Safe Few-Step Generation via Velocity Editing

As text-to-image (T2I) generation shifts toward flow matching models that require very few sampling steps, existing safety mechanisms—which typically rely on iterative trajectory steering or prompt embedding manipulation—become ineffective. The authors investigate how to enforce safety in this few-step regime without requiring model retraining or compromising the quality of benign images.

Instead of modifying the text embedding or applying cumulative trajectory corrections, the authors propose VESFlow, which directly edits the velocity field of the flow matching model. By leveraging a Bayesian decomposition of the safe-conditional posterior, the model steers the sampling trajectory toward safe outputs. To optimize performance, they introduce a risk score-based filter that identifies potentially unsafe prompts, allowing the model to bypass velocity editing for benign inputs. This enables a more aggressive variant, VESFlow+, which simultaneously pulls the trajectory toward safe regions and pushes it away from unsafe ones when a prompt is flagged as high-risk.

VESFlow and its enhanced version, VESFlow+, demonstrate significant improvements in safety compared to existing training-free baselines. On a 4-step MeanFlow model, VESFlow+ reduced the NudeNet attack success rate to 6.3% on the Ring-A-Bell dataset and 6.8% on MMA-Diffusion. Crucially, because the velocity editing becomes negligible for prompts that are already safe, the method maintains high image fidelity and alignment with benign prompts, outperforming traditional methods that often struggle with the trade-off between safety and generation quality in the few-step regime.

This research provides a practical, efficient solution for deploying safe generative models in real-world applications where computational efficiency is paramount. By shifting the focus from iterative trajectory correction to direct velocity field editing, the authors offer a robust framework that scales well to modern, high-performance T2I architectures like FLUX and SD v3, which are increasingly difficult to secure using legacy token-level or embedding-level interventions.