The research, led by Qiqi Bao and Jiaoling Li of Zhejiang University of Science and Technology together with colleagues at Harbin Institute of Technology Shenzhen, Zhejiang University, and Université Paris Cité, demonstrates that concepts which appear thoroughly erased under standard text-based testing can reappear with alarming ease once the model is combined with the structural control tools that define modern image generation. The team calls the attack Structure-Guided Concept Reappearance, or SGCR, and its central insight is deceptively simple: safety evaluations focus almost exclusively on the text pathway, while real-world diffusion systems increasingly generate images through a second, non-textual route that defenses never touch.

To understand why this matters, it helps to look at how contemporary diffusion pipelines actually work. A latent diffusion model consists of an encoder that compresses images into a compact latent representation, a decoder that reconstructs them, and a denoising network that gradually transforms random noise into a coherent image. Text prompts influence this process mainly through cross-attention modules that bind semantic content to spatial locations. Concept erasure methods, whether they edit model weights as ESD, UCE, MACE, and TRCE do, or intervene at inference time as Negative Prompting, Safe Latent Diffusion, and AdaVD do, all share the same underlying objective: they weaken the association between a textual trigger and its corresponding visual concept. The implicit assumption has always been that if the text route is blocked, the concept is effectively gone.

That assumption collapses when a structural controller enters the picture. Tools such as ControlNet have made it routine for users to steer generation with Canny edge maps, depth maps, or semantic segmentation maps derived from reference images, all without modifying the backbone model. These structural representations discard color, texture, and most appearance information, which is precisely why they were assumed to be semantically inert. The researchers show otherwise. Using a zero-shot CLIP probe, they demonstrated that edge, depth, and segmentation maps extracted from target-concept reference images retain enough category-related geometry, spatial layout, and instance-specific cues to reliably distinguish target conditions from benign ones. A line drawing stripped of every pixel of explicit content still carries the silhouette of what it depicts.

The SGCR attack exploits this residual information under a deliberately practical grey-box threat model. The attacker needs no access to training data, no gradients from the defended model, and no ability to modify its parameters. Instead, the attacker simply knows the deployed backbone-controller configuration, supplies a completely benign text prompt containing no target semantics, and attaches a pre-trained structural controller fed with a condition extracted from a publicly available reference image of the target concept. The controller injects geometry-consistent residual features into the U-Net through zero-convolution connections, and these structurally modulated representations are progressively integrated across downstream blocks during denoising, steering the latent trajectory toward spatial configurations that conform to the supplied scaffold.

The experimental results are stark. Across twelve target concepts spanning explicit content from the I2P benchmark, copyrighted artistic styles including Van Gogh, Picasso, and Kelly McKernan, and generic objects drawn from CIFAR-10, SGCR markedly increased attack success rates against representative defenses from all three major paradigms. MACE, which reduced the text-only attack success rate for nudity to zero percent, saw that figure climb to 72 percent under Canny guidance, while its success rate on Picasso reached a full 100 percent. UCE’s nudity rate rose from 22 to 49 percent, and its Cat success rate jumped from 2 to 74 percent. Notably, the Fréchet Inception Distance of MACE’s nudity outputs fell from 48.61 to 7.37, meaning the attacked images were not degraded artifacts but high-quality generations closely matching the original model’s output distribution.

The team went to considerable lengths to rule out alternative explanations. In a controlled prompt-structure analysis with seven distinct conditions, they showed that adding target-consistent structure while holding the text fixed raised success rates by 20 to 51 percentage points across all eight models tested, whereas pairing the benign prompt with a non-target human structure produced far weaker effects. This establishes that the reappearance is driven by the semantic content of the structural condition itself, not merely by the activation of a controller. They also found that exact prompt-reference pairing was unnecessary: cyclically shifting target-category structures across prompts yielded statistically indistinguishable results, indicating category-level transfer across reference instances. A multi-reference, multi-seed extension covering three concepts and four defenses confirmed that the behavior persists across 100 distinct reference images and three random seeds, with success rates ranging from 58 to 84.3 percent.

