SafeCtrl: Region-Aware Diffusion Safety

• SafeCtrl is a region-aware safety framework that detects localized unsafe regions using attention-guided analysis in diffusion models.
• It employs a detect-then-suppress paradigm with image-level direct preference optimization to neutralize harmful content without altering the entire image.
• The framework achieves an improved safety–fidelity balance and robustness against adversarial prompts with lower computational overhead compared to global methods.

SafeCtrl is a region-aware safety control framework for text-to-image diffusion models that operates on a Detect-Then-Suppress paradigm. It is designed to mitigate visually harmful content—including nudity, violence, and horror imagery—while preserving surrounding context, identity, and artistic intent. In the formulation reported for Stable Diffusion v2.1, SafeCtrl keeps the base U-Net frozen, first localizes risk regions through attention-guided analysis of internal visual features, and then applies localized suppression only inside the detected mask, with the suppressor trained in latent space by image-level Direct Preference Optimization (DPO). The central claim is that this decoupling of localization and suppression improves the safety–fidelity trade-off and strengthens resilience to adversarial prompt obfuscation relative to global interventions and prompt-side filtering (Zhang et al., 5 Apr 2026).

1. Problem setting and design rationale

Text-to-image diffusion models trained on web-scale data can generate harmful outputs such as explicit anatomy, weapons and blood, or horror entities including ghosts, zombies, and monsters. In the SafeCtrl formulation, the safety problem is not treated solely as a prompt moderation problem. Instead, it is posed as a conflict between two requirements: reducing unsafe content and preserving the safe parts of the image. Existing interventions are described as suffering from two recurrent weaknesses. Input filtering blocks prompts with unsafe keywords but is fragile under leetspeak, obfuscation, synonyms, and zero-width characters. Global concept erasure, whether implemented by fine-tuning or inference-time guidance, suppresses unsafe semantics across the whole image and often damages unrelated background, composition, and identity; it also remains vulnerable to adversarial prompts because it relies heavily on text conditioning (Zhang et al., 5 Apr 2026).

SafeCtrl is proposed specifically to break that coupling. Its underlying premise is that unsafe content in an image is frequently spatially localized, whereas the surrounding composition is benign and should remain unchanged. This motivates a region-aware formulation in which risk localization is separated from semantic suppression. The framework therefore anchors detection on internal visual features—cross-attention and self-attention inside the frozen U-Net—rather than relying on explicit prompt semantics alone. This design is intended to preserve context outside the unsafe region and to remain effective when textual cues are obfuscated.

The method targets three risk categories in the reported experiments: nudity, violence, and horror. The paper’s examples emphasize localized transformations rather than whole-image edits: explicit anatomy is removed while scene elements remain intact; guns and knives are transformed into safe alternatives while hands and backgrounds are preserved; ghosts, zombies, and monsters are turned into benign entities without changing the overall composition (Zhang et al., 5 Apr 2026).

2. Detect-Then-Suppress architecture

The pipeline is implemented on a frozen Stable Diffusion v2.1 U-Net. During an early detection window $[T_{\mathrm{start}}, T_{\mathrm{switch}}]$, SafeCtrl extracts attention-derived signals and accumulates a spatial risk mask $M$. From $T_{\mathrm{switch}}$ to the end of denoising, a suppression module is activated only if risk has been detected; it edits latent features only within the mask and leaves the rest of the feature field untouched (Zhang et al., 5 Apr 2026).

The key architectural property is masked fusion. If $V_{\mathrm{orig}}$ denotes the original frozen U-Net feature and $V_{\mathrm{safe}}$ the safety-adjusted feature, SafeCtrl uses

$$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$

This implies exact equality to the frozen model outside $M$. In contrast to global suppression, the framework therefore preserves background and unrelated objects by construction.

Dynamic scheduling is another defining element. Detection is concentrated early, when semantic structure stabilizes, while suppression is delayed to later denoising steps. The reported analysis states that detection quality increases as the timestep decreases from $1000 \to 0$, with the most stable masks appearing in the range $t \in [600, 800]$ and with $T_{\mathrm{start}} \approx 700$ on a $M$0-step scale. This scheduling is presented as a way to reduce overhead and avoid editing on excessively noisy or already-solidified structures (Zhang et al., 5 Apr 2026).

The inference loop uses DDIM with $M$1 steps. For each timestep, detection is run only if $M$2; suppression is run only if $M$3 and the accumulated mask is non-empty. Otherwise, the system falls back to the frozen U-Net with no modification.

