AI Image Generator — Module 23.1

How This Lesson Fits the Module & Volume

Text caps (email, support, RAG) stay in language. AI Image Generator is the stills capstone: prompt → image via a hosted API or local Stable Diffusion, plus safety filters and watermark/disclosure. Mechanism is Vol. 17 diffusion, Stable Diffusion, SDXL, ComfyUI. Ecosystem choice is Vol. 22.2 Image AI—Stability, FLUX, Midjourney, Firefly, plus Vol. 22.5 Replicate / Vol. 18 OpenAI SDK for APIs. Vol. 20 AI safety, copyright, and transparency are product requirements, not footnotes.

Next, AI Research Assistant returns to citation-locked text. Do not invent dollar rates, FID leaderboards, or “beats Midjourney” claims.

Learning Objectives

By the end of this lesson, students should be able to:

Define the image-generator capstone as prompt → safety filter → generate (API or local SD) → watermark/disclosure → store metadata.
Choose MVP vs stretch: one hosted image API vs local SD/SDXL (Vol. 17) with queue + GPU ops.
Apply pre-prompt and post-image safety filters; refuse disallowed categories without writing exploit content.
Require visible disclosure and/or watermark / content credentials on every output.
Sketch FastAPI generate + audit fields (prompt hash, model id, seed, filter decision).
Eval prompt adherence (human), filter catch rate, disclosure presence, and copyright/ToS hygiene—no fake benchmarks.

Definition

An AI Image Generator (this capstone) is a product that accepts a text prompt (optional negative prompt / size), runs safety filters before calling a generator, produces a still via a hosted image API or local diffusion (Stable Diffusion / SDXL / compatible checkpoint), then attaches watermark and/or disclosure so downstream users know the still is AI-generated. Metadata (model id, seed, filter decision, prompt hash) is part of the artifact. The product does not claim photoreal identity of real private people, does not generate disallowed sexual/violent CSAM-adjacent content, and does not treat copyright as “the model trained so it is free to use commercially” without reading licenses and ToS (Vol. 17 + Vol. 22.2 + Vol. 20).

MVP vs Stretch

Slice	MVP	Stretch
Backend	Hosted image API (OpenAI Images, Stability Platform, Replicate, …) via Vol. 18 SDK	Local SD/SDXL (diffusers or ComfyUI worker) + GPU queue (Celery/Redis)
Prompt	Text + size enum; max length cap	Negative prompt, seed, steps, CFG; optional ControlNet (Vol. 17)
Safety	Keyword/classifier pre-filter + provider safety; refuse + log reason	Second-pass image classifier; rate limits; abuse review queue
Disclosure	Visible UI badge + filename/sidecar `ai_generated: true`	Visible watermark and/or C2PA / content credentials where the stack supports it
Auth / quota	Single-user demo key; per-user daily cap	Vol. 18 auth + monitoring; cost dashboards (no fake $)
Out of scope	Deepfakes of real private people; disallowed sexual/minor content; “undetectable” stego	Same refusals—stretch does not unlock them

Architecture: API vs Local SD

Prompt

Validate + hash; wrap as data.

Filter

Pre-gen safety; refuse closed.

Generate

Hosted API or local SD worker.

Disclose

Watermark / badge + metadata.

Hosted API (MVP-friendly)

No VRAM ops; ToS + billing meter
Provider safety as a floor, not the only gate
Vol. 18 OpenAI SDK / Vol. 22.5 Replicate
Weaker ControlNet-class lock

Local SD / SDXL (stretch)

Vol. 17 weights + diffusers / ComfyUI
You own sampler, VRAM, and safety
RAIL/community licenses $\neq$ Apache-by-default
Queue jobs; never block the API on 50-step UNet

Disclosure (required)

UI: “AI-generated” on every still
Sidecar JSON: model, seed, filter
Optional visible watermark
Vol. 20 transparency + copyright

Do

Fail closed on filter hits; log decision codes
Cap prompt length, steps, and concurrent jobs
Store prompt hash, not always the raw prompt, if policy requires
Read checkpoint + API licenses before any “commercial use” claim

