Safe Text Embedding Guidance (STG)

• STG is a training-free technique that adjusts text embeddings to steer diffusion models away from unsafe, biased content.
• It utilizes gradient-based updates and additive steering to nudge prompt embeddings into a safer semantic region during sampling.
• Empirical results show significant reductions in unsafe image outputs while preserving output quality and style diversity.

Safe Text Embedding Guidance (STG) is, in the narrow sense, a training-free approach that improves the safety of diffusion models by guiding the text embeddings during sampling, adjusting the text embeddings based on a safety function evaluated on the expected final denoised image so that the model generates safer outputs without additional training (Na et al., 28 Oct 2025). In a broader literature-level sense, the term also covers methods that intervene directly in the text-conditioning embedding of a text-to-image model so that unsafe or biased prompts are moved into a safer region of conditioning space before or during generation, while leaving the underlying generator largely unchanged (Li et al., 21 May 2025).

1. Concept and rationale

STG emerged from a specific diagnosis of failure in text-to-image safety systems. Prompt filtering only catches explicit unsafe language, but diffusion models can still produce unsafe images from benign-looking prompts; the literature repeats the example that a prompt like “a beautiful woman” may still yield nudity (Li et al., 21 May 2025). At the same time, denoiser-side concept erasure and related alignment methods often suppress unsafe generations only incompletely while also degrading outputs for benign prompts, because the diffusion module is the component that actually performs denoising and image synthesis (Hu et al., 28 Feb 2025).

The central STG intuition is therefore to move the intervention upstream, into the conditioning representation itself. Related work argues that if a well-trained text-to-image model generates unsafe content, then the unsafe semantics likely entered through the textual conditioning signal, namely the prompt embedding produced by the text encoder (Qiu et al., 2024). This reframes safety control as a geometric problem in embedding space: unsafe content is addressed not only by blocking words, but by steering the full prompt representation away from unsafe semantic directions or toward safer ones (Li et al., 21 May 2025).

This conditioning-side perspective also broadens the scope of safety beyond explicit NSFW filtering. The same machinery has been used for pornography, violence, self-harm, illegal activity, hate, harassment, and related harmful categories, as well as fairness-oriented objectives such as gender, race, and age debiasing in profession prompts (Li et al., 21 May 2025). In the narrower STG formulation, the external safety function can also target artist-style removal and bias mitigation, which makes the framework a general constraint-guided embedding-steering method rather than a single-purpose nudity filter (Na et al., 28 Oct 2025).

2. Intervention point in the generation pipeline

Across STG and closely related methods, the key intervention point is the text-conditioning interface between the text encoder and the denoiser. In the “safe region” formulation, a prompt is encoded as a prompt embedding

$P_c \in \mathbb{R}^{L \times D},$

with $L=77$ tokens and $D=768$ for Stable Diffusion v1.4, and the learned object is a direction tensor $d \in \mathbb{R}^{L \times D}$ added to the encoded prompt embedding at inference time (Li et al., 21 May 2025). In other systems, the diffusion module is frozen while either the prompt embedding is edited at inference or the text encoder alone is aligned so that unsafe prompts are mapped differently and safe prompts remain nearly unchanged (Hu et al., 28 Feb 2025).

Representative variants differ mainly in how they modify conditioning and when they do so.

Approach family	Core mechanism	Intervention point
Learned safe-direction steering	Add $d$ or $\beta d$ to prompt embedding	After CLIP encoding, before U-Net
Training-free STG	Update $c$ by safety gradient during sampling	Text embedding inside denoising loop
Embedding sanitization	Subtract toxic component from prompt embedding	After text encoder, before denoising
Encoder alignment	Fine-tune text encoder, freeze diffusion module	Text encoder itself
Subspace projection	Project toxic-relevant tokens away from toxic subspace	Text embedding space at inference

These variants share an architectural commitment: they do not primarily rely on output moderation, image blackout, or global denoiser retraining. Even SAFREE, which supplements text steering with latent-space attenuation, begins by identifying a toxic concept subspace in text embedding space and steering prompt embeddings away from that subspace at inference time (Yoon et al., 2024). The practical attraction is deployment simplicity: at minimum, inference may require only a tensor addition or a prompt-conditioned embedding update rather than full model fine-tuning (Li et al., 21 May 2025).