3. Attention-guided risk localization

The Detect module uses intermediate U-Net features $M$4 and combines cross-attention, which aligns image regions with text tokens, with self-attention, which captures object structure. The reported formulation defines

$M$5

and

$M$6

Here $M$7 is the prompt embedding and $M$8 is the attention-head scaling term (Zhang et al., 5 Apr 2026).

The two attention maps are fused to produce a spatial activation. At a single timestep, the paper writes

$M$9

and across timesteps and layers,

$T_{\mathrm{switch}}$0

This fusion is intended to combine semantic alignment with structural coherence. The threshold $T_{\mathrm{switch}}$1 determines the mask’s coverage: higher $T_{\mathrm{switch}}$2 reduces false positives but can miss faint regions, while lower $T_{\mathrm{switch}}$3 increases coverage at the risk of spillover.

The detector is trained with few-shot supervision, using approximately $T_{\mathrm{switch}}$4 pixel-annotated images per concept. The reported loss combines Dice and $T_{\mathrm{switch}}$5 terms:

$T_{\mathrm{switch}}$6

This pretraining reuses the frozen U-Net’s attention and does not duplicate the U-Net. The inference-time detector is also explicitly described as not relying on CLIP or external classifiers (Zhang et al., 5 Apr 2026).

Localization performance is reported in a $T_{\mathrm{switch}}$7-shot setting on Pascal-Car, CelebA-HQ, and Pascal-Horse. The average mIoU is $T_{\mathrm{switch}}$8 for SafeCtrl, compared with $T_{\mathrm{switch}}$9 for CR, $V_{\mathrm{orig}}$0 for SLiMe, and $V_{\mathrm{orig}}$1 for ReGAN. Although these datasets are proxy segmentation tasks rather than the safety benchmark itself, the result is used to support the claim that attention-guided localization is sufficiently precise for region-restricted intervention.

4. Localized suppression and image-level DPO

Once a non-empty mask is detected, the Suppress module modifies latent features only within the risky region. The objective is not hard concept replacement. Instead, the module learns to neutralize harmful semantics while permitting the frozen model’s generative prior to resolve the region into a safe alternative. The paper emphasizes that this avoids “hard replacement tokens” and does not require pixel-level supervision for the suppression stage (Zhang et al., 5 Apr 2026).

Suppression is trained with image-level Direct Preference Optimization in latent space. Preference pairs are produced by GPT-4 prompt synthesis: unsafe and safe prompt counterparts are generated, then Stable Diffusion outputs are used to form tuples $V_{\mathrm{orig}}$2, where $V_{\mathrm{orig}}$3 is the safe-preferred image and $V_{\mathrm{orig}}$4 is the unsafe or baseline image. The implicit reward is defined through denoising error relative to a reference model:

$V_{\mathrm{orig}}$5

The latent DPO loss is

$V_{\mathrm{orig}}$6

The temperature $V_{\mathrm{orig}}$7 controls the preference margin (Zhang et al., 5 Apr 2026).

The training data for suppression consists of approximately $V_{\mathrm{orig}}$8 image-level preference pairs. Because fusion is hard-masked, background features remain frozen outside $V_{\mathrm{orig}}$9, and the paper argues that this provides an implicit regularizer for fidelity. A plausible implication is that the model does not need an explicit background-preservation loss: preservation is enforced structurally by the feature fusion rule.

The qualitative examples reported for this stage illustrate the intended behavior. For the prompt “A bare man in a mountain valley under a vivid sunset,” baseline Stable Diffusion generates unsafe nudity, while global fine-tuning can alter the background, lighting, and identity. SafeCtrl instead detects the nudity region and suppresses it locally, preserving the sunset, valley, composition, and identity cues. Similar examples are given for violence and horror, where localized regions are transformed into toy-like or benign entities while the larger scene remains unchanged (Zhang et al., 5 Apr 2026).

5. Evaluation, robustness, and efficiency

The evaluation protocol uses three benchmarks. I2P measures inappropriateness ratio $V_{\mathrm{safe}}$0 using detection classifiers including NudeNet and Q16. COCO-30k measures fidelity using FID and CLIP similarity. Ring-A-Bell measures adversarial prompt robustness through Unsafe Ratio or Attack Success Rate. The paper defines Safety Score as $V_{\mathrm{safe}}$1, utility as a min-max normalization of FID and CLIP,

$V_{\mathrm{safe}}$2

and the harmonic trade-off score

$V_{\mathrm{safe}}$3

This H-Score is used to summarize the safety–fidelity balance (Zhang et al., 5 Apr 2026).

The reported quantitative results place SafeCtrl at the lowest overall Unsafe Ratio on I2P and the highest H-Score among the listed baselines. The main comparison figures are as follows.

