feat(safety): adultify realistic prompts, strengthen minor-block negatives, dedicated Qwen guard VLM

- _adultify_prompt rewrites girl->woman / 1girl->1woman on models flagged
realistic (samanima, realism-illustrious, the 3 z-image); anime keeps 1girl.
- MINOR_NEG force-prepended in _resolve_negative for realistic models even when
the caller supplies a negative; seed loli/child/shota into anime negatives too.
- Split VLM: Gemma stays the prompt assistant; a dedicated GUARD_MODEL_ID
(default Qwen3.5-4B, 8bit) runs _moderate_image_inner, with graceful fallback
to the main VLM on load failure. eos/pad pinned for no-generation_config Qwen.
- Log peak VRAM in the generate GPU window.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app.py

@@ -117,12 +117,57 @@ NOOBXL_PREFIX = (
     "very aesthetic, depth of field, highres"
 )
 NOOBXL_NEGATIVE = (
+    "loli, child, shota, toddler, "
     "worst quality, normal quality, anatomical nonsense, bad anatomy, "
     "interlocked fingers, extra fingers, watermark, simple background, transparent, "
     "low quality, logo, text, signature, face backlighting, backlighting"
 )
 
 
+# ---------------------------------------------------------------------------
+# Minor-safety guards (gated on a model's ``realistic`` registry flag).
+#
+# Photoreal checkpoints inherit a youthful "anime girl" prior from booru tags
+# like ``1girl`` (age-neutral in tag-space, but young-skewing in practice). On a
+# stylized anime model that reads as harmless convention; rendered photoreal the
+# same prior can look like a real minor. Two defenses, both realistic-only so the
+# anime models keep their intended ``1girl`` behaviour:
+#   1. Rewrite youthful subject tokens in the POSITIVE prompt to adult ones
+#      (``girl`` -> ``woman``, ``1girl`` -> ``1woman``) via _adultify_prompt.
+#   2. Force a strong minor-blocking NEGATIVE (MINOR_NEG) that is applied even
+#      when the caller supplies their own negative (see _resolve_negative).
+MINOR_NEG = (
+    "child, children, kid, toddler, infant, baby, loli, shota, preteen, teen, "
+    "teenager, adolescent, underage, minor, young girl, little girl, schoolgirl, "
+    "child-like face, childlike body, childish proportions, chibi"
+)
+
+# Female subject counters/tokens: standalone ``girl``/``girls`` and the booru
+# ``Ngirl(s)`` forms. The lookbehind ignores letters/digits already attached so
+# ``girlfriend`` and ``cowgirl`` are left intact; the trailing lookahead keeps it
+# from biting into ``girlish`` etc.
+_GIRL_RE = re.compile(r"(?<![a-z0-9])(\d*)\s*girls?(?![a-z])", re.IGNORECASE)
+
+
+def _adultify_prompt(prompt):
+    """Replace youthful female subject tokens with adult equivalents.
+
+    ``girl`` -> ``woman``, ``girls`` / ``2girls`` -> ``women`` / ``2women``,
+    ``1girl`` -> ``1woman``. Only the bare subject token is touched; compounds
+    like ``girlfriend`` and ``cowgirl`` are preserved by the regex boundaries.
+    """
+    if not prompt:
+        return prompt
+
+    def _repl(match):
+        digits = match.group(1) or ""
+        had_s = match.group(0).rstrip().lower().endswith("s")
+        plural = had_s or (digits not in ("", "1"))
+        return f"{digits}{'women' if plural else 'woman'}"
+
+    return _GIRL_RE.sub(_repl, prompt)
+
+
 def _apply_prefix(prompt, prefix):
     """Prepend ``prefix`` to ``prompt``, dropping any prefix tag the prompt already
     contains (case-insensitive, per comma-separated token). Empty prefix is a no-op."""
@@ -171,6 +216,7 @@ IMAGE_MODELS = {
     "realism-illustrious": dict(
         label="Realism Illustrious (Stable Yogi)", family="illustrious",
         checkpoint="checkpoints/il/realismIllustriousBy_v55FP16.safetensors",
+        realistic=True,
         steps=30, guidance=5.0, height=1152, width=896, negative=True,
         prefix="masterpiece, best quality, amazing quality, very aesthetic, absurdres, highres, ultra detailed",
         default_negative=(
@@ -182,16 +228,19 @@ IMAGE_MODELS = {
     "moody-pro-mix": dict(
         label=MODEL_ZIMAGE, family="zimageturbo",
         checkpoint="checkpoints/zimageturbo/moodyProMix_zitV12DPO.safetensors",
+        realistic=True,
         steps=9, guidance=0.0, height=1024, width=1024, negative=False, prefix="",
     ),
     "pornmaster-zimage": dict(
         label="PornMaster Z-Image", family="zimageturbo",
         checkpoint="checkpoints/zimageturbo/pornmasterZImage_turboV35Bf16.safetensors",
+        realistic=True,
         steps=9, guidance=0.0, height=1024, width=1024, negative=False, prefix="",
     ),
     "zimage-nsfw-yogi": dict(
         label="Z-Image NSFW (Stable Yogi)", family="zimageturbo",
         checkpoint="checkpoints/zimageturbo/zimageTurboNSFWBy_2602NSFWBF16.safetensors",
+        realistic=True,
         steps=9, guidance=0.0, height=1024, width=1024, negative=False, prefix="",
     ),
     "wai-anima": dict(
@@ -200,12 +249,14 @@ IMAGE_MODELS = {
         steps=24, guidance=0.0, height=1024, width=1024, negative=True,
         prefix="masterpiece, best quality,score_7,",
         default_negative=(
+            "loli, child, shota, toddler, "
             "worst quality, low quality, score_1, score_2, score_3, artist name,"
             "blurry, jpeg artifacts, lowres,censor"),
     ),
     "samanima": dict(
         label="Realistic", family="anima",
         checkpoint="checkpoints/anima/samANIMA_v20.safetensors",
+        realistic=True,
         steps=24, guidance=0.0, height=1024, width=1024, negative=True,
         prefix="masterpiece, best quality, score_7,",
         default_negative=(
@@ -235,10 +286,17 @@ def _model_entry(model_name):
 def _resolve_negative(entry, negative_prompt, use_negative_prompt, model_name):
     """The negative prompt to actually use: the caller's (when they enabled it and
     this model honors negatives), else the model's `default_negative`. Disabled or
-    unsupported -> empty."""
+    unsupported -> empty.
+
+    Realistic-leaned models additionally PREPEND the minor-safety block
+    (``MINOR_NEG``) unconditionally — even when the caller passes their own
+    negative, which would otherwise replace the default and drop the guard."""
     if not (use_negative_prompt and _supports_negative(model_name)):
         return ""
-    return (negative_prompt or "").strip() or entry.get("default_negative", "")
+    neg = (negative_prompt or "").strip() or entry.get("default_negative", "")
+    if entry.get("realistic"):
+        neg = f"{MINOR_NEG}, {neg}" if neg else MINOR_NEG
+    return neg
 
