1 Introduction↩︎

Many generative tasks can be viewed as promoting a desirable distribution \(\pi^+\) while suppressing an undesirable one \(\pi^-\). In conditional generation, this corresponds to producing samples that better match the target condition and avoiding inconsistent outputs [1]–[8]. In safety and alignment settings, the objective is to generate value-aligned outputs while excluding harmful ones [9]–[11]. In preference learning, given preferred and dispreferred samples, the goal is to steer generation toward the preferred distribution [12]–[16]. Across these settings, the central challenge is to design mechanisms that reliably amplify desirable modes while discouraging undesirable ones.

For flow and diffusion models [17]–[23], the standard approach is to apply guidance [3]–[8] at sampling time, where trajectories are steered by extrapolating between positive and negative fields [3]. However, such procedures remain largely heuristic: their induced sampling distributions are poorly understood, making it unclear which regions of the data space are ultimately promoted or suppressed.

We propose signed measures as a principled mechanism for incorporating negative information into generative modeling. Given a distribution \(\pi^+\) to favor and \(\pi^-\) to avoid, we consider the signed target \[\pi^{\mathtt{sign}}(\boldsymbol{x}) = (1+\alpha)\,\pi^+(\boldsymbol{x}) - \alpha\,\pi^-(\boldsymbol{x}), \qquad \alpha>0.\] The goal is to use negativity to encode more than the mere absence of positive data: the signed target explicitly specifies what the model should avoid. Although \(\pi^{\mathtt{sign}}\) is not generally a probability distribution and cannot be sampled from in the usual sense, we do not seek to sample from it directly. Instead, we use it as an intermediate object for constructing a valid generative procedure that follows its positive part while avoiding regions dominated by negative mass.

To achieve this, we formally extend Rectified Flow [20], [21] to signed targets by extrapolating the standard RF velocity formula to \(\pi^{\mathtt{sign}}\). As illustrated in Fig. 2, simulating the resulting dynamics from the source distribution generates samples from a dynamically reachable subset of the positive region of the signed target. Regions in which \(\pi^{\mathtt{sign}}\) is negative are never sampled, while an additional unsampled ghost region separates the reachable and negative regions. Signed RF therefore rectifies the signed target into a valid sampling law by preserving the signed density on its reachable region and assigning zero density elsewhere.

The paper is organized as follows. In Sec. 2.1, we derive Signed RF by extending Rectified Flow from convex mixtures to signed targets. In Sec. 2.2, we characterize the induced sampling law through the notions of reachable and ghost regions, provide a charged-particle interpretation of the dynamics, and establish the main theoretical guarantees, including density preservation on the reachable region and nonpenetration into negative regions. In Sec. 2.3, we derive a practical guidance-form implementation whose strength is determined by a density ratio, estimated either with a learned classifier or through online ODE tracking. Finally, in Sec. 3, we demonstrate Signed RF across a range of applications, including conditional generation, safe generation, trajectory planning, concept suppression, and anti-memorization.

2 Method↩︎

2.1 From Rectified Flow to Signed Rectified Flow↩︎

2.1.0.1 Rectified Flow.

Let \(\pi_1\) be the target data distribution on \(\mathbb{R}^d\), and let \(\pi_0\) be a noise source, such as \(\mathcal{N}(0,\boldsymbol{I})\). Rectified Flow (RF) [20]–[23] constructs a linear interpolation \(\boldsymbol{X}_t=t\boldsymbol{X}_1+(1-t)\boldsymbol{X}_0\), where \(\boldsymbol{X}_0\sim\pi_0\) and \(\boldsymbol{X}_1\sim\pi_1\) are independent. This interpolation induces the ODE \[\frac{\mathrm d \boldsymbol{Z}_t}{\mathrm d t}=v_t^{\mathtt{RF}}(\boldsymbol{Z}_t), \qquad \text{starting from } \boldsymbol{Z}_0\sim\pi_0,\] whose velocity field is given by \[\begin{align} \label{eq:rf95velocity} v_t^{\mathtt{RF}}(\boldsymbol{x}) = \mathbb{E}\bigl[\boldsymbol{X}_1 - \boldsymbol{X}_0 \mid \boldsymbol{X}_t = \boldsymbol{x}\bigr]. \end{align}\tag{1}\] Let \(\pi_t\) denote the marginal distribution of \(\boldsymbol{X}_t\). A key property of RF is marginal preservation: the ODE solution satisfies \(\boldsymbol{Z}_t\sim\pi_t\) for all \(t\in[0,1]\), and in particular \(\boldsymbol{Z}_1\sim\pi_1\). In practice, the velocity field \(v_t^{\mathtt{RF}}\) is approximated by a neural network \(v^\theta\) trained with \[\mathcal{L}(\theta) = \int_0^1\mathbb{E}\Bigl[\|v^\theta(\boldsymbol{X}_t,t)-(\boldsymbol{X}_1-\boldsymbol{X}_0)\|^2\Bigr]\,\mathrm{d}t.\]

2.1.0.2 Rectified Flow for Convex Mixtures.

We next examine how Rectified Flow behaves under mixtures of target distributions. Let \((\pi_t^+,v_t^+)\) and \((\pi_t^-,v_t^-)\) denote the RF marginals and velocity fields induced, respectively, by \(\boldsymbol{X}_t^+\!=\!(1-t)\boldsymbol{X}_0+t\boldsymbol{X}_1^+\) and \(\boldsymbol{X}_t^-\!=\!(1-t)\boldsymbol{X}_0+t\boldsymbol{X}_1^-\), where \(\boldsymbol{X}_0\sim\pi_0\), \(\boldsymbol{X}_1^+\sim\pi_1^+\), and \(\boldsymbol{X}_1^-\sim\pi_1^-\). For the convex mixture \(\pi_1^{\mathtt{mix}}\!=\!(1-w)\pi_1^+ + w\pi_1^-\), with \(w\in[0,1]\), linearity of the RF marginal and flux gives \(\pi_t^{\mathtt{mix}}\!=\!(1-w)\pi_t^+ + w\pi_t^-\). Applying Eq. 1 to the mixture gives the RF velocity field \[v_t^{\mathtt{mix}}(\boldsymbol{x}) = \frac{ (1-w)\,\pi_t^+(\boldsymbol{x})\,v_t^+(\boldsymbol{x}) + w\,\pi_t^-(\boldsymbol{x})\,v_t^-(\boldsymbol{x}) }{ (1-w)\,\pi_t^+(\boldsymbol{x}) + w\,\pi_t^-(\boldsymbol{x}) }. \label{eq:mixture95velocity}\tag{2}\] By the marginal-preservation property of RF, integrating \(\dot{\boldsymbol{Z}}_t\!=\!v_t^{\mathtt{mix}}(\boldsymbol{Z}_t)\) from \(\boldsymbol{Z}_0 \!\sim\!\pi_0\) yields \(\boldsymbol{Z}_t\sim\pi_t^{\mathtt{mix}}\) for all \(t\in[0,1]\), and in particular \(\boldsymbol{Z}_1\sim\pi_1^{\mathtt{mix}}\). For \(w\in[0,1]\), \(\pi_t^{\mathtt{mix}}\) remains a nonnegative, normalized density for all \(t\), and the associated dynamics therefore define a standard probability flow. A natural question, however, is what happens when \(w\) is allowed to be negative.

2.1.0.3 Rectified Flow for Signed Mixtures.

We now extend the mixture coefficient beyond the convex regime by setting \(w\!=\!-\alpha\), where \(\alpha>0\). This gives the signed target \(\pi_1^{\mathtt{sign}}(\boldsymbol{x})\!\mathrel{\vcenter{:}}=\!(1+\alpha)\pi_1^+(\boldsymbol{x})-\alpha\pi_1^-(\boldsymbol{x})\), which has unit total mass but need not be nonnegative. By linearity of the RF marginals, the corresponding signed marginal is \(\pi_t^{\mathtt{sign}}(\boldsymbol{x})\!=\!(1+\alpha)\pi_t^+(\boldsymbol{x})-\alpha\pi_t^-(\boldsymbol{x})\) for \(t\in[0,1]\). Substituting \(w\!=\!-\alpha\) into Eq. 2 yields the Signed RF velocity field \[v_t^{\mathtt{signRF}}(\boldsymbol{x}) = \frac{ (1+\alpha)\,\pi_t^+(\boldsymbol{x})\,v_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x})\,v_t^-(\boldsymbol{x}) }{ (1+\alpha)\,\pi_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x}) }. \label{eq:signed95rf95velocity}\tag{3}\] The denominator is precisely \(\pi_t^{\mathtt{sign}}(\boldsymbol{x})\), and hence \(v_t^{\mathtt{signRF}}\) is well defined away from the zero set \(\Omega_t^0\!\mathrel{\vcenter{:}}=\!\{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})=0\}\). Although \(\pi_t^{\mathtt{sign}}\) may fail to be a probability density, its initial marginal remains the valid source distribution: \(\pi_0^{\mathtt{sign}}\!=\!\pi_0\). We therefore define Signed RF through the source-initialized ODE \(\dot{\boldsymbol{Z}}_t\!=\!v_t^{\mathtt{signRF}}(\boldsymbol{Z}_t)\), with \(\boldsymbol{Z}_0\sim\pi_0\), and denote the law of \(\boldsymbol{Z}_t\) by \(\pi_t^{\mathtt{signRF}}\). As we establish below, source-initialized trajectories remain in the positive region \(\Omega_t^+\!\mathrel{\vcenter{:}}=\!\{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})>0\}\) and do not cross the singular zero set \(\Omega_t^0\). The singular boundary therefore acts as a repulsive barrier for the realized dynamics, allowing the ODE to remain well defined along sampled trajectories even when the signed marginal develops negative regions.

