Eleven image generators rarely refused prompts for harmful diagrams, interfaces and records, and the safety detectors designed to catch that content missed it too
AspireAI community · arXiv (Zhu, Liu, Lyu, Wu)
Image generators can produce complex visual artifacts - diagrams, interfaces, records - that combine text, graphics and layout to convey detailed information, so they may refuse overtly harmful imagery and still generate artifacts that guide dangerous actions or support deception. The paper calls this functional visual harm, the risk arising from what such images enable rather than what they depict, and notes that existing safety benchmarks focus largely on overtly harmful content such as pornography and graphic violence. FVH-Bench comprises 669 prompts across five harmful visual functions and ten risk domains. The 11 evaluated image generators rarely refuse these requests and frequently generate artifacts that fulfil the targeted harmful functions, with high scores for both target harm realization and harmful artifact usability, indicating the outputs can support the intended harmful purposes. The analysis also finds existing safety detectors provide limited coverage of functional visual harm, so they cannot recognize harmful visual functions either. The limitation is that the paper establishes the gap rather than fixing it - it offers no defense, and the 669 prompts are a deliberately narrow slice of what is possible.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.