 
 # Which models to load this boot. Unknown keys are ignored; an empty / all-invalid
@@ -396,21 +454,16 @@ print(f"Image models loaded: {list(PIPELINES)}")
 VLM_MODEL_ID = os.environ.get("VLM_MODEL_ID", "prithivMLmods/gemma-4-E4B-it-Uncensored-MAX")
 VLM_LOAD_8BIT = os.environ.get("VLM_LOAD_8BIT", "0").lower() not in ("0", "false", "no", "")
 
-print(f"Loading assistant: {VLM_MODEL_ID} (8bit={VLM_LOAD_8BIT}) ...")
-vlm_processor = AutoProcessor.from_pretrained(
-    VLM_MODEL_ID, token=HF_TOKEN, trust_remote_code=True
-)
-_vlm_kwargs = dict(token=HF_TOKEN, trust_remote_code=True, torch_dtype=torch.bfloat16)
-if VLM_LOAD_8BIT:
-    # bitsandbytes quantizes the weights on GPU as they load; device_map places them
-    # there directly, so we must NOT call .to("cuda") afterwards (it errors on a
-    # quantized model).
-    _vlm_kwargs["quantization_config"] = BitsAndBytesConfig(load_in_8bit=True)
-    _vlm_kwargs["device_map"] = "auto"
-vlm_model = AutoModelForImageTextToText.from_pretrained(VLM_MODEL_ID, **_vlm_kwargs)
-if not VLM_LOAD_8BIT:
-    vlm_model.to("cuda")
-vlm_model.eval()
+# Dedicated image-moderation guard VLM, kept SEPARATE from the prompt-assistant
+# VLM so each can be specialized: Gemma (above) writes/improves prompts — fluent
+# and fast — while a stricter rater judges generated images. Defaults to a
+# Qwen3.5-4B in 8-bit (~4.5 GB) so it co-resides with Gemma + the diffusion
+# pipelines on the zero-a10g. The guard MUST be vision-capable
+# (AutoModelForImageTextToText) — confirm any override is a Qwen3.5-VL / other
+# multimodal checkpoint. Set GUARD_MODEL_ID="" to disable the split and moderate
+# with the main VLM, and GUARD_LOAD_8BIT=0 to load it in bf16.
+GUARD_MODEL_ID = os.environ.get("GUARD_MODEL_ID", "rodrigomt/Qwen3.5-4B-Uncensored-Aggressive")
+GUARD_LOAD_8BIT = os.environ.get("GUARD_LOAD_8BIT", "1").lower() not in ("0", "false", "no", "")
 
