SaTPO: Text-to-Image Safety Alignment via Transition Preference Optimization
Text-to-image safety alignment typically relies on coarse, image-level preference signals that can degrade overall generation quality. SaTPO proposes step-wise transition preferences between an unsafe prompt and its safe rewrite, sharing the parent latent state and noise to isolate the safety direction without a learned reward model. Multi-scale drift regularization and benign replay attempt to preserve ordinary generation, and experiments on Stable Diffusion v1.5 and SDXL report lower unsafe-detection rates and better FID than strong baselines.
SaTPO offers an elegant structural insight—unsafe and safe prompt pairs supply intrinsic step-level preferences—and couples them through shared parent states to avoid trajectory drift. The empirical trade-offs on SD-v1.5 and SDXL are favorable relative to AlignGuard and SafetyBPO. However, the evaluation leans entirely on automated detectors, and the ablation without benign replay shows catastrophic quality degradation, suggesting a fragile objective. The theoretical justification assumes equal-covariance Gaussian transitions, which is only approximate under classifier-free guidance.
The core design is strong: by generating one-step candidates from the same parent latent with shared noise, the difference between safe and unsafe transitions is exactly the rewrite-induced mean shift, eliminating confounding trajectory history. This yields a reward-free directional signal that is conceptually cleaner than image-level DPO or latent reward models. The CoProPV refinement is also pragmatic; the authors show that only a fraction of CoProV2 pairs actually produce the expected safe/unsafe image labels on a given backbone, so backbone-specific verification improves data quality.
The safety metrics are entirely automated classifiers (PerspectiveVision, Q16, NudeNet), with no human evaluation or calibration reported; reductions in detection rates could reflect classifier brittleness rather than true harm reduction. The method also depends on a large battery of hyperparameters—local, common, and benign drift radii, sharpness terms, and weights—that differ markedly between SD-v1.5 and SDXL, yet only a narrow ablation is provided.
Removing benign replay causes catastrophic FID degradation (69.19 versus 25.95 on SD-v1.5) and a collapse in CLIP similarity, which suggests the safety objective is far from orthogonal to generation quality and the drift penalties alone are insufficient. Finally, the adapted LPO baseline fails dramatically on SD-v1.5, raising fairness concerns about the comparison to step-level reward-model methods; the paper does not diagnose whether this is due to the reward model, the LoRA scale, or a mismatch between safety and aesthetic training regimes.
The reported numbers support the claim that SaTPO improves over AlignGuard and SafetyBPO on the evaluated safety and FID metrics. However, baseline comparisons are uneven: AlignGuard and SafetyBPO use officially released weights, while LPO is re-implemented by the authors and reportedly collapses. ESD-u, UCE, and RECE are also reproduced or ported, which introduces implementation variance. The adversarial evaluation is limited to fixed prompt benchmarks rather than adaptive attacks that could exploit the transition-preference structure, so robustness claims should be treated cautiously.
The paper does not mention code release, and several algorithmic components—such as the surrogate gradient estimator for the common-drift penalty and the caching of benign transitions—are non-trivial to re-implement from the text alone. Hyperparameters are listed in Table 6, but their sensitivity is not systematically studied. CoProPV is derived from CoProV2 through a model-specific regeneration and labeling pipeline; absent release of the filtered pair lists or the SafetyLRM checkpoint, independent reproduction of the exact training data is difficult.
Safety alignment of text-to-image diffusion models aims to suppress harmful content without compromising useful generation capabilities. However, preferences over completed images compress multidimensional generation factors into a coarse signal, potentially driving changes beyond those required for safety. To address this, we propose Safety Transition Preference Optimization (SaTPO), which enforces step-wise alignment during denoising. SaTPO leverages the insight that an unsafe prompt and its safe rewrite naturally form a tightly coupled preference pair when conditioned on a shared parent state and noise realization. By anchoring optimization on identical parent states, SaTPO eliminates historical trajectory divergence, confining safety adaptation to an incremental alignment while preserving task-relevant semantics. Multi-scale drift constraints and benign replay further limit behavioral deviation and preserve ordinary generation. We additionally construct CoProPV, a refined dataset ensuring visually verified contrasts. Experiments on Stable Diffusion v1.5 and SDXL demonstrate improved safety-quality trade-offs. Compared with AlignGuard, PerspectiveVision unsafe-detection rates on Inappropriate Image Prompts decrease from 12.70% to 6.00% and from 15.04% to 9.30%, respectively, while FID improves from 32.28 to 25.95 and from 36.50 to 27.51. Warning: this paper includes potentially offensive content.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.