Dynamic VLM-Guided Negative Prompting for Diffusion Models

AI summary

Overview

• Research area: Computer vision / text-to-image (T2I) generative modeling, specifically safety-oriented content filtering for diffusion models using Vision-Language Models (VLMs).
• Technical level: Intermediate. Readers should be comfortable with diffusion denoising, Classifier-Free Guidance (CFG), and standard T2I evaluation metrics (CLIP, FID, ASR).
• Scope (one sentence): The paper introduces VL-DNP, a training-free scheme that queries a VLM at a small set of denoising timesteps to generate negative prompts on the fly, and compares its safety-versus-alignment trade-off against static negative prompting and the SAFREE baseline.

What This Paper Is About

Negative prompting steers a text-to-image diffusion model away from unwanted concepts, but it normally relies on a fixed negative prompt chosen before inference and can disrupt generation even when the unwanted content is absent, causing over-correction and semantic drift. The authors propose replacing that fixed prompt with one generated dynamically: the model predicts an intermediate clean image during denoising, a VLM inspects it, and the resulting negative prompt is fed back into classifier-free guidance for the remaining steps. The goal is to filter unwanted content more precisely without the fidelity loss that static negative prompting incurs.

Key Contributions

1. A dynamic negative prompting framework (VL-DNP). Negative conditions become functions of the evolving intermediate image rather than a fixed string, formalized as a time-varying negative condition c-_t_i produced by a VLM at query timesteps.
2. A concrete inference pipeline. The method predicts x̂_0 at a predefined set of timesteps, queries a lightweight VLM, and applies the resulting negative guidance for the interval until the next query, all without joint training or modification of the pretrained diffusion model.
3. Empirical characterization of the safety–alignment trade-off. Evaluated across Ring-a-Bell-16, P4D, Unlearn-Diff, and a 100-prompt COCO set, showing that raising the negative-guidance scale lowers ASR/TR but raises FID, and that the dynamic schedule dominates static prompting points in Pareto terms.
4. A baseline comparison against SAFREE (a token embedding projection method), which the authors report preserves the highest CLIP score in their table but at substantially poorer safety.

Main Findings

• Static negative prompting degrades fidelity sharply as guidance rises. Increasing the static negative guidance scale from ω_neg = 7.5 to 20 moves CLIP from 0.313 down to 0.277 and FID from 107.3 up to 152.5.
• VL-DNP keeps CLIP nearly constant across the same sweep. CLIP moves only from 0.312 to 0.311, while FID stays in the 8–15 range (8.0 at ω_neg = 7.5, 12.9 at 15.0, 15.3 at 20.0, 15.1 at 25.0), and ASR still drops, especially at ω_neg = 20 and 25.
• The no-negative baseline is unsafe. SD v1.4 without negative prompting reports ASR/TR of 0.958/0.961 (Ring-a-Bell-16), 0.960/0.935 (P4D), and 0.697/0.734 (Unlearn-Diff); its FID is not reported.
• Safety improves monotonically with the dynamic guidance scale on most datasets. On Ring-a-Bell-16, ASR falls from 0.495 (ω_neg = 7.5) to 0.084 (15.0), 0.011 (20.0), and 0.032 (25.0); on Unlearn-Diff, ASR falls from 0.310 to 0.099, 0.085, and 0.077 respectively.
• Static prompting can reach lower raw ASR at a fixed scale, but at a larger alignment cost. At ω = 15 on P4D, static prompting attains 0.053 ASR versus 0.225 for VL-DNP, but with a CLIP loss of –5.4% relative to no-negative versus –0.5% for VL-DNP.
• SAFREE sits at the opposite end of the trade-off. It records the highest CLIP in the table (0.315 on COCO-100) but higher ASR/TR values (e.g., 0.453 ASR on Ring-a-Bell-16), and the authors state that for any CLIP it attains, VL-DNP matches or beats it on ASR and usually on FID.
• VLM negative prompts tend to be concept-specific. The authors report the VLM proposing narrow negatives such as "Male breast" and "Buttocks" instead of a generic "nsfw", which they argue reduces collateral suppression; prompts also evolve as artifacts disappear.
• Runtime overhead is reported. VL-DNP at ω_neg = 7.5 takes 29.673 seconds per image versus 11.967 seconds for static prompting at the same scale and 9.01 seconds for SAFREE; the no-negative baseline is 8.0 seconds. Inference times for VL-DNP at ω_neg = 15.0, 20.0, and 25.0 are not reported.