 
 def _resolve_vlm_eos_ids(tokenizer, model):
@@ -441,14 +494,54 @@ def _resolve_vlm_eos_ids(tokenizer, model):
     return sorted(ids)
 
 
-_vlm_tokenizer = getattr(vlm_processor, "tokenizer", vlm_processor)
-_VLM_EOS_IDS = _resolve_vlm_eos_ids(_vlm_tokenizer, vlm_model)
-_VLM_PAD_ID = (
-    _vlm_tokenizer.pad_token_id
-    if _vlm_tokenizer.pad_token_id is not None
-    else (_VLM_EOS_IDS[0] if _VLM_EOS_IDS else None)
+def _load_vlm(model_id, load_8bit, role="VLM"):
+    """Load a multimodal VLM (processor + model) and resolve its stop/pad ids.
+
+    bf16 by default; ``load_8bit`` uses bitsandbytes — which quantizes on GPU as
+    the weights load via ``device_map='auto'``, so we must NOT call ``.to('cuda')``
+    afterwards (it errors on a quantized model). Returns
+    ``(processor, model, eos_ids, pad_id)``."""
+    print(f"Loading {role}: {model_id} (8bit={load_8bit}) ...")
+    processor = AutoProcessor.from_pretrained(model_id, token=HF_TOKEN, trust_remote_code=True)
+    kwargs = dict(token=HF_TOKEN, trust_remote_code=True, torch_dtype=torch.bfloat16)
+    if load_8bit:
+        kwargs["quantization_config"] = BitsAndBytesConfig(load_in_8bit=True)
+        kwargs["device_map"] = "auto"
+    model = AutoModelForImageTextToText.from_pretrained(model_id, **kwargs)
+    if not load_8bit:
+        model.to("cuda")
+    model.eval()
+    tokenizer = getattr(processor, "tokenizer", processor)
+    eos_ids = _resolve_vlm_eos_ids(tokenizer, model)
+    pad_id = (tokenizer.pad_token_id if tokenizer.pad_token_id is not None
+              else (eos_ids[0] if eos_ids else None))
+    print(f"{role} loaded! (eos_ids={eos_ids}, pad_id={pad_id})")
+    return processor, model, eos_ids, pad_id
+
+
+# Prompt-assistant VLM (Gemma): the "Prompt Assistant" tab + the prompt-improve
+# pass. One-turn Q&A with an optional image; turns rough ideas into rich prompts.
+vlm_processor, vlm_model, _VLM_EOS_IDS, _VLM_PAD_ID = _load_vlm(
+    VLM_MODEL_ID, VLM_LOAD_8BIT, role="assistant VLM"
 )
-print(f"Assistant loaded! (eos_ids={_VLM_EOS_IDS}, pad_id={_VLM_PAD_ID})")
+
+# Image-safety guard VLM (moderation only). Falls back to the main VLM when
+# disabled (GUARD_MODEL_ID="" or == the assistant) or if loading fails (e.g. OOM)
+# so moderation never silently breaks and the Space always boots.
+if GUARD_MODEL_ID and GUARD_MODEL_ID != VLM_MODEL_ID:
+    try:
+        guard_processor, guard_model, _GUARD_EOS_IDS, _GUARD_PAD_ID = _load_vlm(
+            GUARD_MODEL_ID, GUARD_LOAD_8BIT, role="guard VLM"
+        )
+    except Exception as exc:  # noqa: BLE001 - degrade gracefully, never block boot
+        print(f"[guard] failed to load {GUARD_MODEL_ID}: {type(exc).__name__}: {exc}; "
+              f"moderation will use the main VLM ({VLM_MODEL_ID})", flush=True)
+        guard_processor, guard_model = vlm_processor, vlm_model
+        _GUARD_EOS_IDS, _GUARD_PAD_ID = _VLM_EOS_IDS, _VLM_PAD_ID
+else:
+    guard_processor, guard_model = vlm_processor, vlm_model
+    _GUARD_EOS_IDS, _GUARD_PAD_ID = _VLM_EOS_IDS, _VLM_PAD_ID
+    print(f"Guard VLM: using main VLM ({VLM_MODEL_ID}) for moderation")
 
