DiSCO cuts NSFW attack success rate by up to 37.7% in text-to-image models
Text-to-image generative models keep getting more capable, and with that comes a growing safety problem: the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, a risk that red-teaming adversarial attacks make worse by deliberately hunting for prompts that slip past safety filters. Most existing defenses assume white-box access to the model, relying on optimizing its text encoder, editing its weights, or intervening at inference time, which the authors say fundamentally cannot scale to proprietary models whose internals nobody outside the vendor can reach. Black-box alternatives exist too, built around using a separate LLM to rewrite prompts before they reach the image model, offering broader applicability, but the authors say these fail in what they call the 'benign adversarial problem': prompts that are linguistically safe on their face yet still trigger harmful generation because of the target model's own learned data distribution.
The paper proposes DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. It works by taking an incoming prompt and expanding it with a suffix chosen through beam search, guided by contrastive scoring against pools of safe and unsafe images that the target model itself generates. DiSCO repeats this with iterative adaptive feedback until the output is judged safe.
Tested on the I2P benchmark under multiple red-teaming attacks, DiSCO achieves an attack success rate (ASR) reduction of 37.7% on undefended models and 25.13% on models that already carry some other defense, while the authors say it maintains semantic fidelity and improves image coherence. Because DiSCO treats the target model as a black box and works purely by manipulating the prompt, the authors say it can be applied to any text-to-image system without changing the model itself.
Key facts
- DiSCO is a zero-shot, strictly black-box, prompt-level defense: no model retraining, fine-tuning, or access to internals is required to deploy it.
- It targets what the authors call the 'benign adversarial problem': prompts that read as linguistically safe but still trigger harmful image generation because of the model's own learned data distribution.
- DiSCO expands a prompt with a suffix chosen via beam search, scored by contrasting it against pools of safe and unsafe images the target model itself generates, refined through iterative adaptive feedback.
- On the I2P benchmark under multiple red-teaming attacks, DiSCO cuts the attack success rate (ASR) by 37.7% on undefended models and by 25.13% on already-defended models.
- The method preserves semantic fidelity and improves image coherence, and being black-box and architecture-agnostic, it can attach to any text-to-image system without modifying it.
Why it matters
Text-to-image models keep getting more capable, and with that comes a growing safety problem: generating NSFW content such as violence and nudity, a risk that red-teaming adversarial attacks make worse by deliberately hunting for prompts that slip past safety filters. Most existing defenses assume white-box access, relying on optimizing the model's text encoder, editing its weights, or intervening at inference time, which the authors say fundamentally cannot scale to proprietary models where nobody outside the vendor can reach those internals. Black-box alternatives exist too, built around using another LLM to rewrite prompts, but the authors say these fail against what they call the 'benign adversarial problem': prompts that are linguistically safe on their face yet still trigger harmful generation because of the model's own learned data distribution. DiSCO is proposed as a defense that works in exactly that black-box setting and specifically targets that failure mode.
Who it affects
The paper frames DiSCO as relevant to anyone running or building on top of a proprietary text-to-image system, since its entire design point is defending models without needing access to their internals, retraining, or fine-tuning. It is evaluated specifically against red-teaming adversarial attacks, the kind of deliberate prompt engineering used to bypass safety filters, rather than only casual misuse.
How to use it
DiSCO works as a plug-and-play module at the prompt level: it takes an incoming prompt, expands it with a suffix chosen through beam search, scores candidate suffixes by contrasting them against pools of safe and unsafe images that the target model itself generates, and repeats with iterative adaptive feedback until the output is judged safe. Deploying it needs no retraining, fine-tuning, or access to the target model's internals, and the authors describe it as architecture-agnostic, applicable to any text-to-image system without changing the model itself. There is no mention of code, model weights, or a demo being released.
How solid is it
The headline numbers come from the I2P benchmark, tested under multiple red-teaming attack methods: an attack success rate (ASR) reduction of 37.7% on undefended models and 25.13% on models that already carry some other defense, alongside the authors' claim that semantic fidelity holds up and image coherence improves. The abstract does not name the baseline defense methods DiSCO is compared against, or the specific target text-to-image model used to generate the safe/unsafe image pools and run the experiments.
Risks and caveats
The abstract does not say whether the reported 37.7% and 25.13% figures are percentage-point drops in ASR or relative reductions. No baseline defense method, target text-to-image model, or institution is named. The material lists no individual authors: the 'Tong Zhang' byline attached to the Hugging Face listing is submitter metadata, not an author credit from the paper itself. There is no mention of code, model weights, or a demo release.