AEGIS: A Mechanism-Guided Defense against Visual Synonym Jailbreaks in Text-to-Image Models

2026-07-08 · Source: cs.CV updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

Text-to-image diffusion models like SD 1.4, SD 2.1, and FLUX.1 are vulnerable to "visual synonym attacks" (VSA), where benign-looking prompts elicit prohibited imagery. Existing alignment paradigms often face a safety-utility dilemma, either under-mitigating VSA threats or over-suppressing visually similar benign concepts. This work introduces Aegis, an inference-time defense that dynamically traces how unsafe semantics emerge during generation. Mechanistic analysis reveals VSA and explicit unsafe prompts converge through sparse "semantic-injecting attention heads." Aegis applies similarity-aware repulsion only at these identified vulnerable heads. On SD 1.4, Aegis reduces Attack Success Rate (ASR) to 0.00/0.03 for in-domain violence/nudity VSA and achieves ASRs ≤0.09 for out-of-domain explicit and adversarial attacks, while preserving benign fidelity (FID 66.70, CLIP 30.55) and transferring to SD 2.1 and FLUX.1.

Key takeaway

For AI Security Engineers deploying text-to-image models, you should consider implementing dynamic, inference-time defenses like Aegis to counter evolving visual synonym attacks. This approach, which targets specific "semantic-injecting attention heads" rather than broad content filters, offers robust safety (ASR ≤0.09) without degrading benign generation utility (FID 66.70). Prioritize solutions that adaptively steer internal model mechanisms to avoid over-mitigation and ensure cross-architecture transferability.

Key insights

Unsafe visual semantics in T2I models emerge via sparse "semantic-injecting attention heads" that can be dynamically steered.

Principles

• Dynamic semantic tracing is superior to static concept suppression.
• Unsafe visual semantics converge in sparse attention heads.
• Inference-time intervention can balance safety and utility.

Method

Aegis identifies sparse semantic-injecting attention heads via Lasso regression on signature profiles. It then applies similarity-aware adaptive repulsion at these heads during inference, steering activations away from malicious anchor embeddings.

In practice

• Profile latent trajectories to identify semantic convergence.
• Use anchor embeddings as repulsion beacons for steering.
• Implement adaptive gating for nuanced intervention strength.

Topics

• Text-to-Image Models
• Visual Synonym Attacks
• Diffusion Model Safety
• Mechanistic Interpretability
• Attention Heads
• Inference-Time Defense

Code references

• notAI-tech/NudeNet

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, Machine Learning Engineer

Related on AIssential

• Systematic Discovery of Semantic Attacks in Online Map Construction through Conditional Diffusion — Semantic-level adversarial attacks exploiting diffusion model latent spaces bypass standard defenses and appear realistic.
• Attention-Guided Reward for Reinforcement Learning-based Jailbreak against Large Reasoning Models — Successful LRM jailbreaks correlate with specific attention patterns, which can be optimized via RL for higher attack rates.
• Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation — Anti-Prompt protects images from I2V misuse by subtly perturbing them to weaken text guidance and amplify visual-only pathways.
• Embedding Inference Attack — Black-box IR systems are vulnerable to embedding inference attacks, allowing model identification via tailored queries.
• Multimodal Generative Engine Optimization: Rank Manipulation for Vision–Language Model Rankers — MGEO reveals VLMs' vulnerability to rank manipulation via joint image perturbations and textual suffixes, exploiting internal cross-modal knowledge.
• THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models — Safety in multi-turn LLM interactions is trajectory-dependent, requiring defenses that model temporal risk accumulation.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CV updates on arXiv.org.