🤖 machine learning

Signed Rectified Flow: Negativity-Controlled Generation

This paper introduces Signed Rectified Flow, a generative modeling framework that extends Rectified Flow to handle signed measures, enabling principled negative information incorporation to suppress unwanted content (such as nudity or memorized data) while preserving image quality and diversity.

Original authors: Runlong Liao, Baiyu Su, Lizhang Chen, Qiang Liu

Published 2026-07-22

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Runlong Liao, Baiyu Su, Lizhang Chen, Qiang Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a robot to paint. You show it thousands of pictures of beautiful sunsets, and it learns to make its own. But what if you also want to teach it what not to paint? Maybe you don't want it to draw ugly scribbles, or perhaps you want it to avoid copying a specific copyrighted character like Mickey Mouse. In the world of artificial intelligence, this is a tricky puzzle. Usually, AI models learn by being shown what to do, but they struggle when you just say, "Don't do that." It's like trying to tell a dog not to chase a squirrel by just standing still; the dog doesn't know what to do with its energy.

This paper dives into a specific corner of AI called "generative modeling," where computers create new images, sounds, or paths from scratch. The authors are building on a technique called "Rectified Flow," which is like a super-efficient highway for turning random noise into a clear picture. Think of it as a straight, fast train track that guides a chaotic cloud of dust into a perfect statue. The big question they tackle is: How do we build a train track that not only guides the dust to the statue but also actively pushes it away from a pile of trash we don't want?

The authors introduce a clever new method called Signed Rectified Flow. Instead of just trying to steer the AI away from bad things, they mathematically treat the "bad" things as having "negative mass." Imagine the AI's creative space as a landscape. Usually, the AI is attracted to high ground (good pictures). This new method creates a "negative gravity" zone over the bad pictures. It's like placing a giant, invisible magnet that repels the AI's creative energy, forcing it to flow around the forbidden zones and settle only in the safe, beautiful areas. They tested this on everything from 2D maps to complex images, and the results suggest it's a powerful way to make AI safer and more obedient without ruining the quality of its art.

The Magic of "Negative" Gravity

To understand how this works, let's picture the AI's journey as a river flowing from a noisy mountain spring (random static) down to a calm lake (the final image). In standard AI, we just build a channel to guide the water to the lake. But what if there's a swamp in the middle we want to avoid?

The authors propose a fascinating idea: treat the swamp as having negative water. In the real world, negative water doesn't exist, but in math, it does. They create a "signed" map where the good areas have positive water and the bad areas have negative water. When the AI tries to flow through this map, the negative water acts like a repulsive force. It doesn't just sit there; it pushes the river away.

Here is the cool part: The AI doesn't actually flow through the negative swamp. Instead, the math creates a "ghost region" or a barrier. The river naturally curves around the negative zone, finding a path that stays entirely in the positive, safe areas. It's as if the AI is a hiker who can feel a magnetic pull away from a cliff edge. The hiker never falls off because the ground itself seems to tilt away from the danger.

The "Charged Particle" Analogy

The authors explain this using a fun physics analogy: charged particles. Imagine the AI's data points are tiny particles. The good data (like a picture of a cat) has a positive charge, and the bad data (like a picture of a dog when you wanted a cat) has a negative charge.

When the AI generates a new image, it's like releasing a positive particle at the start of a journey. As it moves forward, it feels a strong repulsion from the negative charges. If it gets too close to the "bad" zone, the repulsion gets so strong it acts like a wall, bouncing the particle back toward the good side. The paper shows that this creates a "reachable region" where the AI can safely explore, while the "negative region" remains completely untouched. The AI never accidentally steps into the forbidden area because the math of the flow makes it physically impossible for the particle to cross that boundary.

What They Found in the Lab

The team didn't just dream this up; they tested it in several ways, and the results look promising.

1. The 2D Toy Maps
First, they played with simple 2D maps. Imagine a map with a "good" island and a "bad" swamp. When they used old methods, the AI either got stuck in the swamp or got pushed so far away it ended up in a barren desert. With Signed Rectified Flow, the AI stayed perfectly on the good island, avoiding the swamp entirely while still covering the whole island. It was like a perfect GPS that knew exactly where not to go.

2. The "Anti-Memorization" Test
One of the biggest worries with AI is that it might just copy-paste pictures from its training data (memorization). The authors used their method to tell the AI, "Don't copy the exact pictures you saw in training." They treated the training data as the "negative" zone.