3. Principal formulations

One major formulation learns an additive semantic direction and defines the “safe region” implicitly rather than as an explicit polytope or convex set. In this view, safety is realized by moving the prompt embedding along a learned direction so that the transformed embedding $P_c + \beta d$ yields a denoising trajectory aligned with a safer conditional noise distribution (Li et al., 21 May 2025). The core optimization learns $d$ so that the denoiser conditioned on $c+d$ matches a toward- or away-from-concept target noise estimate:

$L=77$0

This formulation uses the frozen diffusion model itself as an implicit classifier, borrowing from classifier-free guidance logic, and for safe generation inference reduces to

$L=77$1

In the reported experiments, $L=77$2 (Li et al., 21 May 2025).

The narrower, named STG formulation replaces a fixed learned direction with a per-sample, per-timestep gradient update. Let $L=77$3 be the noisy latent and $L=77$4 the text embedding. The method estimates the expected final denoised image

$L=77$5

defines a time-dependent safety function

$L=77$6

and updates the embedding by

$L=77$7

or, in practice,

$L=77$8

The resulting score is

$L=77$9

which gives STG its characteristic form: the embedding is nudged in the direction that makes the predicted clean image safer (Na et al., 28 Oct 2025).

Other embedding-space methods instantiate the same general idea with different parameterizations. Embedding Sanitizer predicts a toxic component $D=768$0, assigns a token-wise harmfulness score $D=768$1, and subtracts a score-weighted toxic component,

$D=768$2

so that sanitized embeddings guide denoising in place of the original prompt representation (Qiu et al., 2024). SAFREE instead constructs a toxic concept subspace $D=768$3, projects token embeddings away from $D=768$4 while keeping them in the prompt’s input space, and applies the filtered embedding only for an adaptively chosen subset of denoising steps (Yoon et al., 2024).

A notable engineering refinement in the safe-direction work is the use of LoRA not to fine-tune network weights, but to parameterize the direction vector itself as $D=768$5, with $D=768$6 and $D=768$7. For Stable Diffusion v1.4 this reduces the trainable parameter count to $D=768$8, and the ablation reports I2P ratio $D=768$9, FID $d \in \mathbb{R}^{L \times D}$0, and CLIP $d \in \mathbb{R}^{L \times D}$1 for the LoRA-based vector versus I2P ratio $d \in \mathbb{R}^{L \times D}$2, FID $d \in \mathbb{R}^{L \times D}$3, and CLIP $d \in \mathbb{R}^{L \times D}$4 for a standard full-rank direction (Li et al., 21 May 2025).

4. Method families and neighboring approaches

A useful distinction is between runtime embedding guidance and offline embedding alignment. SafeText belongs to the second category: it fine-tunes the text encoder rather than the diffusion module, with the objective

$d \in \mathbb{R}^{L \times D}$5

where $d \in \mathbb{R}^{L \times D}$6 preserves safe-prompt embeddings and $d \in \mathbb{R}^{L \times D}$7 drives unsafe-prompt embeddings away from their original positions (Hu et al., 28 Feb 2025). This is highly relevant to STG because it shows that safety can be enforced in text embedding space alone, but it is not an inference-time guidance method in the usual sense.

A second distinction is between direct embedding editing and embedding-guided prompt sanitization. SafeGuider first extracts the aggregated $d \in \mathbb{R}^{L \times D}$8 representation $d \in \mathbb{R}^{L \times D}$9, uses a lightweight three-layer recognition model to classify prompt safety, and then performs a Safety-Aware Feature Erasure beam search that removes tokens so that the resulting embedding becomes safe while preserving semantic similarity to the original aggregated representation (Qi et al., 5 Oct 2025). This remains an embedding-space safety controller, but its mechanism is token-subset search rather than vector-gradient updates or geometric projection.