Mechanistic probes added further texture to the picture. When the researchers replaced attention maps with those from paired benign generations, swapping self-attention produced larger drops in attack success than swapping cross-attention, suggesting that image-side feature interactions play a greater role than the text-conditioning pathway in propagating structural information. Activation-energy visualizations showed self-attention responses aligning with the supplied structural contours even as text-related cross-attention remained weak, and intermediate denoising trajectories revealed target-consistent spatial organization emerging progressively in the mid-to-late sampling stages. An ablation over guidance strength found the attack most effective in an intermediate range around a scale of 1.0, with effects saturating beyond that point. The authors are careful to frame all of this as a system-level property of the composed backbone-controller pipeline rather than proof that the erased backbone secretly harbors the concept in a single recoverable module.

The practical implications are scoped precisely but seriously. The demonstrated threat applies to local modular systems and to services that expose compatible structural-control interfaces, not to closed text-only APIs, since an attacker must be able to attach a controller and supply a structural condition. Within that scope, the consequences extend beyond regenerating a single reference image: structural conditions can be reused with different benign prompts and seeds to produce endless target-consistent variants, potentially defeating exact-match and duplicate-detection safeguards. The authors propose three directions for future work: evaluation protocols that include controller-augmented generation, defenses that jointly suppress text-conditioned generation, image-side feature interactions, and attached controllers, and safety alignment studied at the system level. The parallel they draw is instructive: just as visual inputs have jailbroken aligned large language models, multimodal deployments of diffusion models can expose gaps that no text-focused evaluation will ever catch. For an industry racing to certify the safety of generative systems, the message is uncomfortable but clear: erasing a concept from what a model hears does not mean erasing it from what a model can be shown.

Subject of Research: Evasion attacks on concept erasure safeguards in text-to-image diffusion models using structural conditioning

Article Title: Evasion attacks on generative safeguards: target-concept reappearance under structural control in grey-box settings

Article References: Bao, Q., Li, J., Zhang, Y., Qian, Y., Gu, Z., Ji, S., Wang, B., & Naït-Abdesselam, F. (2026). Evasion attacks on generative safeguards: target-concept reappearance under structural control in grey-box settings. Cybersecurity, 9(1), Article 227. https://doi.org/10.1186/s42400-026-00664-6

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00664-6

Keywords: diffusion models, concept erasure, AI safety, ControlNet, adversarial attacks, text-to-image generation, structural conditioning, machine unlearning, cybersecurity, generative AI, grey-box attack, model robustness

The core insight behind MIGF is that different sources of information are not equally reliable for every image. A sketch may pin down geometry precisely while saying almost nothing about color or texture; a reference photograph may be rich in visual detail yet contain elements irrelevant to the desired output. Most existing systems handle this by simply concatenating all the condition features or by applying a fixed set of learned weights that treat every input identically. MIGF’s Adaptive Condition Fusion module takes a different approach: it predicts, for each individual input, a normalized weight vector that determines how much each modality should contribute. The features are first contextualized through a self-attention operation, so the weight assigned to one condition can depend on what the other conditions already provide, and a lightweight gating network then produces the final modality weights that are injected into the denoising network through cross-attention.

This design has a practical consequence that the authors demonstrate directly. When a text prompt and a reference image already carry sufficient information, the framework can automatically down-weight a sparse or redundant sketch, rather than letting noisy structural cues corrupt the result. In a controlled comparison where only the fusion strategy was swapped while the backbone, training data and inference settings were held fixed, ACF outperformed naive concatenation, static weighted averaging and FiLM-style feature modulation on every metric measured, including image quality, semantic alignment and control precision. The authors are careful to note that the Softmax-based weighting bounds the fused feature norm, which helps explain the numerical stability of the mechanism, though they stop short of claiming it as a formal convergence guarantee.

The second pillar of the framework addresses a long-standing desire among digital artists: independent control over what an image shows versus how it looks. The Semantic Decoupling Module organizes the latent representation into two subspaces, one carrying content-related information such as structure and semantics, the other carrying style-related attributes such as appearance and tone. Training relies on contrastive supervision: images sharing the same content but rendered in different styles are treated as positive pairs in the content subspace, while semantically different samples serve as negatives, with an analogous objective for the style branch. Importantly, the authors frame this as practical separability rather than mathematically strict disentanglement, acknowledging that the two subspaces are encouraged to capture complementary factors without any hard independence constraint.

