TwoHamsters: Benchmarking Multi-Concept Compositional Unsafety in Text-to-Image Models

1. Problem Definition: Multi-Concept Compositional Unsafety (MCCU)

Current Text-to-Image (T2I) safety mechanisms primarily focus on explicit malicious concepts (e.g., nudity, gore, or direct hate speech). However, they fail to address Multi-Concept Compositional Unsafety (MCCU).

• Definition: MCCU occurs when individually benign concepts, when combined, generate unsafe or offensive semantics due to implicit social, historical, or cultural contexts.
• The Gap: Standard safety filters analyze atomic concepts in isolation. Since the individual components (e.g., "cotton" and "black man") are safe, filters fail to detect the harmful composition (e.g., racial stereotypes).
• The Dilemma: Existing "concept erasure" methods (which remove specific concepts to prevent harm) are ineffective here because the constituent concepts are legitimate and necessary for safe generation. Erasing them destroys model utility.

2. Methodology: The TwoHamsters Benchmark

The authors introduce TwoHamsters, a comprehensive benchmark designed to quantify and evaluate MCCU vulnerabilities.

A. Data Construction Pipeline

The dataset consists of 17,500 curated prompts covering 5.8k high-risk scenarios across 10 risk categories and 51 fine-grained concept pairs. The construction involves a rigorous multi-stage pipeline:

1. Taxonomy Creation: A hierarchical taxonomy was built by synthesizing safety policies from leading T2I platforms, defining 10 core risk dimensions (e.g., Hate, Illegal, Sexual, Political).
2. Prompt Generation: A dual-stream strategy was used:
   • Taxonomy-driven retrieval from existing datasets.
   • LLM-based adversarial expansion to create complex scenarios where benign concepts interact to trigger risks.
   • Constraints: Strict blocklists ensured no explicit unsafe words were used; risks must emerge solely from composition.
3. Filtering & Verification:
   • Semantic Diversity: CLIP embeddings were used to prune redundant prompts.
   • Visual Validity: A cross-modal check ensured that generated images accurately reflected the atomic concepts (preventing semantic degradation).
   • Human-in-the-Loop: Expert auditors verified the "rationale" (the logical link between the concepts and the risk) via double-blind review.

B. Automated Evaluation Framework

Since standard classifiers struggle with MCCU, the authors developed two specialized detectors:

1. MCCU-ViT: A high-throughput ViT-based classifier fine-tuned on 300k image-text pairs. It uses a Multi-Head Causal Consistency mechanism, requiring three parallel heads to agree (Unsafe + Concept 1 Alignment + Concept 2 Alignment) to flag a violation, reducing false positives.
2. MCCU-VLM: A reasoning-heavy Vision-Language Model (based on Qwen2-VL) used for qualitative verification and interpretability.

C. Evaluation Metrics

The paper defines three key metrics to balance safety and utility:

• MCCU Defense Rate (MDR): The rate at which a model/filter successfully blocks the generation of unsafe compositions.
• Single-Concept Retention (SCR): Measures if the model can still generate the individual benign concepts (utility preservation).
• Non-target Concept Retention (NCR): Measures collateral damage to unrelated concepts.

3. Key Contributions

1. Formalization of MCCU: The first formal definition and hierarchical taxonomy mapping risk categories to specific concept pairs, distinguishing atomic safety from interpretative harmfulness.
2. TwoHamsters Dataset: A high-quality, large-scale benchmark (17.5k prompts) specifically engineered to test compositional vulnerabilities, filling a critical gap in T2I safety research.
3. Comprehensive Evaluation: An extensive audit of 10 state-of-the-art (SOTA) T2I models, 7 safety filters, and 10 concept erasure methods.
4. New Evaluation Paradigm: Introduction of a logic-oriented safety alignment approach, moving beyond simple keyword filtering.

4. Experimental Results & Key Insights

The evaluation of 10 SOTA models (including FLUX.1, SDXL, SD-v3.5) and various defense mechanisms yielded 8 pivotal insights:

• Insight 1: The "Instruction-Safety" Dilemma: As models improve in instruction following and generation quality (e.g., FLUX.1), their susceptibility to MCCU increases. FLUX.1 achieved a 99.52% success rate in generating unsafe compositions, whereas older U-Net models had lower rates (~40%). Models prioritize semantic adherence over safety reasoning.
• Insight 2: Taxonomic Bias: Current defenses are heavily biased against explicit visual hazards (e.g., nudity) but fail catastrophically on high-level socio-semantic risks like Harassment (8.81% MDR) and Hate Speech.
• Insight 3: Semantic Agnosticism: Attention map analysis (Figure 3) shows that models like FLUX can attend to benign atomic concepts but fail to recognize the interaction that creates the harmful intent.
• Insight 4: Filter Failure: Mainstream safety filters (including LLaVA-Guard) have extremely low recall (~41%) on MCCU because they rely on explicit visual features and lack training on compositional risks.
• Insight 5: Semantic Fluidity: MCCU risks are socially constructed and culture-dependent, making a universal, static filter theoretically elusive.
• Insight 6: Feature Space Proximity: In CLIP latent space, MCCU images "parasitize" the overlapping regions of their benign constituent concepts, making them indistinguishable from safe images to standard encoders.
• Insight 7: The Erasure Dilemma: Concept erasure methods (e.g., ESD, UCE) fail to mitigate MCCU without causing utility collapse. Because the constituent concepts are benign, erasing the "combination" often requires suppressing the base concepts, degrading the model's ability to generate safe images.
• Insight 8: Need for Disentanglement: The paper argues for a shift from "concept erasure" to "compositional disentanglement." Future alignment must focus on orthogonalizing the interaction manifolds in cross-attention layers to prevent harmful synthesis without destroying the knowledge base.

5. Significance

• Paradigm Shift: The paper challenges the current safety alignment paradigm, demonstrating that filtering explicit content is insufficient for the next generation of T2I models.
• Critical Vulnerability: It highlights a severe security gap where SOTA models are nearly 100% vulnerable to compositional jailbreaks, posing significant risks for deployment in commercial and public sectors.
• Roadmap for Defense: It provides a concrete roadmap for researchers to move from data-centric filtering to logic-oriented alignment, emphasizing the need for models to understand the contextual relationships between concepts rather than just the concepts themselves.
• Resource Availability: The release of TwoHamsters and the MCCU-ViT/VLM evaluators provides the community with the necessary tools to rigorously test and improve future safety mechanisms.