2.2 Sampling Behavior of Signed RF↩︎

By construction, \(\pi_t^{\mathtt{signRF}}\), as the law of the source-initialized ODE, is a valid probability distribution. In contrast, \(\pi_t^{\mathtt{sign}}\) has unit total mass but may take negative values. Therefore, once negative regions emerge, \(\pi_t^{\mathtt{signRF}}\) can no longer coincide globally with \(\pi_t^{\mathtt{sign}}\). This raises the central question: which part of the signed marginal is realized by the source-initialized flow? The one-dimensional example in Fig. 2 illustrates the resulting structure. The black curve shows the signed marginal \(\pi_t^{\mathtt{sign}}\), while the blue histogram shows the empirical density obtained by simulating the ODE driven by \(v_t^{\mathtt{signRF}}\) from \(\boldsymbol{Z}_0\sim\pi_0\). Their evolution reveals three key phenomena.

• Trajectories remain in the positive region. The source-initialized trajectories remain in the positive region \(\Omega_t^+\!\mathrel{\vcenter{:}}=\!\{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})>0\}\) and never enter the negative region \(\Omega_t^-\!\mathrel{\vcenter{:}}=\!\{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})<0\}\). However, they generally occupy only a subset of \(\Omega_t^+\). We define \(\Omega_t^r\!\mathrel{\vcenter{:}}=\!\operatorname{supp}(\pi_t^{\mathtt{signRF}})\) as the reachable region, shown in blue in Fig. 2.

• Signed RF rectifies the signed marginal. On the reachable region \(\Omega_t^r\), the sampling density \(\pi_t^{\mathtt{signRF}}(\boldsymbol{x})\) coincides exactly with the signed marginal \(\pi_t^{\mathtt{sign}}(\boldsymbol{x})\). Outside this region, no mass is realized by the source-initialized flow. That is, \[\pi_t^{\mathtt{signRF}}(\boldsymbol{x}) = \pi_t^{\mathtt{sign}}(\boldsymbol{x})\,\mathbf{1}\{\boldsymbol{x}\in \Omega_t^r\}. \label{eq:signed95rf95sampling95law}\tag{4}\]

• The ghost region. The remaining part of the positive region, \(\Omega_t^g\!\mathrel{\vcenter{:}}=\!\Omega_t^+\setminus\Omega_t^r\), is not reached by trajectories initialized from \(\pi_0\). We call it the ghost region. Since both \(\pi_t^{\mathtt{signRF}}\) and \(\pi_t^{\mathtt{sign}}\) have unit total mass, Eq. 4 implies \[\int_{\Omega_t^r} \pi_t^{\mathtt{sign}}(\boldsymbol{x})\,\mathrm{d}\boldsymbol{x}= 1 \qquad\Longrightarrow\qquad \int_{\Omega_t^g} \pi_t^{\mathtt{sign}}(\boldsymbol{x})\,\mathrm{d}\boldsymbol{x} + \int_{\Omega_t^-} \pi_t^{\mathtt{sign}}(\boldsymbol{x})\,\mathrm{d}\boldsymbol{x} = 0.\] Thus, the positive mass contained in the ghost region exactly balances the magnitude of the negative mass excluded from the sampling law.

2.2.0.1 Remark.

The identities above characterize the mass decomposition, but the location of the reachable region \(\Omega_t^r\) is determined implicitly by the flow dynamics. In general, it need not admit a closed-form representation; all that is known is that it lies inside the positive region and is separated from the negative region \(\Omega_t^-\) by the ghost region. Thus, Signed RF can be viewed as “rectifying” the signed marginal \(\pi_t^{\mathtt{sign}}\) into a valid probability law \(\pi_t^{\mathtt{signRF}}\): it preserves the signed density on a reachable subset of the positive region and sets it to zero elsewhere. Equivalently, \(\pi_t^{\mathtt{signRF}}\) is one of the total-variation-optimal nonnegative approximations to \(\pi_t^{\mathtt{sign}}\), solving \(\min_{\rho\in\mathcal{P}} \mathrm{TV}(\rho,\pi_t^{\mathtt{sign}})\) over the set of valid probability distributions \(\mathcal{P}\). See Proposition 1. The corresponding region decomposition is summarized in Fig. 3.

2.2.0.2 The physical picture.

How does the ghost region arise? A useful intuition is to interpret the Signed RF dynamics as the motion of charged particles. Starting from the terminal signed target \(\pi_1^{\mathtt{sign}}\), trace the dynamics backward toward \(t=0\). Imagine placing a particle at each \(\boldsymbol{x}\) at \(t=1\), with charge determined by the sign of \(\pi_1^{\mathtt{sign}}(\boldsymbol{x})\), and evolving it backward according to \(\dot{\boldsymbol{Z}}_t=v_t^{\mathtt{signRF}}(\boldsymbol{Z}_t)\). Its fate depends on the region from which it originates.

• Reachable particles. Positive particles originating from the reachable region \(\Omega_1^r\) admit well-defined backward trajectories all the way to \(t=0\). These trajectories remain in the positive region and, collectively, recover the source distribution \(\pi_0\) at \(t=0\). Reversing them in time yields precisely the trajectories obtained by simulating Signed RF forward from \(\boldsymbol{Z}_0\sim\pi_0\).

• Ghost and negative particles. Positive particles originating from the ghost region \(\Omega_1^g\), along with negative particles originating from \(\Omega_1^-\), do not admit backward trajectories that reach \(t=0\). Instead, they encounter the moving zero set \(\Omega_t^0\!\mathrel{\vcenter{:}}=\!\{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})=0\}\), where the velocity field becomes singular. In the particle picture, positive and negative particles meet and annihilate at this boundary, reflecting the equal and opposite signed masses of the ghost and negative regions. Equivalently, viewed forward in time, the singular boundary can be interpreted as creating positive–negative particle pairs. The positive branch forms the ghost region, while the negative branch forms \(\Omega_1^-\). These “dark” particles are invisible to the source-initialized sampler because they emerge from the singular boundary at intermediate times rather than being transported from \(\pi_0\).

2.2.0.3 Continuity equation.

Why do \(\pi_t^{\mathtt{sign}}\) and \(\pi_t^{\mathtt{signRF}}\) coincide on the reachable region, as in Eq. 4 ? The key is that the signed marginal and the source-initialized sampling law obey the same continuity equation on this region. Following standard RF theory, each branch satisfies \(\partial_t \pi_t^\pm+\nabla\!\cdot(\pi_t^\pm v_t^\pm) = 0,\) which ensures marginal preservation for each branch. Taking the corresponding signed combination yields \(\partial_t\pi_t^{\mathtt{sign}} + \nabla\!\cdot\!\left( (1+\alpha)\pi_t^+v_t^+ - \alpha\pi_t^-v_t^- \right) =0.\) By the definition of \(v_t^{\mathtt{signRF}}\) in Eq. 3 , the signed marginal therefore satisfies \[\partial_t\pi_t^{\mathtt{sign}} + \nabla\!\cdot\!\left(\pi_t^{\mathtt{sign}}v_t^{\mathtt{signRF}}\right) =0.\] Thus, \(\pi_t^{\mathtt{sign}}\) is a signed solution of the continuity equation driven by \(v_t^{\mathtt{signRF}}\). However, this alone does not make it the law of \(\boldsymbol{Z}_t\), since \(\pi_t^{\mathtt{sign}}\) may take negative values.

Now consider the restriction of the signed marginal to the reachable region, \(\bar{\pi}_t(\boldsymbol{x}) \mathrel{\vcenter{:}}= \pi_t^{\mathtt{sign}}(\boldsymbol{x})\mathbf{1}\{\boldsymbol{x}\in\Omega_t^r\}.\) The region \(\Omega_t^r\) is transported by the same flow, so its moving boundary carries no additional flux. Consequently, \(\bar{\pi}_t\) satisfies the same continuity equation and remains a valid probability density. Under the standard regularity conditions stated in Appendix 6, it must therefore coincide with the law of the source-initialized ODE: \(\pi_t^{\mathtt{signRF}}(\boldsymbol{x}) = \pi_t^{\mathtt{sign}}(\boldsymbol{x})\mathbf{1}\{\boldsymbol{x}\in\Omega_t^r\}.\) The appendix also establishes that source-initialized trajectories remain in the positive region and never cross into \(\Omega_t^-\).

2.3 Signed Rectified Flow in Practice↩︎

For practical implementation, it is useful to rewrite Eq. 3 in a guidance-like form. Define the density ratio \(r_t(\boldsymbol{x})\!\mathrel{\vcenter{:}}=\!\pi_t^-(\boldsymbol{x})/\pi_t^+(\boldsymbol{x})\) and \(\Delta v_t(\boldsymbol{x})\!\mathrel{\vcenter{:}}=\!v_t^+(\boldsymbol{x})-v_t^-(\boldsymbol{x})\). Then, wherever \(\pi_t^{\mathtt{sign}}(\boldsymbol{x})\neq0\), \[v_t^{\mathtt{signRF}}(\boldsymbol{x}) = v_t^+(\boldsymbol{x}) + \lambda_t^\alpha(\boldsymbol{x})\,\Delta v_t(\boldsymbol{x}), \qquad \lambda_t^{\alpha}(\boldsymbol{x}) = \frac{\alpha\,r_t(\boldsymbol{x})}{(1+\alpha)-\alpha\,r_t(\boldsymbol{x})}. \label{eq:signed95rf95guidance}\tag{5}\] Thus, Signed RF takes \(v_t^+\) as its base field and applies time- and state-dependent guidance in the direction \(v_t^+-v_t^-\). Implementing this velocity requires two ingredients: (i) the branch velocities \(v_t^+\) and \(v_t^-\), obtained either from a single model under different conditionings or from separately trained models; and (ii) the density ratio \(r_t(\boldsymbol{x})\), for which we consider two estimators below.

