DiSCO: Defending Text-to-Image Generation via Distribution-Guided Contrastive Prompt Optimization

Summary

As text-to-image generative models advance, they raise safety concerns, particularly generating Not-Safe-For-Work (NSFW) content, further exacerbated by red-teaming attacks. Existing defenses often rely on white-box assumptions, while black-box alternatives based on LLM prompt rewriting fail in what we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining or access to internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model, with iterative adaptive feedback until safe content is produced. On the I2P benchmark, DiSCO reduces attack success rate (ASR) by 37.7% on undefended models and 25.13% on defended models under multiple red-teaming attacks, while maintaining semantic fidelity and improving image coherence. Being architecture-agnostic, DiSCO can be applied to any text-to-image system without altering the model.