Writing study: SAFETY-GUIDED FLOW (SGF): A UNIFIED FRAMEWORK FOR NEGATIVE GUIDANCE IN SAFE GENERATION

ICLR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICLR 2026 oral writing corpus

Mingyu Kim, Young-Heon Kim, Mijung Park · Official ICLR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Inference, algorithms & systems efficiency (primary) · Theory & formal foundations.

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

28 physical pages

Before references / appendix

≈ 10.57 page-equivalents

Main figures / tables

4 / 4

Attached appendix figures / tables

8 / 2

Attached appendix span

≈ 13.89 page-equivalents

Before references / appendix: ≈ 37.75%References / intervening material: ≈ 12.64%Attached appendix: ≈ 49.61%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 INTRODUCTION	1	≈ 1.46 pp.	5.21%
2 RELATED WORKS	3	≈ 0.42 pp.	1.5%
3 BACKGROUND	3	≈ 1.21 pp.	4.32%
4 METHOD	4	≈ 2.9 pp.	10.36%
5 EXPERIMENTS	7	≈ 3.03 pp.	10.82%
6 CONCLUSION	10	≈ 0.44 pp.	1.57%
ACKNOWLEDGMENTS	11	≈ 0.22 pp.	0.79%
ETHICS STATEMENT	11	≈ 0.14 pp.	0.5%
REPRODUCIBILITY STATEMENT	11	≈ 0.11 pp.	0.39%
REFERENCES	11	≈ 3.53 pp.	12.61%
A PROOF OF THEOREM 2	15	≈ 1 pp.	3.57%
B SAFE DENOISER: DECOMPOSING INTO SAFE AND UNSAFE DENOISERS	16	≈ 1.33 pp.	4.75%
C SHIELDED DIFFUSION (SPELL)	17	≈ 1.67 pp.	5.96%
D IMPLEMENTATION DETAILS	19	≈ 4.26 pp.	15.21%
E ADDITIONAL DISCUSSION	23	≈ 0.84 pp.	3%
F ADDITIONAL EXPERIMENTS	24	≈ 1.23 pp.	4.39%
G GRAPHICAL EXAMPLES	25	≈ 3.57 pp.	12.75%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Figure 2 · p. 5
• Table 1 · p. 8
• Table 2 · p. 8
• Table 3 · p. 9
• Figure 3 · p. 9
• Figure 4 · p. 9
• Table 4 · p. 10

Attached appendix

• Figure D.1 · p. 22
• Figure F.2 · p. 24
• Table F.1 · p. 24
• Table F.2 · p. 25
• Figure G.3 · p. 25
• Figure G.4 · p. 26
• Figure G.5 · p. 26
• Figure G.6 · p. 27
• Figure G.7 · p. 28
• Figure G.8 · p. 28

Argument and organization

1. Unifying negative guidance

   Connect kernel repulsion to two existing methods before giving an early-window control argument.

2. Safety, diversity and memorization experiments

   Separate three operational objectives, then vary guidance duration and placement.

Problem, claim and contribution

The introduction identifies a precise unresolved question—when to intervene—rather than simply proposing stronger suppression. The three contribution bullets distinguish formulation, equivalence claims and timing analysis.

Section 1, pages 1–2. · Main paper

Argument and section order

The timing ablation tests equal per-step strength, equal integrated budget and shifted fixed-width windows, isolating intervention timing more convincingly than comparing full and early-only guidance alone.

Figure 4 and Section 5.4, pages 9–10. · Main paper

Figures, captions and visual explanation

The four-panel toy example distinguishes the learned field, repulsive direction, full guidance and early stopping; its caption supplies Wasserstein values alongside a visual mechanism.

Figure 2, page 5. · Main paper

Tables, comparisons and evidence

Table 1 groups fine-tuning and training-free pipelines and separates attack success from benign-image quality. Table 2 retains precision/diversity trade-offs rather than reporting only the most favorable metric.

Tables 1–2, page 8. · Main paper

Appendix and reproducibility

Appendix D gives actual kernel-gradient code and sampler settings, while Appendix E explicitly discusses diffusion-language-model schedules outside the proposed regime.

Appendices D–E, pages 19–24. · Main paper

Clarity and writing conventions

Theoretical unification is overstated: Appendix C supplies a bandwidth-existence condition absent from the main proposition, and matching one radius is not equality of entire force fields. Appendix A's drift inequalities also do not follow directly from the stated absolute-value assumption.

Proposition 2, page 6; Appendix A, page 15; Appendix C.1, page 18. · Main paper

What to reuse—and what not to infer

Transferable lesson: For inference guidance, make timing a controlled experimental variable and report safety together with fidelity and diversity, not one composite victory claim.

Boundary: Treat empirical improvements separately from certified safety. Negative-set coverage and detector thresholds bound the evidence; the main/appendix memorization values and theoretical/code sign conventions need reconciliation before reimplementation.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-19

Reading status

Full text + selected visuals inspected

Main text

Pages 1–11: Sections 1–6 and ethics/reproducibility statements.

Appendix / supplement

Pages 15–28: Appendices A–G, proofs, source-code listings, protocols and qualitative-example captions.

Visually inspected PDF pages

5, 8

• ICLR 2026 final proceedings · 28 pages