标题： 对嵌入空间进行扭曲以确保安全：一种针对对抗鲁棒扩散模型的防御机制 显示英文标题

标题： Distorting Embedding Space for Safety: A Defense Mechanism for Adversarially Robust Diffusion Models

摘要： 文本到图像扩散模型在遵循文本提示时表现出显著的生成性能，但可能从不安全的提示中生成不适合工作场合（NSFW）的内容。 现有的方法，如提示过滤或概念遗忘，无法在保持良性图像质量的同时抵御对抗攻击。 在本文中，我们提出了一种称为扭曲嵌入空间（DES）的新方法，这是一种基于文本编码器的防御机制，通过创新的嵌入空间控制有效解决这些问题。 DES将从文本编码器中使用不安全提示提取的不安全嵌入，转换到精心计算的安全嵌入区域，以防止不安全内容的生成，同时再现原始的安全嵌入。 DES还通过将使用提示“nudity”提取的裸露嵌入与中性嵌入对齐，中和了裸露嵌入，以增强对对抗攻击的鲁棒性。 这些方法确保了强大的防御能力和高质量的图像生成。 此外，DES可以以即插即用的方式采用，并且需要零推理开销，便于部署。 在多种攻击类型上的广泛实验，包括黑盒和白盒场景，证明了DES在防御能力和良性图像生成质量方面的最先进性能。 我们的模型可在 https://github.com/aei13/DES 获取。 显示英文摘要

摘要： Text-to-image diffusion models show remarkable generation performance following text prompts, but risk generating Not Safe For Work (NSFW) contents from unsafe prompts. Existing approaches, such as prompt filtering or concept unlearning, fail to defend against adversarial attacks while maintaining benign image quality. In this paper, we propose a novel approach called Distorting Embedding Space (DES), a text encoder-based defense mechanism that effectively tackles these issues through innovative embedding space control. DES transforms unsafe embeddings, extracted from a text encoder using unsafe prompts, toward carefully calculated safe embedding regions to prevent unsafe contents generation, while reproducing the original safe embeddings. DES also neutralizes the nudity embedding, extracted using prompt ``nudity", by aligning it with neutral embedding to enhance robustness against adversarial attacks. These methods ensure both robust defense and high-quality image generation. Additionally, DES can be adopted in a plug-and-play manner and requires zero inference overhead, facilitating its deployment. Extensive experiments on diverse attack types, including black-box and white-box scenarios, demonstrate DES's state-of-the-art performance in both defense capability and benign image generation quality. Our model is available at https://github.com/aei13/DES.