DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization

August 19, 2026 | Source: arXiv AI

Tags: text-to-image safety, content moderation, adversarial attacks, NSFW defense, prompt optimization

DiSCO is a zero-shot, plug-and-play black-box defense for text-to-image models that reduces attack success rate by 37.7% on the I2P benchmark without retraining or accessing model internals — solving the 'benign adversarial' problem where linguistically safe prompts still trigger NSFW generation.

Details

Existing safety defenses for text-to-image generation mostly require white-box access — text encoder optimization, weight editing, or inference-time hooks — making them inapplicable to proprietary models like DALL-E or Midjourney. Black-box LLM prompt rewriting exists but fails on a class of prompts DiSCO identifies as the 'benign adversarial' problem: prompts that are linguistically clean but still trigger harmful content due to the model's learned distribution. DiSCO operates as a prompt-level suffix expander: it runs beam search to find suffixes that contrastively score safe above unsafe by sampling from the target model's own outputs. No model retraining or fine-tuning required. It runs iterative adaptive feedback until safe content is produced. On the I2P benchmark, DiSCO achieves 37.7% attack success rate (ASR) reduction on undefended models and 25.13% on already-defended ones, while maintaining semantic fidelity. As an architecture-agnostic module, it can wrap any text-to-image system. The practical value is clear: safety teams at companies deploying commercial image generation APIs can bolt on DiSCO without touching upstream models. The benign adversarial framing is also a useful concept for thinking about why purely linguistic content filters miss a large class of real-world attacks.