Mitigating inappropriate concepts in text-to-image generation with attention-guided Image editing

Reducing inappropriate concepts in images

Inappropriate images from generative models are identified as a new social issue (Bird, Ungless & Kasirzadeh, 2023). Advanced diffusion models have demonstrated the ability to learn and reproduce undesirable concepts, largely due to their training on extensive internet-sourced datasets. These datasets, often compiled using search engine criteria, may include personal, offensive, and hateful imagery (Wu et al., 2023; Li et al., 2024). Early attempts to solve this problem have been relatively straightforward yet limited in their effectiveness. For example, a user can re-generate images with their own prompt editing until an image without inappropriate content is provided. However, this approach is time-consuming, user/skill-dependent (e.g., level of prompt engineering), and significantly alters the original creative vision or purpose of the image generation. Data filtering is another obvious solution that removes inappropriate content from training data. However, this approach is also time-intensive and may compromise output quality by reducing the size of data (Gandikota et al., 2023). Post-generation techniques have emerged as alternative strategies. These methods have focused on modifying or obscuring inappropriate content after image creation, employing strategies like content masking (Maidhof et al., 2022) and targeted image editing (e.g., removing nudity by putting on clothes) (More et al., 2018). However, these approaches still struggled with producing natural outputs and required additional model training or image processing steps.

Recent research has explored leveraging text data to identify potentially inappropriate content and refining the image generation process. One notable method is SLD (Schramowski et al., 2023), which extends the capabilities of SD by modifying the generated guidance for text using classifier-free guidance to reduce the inappropriateness of images. During inference, SLD employs a set of hyper-parameters to guide SD in the direction of generating appropriate images. However, empirical observations revealed a significant trade-off: stronger content regulation often results in output images that deviate considerably from the original. Furthermore, considerable effort was required to adjust multiple hyper-parameters. Another approach called ESD was proposed by Gandikota et al. (2023), which aims to erase unsafe concepts through minimal training procedures. ESD employs a fine-tuning process to remove specific undesirable concepts from the weights of the pre-trained SD model. To this end, they utilized a teacher model trained with negative prompts to guide pre-trained SD in eliminating visually unsafe concepts. ESD demonstrated performance as effective as SLD (Schramowski et al., 2023), despite relying primarily on fine-tuning rather than extensive retraining.

While SLD and ESD have made significant strides in addressing inappropriate content generation, each approach comes with its own set of trade-offs. SLD offers adaptable content moderation but demands precise parameter tuning and often significantly alters the original styles. On the other hand, ESD enables specific concept removal but necessitates additional model training. Our study aims to streamline the process of reducing inappropriate content while enhancing the image-generation experience for users. Unlike ESD, our method eliminates the need for additional training, and in contrast to SLD, it retains the style of original images and reduces the effort to identify optimal hyper-parameters. To achieve this, we propose to leverage the attention maps of diffusion models.

Image editing using attention maps

Recent research has seen a proliferation of techniques leveraging attention maps for image and video editing (Liu et al., 2024b, 2024a; Hertz et al., 2022; Chefer et al., 2023), offer efficient, tuning-free or minimal-training approaches. These methods leverage the rich spatial and semantic information encoded within attention mechanisms to enable targeted modifications. Specifically, text-to-image diffusion models establish a spatial correspondence between individual words in the input prompt and specific regions in the generated image. This correspondence manifests through distinct attention maps for each word, indicating that the semantic information associated with each term can be localized to particular areas within the visual output. Accordingly, altering the prompt leads to corresponding changes in the attention maps. For example, Hertz et al. (2022) explored revising images while preserving original styles by manipulating cross-attention maps between text and spatial layouts. Another method, MasaCtrl (Cao et al., 2023), was introduced to address the challenges of complex non-rigid image editing. This method transforms the self-attention in diffusion models into cross-attention, thereby facilitating access to the images’ feature representations, encompassing both local content and textural elements. Consequently, this enabled sophisticated editing while maintaining image coherence. Furthermore, Chefer et al. (2023) demonstrated object-specific editing in SD by exploiting cross-attention maps. In the case of video editing, Liu et al. (2024b) presented Video-P2P, a large-scale model that employed separate unconditional embedding for both source and target prompts, thereby enhancing both reconstruction fidelity and editability. Their works revealed that utilizing attention map variations allows for edits that effectively preserve the structure and content of the original image, enabling fine-grained control over the generated output through strategically altered text input.