 
 # =============================================================================
@@ -574,7 +667,10 @@ def _parse_moderation_json(text):
 
 
 def _moderate_image_inner(image, max_new_tokens=320):
-    """Synchronously run the VLM moderation check on a PIL image (GPU-side)."""
+    """Synchronously run the safety-guard VLM moderation check on a PIL image
+    (GPU-side). Uses the dedicated guard model (``guard_model``) — which may be a
+    different, stricter VLM than the prompt assistant — with greedy decoding and
+    NO repetition penalties (those mangle the repetitive rating JSON)."""
     messages = [{
         "role": "user",
         "content": [
@@ -582,16 +678,19 @@ def _moderate_image_inner(image, max_new_tokens=320):
             {"type": "text", "text": MODERATION_PROMPT},
         ],
     }]
-    inputs = vlm_processor.apply_chat_template(
+    inputs = guard_processor.apply_chat_template(
         messages, tokenize=True, add_generation_prompt=True,
         return_dict=True, return_tensors="pt", enable_thinking=False,
-    ).to(vlm_model.device)
+    ).to(guard_model.device)
     with torch.inference_mode():
-        generated = vlm_model.generate(
+        generated = guard_model.generate(
             **inputs, max_new_tokens=int(max_new_tokens), do_sample=False,
+            # Pin stop/pad ids so a guard model without a generation_config (e.g.
+            # the Qwen3.5 finetunes) terminates instead of rambling to the budget.
+            eos_token_id=_GUARD_EOS_IDS, pad_token_id=_GUARD_PAD_ID,
         )
     trimmed = generated[0][inputs["input_ids"].shape[-1]:]
-    tokenizer = getattr(vlm_processor, "tokenizer", vlm_processor)
+    tokenizer = getattr(guard_processor, "tokenizer", guard_processor)
     text = tokenizer.decode(trimmed, skip_special_tokens=True)
     return _parse_moderation_json(text)
 
@@ -859,6 +958,14 @@ def generate_image(
         if improved:
             effective_prompt = improved
 
+    # Minor-safety: on realistic-leaned models, rewrite youthful subject tokens to
+    # adult ones (e.g. the photoreal `1girl` -> `1woman`). Applied after any
+    # prompt-improve pass so the rewrite can't be reintroduced, and echoed back as
+    # `effective_prompt`. Anime models are not flagged `realistic`, so they keep
+    # `1girl` unchanged.
+    if _model_entry(model_name).get("realistic"):
+        effective_prompt = _adultify_prompt(effective_prompt)
+
     q = queue.Queue()
     result = {}
 
@@ -904,6 +1011,16 @@ def generate_image(
     except Exception as exc:  # noqa: BLE001 - never let moderation break generation
         moderation = {"ok": False, "rating": None, "confidence": None,
                       "flags": None, "raw": "", "error": f"{type(exc).__name__}: {exc}"}
+    # VRAM report: peak usage in this GPU window, with the diffusion pipeline +
+    # both VLMs (assistant + guard) resident. Lets us see what the guard split
+    # actually costs on the zero-a10g.
+    if torch.cuda.is_available():
+        print(
+            f"[ImageStudio] VRAM peak={torch.cuda.max_memory_allocated()/2**30:.2f} GB "
+            f"reserved={torch.cuda.memory_reserved()/2**30:.2f} GB "
+            f"(guard={GUARD_MODEL_ID or 'main-vlm'} 8bit={GUARD_LOAD_8BIT})",
+            flush=True,
+        )
     yield ("image", image, result["seed"], moderation, effective_prompt)