Keep It CALM: A Geometric Case That One Global 'Unsafe Direction' Cannot Fix Text-to-Image Safety Everywhere

A different kind of safety paper

Most headlines about AI image generators and safety involve a filter that let something through that should not have, or blocked something harmless. A new peer-reviewed-venue paper argues that a common design of such filters has a deeper problem than bad tuning: the mathematics of the approach itself makes certain failures unavoidable.

The paper is 'Keep It CALM: Analyzing the Limits of Global Unsafety in Text-to-Image Generation' by NaHyeon Park, Minhyun Lee and Hyunjung Shim. It was submitted to arXiv on October 1, 2026 (arXiv:2610.02300) and is marked as accepted at NeurIPS 2026, a leading machine learning conference.

This article is an analysis of the paper's claims, not a report of a new product or incident. Note on sourcing: the full text of the paper was not retrievable at drafting time, so the concrete benchmark numbers, datasets and baseline comparisons in the paper could not be independently verified here. What follows is grounded in the paper's verified abstract page on arXiv, which states the paper's central claims in the authors' own words. Anything beyond that is labeled as the authors' self-reported claim or as this publication's interpretation.

What 'global unsafety' means, in plain language

Text-to-image models turn a written prompt into an image. Internally, the model represents each prompt as a list of vectors, one per token, in a high-dimensional space. Directions in that space can encode meaning, and researchers have found that some directions seem to encode 'unsafe' content such as violent or explicit material.

Many training-free safety filters exploit that idea. Instead of retraining the model, they compute a reusable safety signal, often called an unsafe direction or a global toxic subspace, and then suppress that component of the representation whenever a prompt is processed. One direction, removed everywhere, for every prompt.

The appeal is obvious. It is cheap, it needs no fine-tuning, and it can be bolted onto an existing model. The new paper questions whether the premise, that unsafe content lives in one compact, reusable direction, can actually hold.

The coverage-selectivity trade-off

The paper's abstract describes a 'controlled geometric analysis of this global-unsafety assumption' that 'reveal[s] a consistent coverage-selectivity trade-off.' Here is what that phrase captures, as the authors state it.

On one side is coverage. Unsafe content is heterogeneous: violence, explicit material, self-harm and other categories do not all point the same way in the model's internal space. A compact subspace, the abstract says, 'fail[s] to cover heterogeneous unsafe semantics.' If you remove only a small slice of the space, many kinds of unsafe prompts are untouched and slip through.

On the other side is selectivity. If you widen the removal, aggregating more and more directions to catch more unsafe content, the removed region starts to overlap with ordinary meaning. The abstract states that 'broader aggregation increasingly distorts safety-adjacent benign prompts.' Prompts that sit near the unsafe region geometrically, even if they are perfectly innocent in intent, get degraded or suppressed.

The consequence a general reader should take from the analysis: a filter built this way can be simultaneously too permissive on some unsafe prompts and over-censored on innocent ones. In the paper's framing, that is a structural property of the design, not a bug that better tuning would erase.

One caution before going further. The geometric critique is the paper's demonstrated analysis. The behavioral conclusions, how often real filters under-block or over-block, depend on the paper's experiments, which could not be verified for this article. And the claim certainly does not mean every deployed filter 'will fail in production.' It means one family of filter designs has an identified structural limitation, under the conditions the authors tested.

CALM: replacing global removal with local correction

The authors' proposed alternative is CALM, short for Counterfactual Adaptive Local Modulation. It is also training-free, so it shares the practical appeal of the filters it critiques.

Per the abstract, CALM works in three steps. First, using 'matched unsafe-benign anchors,' it routes each prompt to the unsafe categories it actually touches, rather than applying one global treatment. Second, it 'minimally edits only violating token representations toward the safe side,' so tokens that are not implicated are left alone. Third, it 'suppresses positively aligned unsafe residual components,' cleaning up whatever unsafe alignment remains after the local edit.

In plain terms: instead of carving one unsafe direction out of the whole model, CALM looks at each prompt, asks which unsafe categories it resembles, and nudges only the offending pieces of the prompt's representation toward safety.

The abstract's bottom line, in the authors' words: 'Across broad evaluation, CALM significantly improves unsafe content suppression while preserving benign utility, demonstrating that local counterfactual correction provides a more selective alternative to global unsafe signal removal.'

That last sentence deserves careful labeling. It is the authors' self-reported result. The claim that CALM beats global-removal baselines rests on the paper's own broad evaluation and, like any new method's claims, awaits independent replication. This article presents it as a reported result, not established fact.

Why it matters beyond this one paper

If the coverage-selectivity trade-off generalizes, it helps explain a familiar frustration. Users of image generators sometimes see plainly innocent prompts refused or degraded while, in other reported incidents, problematic content slips through. A structural account like this one suggests the two phenomena can come from the same design choice, rather than from carelessness on either side.

It also matters for how the field builds safeguards. 'Training-free' methods are attractive because they are fast to deploy and do not require touching the base model. But the paper's argument implies that the specific implementation most commonly used, global subspace removal, buys its simplicity at a real price.

The practical direction the paper points toward is targeted, per-prompt intervention. Whether CALM specifically is the right implementation is exactly the kind of question independent evaluation should answer. The geometric diagnosis is the paper's strongest, most reproducible contribution; the method's superiority is the part most in need of outside confirmation.

For developers and policy-minded readers, the takeaway is modest but useful: safety filter behavior should be evaluated on both dimensions at once, unsafe suppression and benign utility, and a filter that looks good on one may be quietly failing on the other because of how it is built, not how it was tuned.

What this article could and could not verify

Verified here, from the arXiv abstract page retrieved on October 6, 2026: the paper's title, authors, submission date of October 1, 2026, NeurIPS 2026 acceptance note, DOI, and the full text of the abstract, including the coverage-selectivity trade-off claim and the description of CALM.

Not verified here: the paper's experimental setup, datasets, baseline filters, and all quantitative results. The HTML version of the paper returned only section headings at retrieval time, and the PDF was unavailable. Those details are therefore reported only as summarized in the abstract, and no specific numbers are cited in this article.

Interpretation and opinion in this article: the framing of the trade-off's significance for everyday users and filter design is this publication's assessment, clearly separated above from the paper's own claims. The paper's analysis and CALM's reported performance belong to the authors; whether CALM holds up in replication is an open question.