Despite these advancements in leveraging attention maps for image and video editing, their potential for inappropriate content mitigation in generative models remain largely unexplored. Existing solutions, such as ESD and SLD, often either compromise original image style or demand substantial computational overhead for model fine-tuning and complex hyperparameter tuning, which severely limits their practical usability. To address this gap, our work investigates the feasibility of using cross-attention maps in diffusion models. By strategically leveraging attention mechanisms, specifically by harnessing both classifier-free guidance and directly editing attention maps, we aim to filter out the representation of inappropriate concepts in generated images while preserving their intended visual characteristics. By exclusively utilizing pretrained text-to-image models and minimizing hyperparameter complexity, this approach allows us to suppress undesirable content without the need for additional model training or extensive engineering effort. To thoroughly evaluate our attention map-based content mitigation framework, we pose the following research questions:

• RQ1

  Can our attention map-based approach effectively and efficiently mitigate inappropriate content?

• RQ2

  How do humans perceive the appropriateness and quality of the images generated by our attention map-based approach?

• RQ3

  What is the impact of key hyper-parameters on the performance of our attention map-based approach?

Background

Latent diffusion models (LDMs) (Rombach et al., 2022) generate an image latent $z_0$ using a random noise vector $z_T$ and textual condition $p$ as inputs. They predict and remove artificial noise ${\epsilon }_t$ added to $z_t$ over T steps, resulting in $z_0$, which is decoded to generate the image. To facilitate this iterative denoising process, the model predicts the noise ${\epsilon }_{\theta }$ to refine the latent $z_{t-1}$ from $z_t$ using the following equation:

(1) $$z_{t-1}=\frac{1}{\sqrt{{\alpha }_t}}\left(z_t-\frac{1-{\alpha }_t}{\sqrt{1-{\overline{\alpha }}_t}}{\epsilon }_{\theta }(z_t,t,\mathcal{P})\right)+{\sigma }_t\epsilon ,$$where $\overline{{\alpha }_t}$ is the cumulative product of denoising strength $\alpha$ up to timestep $t$, $\mathcal{P}$ represents the embedding of the text input $p$, and ${\sigma }_t$ is the standard deviation of the added noise.

Attention-guided image editing for mitigating inappropriateness

Building on the insight that prompt alterations correspond to changes in attention maps (Hertz et al., 2022; Chefer et al., 2023), we propose an effective approach that regulates these maps to mitigate inappropriate content in generated images. Our approach is based on the assumption that if a text prompt contains inappropriate words/terms, then the corresponding attention maps are likely to highlight regions associated with inappropriate elements. Therefore, we propose to use attention maps derived from inappropriate words to identify and mitigate the presence of inappropriate elements during image generation.

Figure 1 shows an illustrative example of how we manipulated attention maps to reduce inappropriateness in the image generation process. Let $M_{text}$ denote the attention map derived from a text prompt embedding ${\mathcal{P}}_{text}$, and $M_{inappr}$ denote the attention map derived from the embedding of inappropriate words ${\mathcal{P}}_{inappr}$. Given an image $\mathcal{I}$ generated from the predicted latent $z_0$, $M_{text}$ illustrates how ${\mathcal{P}}_{text}$ influences each part of $\mathcal{I}$. Conversely, $M_{inappr}$ highlights areas within $\mathcal{I}$ where inappropriate content is prominent, as indicated by higher attention values. Therefore, it can be interpreted that the residual attention map $M_r$, derived from the difference between $M_{inappr}$ and $M_{text}$, specifically identifies image regions containing inappropriate elements. Thus, by utilizing $M_r$, which captures areas of higher inappropriateness, one can effectively create an image where inappropriate content has been mitigated.

