As text-to-image generative models advance, they raise critical safety concerns, particularly the generation of Not-Safe-For-Work (NSFW) content such as violence and nudity, further exacerbated by red-teaming adversarial attacks. Existing defenses predominantly operate under white-box assumptions, relying on text encoder optimization, weight editing, or inference-time intervention, and fundamentally cannot scale to proprietary models. Black-box alternatives based on LLM prompt rewriting offer broader applicability, yet fail in a critical regime we identify as the \textit{benign adversarial} problem: prompts that are linguistically safe but still trigger harmful generation due to the model's learned data distribution. We propose DiSCO, a zero-shot, strictly black-box defense that operates entirely at the prompt level as a plug-and-play module, requiring no model retraining, fine-tuning, or access to model internals. DiSCO performs distribution-guided suffix expansion via beam search, optimized through contrastive scoring over safe and unsafe image pools generated by the target model itself, with iterative adaptive feedback until safe content is produced. We demonstrate that DiSCO consistently enhances the safety of both undefended and defended models on the I2P benchmark under multiple red-teaming attacks, achieving 37.7% and 25.13% ASR reduction, respectively, while maintaining semantic fidelity and improving image coherence. As a black-box, architecture-agnostic module, DiSCO can be readily applied to any text-to-image system without necessitating any changes to the model itself.
Alex: Welcome to another episode of ResearchPod. Today we're looking at a safety problem in text-to-image systems — the kind of AI that turns a written description into a picture. The issue is that a prompt can look completely harmless when you read it, yet the system still produces a violent or sexual image. This paper asks whether you can stop that from happening without ever opening up the model itself.
Sam: So the challenge is that the dangerous output isn't obvious from the words alone?
Alex: Right. Text filters — tools that scan for bad words — miss the problem entirely, because the prompt can look innocent on the page. The model has learned patterns from enormous amounts of data, and sometimes a perfectly ordinary-sounding phrase lands in a part of that learned space that produces harmful images. The paper calls these "benign adversarial prompts."
Sam: That's a strange idea. How does a normal-sounding phrase cause a harmful image?
Alex: Think of it like a map. The model has a huge internal map of concepts, and every prompt drops a pin somewhere on that map. Most pins land in safe territory. But some phrases, even polite ones, drop a pin surprisingly close to unsafe zones — not because the words are bad, but because of how the model learned to connect ideas. The question is whether you can move that pin without touching the map itself.
Sam: And that's what DiSCO tries to do?
Alex: Exactly. Instead of retraining the model or editing its internals, DiSCO changes the prompt. It adds a short piece of text to the end of the original request — a few extra words — chosen specifically to nudge the model's output toward safer territory. The model itself is never touched.
Sam: But if you can't see inside the model, how do you know which extra words will help?
Alex: You use the model's own outputs as your guide. The authors first collect two sets of images: ones the model produces that are clearly safe, and ones that are clearly unsafe. Then, when a new prompt comes in, the system generates a rough image and asks a simple question: does this look more like the safe group or the unsafe group?
Sam: How do you compare images that way? They're all different pictures.
Alex: There's a technique for turning images into lists of numbers, where similar-looking images produce similar numbers and different images produce different numbers. It's like giving every picture a unique address, and addresses for similar pictures are close together in that space. DiSCO uses those addresses to measure whether a new image is drifting toward the safe neighborhood or the unsafe one.
Sam: So it's essentially using the model's own past behavior as a reference?
Alex: Precisely. That's what makes it a black-box approach — it only ever looks at what the model produces, never at the model's internal settings or weights. No retraining required. You can place it in front of a system you don't own or control.
Sam: And once it knows an image is drifting unsafe, how does it fix the prompt?
Alex: It searches for a better ending, one small piece of text at a time. A separate language model — think of it as a writing assistant — proposes candidate additions to the prompt. The system tests each one, checks whether the resulting image moves closer to the safe group, and keeps the best option. It's a bit like editing a sentence by trying different endings until the meaning lands where you want it.
Sam: Does that make the prompt weird? Like, does it add random words that make the image less accurate?
Alex: The paper found the opposite. Safety improved, and the images stayed close to what the original prompt was asking for. The suggestion is that DiSCO isn't just suppressing content — it's guiding the model toward a more faithful reading of the benign intent behind the prompt. The extra words aren't noise; they're a correction.
Sam: What did the tests actually show?
Alex: The authors report a meaningful drop in unsafe image generations across a range of different attack types and different model families. Crucially, that improvement held even when other safety measures were already in place — meaning DiSCO added something on top of existing defenses rather than simply duplicating them.
Sam: What should we be cautious about when reading those results?
Alex: The paper is careful to frame this as an empirical finding, not a guarantee. It was tested across several attack methods and several model setups, which gives the results some breadth. But it's still limited to the specific conditions the authors evaluated. No single method closes every gap, and new attack strategies could emerge that this approach hasn't been tested against.
Sam: So it's a useful tool, but not a complete solution.
Alex: That's a fair way to put it. The practical value is that it's training-free, works without access to the model's internals, and can be placed in front of systems you don't control. The broader point the paper makes is that safety doesn't always require changing the generator — sometimes you can reduce harm by steering the request itself more carefully. DiSCO is a concrete example of that idea working in practice.
Sam: That feels like a meaningful contribution, especially for anyone deploying these systems in the real world.
Alex: It is. It won't be the last word on image safety, but it offers a workable, careful approach to reducing harm from the outside while keeping the prompt's original meaning largely intact. Thanks for listening to ResearchPod.