The third component, the Interactive Feedback Mechanism, is what turns the system from a one-shot generator into a genuine creative collaborator. Users can perform local modifications by selecting a region and providing a text instruction, adjust attributes such as style strength or color tone through a scalar control, or supply an additional reference image as guidance. Rather than treating each of these as a separate editing system, IFM converts all feedback into conditional signals compatible with the existing pipeline. A masked region is regenerated during subsequent denoising steps while the rest of the image is preserved, and the updated condition is blended into the original with a strength coefficient. This progressive adjustment strategy means successive user operations refine an existing result instead of restarting from an unrelated random sample, which is precisely the workflow designers and illustrators actually want.

To train and evaluate the framework, the team assembled a multimodal dataset of 50,000 high-resolution images spanning natural scenes, artistic works, design patterns and architecture, each accompanied by text descriptions, semantic annotations and structural information. Twelve trained annotators with design or computer vision backgrounds produced the labels under a unified protocol, with every sample reviewed by at least two annotators and disagreements adjudicated by senior reviewers. Inter-annotator agreement ranged from 0.79 to 0.86 across annotation types, indicating reasonably consistent labeling quality. Images were standardized at 512 by 512 pixels, with text descriptions averaging 24 words, and the data were split 8:1:1 into training, validation and test sets.

The headline numbers are striking. Under matched evaluation settings against ControlNet, the strongest self-run baseline, MIGF reduced the Fréchet Inception Distance, a measure of how closely generated images match the real distribution, by 23.7 percent, from 14.26 to 10.88. The CLIP Score, which quantifies text-image semantic consistency, improved by 18.6 percent, and the perceptual LPIPS metric dropped by 12.7 percent. Ablation experiments confirmed that each component contributes: adding ACF to the baseline cut FID from 16.42 to 13.75, adding SDM brought it to 12.19, and the full framework reached 10.88 with a CLIP Score of 35.7. When text, image and sketch conditions were combined, the framework achieved a Control Precision of 0.876, roughly an 11.9 percent improvement over the strongest single-modality configuration, sketch-only generation at 0.783.

The authors also took steps to guard against overclaiming. Comparisons were repeated across three random seeds with small standard deviations, and a zero-shot evaluation on 30,000 MS-COCO captions showed that the improvements transfer beyond the in-house data distribution, with MIGF achieving an FID-30K of 9.84. Results for closed-source systems such as DALL-E 2 and Imagen are reported only as contextual references, since identical inference conditions cannot be reproduced for them. Robustness testing revealed a nuanced picture: removing the reference image mainly hurt appearance quality, while degrading the sketch disproportionately damaged structural control, and simultaneous corruption of multiple conditions produced the largest performance drop, with FID rising to 12.71 and Control Precision falling to 0.792.

Speed matters for real creative work, and here the framework offers two operating points. The standard configuration uses 50 DDIM sampling steps and takes 4.3 seconds per image, while a fast mode requiring no retraining cuts the schedule to 20 steps and brings generation down to 1.9 seconds per image, roughly 0.53 images per second, with peak memory usage of 10.1 gigabytes. Quality curves show that most of the improvement occurs in the earlier sampling steps, so the fast mode trades a modest amount of fidelity for substantially lower latency. A sensitivity analysis of the five loss weights showed smooth performance around the selected configuration, suggesting the results are not an artifact of one fragile hyperparameter combination.

The authors are candid about limitations. Highly complex or internally contradictory prompts, such as classical futuristic architecture, can still produce semantic confusion, reflecting the difficulty of representing rare concept combinations with pretrained text-image representations. The interaction interface currently supports text, masks, sliders and reference images but not voice or gesture, computational cost remains non-trivial for edge deployment, and coverage of specialized domains like medical or satellite imaging is limited. Future directions include incorporating large language models to decompose complex instructions into structured constraints, extending the framework to video and 3D content, integrating watermarking for content provenance, and using the explicit per-modality weights as a starting point for interpretability analysis. Even with those caveats, MIGF offers a compelling demonstration that adaptive fusion, decoupled representations and unified feedback can be coordinated within a single diffusion pipeline, moving image generation closer to the iterative, multimodal way humans actually create.