The pseudo algorithm is shown in Algorithm 1. The core of the algorithm is an iterative denoising process that runs from timestep T to 1. The proposed approach leverages classifier-free guidance to generate high-quality images that align with the given prompts while mitigating inappropriate content. Therefore, for the initial input, we utilize unconditional embedding $\mathrm{\varnothing }$ along with textual ${\mathcal{P}}_{text}$ and inappropriate word ${\mathcal{P}}_{inappr}$ embeddings. The algorithm starts with a randomized latent vector $z_T$ sampled from a standard normal distribution. For the first few steps (determined by $\tau$), the algorithm uses standard diffusion with only the text prompt, which allows the initial structure of the image to form based on the user’s intention (Line 13). After these steps, we apply a mechanism for inappropriateness reduction through Line 5–11. For this, we get attention maps for both the text prompt $M_{text}$ and the inappropriate words $M_{inappr}$ (Line 7). To reduce the inappropriateness within $M_{text}$, we first compute a residual attention map $M_r$ by subtracting the text attention from the inappropriateness attention (Line 8). Then, we apply ReLU activation to $M_r$ (Line 9), which suppresses negative values, emphasizing areas where the influence of inappropriate content exceeds that of text prompts. Subsequently, a final attention map $M_t$ is created by subtracting the residual map $M_r$ scaled by $\lambda$ from the text attention map $M_{text}$. Here, $\lambda$ modulates the extent of adjustment applied to $M_{text}$. The process continues until the final denoised latent $z_0$ is obtained, which is then used to generate the final image $\mathcal{I}$.

The proposed method allows for real-time filtering of inappropriate content during the generation process without requiring model retraining or extensive hyper-parameter tuning. It can also strike a balance between appropriateness and preserving the user’s original artistic intent.

Experimental settings

Quantitative results

Summary

Our evaluation revealed that SLD-Max achieved the lowest I2P score, decreasing the probability of generating inappropriate content by over 75%. While our method demonstrated the highest visual similarity to original images as evidenced by the lowest LPIPS score, it provided only a modest reduction in inappropriateness from the perspective of I2P evaluation. Text-image alignment remained relatively consistent across all methods, with minor differences in CLIP scores, which suggests that the semantic relationships between the textual prompts and generated images were generally preserved across models. Moreover, our method stands out in terms of computational efficiency, exhibiting a faster runtime and lower GPU memory usage compared to ESD and SLDs.

However, it is crucial to recognize the limitations of the I2P score, which relies exclusively on predictions from Q16 and NudeNet classifiers. This may result in an incomplete assessment, as these classifiers may not fully capture the subtle yet significant changes implemented by ESD and our method. Consequently, even when our approaches effectively mitigate inappropriate content, the I2P score might not accurately reflect these improvements. Figure 2 exemplifies instances where the classifiers failed to make accurate predictions. In several cases, our method effectively removed or obscured inappropriate elements, yet the classifiers erroneously labeled these sanitized images as inappropriate. Conversely, and perhaps more concerningly, some original SD-generated images exhibiting clearly inappropriate content were misclassified as appropriate, particularly evident in rows 2–4. These false negatives highlight a critical gap in the classifiers’ ability to consistently identify problematic content. Furthermore, this suggests that our method’s efficacy in reducing inappropriate elements may be substantially underestimated by the I2P score. Recognizing the inherent limitations of quantitative assessments derived from automated classifiers, we sought a more nuanced and accurate evaluation approach. To this end, we conducted a comprehensive human perceptual study, which will be elaborated upon in subsequent sections.

Qualitative results

To explore the effectiveness of the inappropriateness reduction methods in a more comprehensive manner, we present a comparison of images generated by baselines (i.e., SLD-Weak, SLD-Max, and ESD) and our proposed method. The examples are shown in Fig. 3. In the first column, the input text prompt and its corresponding images generated using SD are displayed. Each subsequent column demonstrates how the models mitigate the inappropriate elements present in the original image. Generally, all the methods successfully reduced or removed inappropriate elements from the original image; however, each method behaved differently.

Our approach effectively removed inappropriate elements during image generation through attention-guided targeted image editing. For example, the proposed method identified inappropriate elements within images, such as blemishes, genitalia, cigarettes, and inflamed eyes (rows 1–4). Then, these were addressed by adding clothing (rows 1 and 2), removing problematic objects (row 3), and adjusting color tones (row 4). Throughout this process, our method maintained the contextual integrity of the generated image, preserving key contexts such as facial appearances, backgrounds, and body posture that collectively constitute the overall composition of the image. Conversely, it should be noted that both SLDs and ESD methods tended to significantly alter the original context, resulting in the creation of entirely new images that bear little resemblance to the original objects and properties. Although ESD appeared to produce relatively closer images to the originals compared to SLD methods, it still struggles to maintain the original properties, often resulting in entirely different illustrations (see rows 1 and 4). Additional examples can be found in Fig. 4.