The Result: When they asked the AI to draw a specific dog breed, the standard AI sometimes copied the exact photo from its training set, including weird artifacts like watermarks or borders. The Signed Rectified Flow AI, however, drew a new, unique dog that looked like the breed but didn't copy the specific training photo. It successfully pushed the generated images away from the "training data swamp" while keeping the dog looking like a dog.
The Numbers: In their tests, they found that using this method reduced the similarity to training images significantly. For example, with a specific setting, they reduced the "attack success rate" (how often the AI failed to avoid bad content) from 15.19% down to 6.33% in safety tests, while keeping the image quality scores (CLIP and Aesthetic scores) almost exactly the same.

3. Safety and Concept Suppression
They also tested if they could stop the AI from drawing inappropriate content or specific copyrighted characters.

The Mickey Mouse Test: They told the AI to draw a "cartoon mouse with round black ears and red shorts" but explicitly said, "Do not draw Mickey Mouse." The standard AI often drew Mickey Mouse anyway. The Signed Rectified Flow AI drew a mouse that had all the requested features (ears, shorts, shoes) but looked distinct enough to avoid the copyrighted identity.
The Nudity Test: On a benchmark called "Ring-A-Bell," which tries to trick AI into drawing nudity, the new method reduced the failure rate from 15.19% to 6.33%. This means it was much better at following the "don't do this" rule without making the images look blurry or broken.

Why This Matters

The beauty of this approach is that it's not just a "hack" or a simple filter. It's a fundamental change in how the AI moves through its creative space. By using the concept of "negative mass," the authors created a system where the AI naturally avoids bad things because the math of its journey pushes it away.

They showed that this works whether you are guiding a robot through a maze, generating new images of dogs, or trying to make sure an AI doesn't copy its training data. The method is flexible: you can turn the "repulsion" up or down (using a parameter called $\alpha$ ) to decide how strictly the AI should avoid the bad stuff.

The paper suggests that this is a principled, mathematically sound way to handle negative instructions. It's not just about saying "no"; it's about building a world where "no" is a physical barrier that the AI cannot cross. While the authors note that their method requires a bit more computing power (about 10% more time and memory) to calculate these repulsive forces, the trade-off seems worth it for the extra safety and control it provides.

In short, Signed Rectified Flow gives AI a new kind of common sense: the ability to not just know what to do, but to truly understand what not to do, all while keeping its creative spark alive.

Technical Summary: Signed Rectified Flow (Signed RF)

Problem Statement

Many generative modeling tasks require not only promoting a desirable distribution ( $\pi_+$ ) but also explicitly suppressing an undesirable one ( $\pi_-$ ). This arises in conditional generation (matching targets while avoiding inconsistencies), safety alignment (generating value-aligned outputs while excluding harmful ones), and preference learning.

Current approaches, particularly for flow and diffusion models, rely on heuristic guidance at sampling time (e.g., Classifier-Free Guidance). These methods extrapolate between positive and negative fields using fixed or manually tuned scales. However, the induced sampling distributions are poorly understood, making it unclear which regions of the data space are effectively promoted or suppressed. Furthermore, standard guidance struggles with the "missing negative data" problem, where the absence of negative examples in training does not inherently prevent the model from generating them.

Methodology: Signed Rectified Flow

The authors propose Signed Rectified Flow (Signed RF), a principled framework that generalizes Rectified Flow (RF) to handle signed measures.

1. The Signed Target

Instead of a standard probability distribution, Signed RF defines a signed target measure:
$\pi_{\text{sign}} = (1 + \alpha)\pi_+ - \alpha\pi_-$
where $\alpha > 0$ . Here, $\pi_+$ represents the distribution to promote, and $\pi_-$ represents the distribution to suppress. While $\pi_{\text{sign}}$ is not a valid probability distribution (it can take negative values and does not integrate to 1 in the standard sense), it serves as an intermediate object to encode explicit exclusion constraints.

2. Dynamics and Velocity Field

Signed RF extends the RF velocity formula to this signed target. Given marginal distributions $\pi^+_t$ and $\pi^-_t$ and their respective velocity fields $v^+_t$ and $v^-_t$ induced by linear interpolation from a source distribution $\pi_0$ , the Signed RF velocity field is derived as:
$v^{\text{signRF}}_t(x) = \frac{(1 + \alpha)\pi^+_t(x)v^+_t(x) - \alpha\pi^-_t(x)v^-_t(x)}{(1 + \alpha)\pi^+_t(x) - \alpha\pi^-_t(x)}$
This can be rewritten in a guidance-like form:
$v^{\text{signRF}}_t(x) = v^+_t(x) + \lambda^\alpha_t(x) \Delta v_t(x)$
where $\Delta v_t(x) = v^+_t(x) - v^-_t(x)$ and the guidance strength $\lambda^\alpha_t(x)$ is determined by the density ratio $r_t(x) = \pi^-_t(x)/\pi^+_t(x)$ :
$\lambda^\alpha_t(x) = \frac{\alpha r_t(x)}{(1 + \alpha) - \alpha r_t(x)}$

