| --- |
| license: apache-2.0 |
| library_name: pytorch |
| tags: |
| - text-to-image |
| - safety |
| - guardrail |
| - content-moderation |
| - pytorch |
| base_model: |
| - Tongyi-MAI/Z-Image-Turbo |
| - Qwen/Qwen-Image-2512 |
| - hunyuanvideo-community/HunyuanImage-2.1-Diffusers |
| - black-forest-labs/FLUX.2-klein-base-9B |
| - InternVL-U/InternVL-U |
| --- |
| |
| # InGuard Released Weights |
|
|
| This repository contains the released guardrail heads for |
| [InGuard](https://github.com/Alibaba-AAIG/InGuard), an in-pipeline safety |
| framework for text-to-image generation. It does not contain the five base |
| text-to-image models. |
|
|
| For each supported model, the release provides: |
|
|
| - a PE-MLP classifier operating on text-encoder embeddings; and |
| - a ConvNeXt-Base detector operating on an intermediate latent estimate. |
|
|
| ## Supported models |
|
|
| | Model key | PE-MLP input dimension | Latent channels | Detection step | |
| |---|---:|---:|---:| |
| | `z-image-turbo` | 2560 | 16 | 3 | |
| | `qwen-image-2512` | 3584 | 16 | 4 | |
| | `hunyuan-image-2_1` | 3584 | 64 | 4 | |
| | `flux2-klein-base-9b` | 12288 | 32 | 4 | |
| | `internvl-u` | 4096 | 16 | 8 | |
|
|
| `Detection step` uses zero-based indexing and refers to the default deployed |
| configuration in the InGuard code repository. |
|
|
| ## Repository layout |
|
|
| ```text |
| . |
| ├── latent_detector/ |
| │ └── <model>/ |
| │ ├── model.pth |
| │ └── config.json |
| ├── pe_mlp/ |
| │ └── <model>/ |
| │ └── model.pth |
| └── manifest.json |
| ``` |
|
|
| The PE-MLP checkpoints contain `input_dim`, `hidden_dim`, `num_layers`, and |
| `dropout` together with `model_state_dict`; no separate PE-MLP config file is |
| required. Training optimizer states have been removed from all released |
| checkpoints. |
|
|
| ## Download and verify |
|
|
| ```bash |
| git clone https://github.com/Alibaba-AAIG/InGuard.git |
| cd InGuard |
| hf download Alibaba-AAIG/InGuard --local-dir weights |
| pip install -r requirements.txt |
| python scripts/verify_pipeline.py \ |
| --model z-image-turbo \ |
| --stage components \ |
| --device cpu |
| ``` |
|
|
| Use `--stage quick` for file and manifest checks. End-to-end generation also |
| requires the corresponding base model and a suitable GPU; see the main |
| InGuard README for complete instructions. |
|
|
| ## Intended use |
|
|
| These weights are intended for research on generation-time safety screening, |
| prompt-embedding enhancement, and intermediate-latent risk detection with the |
| supported base models. |
|
|
| They are not a standalone image-generation model and must not be treated as a |
| complete content-safety solution. Performance can vary across prompts, |
| languages, model revisions, sampling settings, and content outside the |
| released evaluation distribution. Users remain responsible for downstream |
| validation and compliance with applicable law and platform policy. |
|
|
| ## Base-model terms |
|
|
| The supported base models are not redistributed here. Download them from their |
| respective providers and comply with their individual licenses and access |
| terms. |
|
|
| ## License |
|
|
| The InGuard guardrail weights are released under the Apache License 2.0. See |
| `LICENSE` for details. |
|
|
| ## Citation |
|
|
| ```bibtex |
| @article{wang2026inguard, |
| title = {InGuard: Towards Generalized Inner Guardrail for |
| Safe Text-to-Image Generation}, |
| author = {Wang, Zeyu and Li, Xiaodan and Li, Zhiwen and |
| Chen, Yuefeng and Xue, Hui}, |
| journal = {arXiv preprint arXiv:2609.27620}, |
| year = {2026}, |
| doi = {10.48550/arXiv.2609.27620}, |
| url = {https://arxiv.org/abs/2609.27620} |
| } |
| ``` |
|
|
