FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decoding

Abstract: Diffusion-based image generation models have advanced rapidly but pose a safety risk due to their potential to generate Not-Safe-For-Work (NSFW) content. Existing NSFW detection methods mainly operate either before or after image generation. Pre-generation methods rely on text prompts and struggle with the gap between prompt safety and image safety. Post-generation methods apply classifiers to final outputs, but they are poorly suited to intermediate noisy images. To address this, we introduce FlowGuard, a cross-model in-generation detection framework that inspects intermediate denoising steps. This is particularly challenging in latent diffusion, where early-stage noise obscures visual signals. FlowGuard employs a novel linear approximation for latent decoding and leverages a curriculum learning approach to stabilize training. By detecting unsafe content early, FlowGuard reduces unnecessary diffusion steps to cut computational costs. Our cross-model benchmark spanning nine diffusion-based backbones shows the effectiveness of FlowGuard for in-generation NSFW detection in both in-distribution and out-of-distribution settings, outperforming existing methods by over 30% in F1 score while delivering transformative efficiency gains, including slashing peak GPU memory demand by over 97% and projection time from 8.1 seconds to 0.2 seconds compared to standard VAE decoding.

• The paper introduces a unified NSFW detection framework using a lightweight linear latent decoder that cuts inference time and GPU usage by over 97%.
• It applies a fixed Fourier low-pass filter and a staged curriculum learning approach to enhance robustness during early denoising stages.
• Experimental results show significant F1 score improvements of 30–35 percentage points across both in-distribution and out-of-distribution diffusion generators.

Lightweight In-Generation NSFW Detection for Diffusion Models: An Analysis of FlowGuard

Introduction

Not-Safe-For-Work (NSFW) content detection within text-to-image (T2I) diffusion models remains a critical challenge as these models are increasingly deployed in real-world generative systems. Pre- and post-generation safety paradigms exhibit fundamental limitations: prompt filtering is easily subverted due to semantic drift between text and imagery, while post-generation moderation incurs full generation costs and is unable to intervene early (Figure 1).

Figure 1: Comparison of NSFW detection paradigms for T2I generation. Existing methods either rely on prompt-level filtering or detect unsafe content after the final image is generated. In-generation approaches enable earlier intervention.

Efficient and robust in-generation detection (IGD) is required to intercept unsafe outputs while minimizing resource utilization and enabling scalable deployment across heterogeneous diffusion backbones. FlowGuard ("FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decoding" (2604.07879)) formalizes the problem of unified cross-model IGD and introduces a computationally efficient, architecturally agnostic framework for early NSFW detection during the diffusion process.

FlowGuard: Method and Design

FlowGuard leverages three central design elements to overcome the coupled challenges of model-specific latent heterogeneity and severe stochastic noise in early denoising stages. The overall framework is depicted in Figure 2.

Figure 2: Overview of the FlowGuard framework. (1) Linear Approximation replaces heavy VAE decoding with a lightweight projection layer for early-stage visual reconstruction. (2) The Training Pipeline utilizes a Low-Pass Filter (LPF) and a noise-progressive Curriculum Arrangement to enhance detector robustness. (3) During Deployment, the unified detector intercepts unsafe trajectories across diverse T2I models, skipping final decoding for flagged content to significantly reduce latency and memory overhead.

Linear Approximation Decoder

Instead of full nonlinear Variational Autoencoder (VAE) decoding, which is computationally expensive for intermediate latents, FlowGuard learns a lightweight linear projection layer per model backbone. This layer is trained on matched latent-image pairs and rapidly reconstructs approximate RGB images from diffusion latents at a coarse spatial resolution (128×128). Empirical results demonstrate that this linear approximation preserves core semantic structure while incurring a negligible computational footprint compared to standard VAE decoding; at batch sizes of 50, inference time and peak GPU memory are reduced by over 97% (Figure 3).

Figure 3: Qualitative comparison between images reconstructed by the VAE decoder and our Linear decoder across various T2I models. As illustrated, the images generated by the Linear decoder are rendered at a smaller resolution and exhibit a color discrepancy and increased blurring compared to the VAE ground truth. However, while these outputs sacrifice fine-grained aesthetic details, the semantic integrity and critical features remain distinguishable.

Frequency-Domain Noise Suppression

Semantic separability of early latent reconstructions is severely hampered by diffusion-induced Gaussian noise. FlowGuard applies a fixed Fourier low-pass filter (LPF) to suppress high-frequency artifacts, preserving only the global semantic cues most predictive of NSFW concepts. Ablation studies (Figure 4) validate that the addition of LPF markedly improves accuracy and F1, especially at early denoising stages.

