Global safety filters break images by flattening nuance, so here is the fix

Most text-to-image models use a blunt instrument to catch bad content: a global toxic subspace. You subtract one vector, and everything becomes safer. But that approach forces a trade-off between covering all possible errors and keeping the good prompts intact. If the safety space is too narrow, it misses weird combinations. If it is too wide, it distorts benign images by stripping away useful details. The recent CALM method fixes this by treating safety locally rather than globally.

The geometry of safety errors

Standard safeguards assume a single direction in embedding space represents "unsafe." This works for simple cases, but fails when prompts contain mixed semantics. The researchers analyzed this geometric limitation and found a consistent pattern: compact unsafe subspaces leave heterogeneous unsafe signals undetected. Conversely, aggregating more signals to improve coverage causes collateral damage to safety-adjacent benign prompts. The model starts looking wrong because the filter removed too much information.
This means the current standard is fundamentally imprecise. It treats a prompt for a "cyberpunk cat wearing a neon hat" the same way it treats a "cat in a rainstorm," applying the same global subtraction. The result is either missed artifacts or washed-out colors.

How CALM works

CALM (Counterfactual Adaptive Local Modulation) replaces uniform global removal with prompt-specific adjustments. Instead of one big subtraction, it uses matched unsafe-benign anchors to identify exactly which tokens are causing issues. The process follows three distinct steps:

1. Routing: The system identifies active unsafe categories relevant to the specific prompt.
2. Minimal Editing: It adjusts only the token representations that violate safety constraints, pushing them slightly toward the safe side.
3. Residual Suppression: It suppresses small, positively aligned unsafe residuals that often slip through global filters.

Because it is training-free, you can apply this logic to existing diffusion models without retraining. It acts as a post-hoc or mid-generation correction layer.

Why local beats global

The core advantage is selectivity. By routing each prompt to its specific unsafe category, CALM avoids the coverage-selectivity trade-off. It does not need to widen the entire safety net to catch rare errors. Instead, it tightens the filter only where necessary for that specific image.
This leads to better preservation of benign utility. The image retains its intended style and composition because the filter only tweaks the tokens responsible for the potential error. Global methods often remove texture or lighting cues alongside the noise, but CALM leaves those alone if they are not part of the unsafe signal.

Implementation notes

If you are building your own safety layer, avoid static subtraction vectors. Use dynamic anchoring. Find pairs of similar prompts (one safe, one unsafe) to create a local correction vector. Apply this vector only to tokens matching the unsafe anchor's profile. This keeps the computational cost low since you are modifying fewer dimensions than a global overhaul.
The method proves that precision matters more than breadth in safety filtering. A targeted nudge outperforms a heavy-handed ban.