Subject of Research: Multimodal interactive image generation using diffusion models with adaptive condition fusion, semantic decoupling and user feedback

Article Title: Generative models for interactive content creation and understanding in smart imaging

Article References: Wu, D., Bai, S., & Li, H. (2026). Generative models for interactive content creation and understanding in smart imaging. Discover Artificial Intelligence, 6(1), Article 1355. https://doi.org/10.1007/s44163-026-02418-2

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02418-2

Keywords: generative models, diffusion models, multimodal fusion, image generation, interactive AI, semantic decoupling, ControlNet, CLIP, content-style control, smart imaging, deep learning, human-AI interaction

The conventional routes to multi-attitude radar imagery each carry heavy penalties. Physical measurement of a real aircraft in an anechoic chamber can produce images at many attitudes, but the cost of such campaigns is prohibitively high, and the target must physically exist and be available for the experiment. Electromagnetic computation on a detailed model of the target can, in principle, produce images at any angle, but the computational time grows so steeply that large-scale dataset generation becomes impractical, and certain aspect angles end up missing from the resulting sets. A third route—data augmentation with generative models—has attracted considerable attention, because generative adversarial networks can synthesize plausible new radar images from limited training data. Yet most existing GAN-based methods can control only the azimuth angle of the generated image. Without precise constraint of the elevation angle as well, the projection morphology of the synthetic image can diverge from what a real radar would record at that attitude, undermining the very fidelity the augmentation is meant to provide.

Researchers at the School of Automation of Central South University have now addressed this dual-dimensional control problem with a method built on ControlNet, a generative framework that adds fine-grained spatial conditioning to a pre-trained diffusion model. In a study published in Space: Science & Technology, the team demonstrated the approach using the E-3 AWACS aircraft, one of the most recognizable airborne early warning platforms, as its test target. The workflow begins with electromagnetic computation to obtain echo data at a wide range of azimuth and elevation angles, followed by image formation and careful preprocessing. A frequency-domain filtering technique suppresses the stripe noise that plagues electromagnetic imaging, and Lee filtering mitigates the speckle noise characteristic of coherent imaging. The combination reduced the image entropy of the processed data from 3.24 to 3.06, a quantitative indication that the images became cleaner and more structured. The team then derived, from an optical imaging model, the geometric relationship between projection length and elevation angle, and used Canny edge maps as the control conditions fed into ControlNet. By freezing the backbone network and training only the branch network, the method achieves generation of radar images whose attitude can be specified precisely in both dimensions.

The dataset construction pipeline follows four sequential steps: computer-aided design modeling, electromagnetic computation, imaging and preprocessing, and the generation of edge maps that serve as control inputs. The researchers established a detailed CAD geometric model of the E-3 AWACS and computed its radar echoes using the large-element physical optics method at a center frequency of 80 gigahertz with a bandwidth of 640 megahertz. The raw echo data were then converted into images through a two-dimensional inverse Fourier transform, and Rayleigh clutter was superimposed on the results to simulate realistic measurement environments. This simulation chain produces radar images whose quality reflects the same physical limitations that affect real measurements. Because the electromagnetic imaging process is bounded by the available signal bandwidth and the finite illumination angles, the energy of strong scattering points diffuses across the image, forming prominent cross-shaped stripe artifacts that severely degrade the usefulness of the data for training. Any generative method built on this data inherits these defects unless the artifacts are removed first.

To clean the images, the team examined the two-dimensional spectrum of the electromagnetic imaging results and found that the stripe noise corresponds to identifiable vertical spectral components. By locating these components and setting them to zero, the frequency-domain filter removes the cross-shaped artifacts while leaving the genuine target scattering structure intact. In parallel, Lee filtering was applied to suppress the multiplicative speckle noise that arises from coherent illumination. A comparison of images before and after processing showed that both the stripe and speckle noise were effectively suppressed, and the reduction of image entropy from 3.24 to 3.06 validated the preprocessing quantitatively. The cleaned images then served as the training targets for the generative model. The final ingredient of the data foundation was the control signal itself: using the derived relationship between projection length and elevation angle, the researchers extracted Canny edge maps from optical images rendered at different attitudes, giving the generator an explicit geometric prescription of how the target should appear at any requested combination of azimuth and elevation.

