给AI画图加个“安全滤镜”：不碰模型，只改提示词
现在的AI画图工具能画出暴力、色情内容，而且越是被“红队”攻击就越容易翻车。已有的防御要么需要改模型内部（对闭源模型没用），要么靠大语言模型改写提示词，但遇到“语言上安全、画出来却危险”的提示词就失灵了。DiSCO是个纯黑盒方案：它不碰模型，只在你输入的提示词后面自动加一串后缀，用目标模型自己生成的“安全图”和“危险图”做对比打分，反复调整直到输出安全。在I2P基准上，它能把危险生成率降低37.7%，而且不改变原图语义。它不是你明天就能用的插件，但给“既要安全又不想动模型”的闭源服务指了条路。
📄 原文摘要(英文)
As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the benign adversarial problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.