Safe Autoregressive Image Generation with Iterative Self-Improving Codebooks

Unlike diffusion-based models that operate in continuous latent spaces, autoregressive unified multimodal models produce images by sequentially predicting discretized visual tokens. These tokens are derived from a codebook that maps embeddings to quantized visual patterns. The language-like architecture enables unified multimodal models to effectively capture text conditional information for generation, making them promising for text-to-image tasks. This also raises an interesting question: how safe are the images generated in such an autoregressive way? In this work, we propose iterative self-improving codebooks for safe autoregressive generation. We leverage the understanding and judgment capabilities of the unified multimodal model itself to identify unsafe generated images without human annotation. Subsequently, the inherent representations in the codebook are fixed to eliminate harmful mappings. Our method comprises two steps: first, we use the unified model to identify unsafe generations and construct corresponding harmful and safe image-text pairs. These pairs are used to construct the Harmful Space and guide updates to the codebook, thereby eliminating harmful outputs. Second, we perform adaptive fine-tuning on the codebook within the harmless space using safe image-text pairs to ensure the quality of generated images. These two steps are repeated until no further improvement is observed, producing a safety-enhanced model codebook. Without additional external feedback, the safety of models is improved iteratively.

AI image generation is becoming increasingly powerful, but it also carries risks: models can produce harmful or inappropriate images when given certain text prompts. While researchers have worked to make one family of image generation models safer, a newer and rapidly growing family called autoregressive models, which generate images in a step-by-step manner similar to how language models generate text, has received far less scrutiny. We ask a simple but important question: are images generated by these newer models safe? To address this, we develop a method that makes these models safer without requiring any human labelers to manually flag harmful content. Our approach works in two stages. First, we let the model examine its own outputs and identify which generated images are harmful. Using this self-assessment, we locate the internal building blocks responsible for producing harmful visual patterns and remove those harmful associations. Second, we fine-tune the remaining building blocks using safe examples in a way that prevents harmful content from being reintroduced. These two stages repeat in cycles until no further improvement is achieved.