Metric	SafeCtrl	Context
Unsafe Ratio on I2P	0.11	Best among reported methods
FID on COCO-30k	15.03	Close to original SD at 14.30
CLIP on COCO-30k	0.2616	Close to original SD at 0.2626
H-Score	0.906	Best reported
Avg. mIoU	72.0	10-shot localization
Added parameters	~75M	CR uses ~860M
Latency	11.77s	Original SD 10.63s; CR 12.70s

On I2P, the paper reports Unsafe Ratios of $V_{\mathrm{safe}}$4 for original Stable Diffusion, $V_{\mathrm{safe}}$5 for SLD, $V_{\mathrm{safe}}$6 for ESD, $V_{\mathrm{safe}}$7 for SPM, $V_{\mathrm{safe}}$8 for AlignGuard, $V_{\mathrm{safe}}$9 for RDM, $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$0 for CR, and $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$1 for SafeCtrl. On COCO-30k, SafeCtrl reaches FID $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$2 and CLIP $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$3, compared with original Stable Diffusion at FID $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$4 and CLIP $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$5. The corresponding H-Score is $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$6 for SafeCtrl, compared with $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$7 for RDM, $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$8 for CR, $$V_{\mathrm{new}} = V_{\mathrm{orig}} \odot (1 - M) + V_{\mathrm{safe}} \odot M.$$9 for original SD, and $M$0 for AlignGuard (Zhang et al., 5 Apr 2026).

Adversarial robustness is evaluated on Ring-A-Bell with prompt perturbations including leetspeak, synonyms, token obfuscation, and zero-width characters. The reported Unsafe Ratios are $M$1 for original SD, $M$2 for SLD, $M$3 for ESD, $M$4 for SPM, $M$5 for AlignGuard, $M$6 for RDM, $M$7 for CR, and $M$8 for SafeCtrl. This places SafeCtrl close to CR in robustness while using far fewer added parameters and lower latency. The paper attributes this behavior to visual-feature anchoring rather than text-dependent filtering.

Efficiency is framed as another consequence of the architecture. SafeCtrl adds approximately $M$9M parameters, compared with approximately $1000 \to 0$0M for Concept Replacer, and incurs latency of $1000 \to 0$1s versus $1000 \to 0$2s for CR and $1000 \to 0$3s for original SD. The framework therefore claims substantially lower overhead than prior localized editing methods because it does not duplicate the U-Net and restricts detection to an early timestep window (Zhang et al., 5 Apr 2026).

6. Ablations, limitations, and practical significance

The ablation studies emphasize three design choices. First, dynamic scheduling matters: localization accuracy improves later in denoising, especially around $1000 \to 0$4, and suppression should begin only after masks stabilize. Second, fusion of cross-attention and self-attention improves boundary precision relative to either source alone. Third, hard fusion is central to context preservation because it guarantees exact recovery of the frozen U-Net features outside $1000 \to 0$5 (Zhang et al., 5 Apr 2026).

Several failure modes are explicitly noted. Very small or heavily occluded risk regions may evade detection. Ambiguous prompts can yield diffuse attention and therefore soft or imprecise masks, making threshold tuning critical. Categories beyond localized visual risk—such as subtle psychological horror or symbolic violence—may require additional detectors. The paper also notes an ethical risk of over-censorship or bias if the few-shot masks encode narrow definitions of unsafe content.

From an implementation perspective, the reported recipe is modular. One hooks into the cross-attention blocks of the Stable Diffusion v2.1 U-Net, extracts cross-attention and self-attention during early timesteps, forms the mask $1000 \to 0$6 through normalized fusion and thresholding, and then applies the Suppress module through masked feature replacement. Detect is trained with Dice+$1000 \to 0$7 on approximately $1000 \to 0$8 annotated samples per category; Suppress is trained with latent DPO on approximately $1000 \to 0$9 preference pairs. The scheduler in the reported experiments is DDIM with $t \in [600, 800]$0 steps. Guidance scales and classifier-free guidance are not specified. Integration with SDXL is described as conceptually similar, but no SDXL-specific results are reported.

Taken together, the framework positions region-aware suppression as an alternative to both prompt-side filtering and global model editing. Its central contribution is not merely a new safety head, but a specific decomposition of the safety problem into visual localization and local semantic neutralization. This suggests a broader methodological point: in diffusion safety, spatial selectivity can function as a structural regularizer for fidelity, and image-level preference optimization can be sufficient to train region-restricted interventions when the masking mechanism itself is reliable (Zhang et al., 5 Apr 2026).