Staged Curriculum Learning

Training a safety detector directly on severely noisy reconstructions leads to instability and overfitting to spurious artifacts. FlowGuard employs a curriculum learning schedule, gradually shifting the classifier training distribution from clean/later-stage images to earlier, noisier samples. A temporal consistency loss is used to further regularize predictions across steps of the same trajectory.

Figure 4: Ablation studies on the proposed components. The top row illustrates the impact of LPF cutoff-ratio ($r$) on performance, while the bottom row compares the full FlowGuard model against a baseline without curriculum learning (w/o CL).

Training and Deployment Protocol

A shared, backbone-agnostic NSFW classifier (ViT-B/16) is trained on the LPF-filtered, linearly decoded reconstructions from multiple in-distribution (ID) diffusion backbones, supported by a curated cross-model dataset. For new out-of-distribution (OOD) models, only the linear decoder is adapted—no OOD safety labels are required and the classifier is frozen, making adaptation efficient (sub-minute on a GPU). At inference, early-exit is triggered if the maximum NSFW probability across inspected early denoising steps exceeds a threshold, skipping expensive final image synthesis for unsafe content.

Experimental Results

Benchmarking and Cross-Model Generalization

Experiments are conducted on a comprehensive benchmark comprising nine SOTA diffusion generators spanning multiple architecture families (Flux, PixArt, Qwen-Image, Stable Diffusion, Zimage). The ID set comprises five generators; OOD evaluation is on four held-out backbones. Regardless of generator seen/unseen status, final safety ground truth is derived from high-fidelity ultimate outputs, not noisy intermediates.

Table 1 (paper) summarizes the overall results measured at an early denoising step (20/50). FlowGuard yields 30–35 percentage point gains in F1 relative to strong baselines (Falconsai, LlavaGuard-7B, Qwen3-VL-8B-Instruct) for both ID and OOD settings. All baselines—including large multimodal models—exhibit near-chance F1 on the noisy intermediate samples, confirming their lack of robustness in the presence of diffusion noise and architectural variation.

Early-Step and Stepwise Robustness

Detection accuracy as a function of denoising step (Figure 5) demonstrates that FlowGuard is uniquely robust throughout the entire trajectory—even when other approaches degrade precipitously at early steps ($<$30), where noise dominates. This is critical for efficiently terminating hazardous sampling at the earliest feasible point, removing computational burden and minimizing exposure risk.

Figure 5: Detection accuracy at different denoising steps. The plots evaluate our method against three baselines across diverse architectures. Our approach (red) consistently achieves superior accuracy, particularly in the early-stage denoising regime (steps 10–30), which enables more efficient and robust early-stage safety intervention.

Computational Efficiency

A head-to-head comparison of inference latency and memory usage (Figure 3) confirms that the linear decoder brings orders-of-magnitude improvement over VAE decoding, scaling to large batch sizes and supporting integration into multi-backbone serving stacks.

Theoretical and Practical Implications

FlowGuard advances the field on several axes:

• Scalability and Deployment: Unified, decoder-adapted IGD eliminates the need for niche, model-specific detectors, facilitating rapid onboarding of new diffusion architectures.
• Resource Allocation: By intervening before final image formation, FlowGuard conserves significant computational resources (GPU time, memory) and can be feasibly deployed at cloud edge or in streaming fashion.
• Architecture-Agnosticity and Robustness: The separation of linear decoder adaptation (cheap, data-efficient) from safety detection (cross-model transfer) enables robust operation even as the generative backbone landscape evolves.
• Early-Stage Safety Assurance: FlowGuard’s robustness to heavy denoising noise offers an additional layer of defense against adversarial prompting or emergent failures missed by prompt or posthoc filters.
• Dataset and Benchmarking: The accompanying benchmark provides a shared testbed for evaluating IGD approaches, an essential step for rigorous progress in safety research.

Limitations and Future Directions

The current curriculum regime is static and hand-tuned; adaptive or self-paced curriculum learning could further enhance robustness. Subjective ambiguity in NSFW annotation (especially near category boundaries) persists and may warrant the development of calibrated multilabel or uncertainty-aware detectors. Finally, direct comparison with some recent architecture-specific IGD methods is limited due to lack of reproducible implementations or released data; future work is needed for full empirical resolution.

Conclusion

FlowGuard represents a principled and highly efficient cross-model in-generation NSFW detection framework for diffusion models. By combining model-specific linear latent decoding, frequency-domain denoising, and staged curriculum learning, FlowGuard delivers robust safety assurance with minimal overhead and sets a new standard for scale-agnostic, early-intervention safety in generative AI. These results establish a strong foundation for further research into proactive, architecture-neutral, and context-aware safety controls in both image and multimodal generation.