Tips are greatly appreciated and help sustain the compute resources needed for further research!
Overview
This repository provides an analytical toolkit designed to verify whether the Diffusion Transformer (DiT) engine of FLUX.2-klein-4B contains hidden "guardrail circuits" that intentionally block, noise, or distort extreme image generation.
By measuring the L2 Norm (internal activation energy) across the model's layers, we mathematically confirmed that FLUX.2's DiT does NOT contain active guardrails designed to intentionally destroy images in response to specific prompts.
Consequently, the inability to generate NSFW (Not Safe For Work) or extreme gore images is not due to the AI actively refusing the prompt. Instead, it is proven to be a Knowledge Gap—the developer's safety alignment involved thoroughly scrubbing these concepts from the training dataset, meaning the model simply does not know how to draw them.
TL;DR: Required Actions per Domain
Our internal analysis reveals that the state of the model and the required solutions differ entirely depending on the domain you wish to generate.
Domain
Model's Knowledge
Guardrail Mechanism
Required Action
Blood / Violence
Knows how to draw
None
None (Only Uncensored Text Encoder is needed)
Weapons / Firearms
Knows how to draw
None
None (Only Uncensored Text Encoder is needed)
NSFW / Nudity
Does NOT know
None
Fine-tuning required (Train an NSFW LoRA)
Extreme Gore / Dismemberment
Does NOT know
None
Fine-tuning required (Train a Gore LoRA)
There are no built-in guardrail circuits blocking output within the FLUX.2-klein-4B DiT. The reason NSFW content fails to generate is purely due to dataset deletion. Therefore, performing "Abliteration" (surgical weight removal) on the DiT is completely unnecessary and counterproductive. The only practical solution is to supplement the missing knowledge through LoRA training.
Analytical Scripts Provided
To compare the internal differences when inputting safe versus extreme prompts, we utilized the following two Python scripts:
l2_norm_spike_detector.py
A tool that monitors changes in internal energy (L2 norm) across each Transformer block layer during image generation. If a guardrail circuit activates, the energy value will abnormally spike in specific layers, allowing us to pinpoint it.
threshold_drop_test.py
A tool that interpolates the semantic embedding between a safe prompt and an extreme prompt (Alpha 0.0 to 1.0) to test at which exact blend ratio the structural integrity of the image collapses (Cliff drop).
(Note: To ensure pure measurement of the DiT's behavior, these tests were conducted using a mathematically uncensored Text Encoder to bypass initial input restrictions.)
Verification Results: The Minimal Pair Tests
To determine whether the AI was "destroying the image via guardrails" or simply "lacking knowledge," we conducted comparative experiments using minimal pairs of safe and extreme prompts.
1. Blood & Violence (Red Paint vs. Real Blood)
Result: Even with the extreme prompt (real blood), the L2 norm ratio remained between 1.01x and 1.04x across all layers, indicating no guardrail spikes. Structural scores (image quality) were maintained, and CLIP semantic scores increased.
Conclusion: The DiT knows how to draw blood and does not apply output restrictions. Unlocking the Text Encoder is sufficient.
2. NSFW & Nudity (Silk Dress vs. Explicit Nude)
Result: The L2 norm ratio was flat at 1.01x to 1.02x; no spikes were detected. However, even at maximum extreme alpha, the CLIP score languished between 26 and 29, failing to follow the prompt's intent.
Conclusion: There is no forced image destruction by guardrails. The model simply lacks the knowledge due to complete dataset scrubbing.
3. Weapons & Firearms (Toy Prop Gun vs. Real Lethal Firearm)
Result: The L2 norm ratio was 0.98x to 1.00x.
Conclusion: Similar to blood, the DiT processes "toy" and "real" identically in internal calculations. No active blocking mechanism exists for firearms.
4. Extreme Dismemberment & Gore
Result: The L2 norm ratio peaked at 1.05x, with no definitive spikes detected. However, as the extreme alpha increased, the structural score plummeted from 4685 to 1237.
Conclusion: The lack of abnormal spikes implies this is not an intentional block. The image collapse is the result of the model attempting to reconstruct an unknown concept (dismemberment) and failing mathematically.
Key Takeaways from this Verification
1. Clarification of Internal Architecture (Block 4 Behavior)
During our analysis, we observed a massive amplification in internal energy (L2 norm) at Transformer Block 4 (DoubleStream_Layer_4), jumping from approximately 30,000 to 330,000. At first glance, this might appear to be a strong safety filter (spike) activating at a specific layer. However, our controlled experiments confirmed that this amplification occurs equally even with completely safe prompts. Objective data proves that this numerical jump is not an output restriction, but rather a structural feature of the FLUX architecture (such as dimensional scaling).
2. DiT Abliteration is Unnecessary
Since there are no explicit mechanisms (spikes) blocking specific images within the DiT, attempting to forcibly carve out internal weights using mathematical methods like SVD is a meaningless act that will only destroy the model's normal generative capabilities. To generate unsupported genres in the current FLUX model, supplementing missing knowledge via fine-tuning is the mandatory next step.