A third distinction concerns methods that are adjacent to STG but not literal embedding editing. SP-Guard is an inference-time safety method that estimates prompt harmfulness from denoising-direction similarities and applies a selective mask in noise-prediction space; it is therefore closer to prompt-adaptive, selective score manipulation than to safe text embedding guidance in the narrow mechanistic sense (Yu et al., 14 Nov 2025). By contrast, SAFREE is more naturally classed as training-free STG because it detects a subspace corresponding to toxic concepts in text embedding space and steers prompt embeddings away from it before denoising, then reinforces that intervention in latent space (Yoon et al., 2024).

Taken together, these methods suggest a practical taxonomy. STG in the narrow sense refers to test-time embedding updates driven by a safety function on the predicted image (Na et al., 28 Oct 2025). In a broader sense suggested by the surrounding literature, it includes additive safe-direction steering, embedding sanitization, text-encoder alignment, toxic-subspace projection, and embedding-guided prompt sanitization, provided that the main safety intervention acts on the conditioning representation consumed by the generator rather than on model weights or post hoc filters (Li et al., 21 May 2025).

5. Empirical performance and application domains

The empirical case for embedding-space safety steering is strongest in studies that compare directly against prompt filters, denoiser edits, and adversarial prompt attacks. In the safe-direction “safe region” formulation, evaluation on the I2P benchmark reports an overall inappropriate-image ratio drop from $d$0 for original Stable Diffusion to $d$1, outperforming negative prompt $d$2, SLD $d$3, ESD $d$4, IntDiff $d$5, and SPM $d$6. On adversarial Ring-A-Bell prompts, unsafe-image ratios drop from $d$7 to $d$8 for nudity and from $d$9 to $\beta d$0 for violence. The same paper reports Winobias deviation-ratio averages of $\beta d$1, $\beta d$2, $\beta d$3, and $\beta d$4 across Gender, Gender+, Race, and Race+ settings, versus $\beta d$5, $\beta d$6, $\beta d$7, and $\beta d$8 for the base model, and COCO-30K quality numbers of FID $\beta d$9 and CLIP $c$0 versus Stable Diffusion’s FID $c$1 and CLIP $c$2 (Li et al., 21 May 2025).

SafeText provides a complementary result: by aligning only the text encoder, it reaches NSFW Removal Rate values of $c$3 on Civitai-Unsafe, $c$4 on NSFW, $c$5 on I2P, and $c$6 on U-Prompt, while also reaching $c$7, $c$8, and $c$9 on SneakyPrompt, Ring-A-Bell, and MMA-Diffusion jailbreak sets. Its safe-prompt preservation numbers are LPIPS/FID $P_c + \beta d$0 on Civitai-Safe, $P_c + \beta d$1 on MS-COCO, and $P_c + \beta d$2 on Google-CC, substantially better than the diffusion-level baselines it compares against (Hu et al., 28 Feb 2025).

Embedding Sanitizer reports similarly strong robustness. On I2P it attains overall Erasure Rate $P_c + \beta d$3, and on adversarial prompts it reports an overall average ER of $P_c + \beta d$4, with SP $P_c + \beta d$5, RAB $P_c + \beta d$6, and MMA $P_c + \beta d$7. On COCO-2017 validation, it reaches CLIP $P_c + \beta d$8 and FID $P_c + \beta d$9, compared with SD-v1.4 at CLIP $d$0 and FID $d$1. The paper describes the specificity–fidelity trade-off as about $d$2 degradation versus SD-v1.4 (Qiu et al., 2024).

The named STG method extends these results to a broader set of constraints. Under the nudity-safe setting on COCO, the reported numbers are FID $d$3 and CLIP $d$4, versus base SD v1.4 at FID $d$5 and CLIP $d$6. For violence on Ring-A-Bell, STG improves Defense Success Rate on multiple backbones, including FLUX from $d$7 to as high as $d$8, SD3 from $d$9 to as high as $c+d$0, SDXL from $c+d$1 to as high as $c+d$2, and LCM from $c+d$3 to as high as $c+d$4. It also reports best or near-best artist-style removal metrics for Van Gogh and Kelly McKernan while preserving untargeted styles more effectively than several baselines (Na et al., 28 Oct 2025).