As discussed in this section, our method generally demonstrated a high degree of visual similarity to the original images. This was desirable for maintaining image coherence/context; however, it could inadvertently cause classifiers to identify images as still inappropriate, despite the successful removal of inappropriate content. In contrast, SLD methods generated more diverse outputs that often deviate significantly from the original images, potentially yielding higher performance in terms of I2P scores. Therefore, to complement the quantitative metrics, we conducted a perceptual study to assess how actual users perceive the edited images. By incorporating human evaluation, we aimed to gain insights that extend beyond automated quantitative evaluation.

Perceptual study

For a perceptual study, we used Prolific (https://www.prolific.com/), an online crowd-sourcing platform designed for recruiting research participants. Participants were recruited using predefined qualification filters to ensure data quality and relevance. Specifically, we restricted participation to individuals who were 18 years or older and had a Prolific approval rate of 95% or higher, indicating a reliable track record of participation. In each task, we provided participants with (i) the text prompt, (ii) the original image generated by SD, and (iii) four generated images using inappropriateness reduction methods (SLD-Weak, SLD-Max, ESD, and Ours). We randomly selected 100 samples from the I2P dataset, ensuring that all seven inappropriateness content categories were represented. Although the sampling was not perfectly stratified, care was taken to include examples from each category to capture the dataset’s diverse categories. Each sample was evaluated by 20 participants. Participants were asked to rank the presented generated images based on four criteria that closely aligned with our quantitative metrics:

• Which image is the most similar to the Original?

• Which image best removes inappropriate elements from the Original?

• Which image best represents the text prompt while effectively removing the inappropriate content?

• Which image is of the highest quality?

Figure 5 and Table 5 summarize the results of the perceptual study, presenting the average rankings (with standard deviations) participants assigned to each method across the four evaluation criteria. To analyze this non-parametric ranking data, we performed Friedman tests. The results consistently revealed a statistically significant difference among the methods for all four criteria: Image Consistency (Q1; ${\chi }^2=412.71$), Inappropriateness Reduction (Q2: ${\chi }^2=120.88$), Text Alignment (Q3: ${\chi }^2=168.63$), and Overall Quality (Q4: ${\chi }^2=203.04$) all with $p$-value less than 0.001. Detailed pairwise Wilcoxon signed-rank test with Bonferroni correction results, including effect sizes quantified by the rank-biserial correlation, are reported in Table 6.

Our method consistently outperformed others across all metrics. As detailed in Table 6 (rows 3, 5, and 6), pairwise tests revealed significant improvements ( $p<0.001$), with all corresponding effect sizes ( $r$) consistently exceeding 0.41, indicating a medium to large effect. In terms of image consistency, as depicted in Fig. 5A, our method outperformed not only SLDs but also ESD, which is consistent with the LPIPS results. Specifically, SLD-Max yielded an average ranking of 3.13, while the proposed method received 1.37. Interestingly, in both inappropriateness reduction and text-image alignment, our method achieved superior performance and surpassed the baselines, which contrasts with the results of I2P evaluation and CLIP scores, respectively (Figs. 5B and 5C). Specifically, while other baselines averaged 2.67 in inappropriateness reduction and 2.68 in text-image alignment, our method achieved 2.01 and 1.97, respectively. It is important to note that the participants valued the effectiveness of our method in reducing inappropriateness from the “original” image generated by SD. This can be interpreted that the proposed method is particularly useful in the interactive image generation and editing process, where users are allowed to iteratively manipulate images using generative AIs until they obtain their desired outputs. The above aspect also affected the perceived overall quality of generated images. As shown in Fig. 5D, the participants favored the images generated by the proposed method the most, followed by those from SLD methods and ESD.

The perceptual study yields two key findings. Firstly, unlike the I2P test protocol, human evaluators could discern and assess even subtle differences between images. As a result, the proposed method received a higher rating for inappropriateness reduction when assessed by human evaluators. Secondly, human evaluators reported greater text-image alignment and overall image quality when the generated image maintained contextual or property similarities with the original image.

Ablation study

Finally, to investigate the impact of hyper-parameters in the proposed method on the overall quality and appropriateness of the generated images, we performed the ablation study focusing on $\tau$ and $\lambda$. Table 7 and Fig. 6 demonstrate how the appearances of generated images change with different hyper-parameter settings. The results revealed that $\lambda$ had a greater impact on I2P evaluation scores compared to $\tau$, as shown in Table 7, primarily due to its direct control over the extent of image editing. Specifically, $\lambda$ values of 0.1 to 0.5 demonstrated comparable effects; however, the increase of $\lambda$ to 0.7 led to a notable increase in I2P scores, signifying diminished performance. This suggests that excessively high $\lambda$ values can lead to over-editing, potentially corrupting the original image characteristics and causing unexpected image artifacts, resulting in distorted or unusual images.