2.3.0.1 Classifier-based.

The ratio \(r_t(\boldsymbol{x})\) can be estimated with a binary classifier trained on noisy states \(\boldsymbol{x}_t\). Given a balanced dataset with \(\boldsymbol{x}_t^+\sim\pi_t^+\) and \(\boldsymbol{x}_t^-\sim\pi_t^-\), both obtained from the standard RF interpolation, one can train \(p_t^\phi(y\mid\boldsymbol{x}_t)\) with the binary cross-entropy loss \[\mathcal{L}(\phi) = -\mathbb{E}_{\boldsymbol{x}_t^+ \sim \pi_t^+}\left[\log p_t^\phi(y=+\mid \boldsymbol{x}_t^+)\right] -\mathbb{E}_{\boldsymbol{x}_t^- \sim \pi_t^-}\left[\log p_t^\phi(y=-\mid \boldsymbol{x}_t^-)\right].\] Under balanced sampling, the Bayes-optimal classifier satisfies \(p_t^*(y=-\mid\boldsymbol{x})/p_t^*(y=+\mid\boldsymbol{x}) =\pi_t^-(\boldsymbol{x})/\pi_t^+(\boldsymbol{x})=r_t(\boldsymbol{x})\). Thus, the density ratio in Eq. 5 can be obtained from the classifier odds.

2.3.0.2 Online ratio tracking.

The classifier-based approach requires training an auxiliary model to estimate the density ratio. Alternatively, the ratio can be tracked directly along each Signed RF trajectory. Let \(u_t\!\mathrel{\vcenter{:}}=\!\log r_t(\boldsymbol{z}_t)\), where \(\dot{\boldsymbol{z}}_t=v_t^{\mathtt{signRF}}(\boldsymbol{z}_t)\). The log-density ratio evolves according to \[\dot{u}_t = \nabla\!\cdot\Delta v_t(\boldsymbol{z}_t) + \Delta v_t(\boldsymbol{z}_t)^\top s_t^-(\boldsymbol{z}_t) + \lambda_t^\alpha(\boldsymbol{z}_t)\,\Delta v_t(\boldsymbol{z}_t)^\top \big(s_t^-(\boldsymbol{z}_t) - s_t^+(\boldsymbol{z}_t)\big), \label{eq:online95ratio95tracking}\tag{6}\] where \(s_t^\pm=\nabla\log\pi_t^\pm\) are the branch score functions and \(u_0=0\). For RF with a Gaussian source \(\pi_0\), Tweedie’s formula gives \(s_t^\pm(\boldsymbol{x}) = (t\,v_t^\pm(\boldsymbol{x})-\boldsymbol{x})/(1-t)\) [24]. The divergence term can be evaluated exactly when tractable or estimated using Hutchinson’s trace estimator [25]. Jointly integrating Eq. 6 with the Signed RF ODE therefore tracks the density ratio along the trajectory as \(r_t(\boldsymbol{z}_t)=\exp(u_t)\).

2.3.0.3 Stabilization.

In numerical sampling, finite step sizes may cause the denominator of \(\lambda_t^\alpha\) to become small, leading to excessively large guidance scales. A simple practical modification is to replace the denominator with \(\max\bigl((1+\alpha)-\alpha\,r_t(\boldsymbol{z}_t),\,\varepsilon\bigr)\) and, optionally, cap \(\lambda_t^\alpha\) at \(\lambda_{\max}\).

3 Experiments↩︎

3.1 Toy Datasets↩︎

3.1.0.1 Gaussian mixture.

We construct 2D Gaussian-mixture toys with positive target \(\pi^{+}\) and negative target \(\pi^{-}\). We train separate RF models for the two targets, yielding the velocity fields \(v_t^+\) and \(v_t^-\), and compute the density ratio \(\pi_t^-(\boldsymbol{x})/\pi_t^+(\boldsymbol{x})\) in closed form. We compare standard constant guidance, \(v_t(\boldsymbol{x})=v_t^{+}(\boldsymbol{x})+\omega\bigl(v_t^{+}(\boldsymbol{x})-v_t^{-}(\boldsymbol{x})\bigr),\) with Signed RF, \(v_t(\boldsymbol{x})=v_t^{+}(\boldsymbol{x})+\lambda_t^{\alpha}(\boldsymbol{x})\bigl(v_t^{+}(\boldsymbol{x})-v_t^{-}(\boldsymbol{x})\bigr).\)

Fig. 4 visualizes the resulting sampling behavior. Constant guidance cannot reliably separate the positive and negative modes: weak guidance leaves samples near negative modes, whereas strong guidance over-repels the trajectories and pushes samples into low-density regions under \(\pi^+\). In contrast, Signed RF avoids the negative modes while preserving the positive modes and their coverage. Additional Gaussian-mixture configurations in Sec. 7.1 exhibit the same behavior.

3.1.0.2 PointMaze navigation.

We use the PointMaze dataset [26], [27] to illustrate the missing negative data problem. The offline dataset contains only collision-free demonstrations, from which we train a start–goal-conditioned positive flow \(v^+\). These demonstrations specify where valid trajectories should lie, but provide no explicit supervision for where trajectories must not go. In particular, wall interiors are absent from the dataset, yet their absence alone does not constitute a negative constraint. As a result, model approximation and generalization can still assign probability mass to these unobserved regions, producing wall-crossing trajectories despite training exclusively on valid demonstrations.

Signed RF provides a natural way to supply the missing negative information. We define wall-interior points as a negative distribution, train a negative flow \(v^-\) together with a density-ratio classifier, and use Signed RF to repel the planner from these explicitly modeled invalid regions. As shown in Fig. 5, this removes wall crossings while preserving broad coverage of feasible paths. In contrast, constant guidance exposes the usual scale trade-off: weak guidance fails to enforce the constraint, whereas strong guidance over-repels trajectories and reduces path diversity.

3.2 Signed RF as State-Aware CFG↩︎

We evaluate ImageNet \(256\times256\) class-conditional generation using a pretrained Rectified Flow model [28], [29]. In this setting, \(v_t^+(\boldsymbol{x}_t,c)\) and \(v_t^-(\boldsymbol{x}_t)\) are the conditional and unconditional velocity fields, respectively. We estimate the density ratio using a timestep- and class-conditioned ViT classifier trained on positive–negative latent pairs. We report FID [30], IS [31], and P/R [32] on \(50\mathrm{K}\) generated samples.

As shown in Fig. 6, Signed RF consistently improves FID across all NFE budgets. With 16 NFEs, for example, it reduces FID from \(2.38\) with CFG to \(1.82\). The precision–recall curves further show a better fidelity–diversity trade-off: while both methods improve precision at the expense of recall, Signed RF maintains higher recall at comparable precision.

We further verify that the density-ratio-based guidance is stable in practice. Performance varies little across classifier checkpoints and remains robust to moderate choices of the guidance cap \(\lambda_{\max}\). The resulting \(\lambda_t^\alpha(\boldsymbol{x}_t,c)\) is not a fixed guidance scale or time schedule: it varies across seeds within the same class and across classes for the same seed. The auxiliary classifier adds only modest overhead, increasing runtime and peak GPU memory by approximately \(10\%\), while requiring roughly \(10\%\) of the original model’s pretraining compute in our setup. Additional implementation details, ablations, and comparisons with other guidance methods are provided in Appendix 7.2.

3.3 Anti-memorization↩︎

We next apply Signed RF to anti-memorization by explicitly modeling the training set as a negative distribution, with the goal of reducing training-data replication while preserving generation quality.

3.3.0.1 Analytic flow.

To explicitly model memorization, we take the negative target to be the empirical training distribution \(\pi_1^- = \frac{1}{N}\sum_{i=1}^N\delta_{\boldsymbol{x}^{(i)}},\) where \(\mathcal{D}\!=\!\{\boldsymbol{x}^{(i)}\}_{i=1}^N\) denotes the training set. The RF transporting the Gaussian source \(\pi_0\!=\!\mathcal{N}(\boldsymbol{0},\boldsymbol{I})\) to \(\pi_1^-\) admits a closed-form marginal and velocity field: \[\pi_t^-(\boldsymbol{x}) = \frac{1}{N}\sum_{i=1}^N \mathcal{N}\!\left(\boldsymbol{x};t\boldsymbol{x}^{(i)},(1-t)^2\boldsymbol{I}\right), \qquad v_t^-(\boldsymbol{x}) = \sum_{i=1}^N w_i(\boldsymbol{x},t)\, \frac{\boldsymbol{x}^{(i)}-\boldsymbol{x}}{1-t}, \label{eq:analytic95negative95flow}\tag{7}\] where \(w_i(\boldsymbol{x},t)\) are the normalized Gaussian kernel weights; see Sec. 7.3 for details. This defines a training-free negative flow whose terminal distribution is exactly the empirical training distribution. As \(t\to1\), the Gaussian components in \(\pi_t^-\) collapse onto individual training examples, and trajectories under this flow terminate at training samples [20], [24]. Moreover, \(v_t^-\) contains the singular factor \(1/(1-t)\), inducing strong attraction toward nearby training examples close to terminal time. Constant negative guidance is therefore poorly conditioned, as it directly inherits this terminal singularity.

3.3.0.2 Data Repulsive Flow.

The analytic flow in Eq. 7 provides a natural negative branch for repelling generated trajectories from the training set. For each class \(c\), we define Data Repulsive Flow using the pretrained class-conditional flow as \(v_t^+(\boldsymbol{x},c)\) and the class-specific empirical analytic flow as \(v_t^-(\boldsymbol{x},c)\). We track the density ratio online using Eq. 6 . Specifically, the log-ratio is initialized as \(u_0=0\) and updated at each Euler step using \(v_t^+\), \(v_t^-\), the RF score function [24], [33], and a Hutchinson estimate of \(\nabla\!\cdot(v_t^+-v_t^-)\) [24], [25].

We evaluate memorization using a stress test. Since memorization events are rare under random sampling, aggregate statistics may be dominated by low-risk seeds and obscure copying behavior. For class \(c\), we first generate \(50\mathrm{K}\) samples from the base model with \(\omega=1.0\), rank their initial seeds by the nearest-neighbor SSCD \(L_2\) distance of the resulting samples to the training set [34], and retain the \(600\) highest-risk seeds. All methods are then evaluated using this same seed set for a controlled comparison. We additionally report standard generation metrics on \(50\mathrm{K}\) randomly sampled seeds.