These experiments collectively support a recurring claim: safety interventions in conditioning space generalize better to implicit, euphemistic, and adversarial prompts than word-level filters that depend on enumerating dangerous tokens (Li et al., 21 May 2025). They also show broad compatibility. Safe-direction vectors can be added on top of SLD, ESD, SDXL, and SD3, improving I2P performance, while training-free STG is evaluated on Stable Diffusion v1.4, SDXL, SD3, FLUX, PixArt-$c+d$5, and LCM with several samplers (Li et al., 21 May 2025).

6. Limitations, misconceptions, and dual-use implications

A persistent misconception is that embedding-space safety implies a formally defined safe subspace or a universal robustness guarantee. The “safe region” in the safe-direction literature is explicitly not defined as an explicit geometric polytope or convex set with a closed-form boundary; it is an operational notion induced by a learned translational direction in embedding space (Li et al., 21 May 2025). More generally, these methods remain approximate. Named STG depends on a first-order Taylor analysis, on the approximation $c+d$6, and on a Tweedie-style estimate of the expected final denoised image, so its theory is an alignment-style interpretation rather than a hard guarantee that every generated image will be safe (Na et al., 28 Oct 2025).

A second limitation is scope. SafeText is evaluated mainly on sexual and nudity-related unsafe content, and the paper explicitly notes future work on stronger jailbreak attacks and further utility improvements (Hu et al., 28 Feb 2025). SAFREE acknowledges limitations when toxic prompts become much more implicit and in a chain-of-thought style, and states that such prompts can still jailbreak the method (Yoon et al., 2024). Embedding Sanitizer also depends on selected target-anchor concept pairs and a global sanitization strength $c+d$7, which limits fine-grained per-concept control (Qiu et al., 2024).

A third limitation is operational cost and trade-off tuning. Training-free STG requires gradient computation through the denoiser to the text embedding, increasing both runtime and memory; for batch size 4 in FP16, the paper reports Base $c+d$8 s and $c+d$9 GB versus STG $L=77$00 s and $L=77$01 GB, with a reduced-cost setting at $L=77$02 s and $L=77$03 GB (Na et al., 28 Oct 2025). Other methods expose different tuning knobs—$L=77$04 for additive direction strength, $L=77$05 for safety–utility balance, $L=77$06 and $L=77$07 for sanitization strength, $L=77$08 for update ratio or adaptive scheduling—and the ablations consistently show the expected pattern: stronger steering improves safety but increases semantic drift or image degradation (Li et al., 21 May 2025).

Finally, STG is dual-use. An embedding-guided red-teaming paper on typographic prompt injection in vision-LLMs shows that multimodal embedding distance strongly predicts attack success rate, with $L=77$09 to $L=77$10 and $L=77$11, and then directly maximizes image-text embedding similarity under bounded $L=77$12 perturbations to stress-test safety (Balakrishnan et al., 28 Apr 2026). The same study argues that optimization can recover readability and reduce safety-aligned refusals as two co-occurring effects, and reports cases where bounded perturbations reduce refusal rates without improving visual legibility (Balakrishnan et al., 28 Apr 2026). This suggests that embedding guidance is not safety-neutral: the same representational leverage that allows conditioning-side safety control can also be weaponized as a jailbreak mechanism if the objective is misaligned.

In that sense, STG is best understood not as a single algorithm but as a research program organized around a common intervention site: the text-conditioning representation. Its most mature forms either learn or optimize directions in embedding space that steer generation away from unsafe concepts, while its neighboring methods show that the same embedding-space geometry can support encoder alignment, token-aware sanitization, toxic-subspace projection, prompt-adaptive control, and adversarial stress testing (Na et al., 28 Oct 2025).