Figure 6 provides visual evidence of the effects of varying $\lambda$ and $\tau$ on the generated images. The figure demonstrates that when $\tau$ value is smaller than 25, increasing $\lambda$ leads to a noticeable decline in image quality. In particular, at $\lambda$ values of 0.7 and 0.9, the images exhibited significant noise and distortion, making them appear bizarre and causing the classifiers to perceive them as inappropriate. This is consistent with the result of Table 7 that increased $\lambda$ value leads to a decrease in performance. Moreover, we can observe that $\tau$, which determines the timing of the editing initiation, influences the degree of image editing. A larger $\tau$ value allows the initial image structure to form more completely before the editing process begins, resulting in outputs that more closely resemble the intended original image. That is, a higher $\tau$ value mitigates the artifacts introduced by $\lambda$, resulting in fewer distortions.

Therefore, the ablation study showed that careful tuning of both $\lambda$, which controls the extent of inappropriate content removal, and $\tau$, which controls the initiation of editing, proved crucial for achieving high image quality and appropriateness. The findings consistently indicated that setting $\tau$ to 0 and $\lambda$ to 0.3 resulted in the best performance across qualitative and quantitative assessments, thus we adopted this configuration throughout all of our experiments.

RQ1. Effectiveness and efficiency

We investigated whether our attention map-based approach could effectively and efficiently mitigate inappropriate content in generative models. Our comprehensive quantitative evaluations, supported by qualitative analyses, consistently affirm its capabilities. Our method substantially reduces the presence of inappropriate content in the generated image. While SLD-Max achieved the highest reduction in I2P scores by modifying the latent space, it often led to significant alterations in the original image’s visual appearance, as evident in our qualitative results. In contrast, our approach precisely modifies cross-attention maps, which directly govern specific semantic regions tied to the prompt within the image. Unlike the latent space, which encodes more global and abstract image features, manipulating these attention maps allows for highly targeted content mitigation. By adjusting these specific attention weights, we can suppress undesired content without compromising the image’s inherent visual/structural integrity, as reflected in superior LPIPS scores. Furthermore, our approach maintained consistent text-image alignment, with CLIP scores showing only negligible differences across all models, confirming that semantic relations were largely preserved, even after mitigation. In terms of computational efficiency, our method demonstrated significantly lower GPU memory usage and faster runtime compared to baseline methods. This improvement is primarily due to our strategy of directly modifying cross-attention maps during inference, which eliminates the need for additional training or complex post-processing steps.

In essence, our attention map-based approach successfully addresses RQ1 by offering an effective and efficient solution that achieves a superior balance of content mitigation, visual preservation, text-image alignment, and low computational cost, compared to existing methods.

RQ2. Human perception of quality

Our investigation into human perception of quality and effectiveness directly addresses the limitations observed with automatic metrics, which often fall short in capturing the nuanced improvements or human visual perception. As detailed in our perceptual study, human evaluators consistently favored our method across all assessed metrics. Notably, our approach outperformed baselines in both inappropriateness reduction and text-image alignment from a human perspective, contrasting with quantitative I2P and CLIP results. This indicates the limitations of automated classifiers in detecting nuanced improvements/changes that are readily apparent to human observers. Furthermore, participants particularly valued our method’s ability to reduce inappropriateness while maintaining the context and properties of the original image. This consistency led to a higher perceived overall quality, positioning our method as the most favored among participants.

In summary, these findings highlight that while automated metrics offer a valuable initial assessment, human perception is crucial for accurately assessing the practical effectiveness and usability of safety mechanisms in generative AI. Our superior performance in human evaluations demonstrates that methods preserving original image context and exhibiting subtle, targeted edits are more favorably received by users, particularly in interactive image generation and editing where iterative refinement of outputs is needed.