Methodology in Plain English

The authors start from a pretrained diffusion model that already supports classifier-free guidance, so no retraining is needed. During sampling, they let the model run normally for most steps. At a small, pre-chosen set of timesteps, they use the current noisy latent to estimate what the final image would look like, producing a rough, often blurry intermediate picture. That picture is handed to a vision-language model, optionally with a few demonstration examples, and the VLM is asked to name any inappropriate or unwanted visual elements it sees and to output a short negative prompt targeting them. That negative prompt is then plugged into the guidance formula for all denoising steps until the next query point, at which the process repeats and the negative prompt can change as the image evolves. The authors use Stable Diffusion v1.4 as the generator, Qwen2.5-VL-7B-Instruct as the VLM, DPM-Solver++ with 50 inference steps, and query the VLM at timesteps {45, 44, 43, 41, 38, 34, 29, 23, 16, 8}. Evaluation combines CLIP and FID (text-image alignment and image quality) with NudeNet-based Attack Success Rate and Toxic Rate (safety), over 100 prompts sampled from COCO-30K plus the adversarial prompt sets Ring-a-Bell-16, P4D, and Unlearn-Diff.

Why This Matters

• Research impact: The paper reframes negative prompting as a scheduling problem over both time and content, rather than a single fixed hyperparameter, and argues that the dynamic strategy pushes the entire safety–alignment frontier outward relative to static prompting and SAFREE. It also shows that a general-purpose VLM can act as an in-the-loop safety component without any fine-tuning of the diffusion model.
• Real-world applications:
  • Content moderation in consumer text-to-image tools that must filter unsafe outputs while preserving prompt fidelity.
  • Enterprise and educational image generation systems where brand-safe or age-appropriate outputs are required.
  • Dataset curation pipelines that need to remove unwanted concepts from generated images without degrading prompt adherence.
  • Platforms serving adversarial or jailbreak-style user prompts, of the kind represented by Ring-a-Bell-16, P4D, and Unlearn-Diff.
• Industry relevance: Because the method plugs into any pretrained CFG-based diffusion model without joint training or architectural changes, it is a drop-in addition rather than a new model. The reported latency increase (29.673 seconds versus 11.967 seconds for static prompting at ω_neg = 7.5 in this setup) is the main practical cost that deployment would have to absorb or optimize away.

Future Directions

• Jointly scheduling guidance strength and content instead of only swapping the negative prompt text at fixed timesteps, which the authors identify because absolute ASR still hinges on the guidance scale.
• Reducing runtime overhead via caching intermediate predictions, querying the VLM less frequently (for example every k steps), or using lightweight vision encoders.
• Deploying smaller VLMs or distillation-based approaches to move the method toward real-time use.
• Open question left unresolved: whether dynamic prompting's Pareto advantage over static prompting holds when the guidance scale is tuned per method rather than compared at matched values, since the paper notes static prompting achieves lower raw ASR at some fixed scales.

Target Audience

Researchers and engineers working on safety, moderation, or controllability of diffusion-based text-to-image systems; practitioners who want a training-free add-on for an existing CFG-based model; and readers interested in using vision-language models as runtime components inside generative pipelines. The paper is written for an audience already familiar with classifier-free guidance and standard T2I benchmarks, so beginners may need background reading on diffusion sampling first. The paper is a workshop contribution and does not report statistical significance testing, confidence intervals, or a human evaluation of the filtered outputs.

Authors’ abstract

We propose a novel approach for dynamic negative prompting in diffusion models that leverages Vision-Language Models (VLMs) to adaptively generate negative prompts during the denoising process. Unlike traditional Negative Prompting methods that use fixed negative prompts, our method generates intermediate image predictions at specific denoising steps and queries a VLM to produce contextually appropriate negative prompts. We evaluate our approach on various benchmark datasets and demonstrate the trade-offs between negative guidance strength and text-image alignment.