generation often rely on a reusable safety signal, such as an unsafe direction or global toxic subspace, applied broadly across prompts. We provide a controlled geometric analysis of this global-unsafety assumption and reveal a consistent coverage-selectivity trade-off: compact unsafe subspaces fail to cover heterogeneous unsafe semantics, whereas broader aggregation increasingly distorts safety-adjacent benign prompts. Motivated by this finding, we propose CALM (Counterfactual Adaptive Local Modulation), a training-free safeguard that replaces uniform global removal with prompt-local counterfactual correction. Using matched unsafe-benign anchors, CALM routes each prompt to active unsafe categories, minimally edits only violating token representations toward the safe side, and suppresses positively aligned unsafe residual components. Across broad evaluation, CALM significantly improves unsafe content suppression while preserving benign utility, demonstrating that local counterfactual correction provides a more selective alternative to global unsafe signal removal.
CommentsNeurIPS 2026