Fig. 7 shows representative results on the high-risk seeds. The base model generates images highly similar to their nearest training examples, in some cases reproducing dataset-specific artifacts such as borders and watermarks. Data Repulsive Flow suppresses these artifacts, preserves class semantics, and produces samples that are visibly farther from their nearest training images. Quantitatively, the SSCD \(L_2\) distributions in Fig. 8 shift toward larger distances. Compared with SPELL [35], Data Repulsive Flow achieves a better protection–quality trade-off. At \(\alpha=1.0\), it nearly matches the \(P_{05}\) protection level of SPELL-50 while retaining substantially better generation quality, with FID \(2.03\) versus \(7.41\). Increasing \(\alpha\) to \(7.5\) further strengthens protection with only mild FID degradation and nearly unchanged IS. Additional per-class sweeps in Sec. 7.3 show that protection improves smoothly with \(\alpha\); the same trend holds under the latent \(L_2\) protection metric, which is not used to select the high-risk seeds.

3.4 Concept Suppression↩︎

3.4.0.1 Nudity prevention.

We next apply Signed RF to nudity prevention. Starting from a pretrained text-to-image model², we train two LoRA branches conditioned on the same unsafe prompt: a positive branch \(v^+\) that models safe outputs and a negative branch \(v^-\) that models the corresponding unsafe outputs. The training data are constructed from paired prompts in ViSU-Text [37]. Although fine-tuning \(v^+\) toward safe outputs reduces unsafe generation, residual unsafe modes inherited from the base model may remain. Signed RF explicitly models these modes through \(v^-\) and suppresses them during sampling.

We evaluate on Ring-A-Bell [38], a benchmark of adversarial prompts designed to elicit nude content. We compare with SAFREE [39] and Safe Denoiser [40], using the same backbone fine-tuned on safe outputs for all methods. We report attack success rate (ASR) and toxicity rate (TR), together with CLIP and aesthetic scores (AES) on COCO prompts to measure generation quality. As shown in Fig. 9, Signed RF reduces ASR from \(15.19\%\) to \(6.33\%\) and TR from \(0.180\) to \(0.125\), while maintaining comparable CLIP and AES scores.

3.4.0.2 Concept suppression.

We further study Signed RF in qualitative concept-suppression settings. Given a pretrained text-to-image model [41], we obtain \(v^+\) and \(v^-\) by conditioning the same model on positive and negative prompts, respectively, and track the density ratio online using Eq. 6 .

Results are shown in Fig. 1 and Fig. 10. For IP protection, the positive prompt describes the desired visual attributes without naming the protected character, whereas the negative prompt explicitly specifies the identity to suppress. Signed RF removes identity-specific features while preserving the requested appearance, pose, and composition. For example, it suppresses the recognizable character identity in Fig. 1 (d) while retaining the round black ears, red shorts, yellow shoes, and white gloves. Similarly, in Fig. 10 (e), it removes Spider-Man-specific elements, such as the spider emblem, while preserving the pose, colors, and detailed suit structure. Signed RF also suppresses broader semantic attributes: it replaces a statue-like interpretation with a living angel in Fig. 10 (b) and removes red tones while preserving the landscape structure in Fig. 10 (d). Full prompts are provided in Sec. 7.4.

4 Conclusion↩︎

We introduced Signed Rectified Flow, an extension of Rectified Flow that incorporates explicit negative information through the signed target \((1+\alpha)\pi^+-\alpha\pi^-\). We showed that the source-initialized flow remains in a dynamically reachable subset of the positive region, where its sampling density matches the signed marginal, while the zero set acts as a barrier separating the realized trajectories from negative regions. This yields a state-dependent guidance rule whose strength is determined by the density ratio between the positive and negative distributions.

Signed RF can be implemented using either a learned density-ratio classifier or online ratio tracking. Across diverse settings, it resolves the missing negative data problem in trajectory planning, improves the fidelity–diversity trade-off in ImageNet class-conditional generation, reduces training-data replication, and suppresses unsafe or undesired concepts while preserving generation quality. Overall, Signed RF provides a principled and practical framework for incorporating explicit negative distributions into generative flows.

5 Related Work↩︎

5.0.0.1 Inference-time guidance and its target distribution.

Classifier guidance augments the diffusion score with the gradient of an external classifier, whereas classifier-free guidance (CFG) forms an affine combination of conditional and unconditional model predictions [3], [4]. Both use a user-specified guidance scale. Recent theory shows that CFG should not generally be interpreted as exact sampling from a simple tilt of the clean-data distribution: its effect can depend on the sampler, admit a predictor–corrector interpretation, or require additional correction terms to realize a prescribed tilted target [42], [43]. Other work changes the reference branch itself, for example by guiding with a weaker version of the same model [44].

Signed RF asks a complementary question: given distributions \(\pi^+\) and \(\pi^-\), what RF dynamics are induced by the signed marginal \(\pi_t^{\mathtt{sign}} = (1+\alpha)\pi_t^+ - \alpha\pi_t^-?\) Applying the RF construction to this signed marginal yields a guidance-like velocity whose strength is determined locally by the density ratio between the negative and positive branches. Once \(\alpha\) is fixed, the effective local scale is therefore induced by the signed target rather than prescribed as a fixed schedule. Once the two branch RFs and \(\alpha\) are fixed, they determine the signed flux and velocity away from the zero set. Under the common-Gaussian-source, regularity, nondegeneracy, and ODE well-posedness assumptions in Appendix 6, the zero set forms a dynamical boundary underlying the nonpenetration, reachable-region, and ghost-region behavior analyzed in Sec. 2.2.

5.0.0.2 Adaptive and geometry-aware guidance.

Several methods refine constant-scale CFG by changing when or how guidance is applied. Guidance Interval restricts it to a selected range of timesteps [45]. CFG++ modifies the update to better respect the data manifold and reduce mode collapse [46]. Adaptive Projected Guidance decomposes the update into components parallel and orthogonal to the conditional prediction and down-weights the parallel component associated with oversaturation [47]. CFG-Zero suppresses early-step guidance and adds a scalar correction for inaccurate velocity estimates [48]. Momentum Guidance constructs a trajectory-dependent signal using an exponential moving average of past velocities [8], while Angle Domain Guidance emphasizes angular rather than radial changes to avoid latent-norm amplification [49].

These methods adapt the schedule, geometry, normalization, or temporal aggregation of a guidance update. Signed RF is adaptive for a different reason: its scale is derived from \(r_t(\boldsymbol{x})=\pi_t^-(\boldsymbol{x})/\pi_t^+(\boldsymbol{x})\), and therefore grows where the current state is locally more compatible with the negative branch. Moreover, \((1+\alpha)-\alpha r_t(\boldsymbol{x})\) is the signed-density factor, so its zero set is a structural boundary rather than only a numerical singularity. Learned ratio estimates and clipping approximate this idealized field in practice; under the stated assumptions, the strict nonpenetration result applies to the exact Signed RF dynamics.

5.0.0.3 Dynamic negative guidance and negative prompting.

Dynamic Negative Guidance (DNG) and Training-Free Safe Denoisers are closely related adaptive negative-guidance methods [40], [50]. DNG derives a state-dependent suppression rule from posterior probabilities for class removal. Safe Denoisers derive an adaptive denoiser from a binary safe–unsafe partition. Signed RF instead permits a general, potentially overlapping pair \((\pi^+,\pi^-)\), constructs the signed target \((1+\alpha)\pi^+-\alpha\pi^-\), and analyzes the resulting zero boundary, reachable region, and ghost region.

Negative prompting and semantic-guidance variants also use subtractive directions during sampling, while broader compositional-generation methods combine multiple energy or score terms [51]–[53]. Signed RF provides a target-level construction for positive–negative distribution pairs and derives the associated dynamics.

5.0.0.4 Concept erasure, safety, and controllable suppression.

Concept-erasure methods such as ESD, UCE, MACE, and adversarially robust unlearning alter model weights or attention parameters [54]–[57]. SAeUron instead trains a sparse autoencoder and ablates concept-associated activations at inference time [58]. Other inference-time safety methods retain the base generator and intervene through safety guidance, prompt or representation filtering, or adaptive safe denoisers [11], [39], [40].

Signed RF belongs to the inference-time guidance family. The parameter \(\alpha\) controls the overall degree of suppression, while \(r_t(\boldsymbol{x})\) determines where strong repulsion is needed. Guidance is consequently weak where the negative-to-positive density ratio is small and grows as that ratio increases.

5.0.0.5 Memorization and anti-memorization.

Diffusion models can reproduce or closely imitate training examples, and such replication can be detected with nearest-neighbor and copy-detection metrics such as SSCD [34], [59]–[62]. Training-time mitigations include DP-SGD and learning from corrupted observations [63], [64]. At inference time, guidance can be deferred near attraction basins or samples can be repelled from protected reference sets [35], [65]. CADS instead anneals the condition to improve sample diversity; it is relevant to guidance-induced collapse but is not a direct anti-memorization method [66].

In our anti-memorization instantiation, we take the negative branch to be the empirical training distribution. For a finite dataset, the Gaussian-source RF marginal and velocity toward the empirical measure admit closed forms, yielding an analytic negative flow whose trajectories are attracted toward training examples. Signed RF subtracts this branch at the measure level rather than applying pairwise repulsion to individual references. Near terminal time, the empirical-flow velocity contains the singular factor \(1/(1-t)\); Signed RF modulates its strength using the local density ratio instead of a fixed scale.

5.0.0.6 Density ratios, discriminator guidance, and preference learning.

Estimating \(r_t(\boldsymbol{x})=\pi_t^-(\boldsymbol{x})/\pi_t^+(\boldsymbol{x})\) connects Signed RF to density-ratio estimation and noise-contrastive estimation [67], [68]. With balanced positive and negative samples, a Bayes-optimal binary classifier’s odds recover the ratio. DRE-\(\infty\) estimates an endpoint density ratio by integrating learned time scores across a continuum of bridge distributions [69]; this is related to, but distinct from, tracking a ratio along each sampling trajectory. Discriminator Guidance similarly uses a classifier-derived signal to refine generation [70], while continuous-normalizing-flow likelihood methods supply the divergence identities used for trajectory-wise log-ratio tracking [25], [71], [72].