RQ3. Impact of hyper-parameter on performance

Our ablation study, focusing on the hyper-parameters $\tau$ and $\lambda$, highlights their critical role in balancing inappropriate content mitigation and visual fidelity. These hyper-parameters not only impact the technical performance (i.e., I2P score), but also reflect deeper trade-offs between content mitigation and visual fidelity. Specifically, $\lambda$ governs the intensity of mitigation by scaling the modified attention values. While moderate values (e.g., $\lambda =0.3$) effectively suppressed inappropriate content with minimal visual disruption, excessively high values led to over-editing, introducing noise and artifacts that degraded both visual quality and semantic consistency. This degradation arises because attention maps associated with inappropriate tokens ( $M_{inappr}$) may partially overlap with semantically relevant features of the original prompt. For instance, an inappropriate object might be intricately linked to the overall scene composition, lighting, or even the subject’s posture. As a result, aggressive subtraction of even the scaled residual attention map ( $M_r$) from ( $M_{text}$) risks inadvertently erasing essential visual information. This points to a delicate balance: overly aggressive intervention may corrupt the very characteristics we aim to preserve, paradoxically making the output inadequate. Conversely, $\tau$ influences the degree of original image preservation by determining the editing initiation timestep. A larger $\tau$ permits the initial image structure to form more completely based on the original prompt. While this approach preserves visual fidelity, it can lead to a limited extent of inappropriate content reduction, as the core image structure might already be established.

Our findings highlight that careful co-tuning of $\tau$ and $\lambda$ is crucial for achieving both high image quality and effective inappropriateness reduction, as these parameters dictate the balance of mitigation intensity and visual preservation. This balance ensures our method effectively removes undesirable elements while maintaining visual integrity and preventing unintended artifacts.

Ethical considerations

As image editing capabilities become sophisticated through fine-grained control techniques such as cross-attention map manipulation, it is imperative to examine their ethical implications. While our method offers a powerful way to mitigate inappropriate content while preserving original intent, the ability to selectively suppress or alter visual content may inadvertently facilitate the creation of misleading or malicious imagery. This raises serious concerns about digital authenticity, the potential to create convincing but manipulated images for deceptive purposes, such as creating deepfakes or altering journalistic content. This necessitates the development of clear ethical guidelines for the responsible deployment of such technologies. Moreover, the lack of transparency regarding how attention-guided edits are applied may hinder efforts to detect or audit alterations. Developers should provide clear indicators when automated modifications have occurred, ensuring users maintain control and awareness over the final artistic product. While our primary focus is on enhancing safety, the dual-use nature of this technology demands continuous vigilance and a commitment to mitigating its potential for harm.

Limitations

While our proposed approach demonstrates promising capabilities in mitigating inappropriate content in image generation, we acknowledge several limitations.

First, despite its efficacy, the proposed method may struggle with highly complex scenes or subtle edge cases where inappropriate content is deeply embedded within intricate contexts For instance, our attention map-based manipulation struggled to separate inappropriate elements from essential semantic content in several scenarios, as shown in Fig. 7. The method had particular difficulty with abstractly rendered offensive material (e.g., painterly distorted or complex textual faces; columns 1–2), subtly conveyed inappropriate themes (e.g., implicit horror in post-apocalyptic or densely crowded scenes; columns 3–4), and scenes dominated by undesired content (e.g., dominant anatomical features; column 5). In such cases, inappropriate content may not be completely removed or clearly replaced.

Second, our method relies on predefined hyper-parameters ( $\tau$, $\lambda$). While the parameter set is relatively minimal compared to existing safety methods (e.g., SLD), it still requires manual tuning to adapt to different types of inappropriate content, varying image styles, and dataset distributions. This not only introduces operational overhead but also limits the method’s capability and robustness in real-world, heterogeneous deployment settings where content types and social norms may vary widely.

Third, the I2P benchmark dataset and its corresponding classifier used to detect inappropriateness (i.e., Q16 and NudeNet) may carry inherent biases that affect the fairness and generalizability of our results. These biases may arise from imbalanced representation of cultural, social, or contextual norms within the dataset, potentially leading to inconsistent judgments about what constitutes “inappropriate” content. For instance, classical artworks such as Michelangelo’s David might be classified as inappropriate due to the presence of nudity, without considering their artistic and historical context. Similarly, images of indigenous body paint or ceremonial dresses may be misclassified as inappropriate nudity due to exposed skin or unfamiliar patterns. Such biases could inadvertently influence learned mitigation strategies and reported performance, thereby limiting the generalization of findings to diverse real-world scenarios. Future research should consider evaluating mitigation methods using more diverse, culturally sensitive, and continuously updated datasets to ensure fairness, robustness, and broader applicability across global user populations.