EDGE-Shield: Efficient Denoising-staGE Shield for Violative Content Filtering via Scalable Reference-Based Matching

Abstract: The advent of Text-to-Image generative models poses significant risks of copyright violation and deepfake generation. Since the rapid proliferation of new copyrighted works and private individuals constantly emerges, reference-based training-free content filters are essential for providing up-to-date protection without the constraints of a fixed knowledge cutoff. However, existing reference-based approaches often lack scalability when handling numerous references and require waiting for finishing image generation. To solve these problems, we propose EDGE-Shield, a scalable content filter during the denoising process that maintains practical latency while effectively blocking violative content. We leverage embedding-based matching for efficient reference comparison. Additionally, we introduce an \textit{$x$}-pred transformation that converts the model's noisy intermediate latent into the pseudo-estimated clean latent at the later stage, enhancing classification accuracy of violative content at earlier denoising stages. We conduct experiments of violative content filtering against two generative models including Z-Image-Turbo and Qwen-Image. EDGE-Shield significantly outperforms traditional reference-based methods in terms of latency; it achieves an approximate $79\%$ reduction in processing time for Z-Image-Turbo and approximate $50\%$ reduction for Qwen-Image, maintaining the filtering accuracy across different model architectures.

• The paper introduces EDGE-Shield, a training-free, scalable filtering technique that employs an x-pred transformation for early detection of violative content.
• It leverages pre-computed reference embeddings and cosine similarity to maintain negligible latency even with large, dynamic reference sets.
• Quantitative results demonstrate up to 79% reduction in time-to-classification and ROC-AUC scores between 0.85 and 0.89, outperforming traditional output-based filters.

Scalable Reference-Based Content Filtering with EDGE-Shield

Motivation and Problem Formulation

Recent advancements in text-to-image (T2I) generative models have exacerbated risks associated with the synthesis of violative content, including copyright violations, deepfake imagery, and unauthorized depictions of private individuals. Mitigating these issues remains challenging. Training-based, output-based, and input-based content filters often suffer from poor scalability, high latency, and insensitivity to prompt variation or rapidly evolving reference sets. Reference-based filtering provides strong generalization to new, unseen violative content—crucial for handling the constant influx of novel copyrighted material and personal likenesses. However, existing methods typically incur significant computational costs as reference set sizes grow and may act only after the final output, leading to inefficient and delayed interventions.

EDGE-Shield: Methodological Framework

EDGE-Shield introduces an efficient and scalable denoising-stage reference-based filtering approach. It performs instance-level, training-free similarity-based matching of intermediate latents with a dynamic set of reference content, tightly coupling the following architectural choices:

• Pre-Computed and Cached Reference Embeddings: Reference images are processed through an image encoder to generate fixed-length embeddings, which are stored in a cache for fast batched similarity computation against candidate generations. This minimizes per-query overhead and enables immediate scalability to hundreds of references with negligible additional latency.
• $x$-pred Transformation for Early Violative Content Identification: By leveraging the ODE-based nature of state-of-the-art diffusion models (e.g., Z-Image-Turbo, Qwen-Image), the method applies an $x$-pred transformation to project noisy intermediate latents into pseudo-clean representations. This projection is parameterized in terms of the flow velocity predicted by the model, allowing for effective violative content detection at the earliest feasible denoising timestep, instead of incurring the full generative pass.
• Cosine Similarity-Based Classification: The candidate latent, after $x$-pred transformation and VAE decoding, is embedded and scored for similarity against all cached references. A maximum similarity score exceeding a preset threshold results in rejection of the generation due to a detected match with violative content.

This design leads to a filter that is agnostic to the exact T2I architecture, prompt formulation, and reference cardinality.

Figure 1: Overview of the EDGE-Shield workflow: cached reference embeddings, $x$-pred transformation of intermediates, and in-place similarity computation for fast violative content detection.

Quantitative and Qualitative Results

Experiments are conducted on Z-Image-Turbo and Qwen-Image, with the CPDM and HUB datasets, providing robust benchmarks for copyright, individual identity, and style-based violations. Numerical analysis demonstrates:

• Scalability: Inference-time classification latency is nearly invariant to the number of references. For Z-Image-Turbo, scaling from 10 to 140 references yields a negligible change in processing time, far outperforming classical output-based and reference-based filters that scale linearly or worse with respect to reference count.
• Latency: Compared to output-based baselines (e.g., VLM-Guided, perceptual-metric-based), EDGE-Shield reduces time-to-classification by approximately 79% in Z-Image-Turbo and 50% in Qwen-Image, intervening much earlier in the pipeline.
• Classification Accuracy: ROC-AUC and PR-AUC scores reach 0.85–0.89 on the primary datasets, aligning with or outperforming VLM-based (Qwen3-VL, LLaVaGuard) and advanced perceptual similarity models, particularly in IP and individual-identity categories.

  Figure 2: Comparison of EDGE-Shield with existing content filters, highlighting improvements in latency, scalability, and reference adaptability.

  

Figure 3: Precision-Recall curves show EDGE-Shield dominating baseline performance in high-recall, high-precision regimes.

Component Analysis

Ablation studies provide evidence for the necessity of key components:

• $x$-pred Transformation Impact: Without $x$-pred, similarity-based prediction remains flat in early denoising, failing to distinguish violations until the generative process is almost complete. $x$-pred enables high-confidence violation prediction in early steps, as shown quantitatively and via latent visualization.

Figure 4: Visualization of Z-Image-Turbo latents across denoising steps with/without $x$-pred transformation clarifies the accelerated emergence of discernible semantics.

Figure 5: Qwen-Image latent visualizations demonstrate a less aggressive but still significant benefit from $x$-pred, with effective detection improving after $T=20$.

• Encoder Choice: Substitute of the underlying image encoder (CLIP, SigLIP, SigLIP2, Qwen3VL-Embedding) shifts overall accuracy. High-performing encoders (Qwen3VL-Embedding) yield ROC-AUCs approaching 0.99 on IP/face benchmarks, while style violation detection remains more challenging due to embedding-space limitations.

Defense Against Prompt-Adversarial Evasions

EDGE-Shield is robust to prompt-engineering and circumvention attacks, as its evaluation is prompt-agnostic. When input-based filters are bypassed via roundabout phrasing, reference-based matching at the image/latent level captures semantic violations, independent of textual attributes.

Implications and Future Directions

EDGE-Shield provides a low-latency, highly scalable solution for enforcing compliance against dynamically evolving references in T2I pipelines. The primary limitation—difficulty in capturing style-based violations—stems from the inherent limitations of global feature encodings and cosine similarity. Future work could integrate learned task-specific or style-sensitive embedding spaces and hierarchical matching, extend to video generation tasks, and further optimize for massive reference sets.

Conclusion

EDGE-Shield constitutes a robust, practical advancement in violative content filtering for T2I generative models, supporting large, up-to-date reference sets with negligible latency impact and high detection fidelity, especially for IP and identity content. Its architecture provides a blueprint for future scalable and adaptable filtering solutions critical for the safe deployment of generative imaging systems (2604.06063).