The generative engine of the method is ControlNet, which employs Stable Diffusion as its backbone. The core of Stable Diffusion is a diffusion model, a class of generative network that learns by gradually transforming an image into Gaussian noise through a forward diffusion process and then learning to reverse the procedure, recovering the image from random noise through iterative denoising steps. During training, the objective is to ensure that the noise predicted by the network matches the noise actually added at each step. Diffusion models of this kind produce remarkably realistic images, but the original formulation lacks fine-grained control capability: the user cannot precisely dictate the geometry of what is generated. ControlNet solves this by constructing a parallel branch network alongside the frozen backbone. The backbone loads and freezes the pre-trained Stable Diffusion weights, preserving the general image generation capability the model acquired from large-scale optical imagery. The branch network, which shares an architecture identical to the backbone’s encoder and bottleneck layers, takes the edge maps as input and injects the attitude information they contain into the upsampling stages of the backbone’s decoder through zero-convolution modules.

The zero convolution is a small but crucial design element. It is a one-by-one convolution whose initial weights and biases are all set to zero, which guarantees that at the start of training the branch network contributes nothing to the backbone and cannot disturb the pre-trained generation capability. As training proceeds, the zero convolutions gradually learn to channel attitude control information from the edge maps into the decoder, so the model acquires precise attitude control without sacrificing the generative priors it already possesses. The detailed architecture of the branch network reflects this division of labor: a two-dimensional convolution module first increases the channel dimension of the input edge maps; three down-sampling modules then extract features at multiple spatial scales, with Transformer blocks embedded in the first three groups to strengthen global modeling capability; and the bottleneck outputs high-level semantic features that summarize the attitude information. This design allows the network to retain everything the pre-trained diffusion model learned about image structure on massive optical datasets while gaining a new, radar-specific skill: rendering a target’s radar signature at an exactly specified viewing geometry.

The experimental validation compared ControlNet against two established generative baselines, InfoGAN and Self-Attention GAN, under identical attitude conditions. The images produced by ControlNet reproduced fine details more accurately in the regions dominated by strong scattering points—particularly the engines, the nose, and the radome—and correctly reflected the dimensional changes in the target’s projected shape as the elevation angle varied. Evaluated across the full dataset of 2,821 images, ControlNet outperformed both comparison methods overall in Structural Similarity Index, Peak Signal-to-Noise Ratio, and Fréchet Inception Distance, the three standard metrics for measuring how closely generated images match real ones. The most striking result emerged under deliberately constrained conditions: when only 46 training images were available, the generation quality of InfoGAN degraded continuously as the training data shrank, whereas ControlNet actually improved. The researchers attribute this inversion to the superior distribution modeling capability of diffusion models when data are sparse, combined with the advantage of the pre-training priors inherited from Stable Diffusion. In scenarios involving self-occlusion, where the fuselage hides portions of the wings and tail from the radar’s line of sight, ControlNet generated the occluded regions correctly, preserving occlusion relationships consistent with real images.

The generality of the method was tested by transferring it to a different aircraft, the Su-27 fighter. ControlNet-generated images of the Su-27 achieved a Structural Similarity Index of 0.87 and a Peak Signal-to-Noise Ratio of 24.15 decibels, far surpassing InfoGAN at 0.31 and 20.82 decibels and Self-Attention GAN at 0.11 and 18.95 decibels. This cross-target performance confirms that the approach is not tied to a single airframe but captures a transferable understanding of how radar projections vary with attitude. For the field of radar automatic target recognition, the implications are practical and immediate. The method offers a way to augment radar image datasets of noncooperative targets at will, specifying any azimuth and elevation combination the recognition algorithm needs, and to fill in the missing aspect angles that electromagnetic computation cannot economically produce. As deep learning continues to drive radar recognition of satellites, aircraft, and debris, controllable synthetic data of this kind may prove to be the ingredient that lets recognition models finally see a noncooperative target from every angle it might present.

Subject of Research: Attitude-controllable radar image generation for noncooperative targets using ControlNet

Article Title: Research on an attitude controllable radar image generation method for noncooperative targets

Article References: Research on an attitude controllable radar image generation method for noncooperative targets. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: radar imaging, noncooperative targets, ControlNet, Stable Diffusion, diffusion models, data augmentation, deep learning, automatic target recognition, electromagnetic computation, azimuth and elevation control, E-3 AWACS, Su-27