DPO uses relative policy log-likelihoods, while Diffusion-DPO adapts the objective using an ELBO-derived surrogate for diffusion likelihoods [13], [15]. Diffusion-NPO fine-tunes a diffusion model using negative preferences [73], whereas DDPO optimizes expected reward with policy gradients [14]. These are training-time alignment methods. Signed RF instead uses a positive–negative density ratio at sampling time to set the local guidance strength and determine the valid sampling law induced by the signed target.

6 Proofs and Additional Derivations↩︎

This appendix provides the proofs and derivations deferred from Sec. 2.2 and Sec. 2.3. Let \(\pi_1^+\) and \(\pi_1^-\) be two target distributions, and let \((\pi_t^+,v_t^+)\) and \((\pi_t^-,v_t^-)\) denote the corresponding RF marginals and velocity fields induced from the source \(\pi_0\). For \(\alpha>0\), define the signed marginal \[\pi_t^{\mathtt{sign}}(\boldsymbol{x}) = (1+\alpha)\,\pi_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x}).\] We partition the state space according to the sign of \(\pi_t^{\mathtt{sign}}\): \[\Omega_t^+ \mathrel{\vcenter{:}}= \{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})>0\}, \qquad \Omega_t^0 \mathrel{\vcenter{:}}= \{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})=0\}, \qquad \Omega_t^- \mathrel{\vcenter{:}}= \{\boldsymbol{x}:\pi_t^{\mathtt{sign}}(\boldsymbol{x})<0\}.\] The Signed RF velocity field is well defined on \(\Omega_t^+\cup\Omega_t^-\) and becomes singular on the moving zero set \(\Omega_t^0\). Under the regularity assumptions stated below, it is locally smooth away from \(\Omega_t^0\), so standard ODE theory applies up to the first time a trajectory approaches this zero set. Since both RF branches share the same source distribution, \(\pi_0^{\mathtt{sign}} = (1+\alpha)\pi_0-\alpha\pi_0 = \pi_0>0,\) and hence all source-initialized trajectories begin in \(\Omega_0^+\).

6.0.0.1 Derivation of the Signed RF velocity.

For each branch, \(\pi_t^\pm(\boldsymbol{x})\) denotes the RF marginal density and \(\pi_t^\pm(\boldsymbol{x})v_t^\pm(\boldsymbol{x})\) denotes the corresponding probability flux. Both quantities depend linearly on the terminal distribution. Therefore, for the signed target \(\pi_1^{\mathtt{sign}} = (1+\alpha)\pi_1^+ - \alpha\pi_1^-,\) the induced signed marginal and flux are \[\begin{align} \pi_t^{\mathtt{sign}}(\boldsymbol{x}) &= (1+\alpha)\,\pi_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x}), \tag{8} \\ \pi_t^{\mathtt{sign}}(\boldsymbol{x})v_t^{\mathtt{signRF}}(\boldsymbol{x}) &= (1+\alpha)\,\pi_t^+(\boldsymbol{x})v_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x})v_t^-(\boldsymbol{x}). \tag{9} \end{align}\] As in standard RF, the velocity field is obtained by dividing the flux by the marginal density. Thus, wherever \(\pi_t^{\mathtt{sign}}(\boldsymbol{x})\neq0\), \[v_t^{\mathtt{signRF}}(\boldsymbol{x}) = \frac{ (1+\alpha)\,\pi_t^+(\boldsymbol{x})v_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x})v_t^-(\boldsymbol{x}) }{ (1+\alpha)\,\pi_t^+(\boldsymbol{x}) - \alpha\,\pi_t^-(\boldsymbol{x}) }. \label{eq:signed95rf95velocity95restate}\tag{10}\] This recovers Eq. 3 in the main text.

To obtain the guidance form, define \(r_t(\boldsymbol{x})\mathrel{\vcenter{:}}=\pi_t^-(\boldsymbol{x})/\pi_t^+(\boldsymbol{x})\) and \(\Delta v_t(\boldsymbol{x})\mathrel{\vcenter{:}}= v_t^+(\boldsymbol{x})-v_t^-(\boldsymbol{x})\). Dividing the numerator and denominator of Eq. 10 by \(\pi_t^+(\boldsymbol{x})\) gives \[\begin{align} v_t^{\mathtt{signRF}}(\boldsymbol{x}) &= \frac{ (1+\alpha)v_t^+(\boldsymbol{x}) - \alpha\,r_t(\boldsymbol{x})v_t^-(\boldsymbol{x}) }{ (1+\alpha)-\alpha\,r_t(\boldsymbol{x}) } \notag \\ &= v_t^+(\boldsymbol{x}) + \frac{ \alpha\,r_t(\boldsymbol{x}) }{ (1+\alpha)-\alpha\,r_t(\boldsymbol{x}) } \Delta v_t(\boldsymbol{x}). \end{align}\] Hence, \[v_t^{\mathtt{signRF}}(\boldsymbol{x}) = v_t^+(\boldsymbol{x}) + \lambda_t^\alpha(\boldsymbol{x})\Delta v_t(\boldsymbol{x}), \qquad \lambda_t^\alpha(\boldsymbol{x}) = \frac{ \alpha\,r_t(\boldsymbol{x}) }{ (1+\alpha)-\alpha\,r_t(\boldsymbol{x}) }. \label{eq:signed95rf95guidance95restate}\tag{11}\] The denominator satisfies \[(1+\alpha)-\alpha\,r_t(\boldsymbol{x}) = \frac{\pi_t^{\mathtt{sign}}(\boldsymbol{x})}{\pi_t^+(\boldsymbol{x})}.\] Therefore, assuming \(\pi_t^+(\boldsymbol{x})>0\), it vanishes precisely on the signed zero set \(\Omega_t^0\), where the Signed RF velocity becomes singular.

We state the nonpenetration result for \(t<1\), where the Gaussian interpolation keeps the intermediate marginals smooth. Terminal-time statements can be obtained by taking \(t\uparrow1\), whenever the corresponding laws converge.

For the common Gaussian source \(\pi_0=\mathcal{N}(\boldsymbol{0},\boldsymbol{I})\), Tweedie’s identity gives, for each RF branch, \[\pi_t^\pm(\boldsymbol{x})v_t^\pm(\boldsymbol{x}) = \frac{\boldsymbol{x}}{t}\,\pi_t^\pm(\boldsymbol{x}) + \frac{1-t}{t}\,\nabla\pi_t^\pm(\boldsymbol{x}), \qquad 0<t<1.\] Taking the same signed combination as in the definition of \(\pi_t^{\mathtt{sign}}\) yields \[(1+\alpha)\pi_t^+(\boldsymbol{x})v_t^+(\boldsymbol{x}) - \alpha\pi_t^-(\boldsymbol{x})v_t^-(\boldsymbol{x}) = \frac{\boldsymbol{x}}{t}\,\pi_t^{\mathtt{sign}}(\boldsymbol{x}) + \frac{1-t}{t}\,\nabla\pi_t^{\mathtt{sign}}(\boldsymbol{x}).\] Therefore, at any nondegenerate point of the zero set, where \(\pi_t^{\mathtt{sign}}(\boldsymbol{x})=0\) and \(\nabla\pi_t^{\mathtt{sign}}(\boldsymbol{x})\neq0\), \[\bigl(\nabla\pi_t^{\mathtt{sign}}(\boldsymbol{x})\bigr)^\top \left[ (1+\alpha)\pi_t^+(\boldsymbol{x})v_t^+(\boldsymbol{x}) - \alpha\pi_t^-(\boldsymbol{x})v_t^-(\boldsymbol{x}) \right] = \frac{1-t}{t} \left\|\nabla\pi_t^{\mathtt{sign}}(\boldsymbol{x})\right\|^2 > 0.\] Thus, the signed flux points locally toward increasing \(\pi_t^{\mathtt{sign}}\), i.e., toward the positive side of the zero set. This is the barrier property used in the nonpenetration proof below.

6.0.0.2 Online density-ratio tracking.

We derive the evolution of the density ratio along a source-initialized Signed RF trajectory \(\boldsymbol{z}_t\). Recall \[r_t(\boldsymbol{x}) = \frac{\pi_t^-(\boldsymbol{x})}{\pi_t^+(\boldsymbol{x})}, \qquad u_t \mathrel{\vcenter{:}}= \log r_t(\boldsymbol{z}_t).\] Since the two branches share the same source distribution, \(r_0(\boldsymbol{z}_0)=1\), and therefore \(u_0=0\).

Let \(s_t^\pm(\boldsymbol{x})\mathrel{\vcenter{:}}=\nabla\log\pi_t^\pm(\boldsymbol{x})\) denote the branch score functions. Each branch satisfies the continuity equation \[\partial_t\pi_t^\pm + \nabla\!\cdot \bigl( \pi_t^\pm v_t^\pm \bigr) = 0.\] Dividing by \(\pi_t^\pm\) gives \[\partial_t\log\pi_t^\pm = -\nabla\!\cdot v_t^\pm - (v_t^\pm)^\top s_t^\pm.\]

Along the Signed RF trajectory, \[\dot{\boldsymbol{z}}_t = v_t^+(\boldsymbol{z}_t) + \lambda_t^\alpha(\boldsymbol{z}_t)\Delta v_t(\boldsymbol{z}_t), \qquad \Delta v_t \mathrel{\vcenter{:}}= v_t^+-v_t^-,\] where \[\lambda_t^\alpha(\boldsymbol{z}_t) = \frac{ \alpha\exp(u_t) }{ (1+\alpha)-\alpha\exp(u_t) }.\] Using \(u_t = \log\pi_t^-(\boldsymbol{z}_t)-\log\pi_t^+(\boldsymbol{z}_t)\) and applying the chain rule yields \[\begin{align} \dot{u}_t &= \nabla\!\cdot\Delta v_t(\boldsymbol{z}_t) + \Delta v_t(\boldsymbol{z}_t)^\top s_t^-(\boldsymbol{z}_t) \notag \\ &\quad + \lambda_t^\alpha(\boldsymbol{z}_t)\, \Delta v_t(\boldsymbol{z}_t)^\top \bigl( s_t^-(\boldsymbol{z}_t)-s_t^+(\boldsymbol{z}_t) \bigr). \label{eq:online95ratio95tracking95restate} \end{align}\tag{14}\] This recovers Eq. 6 in the main text.