3. Theoretical Guarantees: Reachable and Ghost Regions

The paper analyzes the behavior of source-initialized trajectories ( $Z_0 \sim \pi_0$ ) under this dynamics:

Positive Region Preservation: Trajectories remain strictly within the positive region $\Omega^+_t = \{x : \pi_{\text{sign}}_t(x) > 0\}$ and never cross into the negative region $\Omega^-_t$ .
Zero Set as a Barrier: The set where $\pi_{\text{sign}}_t(x) = 0$ acts as a repulsive barrier. The velocity field becomes singular at this boundary, preventing penetration.
Reachable vs. Ghost Regions: The sampling law $\pi^{\text{signRF}}_t$ coincides exactly with the signed marginal $\pi_{\text{sign}}_t$ on a reachable region $\Omega^r_t \subseteq \Omega^+_t$ . The remaining part of the positive region is termed the ghost region ( $\Omega^g_t$ ). The positive mass in the ghost region exactly balances the negative mass excluded from the sampling law.
Interpretation: The authors provide a "charged-particle" interpretation where positive and negative particles annihilate at the zero boundary, creating a structural separation between the sampled trajectories and the negative regions.

4. Practical Implementation

To implement Signed RF, the density ratio $r_t(x)$ must be estimated. The paper proposes two methods:

Classifier-based: Training a binary classifier on noisy states from positive and negative branches to estimate the odds ratio.
Online Ratio Tracking: Tracking the log-density ratio $u_t = \log r_t(z_t)$ along the trajectory by integrating an ODE derived from the continuity equation and score functions. This avoids training an auxiliary classifier.

Key Contributions and Results

1. Theoretical Framework

The paper establishes that Signed RF rectifies a signed marginal into a valid probability law by preserving the signed density on the reachable region and assigning zero density elsewhere. This provides a rigorous foundation for incorporating negative information, proving that the induced flow naturally avoids negative regions without requiring ad-hoc constraints.

2. Empirical Applications

The authors demonstrate Signed RF across several domains:

2D Toy Examples & PointMaze: Signed RF successfully separates positive and negative modes and navigates obstacles (missing negative data problem) where constant guidance fails (either failing to repel or over-repelling).
ImageNet Class-Conditional Generation: Using a pretrained Rectified Flow model, Signed RF improves the fidelity–diversity trade-off. At 16 NFE (Number of Function Evaluations), it reduces FID from 2.38 (CFG) to 1.82 while maintaining higher recall at comparable precision.
Anti-Memorization: By modeling the training set as a negative distribution, Signed RF (termed "Data Repulsive Flow") reduces training-data replication. On high-risk seeds, it suppresses dataset-specific artifacts (watermarks, borders) and increases nearest-neighbor distances to the training set while preserving generation quality (FID 2.03 vs. 7.41 for SPELL-50).
Concept Suppression & Safety: Applied to Stable Diffusion 3.5, Signed RF reduces the attack success rate (ASR) for nudity generation from 15.19% to 6.33% and toxicity rates, while preserving CLIP and aesthetic scores. It also effectively suppresses specific concepts (e.g., copyrighted character identities like Mickey Mouse or Spider-Man) while retaining desired visual attributes.

Significance and Claims

The paper claims that Signed Rectified Flow offers a principled and practical framework for incorporating explicit negative distributions into generative flows. Unlike heuristic guidance methods that rely on fixed scales, Signed RF derives a state-dependent guidance strength from the local density ratio between positive and negative branches.

Key claims include:

Theoretical Rigor: It provides a mathematically grounded mechanism for exclusion, proving that source-initialized flows naturally avoid negative regions via a repulsive barrier at the signed zero set.
Solving Missing Negative Data: It addresses the limitation of training data lacking explicit negative examples by allowing the user to define a negative distribution (e.g., the training set itself or a specific concept) to be suppressed.
Trade-off Optimization: Empirically, it achieves better fidelity–diversity trade-offs and more effective concept suppression than existing baselines (CFG, SPELL, SAFREE) without significant computational overhead (approx. 10% increase in runtime and memory).

The work positions Signed RF as a general extension of Rectified Flow that unifies the handling of promotion and suppression within a single dynamical system, moving beyond heuristic extrapolation to a theoretically justified sampling law.