For RF with the Gaussian source \(\pi_0=\mathcal{N}(\boldsymbol{0},\boldsymbol{I})\), the branch scores satisfy \[s_t^\pm(\boldsymbol{x}) = \frac{ t\,v_t^\pm(\boldsymbol{x})-\boldsymbol{x} }{ 1-t }, \qquad s_t^-(\boldsymbol{x})-s_t^+(\boldsymbol{x}) = -\frac{t}{1-t}\Delta v_t(\boldsymbol{x}).\] Substituting these identities into Eq. 14 gives the velocity-only update \[\dot{u}_t = \nabla\!\cdot\Delta v_t(\boldsymbol{z}_t) + \frac{ \Delta v_t(\boldsymbol{z}_t)^\top \bigl( t\,v_t^-(\boldsymbol{z}_t)-\boldsymbol{z}_t \bigr) }{ 1-t } - \lambda_t^\alpha(\boldsymbol{z}_t) \frac{t}{1-t} \bigl\| \Delta v_t(\boldsymbol{z}_t) \bigr\|^2. \label{eq:online95ratio95tracking95velocity95only}\tag{15}\]

Thus, the density ratio can be tracked jointly with the Signed RF trajectory by solving the augmented ODE \[\begin{cases} \displaystyle \dot{\boldsymbol{z}}_t = v_t^+(\boldsymbol{z}_t) + \lambda_t^\alpha(\boldsymbol{z}_t)\Delta v_t(\boldsymbol{z}_t), \\[0.8em] \displaystyle \dot{u}_t = \nabla\!\cdot\Delta v_t(\boldsymbol{z}_t) + \dfrac{ \Delta v_t(\boldsymbol{z}_t)^\top \bigl( t\,v_t^-(\boldsymbol{z}_t)-\boldsymbol{z}_t \bigr) }{ 1-t } - \lambda_t^\alpha(\boldsymbol{z}_t) \dfrac{t}{1-t} \bigl\| \Delta v_t(\boldsymbol{z}_t) \bigr\|^2, \end{cases}\] with \[\boldsymbol{z}_0\sim\pi_0, \qquad u_0=0, \qquad \lambda_t^\alpha(\boldsymbol{z}_t) = \frac{ \alpha\exp(u_t) }{ (1+\alpha)-\alpha\exp(u_t) }.\] The density ratio along the trajectory is then recovered as \(r_t(\boldsymbol{z}_t)=\exp(u_t)\). The divergence \(\nabla\!\cdot\Delta v_t(\boldsymbol{z}_t)\) can be evaluated exactly when tractable or estimated using Hutchinson’s trace estimator.

7 Additional Experimental Details↩︎

7.1 Additional 2D Gaussian Mixture Experiments↩︎

7.1.0.1 Additional results on 2D toys.

Each toy dataset consists of a positive target \(\pi_1^+\) and a negative target \(\pi_1^-\), both defined as mixtures of isotropic Gaussians in \(\mathbb{R}^2\) with specified component means, weights, and variances. We train separate MLP-based RF models on samples from the two targets, yielding the velocity fields \(v_t^+\) and \(v_t^-\). Each velocity model is a four-layer MLP with hidden width \(256\), SiLU activations, and a linear two-dimensional output layer. We train the models for \(10{,}000\) steps using Adam [75], with a learning rate of \(10^{-3}\) and batch size \(1024\).

For Gaussian-mixture targets, the intermediate RF marginals \(\pi_t^+\) and \(\pi_t^-\) remain Gaussian mixtures, allowing the density ratio to be evaluated in closed form. In particular, consider a Gaussian component \(\boldsymbol{X}_1\sim\mathcal{N}(\boldsymbol{\mu}_k,\sigma_k^2\boldsymbol{I})\) and the source \(\boldsymbol{X}_0\sim\mathcal{N}(\boldsymbol{0},\boldsymbol{I})\). Under the RF interpolation \(\boldsymbol{X}_t=t\boldsymbol{X}_1+(1-t)\boldsymbol{X}_0\), its intermediate marginal is \(\boldsymbol{X}_t \sim \mathcal{N}\!\left( t\boldsymbol{\mu}_k,\, \bigl((1-t)^2+t^2\sigma_k^2\bigr)\boldsymbol{I} \right).\) Therefore, \[r_t(\boldsymbol{x}) = \frac{\pi_t^-(\boldsymbol{x})}{\pi_t^+(\boldsymbol{x})} = \frac{ \displaystyle \sum_{k=1}^{K_-} w_k^-\, \mathcal{N}\!\left( \boldsymbol{x};\, t\boldsymbol{\mu}_k^-,\, \bigl((1-t)^2+t^2(\sigma_k^-)^2\bigr)\boldsymbol{I} \right) }{ \displaystyle \sum_{k=1}^{K_+} w_k^+\, \mathcal{N}\!\left( \boldsymbol{x};\, t\boldsymbol{\mu}_k^+,\, \bigl((1-t)^2+t^2(\sigma_k^+)^2\bigr)\boldsymbol{I} \right) }. \label{eq:gaussian95mixture95density95ratio}\tag{16}\] We use this analytic ratio as ground truth, allowing us to study the behavior of Signed RF independently of density-ratio estimation error. Fig. 15 shows additional visualizations across a range of geometries. In all cases, sampling starts from the same Gaussian source and uses Euler integration with \(200\) steps. The background heatmap visualizes the target signed density at \(t=1\), \(\pi_1^{\mathtt{sign}}=(1+\alpha)\,\pi_1^+-\alpha\,\pi_1^-\); blue denotes positive regions and pink denotes negative regions.

7.1.0.2 Density-ratio estimation analysis.

We evaluate the accuracy and stability of the density-ratio estimators. In the same 2D setting, we train a density-ratio classifier with the same depth and hidden width as the velocity networks. The classifier outputs a single logit and is trained with binary cross-entropy on balanced samples from the positive and negative branches. We use Adam for \(10{,}000\) steps, with a learning rate of \(10^{-3}\) and batch size \(2048\).

Using the closed-form ratio in Eq. 16 as ground truth, we compare three variants of Signed RF: the analytic ratio, the classifier-based estimate, and the online-tracked estimate. All variants use the same initial Gaussian noise and the same velocity fields \(v_t^+\) and \(v_t^-\), differing only in how \(r_t(\boldsymbol{x})\) is obtained during sampling. Results are shown in Figs. 11, 12, 13, and 14. Panel (e) shows the mean effective guidance scale \(\lambda_t^\alpha\); the three variants agree closely, except near the beginning of the trajectory. Panel (f) shows the mean \(\log r_t\). Both practical estimators remain close to the analytic ratio over most of the trajectory, although the tracked estimate deviates slightly near the end, likely because of accumulated numerical integration error. Panel (g) shows the sample-wise guidance scales, which vary substantially across trajectories and toy configurations. This confirms that Signed RF guidance is state- and sample-dependent rather than a fixed time schedule.

Despite the observed differences in \(r_t\) and \(\lambda_t^\alpha\), the analytic, classifier-based, and tracked variants produce visually similar samples. These results suggest that Signed RF is robust to moderate density-ratio estimation error in these examples, with both practical estimators closely approaching the sampling behavior obtained using the exact ratio.

7.2 Additional ImageNet-256 Details↩︎

7.2.0.1 Comparison with related methods.

Table ¿tbl:tab:imagenet95cfg95system95comparison? extends the comparison to several related guidance methods, including ADG [49], CFG++ [46], and MG [8]. We report these results in the appendix because these methods are not derived from the same signed-target formulation and therefore are not direct baselines for our theoretical framework. Nevertheless, among methods using the same RF backbone without additional representation alignment, Signed RF achieves comparable or lower FID. We report REPA [76] separately because it introduces vision foundation-model alignment and uses a substantially larger training budget. Our RF backbone is trained for \(320\) epochs without such alignment, whereas REPA is trained for \(800\) epochs with VFM alignment. Despite this difference, Signed RF achieves a comparable FID with substantially fewer sampling steps: \(1.41\) at \(64\) NFE, compared with \(1.42\) at \(250\) NFE for REPA.

5pt

7.2.0.2 Implementation details.

We use the pretrained ImageNet \(256\times256\) model released with the Rectified Flow implementation [29] and perform sampling in the latent space of a KL-16 autoencoder. At each Euler step, evaluating the model with class label \(c\) produces the conditional velocity \(v_t^+(\boldsymbol{x}_t,c)\), while evaluating it with the null class token \(c_\varnothing\) produces the unconditional velocity \(v_t^-(\boldsymbol{x}_t)\).

The CFG baseline uses the constant-guidance field \(\hat{v}_t^{\mathrm{CFG}}(\boldsymbol{x}_t,c) = v_t^+(\boldsymbol{x}_t,c) + \omega \bigl( v_t^+(\boldsymbol{x}_t,c)-v_t^-(\boldsymbol{x}_t) \bigr).\) Signed RF uses the same guidance direction but replaces the constant scale \(\omega\) with the state-dependent scale \(\lambda_t^\alpha(\boldsymbol{x}_t,c)\).

The direction \(v_t^+-v_t^-\) serves two related purposes. First, it strengthens class conditioning by moving away from directions shared across the broader unconditional distribution. Second, because the unconditional branch averages over many classes and modes, it acts as a smoother reference field. Extrapolating away from this reference can compensate for the smoothing effect of neural velocity predictions [8]. Thus, the unconditional branch is not treated as an undesirable distribution to be removed; instead, it provides a reference direction for steering samples toward better class alignment and perceptual quality.

We estimate the density ratio using a separate timestep- and class-conditioned ViT classifier [77] trained in the same latent space. Following the classifier-based estimator in Sec. 2.3, the classifier \(p_t^\phi(y\mid\boldsymbol{x}_t,c)\) predicts the branch label \(y\in\{-,+\}\). With balanced positive and negative sampling, \[\hat{r}_t(\boldsymbol{x}_t,c) = \frac{ p_t^\phi(-\mid\boldsymbol{x}_t,c) }{ p_t^\phi(+\mid\boldsymbol{x}_t,c) }, \qquad \lambda_t^\alpha(\boldsymbol{x}_t,c) = \frac{ \alpha\,\hat{r}_t(\boldsymbol{x}_t,c) }{ (1+\alpha)-\alpha\,\hat{r}_t(\boldsymbol{x}_t,c) }.\]

The classifier training examples are designed to capture both class misalignment and poor sample quality. Positive endpoints \(\boldsymbol{x}_1^+\) are ImageNet latents paired with their ground-truth class labels. Negative endpoints \(\boldsymbol{x}_1^-\) include class-aligned but low-quality samples generated by an earlier model checkpoint without CFG, as well as samples paired with an incorrect conditioning label. The former teaches the classifier to identify over-smoothed or low-quality states, while the latter teaches it to detect class-inconsistent states.

For each positive–negative pair, we sample \(t\sim\mathrm{Unif}[0,1]\) and \(\boldsymbol{x}_0\sim\mathcal{N}(\boldsymbol{0},\boldsymbol{I})\), and construct \[\boldsymbol{x}_t^+ = (1-t)\boldsymbol{x}_0+t\boldsymbol{x}_1^+, \qquad \boldsymbol{x}_t^- = (1-t)\boldsymbol{x}_0+t\boldsymbol{x}_1^-.\] The two branches share the same \((\boldsymbol{x}_0,t)\) within each pair, reducing variation unrelated to the endpoint distributions.

A single classifier is shared across all ImageNet classes and receives the timestep and class label as conditioning. Positive samples are paired with their ground-truth labels. For negative samples, the condition is set to the associated sample class with probability \(0.9\) and to a randomly selected different class with probability \(0.1\). The classifier has \(12\) Transformer layers, a hidden dimension of \(768\), \(12\) attention heads, and AdaLN-style timestep and class conditioning [78], giving it roughly the capacity of a DiT-B model. We train it from scratch using AdamW [79], with a learning rate of \(2\times10^{-4}\), weight decay \(0.01\), global batch size \(1024\), and EMA rate \(0.999\).

During sampling, we apply the stabilization procedures described in Sec. 2.3. Specifically, we clip \(\log\hat{r}_t\) to \([-20,20]\), lower-bound the denominator by \(\max\!\left( (1+\alpha)-\alpha\hat{r}_t,\, 10^{-3} \right),\) and cap the effective guidance scale according to \(\lambda_t^\alpha \leftarrow \min\!\left( \lambda_t^\alpha,\lambda_{\max} \right).\) All ImageNet comparisons use \(50{,}000\) class-balanced samples. We use the same initial Gaussian seeds across methods and NFEs, and report the best-FID operating point from the corresponding sweep over \(\alpha\) or \(\omega\).

7.2.0.3 Runtime and computational cost.

We train the density-ratio classifier for \(250\mathrm{K}\) steps on \(8\) NVIDIA GH200 GPUs using bf16 mixed precision and torch.compile. Training takes approximately \(10\) hours. For comparison, the pretrained XL flow backbone requires approximately \(60\) hours on \(16\) GPUs. Thus, the ratio classifier adds substantially less training cost than the generative backbone.

At inference time, the main overhead of Signed RF comes from evaluating the ratio classifier at each Euler step; the scalar computations required to obtain \(\hat{r}_t\) and \(\lambda_t^\alpha\) are negligible in comparison. We measure this overhead on a single NVIDIA GH200 GPU using bf16 mixed precision, torch.compile, batch size \(100\), and \(64\) Euler steps. We exclude checkpoint loading, compilation warmup, VAE decoding, and image writing from the timing. Under this setup, CFG generates \(13.85\) images/s, corresponding to \(72.22\) ms/image, with \(4.57\) GB of peak GPU memory. Signed RF generates \(12.44\) images/s, corresponding to \(80.38\) ms/image, with \(5.05\) GB of peak GPU memory. This amounts to an \(11.3\%\) increase in sampling time, or \(8.16\) additional ms/image, together with \(0.48\) GB of additional peak memory. Overall, the additional training and inference costs of Signed RF are small relative to those of the underlying generative model.

7.2.0.4 Stability analysis.

We first evaluate sensitivity to the training stage of the density-ratio classifier. We use checkpoints collected after \(100\mathrm{K}\), \(160\mathrm{K}\), \(200\mathrm{K}\), and \(250\mathrm{K}\) updates. For each checkpoint and NFE, we sweep \(\alpha\) and report the operating point with the best FID in Table 1. Performance varies only slightly across checkpoints. The FID ranges are \(1.824\)–\(1.845\) at \(16\) NFE, \(1.536\)–\(1.550\) at \(32\) NFE, and \(1.436\)–\(1.473\) at \(64\) NFE. IS, precision, and recall exhibit similarly small variations. These results indicate that Signed RF does not require the ratio classifier to be stopped at a narrowly selected training checkpoint.

We next study sensitivity to the guidance cap \(\lambda_{\max}\), which limits the effective guidance when \((1+\alpha)-\alpha\hat{r}_t\) becomes small because of ratio-estimation or numerical error. Using the \(250\mathrm{K}\) classifier and fixing \(\alpha=0.08\), Table 2 shows that moderate caps produce similar results. At \(32\) NFE, \(\lambda_{\max}\in\{3,5,10\}\) gives FID \(1.518\), \(1.510\), and \(1.545\), respectively; at \(64\) NFE, the corresponding FIDs are \(1.413\), \(1.431\), and \(1.477\). Fig. 16 visualizes the effective guidance scale along trajectories for several classes using shared initial seeds. The guidance profiles vary across both time and class, confirming that Signed RF applies nontrivial state-dependent guidance rather than a fixed schedule. Overall, Signed RF is robust to both the classifier training checkpoint and the choice of a moderate guidance cap.

0pt

0pt

7.3 Additional Analytic Negative-Flow Details↩︎

7.3.0.1 Analytic flow under a Gaussian source.

Let \(\pi_1\) be the empirical distribution supported on \(\{\boldsymbol{x}_1^{(i)}\}_{i=1}^N\subset\mathbb{R}^D\): \[\pi_1(\boldsymbol{x}) = \frac{1}{N} \sum_{i=1}^{N} \delta_{\boldsymbol{x}_1^{(i)}}(\boldsymbol{x}).\] Consider the RF interpolation \(\boldsymbol{X}_t = t\boldsymbol{X}_1+(1-t)\boldsymbol{X}_0, \qquad \boldsymbol{X}_0\sim\mathcal{N}(\boldsymbol{0},\boldsymbol{I}).\) The corresponding velocity field is \(v_t(\boldsymbol{x}) = \mathbb{E}\!\left[ \boldsymbol{X}_1-\boldsymbol{X}_0 \,\middle|\, \boldsymbol{X}_t=\boldsymbol{x} \right].\) For \(0\leq t<1\), conditioned on \(\boldsymbol{X}_1=\boldsymbol{x}_1^{(i)}\), the intermediate state follows \[\boldsymbol{X}_t \sim \mathcal{N}\!\left( t\boldsymbol{x}_1^{(i)}, (1-t)^2\boldsymbol{I} \right).\] Averaging over the empirical data points therefore gives the time-\(t\) marginal \[\pi_t(\boldsymbol{x}) = \frac{1}{N} \sum_{i=1}^{N} \mathcal{N}\!\left( \boldsymbol{x};\, t\boldsymbol{x}_1^{(i)}, (1-t)^2\boldsymbol{I} \right). \label{eq:analytic95flow95marginal}\tag{17}\]

Given \(\boldsymbol{X}_t=\boldsymbol{x}\), the posterior probability that the endpoint is \(\boldsymbol{x}_1^{(i)}\) is \[w_i(\boldsymbol{x},t) \mathrel{\vcenter{:}}= \mathbb{P}\!\left( \boldsymbol{X}_1=\boldsymbol{x}_1^{(i)} \,\middle|\, \boldsymbol{X}_t=\boldsymbol{x} \right),\] where \[w_i(\boldsymbol{x},t) = \frac{ \exp\!\left( -\|\boldsymbol{x}-t\boldsymbol{x}_1^{(i)}\|^2 \big/ \bigl(2(1-t)^2\bigr) \right) }{ \displaystyle \sum_{j=1}^{N} \exp\!\left( -\|\boldsymbol{x}-t\boldsymbol{x}_1^{(j)}\|^2 \big/ \bigl(2(1-t)^2\bigr) \right) }. \label{eq:analytic95flow95weights}\tag{18}\]

Using \(\boldsymbol{X}_0=(\boldsymbol{X}_t-t\boldsymbol{X}_1)/(1-t)\), we obtain \[\begin{align} v_t(\boldsymbol{x}) &= \mathbb{E}\!\left[ \boldsymbol{X}_1-\boldsymbol{X}_0 \,\middle|\, \boldsymbol{X}_t=\boldsymbol{x} \right] \notag \\ &= \mathbb{E}\!\left[ \frac{\boldsymbol{X}_1-\boldsymbol{x}}{1-t} \,\middle|\, \boldsymbol{X}_t=\boldsymbol{x} \right] \notag \\ &= \sum_{i=1}^{N} w_i(\boldsymbol{x},t) \frac{\boldsymbol{x}_1^{(i)}-\boldsymbol{x}}{1-t}. \label{eq:analytic95flow95velocity} \end{align}\tag{19}\] Thus, the exact velocity is obtained by moving toward the posterior-weighted average of the empirical endpoints.

For numerical evaluation, the corresponding log marginal can be written as \[\log\pi_t(\boldsymbol{x}) = \log \sum_{i=1}^{N} \exp\!\left( -\frac{ \|\boldsymbol{x}-t\boldsymbol{x}_1^{(i)}\|^2 }{ 2(1-t)^2 } \right) - \log N - \frac{D}{2}\log(2\pi) - D\log(1-t). \label{eq:analytic95flow95log95density}\tag{20}\] These density, weight, velocity, and log-density formulas apply for \(t<1\); at \(t=1\), the terminal law is the empirical measure \(\pi_1\).

7.3.0.2 PyTorch implementation.

The implementation below evaluates the analytic velocity for a reference set of data latents with shape \([N,C,H,W]\) and a batch of intermediate states \(\boldsymbol{x}_t\) with shape \([B,C,H,W]\). After flattening the latents, it computes the \(B\times N\) matrix of squared distances \(\|\boldsymbol{x}_t-t\boldsymbol{x}_1^{(i)}\|^2\). A softmax over the reference points gives the posterior weights in Eq. 18 , from which the posterior-weighted endpoint mean and the velocity are obtained. When requested, the same unnormalized log weights are reused to evaluate \(\log\pi_t(\boldsymbol{x}_t)\) through a log-sum-exp operation.

7.3.0.3 ImageNet anti-memorization sampler.

For the anti-memorization experiments in Sec. 3.3, we construct a separate analytic negative branch for each ImageNet class. Given the training latents of class \(c\), \[\mathcal{D}_c = \{\boldsymbol{x}_1^{(i)}\}_{i=1}^{N_c} \subset \mathbb{R}^D, \qquad \pi_{1,c}^-(\boldsymbol{x}) = \frac{1}{N_c} \sum_{i=1}^{N_c} \delta_{\boldsymbol{x}_1^{(i)}}(\boldsymbol{x}),\] Eqs. 17 , 19 , and 20 provide the corresponding marginal, negative velocity \(v_t^-\), and log-density \(\log\pi_{t,c}^-\) in closed form. We augment each class-specific reference set \(\mathcal{D}_c\) with horizontally flipped training latents.

The positive velocity \(v_t^+\) is provided by a pretrained class-conditional ImageNet flow model using CFG with \(\omega=1.0\). Because the positive-branch density is not available in closed form, we use the online-tracked ratio described in Sec. 2.3. For each trajectory, we maintain \(u_t \approx \log r_t(\boldsymbol{x}_t) = \log \frac{\pi_{t,c}^-(\boldsymbol{x}_t)}{\pi_{t,c}^+(\boldsymbol{x}_t)},\) with \(u_0=0\), since both branches share the same Gaussian source.

At each Euler step, we evaluate the pretrained positive velocity \(v_t^+\) and the analytic negative velocity \(v_t^-\). We then recover the branch scores using the Gaussian-source RF identity \(s_t^\pm(\boldsymbol{x}) = \frac{ t\,v_t^\pm(\boldsymbol{x})-\boldsymbol{x} }{ 1-t }\) [24], and update \(u_t\) according to Eq. 14 . The only required divergence term is \(\nabla\!\cdot \bigl( v_t^+-v_t^- \bigr),\) which we estimate using the Hutchinson trace estimator [25]. We apply the same ratio clipping, denominator lower bound, and guidance cap used in the ImageNet-256 experiments above.

7.3.0.4 Evaluation protocol.

For the targeted memorization stress test, we first generate a pool of \(50\mathrm{K}\) base-model samples for each selected class and compute the nearest-neighbor distance from each sample to the corresponding class-specific training set. We rank samples using the \(L_2\) distance between SSCD embeddings, which is more sensitive to copied visual details than pixel-space or latent-space distances in our ImageNet experiments.

For each class, we retain the \(600\) highest-risk initial seeds, defined as those producing the smallest SSCD \(L_2\) nearest-neighbor distances under the base model. Starting from exactly these same initial noise samples, we then rerun the base model, the SPELL baselines, and Data Repulsive Flow. This shared-seed protocol ensures that differences in memorization are attributable to the sampling method rather than to the selected initial states.

We report the \(5\)th, \(10\)th, and \(25\)th percentiles, together with the mean, of the SSCD \(L_2\) nearest-neighbor distance. Larger values indicate that the generated samples are farther from the training set and therefore exhibit less training-data similarity. For the standard generation-quality evaluation, we instead generate \(50\mathrm{K}\) class-balanced samples from random initial noise, while sharing the same initial seeds across all compared methods.

Table ¿tbl:tab:imagenet95memorization95per95class? extends the class-\(248\) results from the main paper to five ImageNet classes and several values of \(\alpha\). Across all evaluated classes, increasing \(\alpha\) consistently raises the lower-tail nearest-neighbor distances. This shows that Data Repulsive Flow provides a smooth and interpretable control over the strength of training-data repulsion, rather than exhibiting an abrupt change at a particular setting.

We additionally report nearest-neighbor distances in the autoencoder latent space. These distances are not used to select the high-risk seeds and therefore serve as an independent evaluation metric. Their consistent increase supports the conclusion that the observed effect is not specific to the SSCD \(L_2\) metric used for seed selection and primary reporting.

2.5pt

7.3.0.5 Runtime and memory cost.

The analytic negative branch requires no additional training. For a batch of size \(B\), a reference set of size \(N\), and latent dimension \(D\), its inference cost is dominated by computing the state–reference Gram matrix and the responsibility-weighted endpoint average. Both operations scale as \(\mathcal{O}(BND)\). The memory cost consists primarily of the reference matrix, which requires \(\mathcal{O}(ND)\) storage, and the temporary \(B\times N\) matrices of logits and posterior responsibilities.

In our class-conditional ImageNet experiments, each class contains approximately \(1.3\mathrm{K}\) reference latents, or \(2.6\mathrm{K}\) after horizontal-flip augmentation. At this scale, the analytic branch is small relative to the pretrained flow backbone in both runtime and memory.

Fig. 17 benchmarks the analytic branch on a single NVIDIA GH200 GPU with the ImageNet latent dimension \(D=4096\). Velocity-only, log-density-only, and joint evaluation have nearly identical runtime because all three reuse the same \(B\times N\) distance logits. At the class-level reference-set sizes used in our experiments, each evaluation takes only a few milliseconds and requires substantially less than \(0.1\) GB of additional memory.

Both runtime and reference storage grow approximately linearly with \(N\). At \(N=2^{18}\), evaluation remains below \(8\) ms. At \(N=2^{22}\), it takes on the order of \(10^2\) ms, while storing the reference set in fp32 requires \(64\) GB. These measurements confirm that the class-specific analytic branch is not a computational bottleneck in our ImageNet anti-memorization experiments. For substantially larger protected datasets, the reference set can be processed in chunks while incrementally accumulating the log-sum-exp normalizer and responsibility-weighted endpoint average. This keeps memory bounded at the cost of additional passes over the reference set.

7.4 Additional Concept Suppression Details↩︎

For the main-text concept-suppression examples, the positive prompt defines the desired visual content and the negative prompt defines the concept or attribute to suppress. We use the following prompt pairs verbatim.

1. Positive: A high-aesthetic anime portrait, upper body, night street background, expressive eyes, polished shading, clean linework, masterpiece, best quality
   Negative: lowres, blurry, bad anatomy, bad hands, missing fingers, extra digits, jpeg artifacts, cropped, low quality, watermark, signature

2. Positive: A clean contemporary house, strong geometric lines, large glass panels, minimalist architecture photography, crisp daylight, centered framing, unobstructed surroundings, pure architectural focus
   Negative: trees, bushes, leaves, greenery, vines, overgrown plants, grass, lawn, meadow, turf, wildflowers, landscaped garden

3. Positive: A single large paper crane flying low over a quiet lake at dawn, close-up, centered composition, the crane fills much of the frame, poetic, minimalist, soft mist
   Negative: origami, folded paper, craft, crease

4. Positive: A solitary young woman sitting by a large train window during rain, soft city lights outside, reflective atmosphere, cinematic portrait
   Negative: sad, crying, depressed, grief, despair, tears, misery

5. Positive: A cheerful cartoon mouse with perfectly round black ears, red shorts, yellow shoes, white gloves, simple face, vintage mascot design, standing confidently against a clean pastel background
   Negative: Mickey Mouse, Disney character

6. Positive: A pale angel standing silently in a winter garden, marble-like skin, white wings dusted with snow, stillness, ethereal realism
   Negative: stone statue, sculpture pedestal, carved marble, museum artifact

7. Positive: A world-class scientist presenting a breakthrough discovery in a sleek research lab, confident, inspiring, magazine-cover composition
   Negative: old white man, male stereotype, lab coat cliche, Einstein-like appearance

8. Positive: A visionary CEO standing in a glass office overlooking a futuristic city, calm authority, elegant natural light
   Negative: middle-aged white man in dark suit, corporate cliche, Wall Street stereotype

9. Positive: A dynamic cinematic shot of a lean teenage superhero crouching high above a city, wearing an iconic red-and-blue skin-tight suit defined by black webbing lines, a bold spider emblem on the chest, and oversized white pointed eye lenses on a full-face mask, athletic, agile, youthful, with a strong sense of motion and classic urban superhero energy
   Negative: Spider-Man, Marvel, Peter Parker, superhero franchise

10. Positive: Sweeping tulip fields under soft spring sunlight, wide-angle landscape view, richly layered flowers, fresh air, elegant color harmony, cinematic countryside photography
    Negative: red, crimson, scarlet, ruby tones

References↩︎

---

1. Co-first authors.↩︎

2. stabilityai/stable-diffusion-3.5-medium [36].↩︎