Don’t

Disable safety “to match Midjourney look”
Generate identifiable real private people without rights
Invent FID/CLIP scores or fake price tables
Strip watermarks to “look more professional”

Safety Filters + Watermark / Disclosure

Control	Where it runs	Notes
Pre-prompt filter	Your API, before provider/local call	Allowlist topics if needed; refuse sexual-minor, non-consensual, graphic crime, etc. Do not document bypasses.
Provider safety	Hosted image API	Treat as a floor. Still log your own decision.
Post-image filter (stretch)	After pixels exist	NSFW/violence classifiers; quarantine, do not return.
Visible disclosure	UI + filename/sidecar	MVP minimum. Vol. 20 transparency.
Watermark / credentials	Pixels and/or C2PA	Stretch; Firefly-class stacks emphasize content credentials (Vol. 22.2). Do not teach watermark stripping.

Classroom policy: no real-person deepfakes, no disallowed sexual content, no attempts to evade filters. Trainers supply any “should refuse” prompts; students do not invent jailbreak payloads (Vol. 20 jailbreaking is theory, not a lab to write exploits).

FastAPI Sketch (API or Local Worker)

MVP calls a hosted generator stub. Stretch swaps generate_image for a Celery SD worker. Educational only—wire your real SDK from Vol. 18 / 22.

# image_generator.py — prompt → filter → generate → disclose (Vol. 18 FastAPI)
import hashlib
from enum import Enum
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel, Field

app = FastAPI(title="Vol23 Image Generator")
DISCLOSURE = "AI-generated image. Not a photograph of a real event unless stated."
BLOCKLIST_MARKERS = ("child sexual", "csam", "nonconsensual explicit", "real-person deepfake")  # teaching stub

class Size(str, Enum):
    s512 = "512x512"
    s1024 = "1024x1024"

class GenIn(BaseModel):
    prompt: str = Field(max_length=2_000)
    size: Size = Size.s512
    seed: int | None = None
    backend: str = "hosted_api"  # hosted_api | local_sd

def prompt_hash(p: str) -> str:
    return hashlib.sha256(p.encode()).hexdigest()[:16]

def safety_precheck(prompt: str) -> dict:
    low = prompt.lower()
    if any(m in low for m in BLOCKLIST_MARKERS):
        return {"ok": False, "code": "disallowed_category"}
    # stretch: call a classifier; never return the prompt to logs if flagged
    return {"ok": True, "code": "pass"}

def generate_image(prompt: str, size: Size, seed: int | None, backend: str) -> dict:
    # MVP: hosted API (OpenAI Images / Stability / Replicate) — see Vol. 18 / 22.
    # Stretch: enqueue local SD/SDXL (Vol. 17 diffusers or ComfyUI worker).
    if backend not in {"hosted_api", "local_sd"}:
        raise HTTPException(400, "bad_backend")
    return {"bytes_ref": "demo://image.png", "model_id": "demo-image-1", "backend": backend, "seed": seed}

def attach_disclosure(meta: dict) -> dict:
    meta = dict(meta)
    meta["ai_generated"] = True
    meta["disclosure"] = DISCLOSURE
    meta["watermark"] = "visible_badge_or_c2pa_stub"
    return meta

@app.post("/v1/images/generate")
def generate(body: GenIn):
    gate = safety_precheck(body.prompt)
    if not gate["ok"]:
        return {"ok": False, "action": "refuse", "filter": gate["code"], "disclosure": DISCLOSURE}
    art = generate_image(body.prompt, body.size, body.seed, body.backend)
    return attach_disclosure({
        "ok": True,
        "action": "generated",
        "image": art["bytes_ref"],
        "model_id": art["model_id"],
        "backend": art["backend"],
        "seed": art["seed"],
        "size": body.size,
        "prompt_hash": prompt_hash(body.prompt),
        "filter": gate["code"],
    })

# Eval: human prompt-adherence sample; refuse-canary set; disclosure present on 100% of successes.
# Do not publish fake FID numbers. Read licenses before any commercial claim.

Acceptance Criteria

ID	Must pass for MVP
AC-1	Generate path is prompt → pre-filter → API or local SD → response with image ref.
AC-2	Disallowed-category canaries (instructor-provided) return `refuse`, not pixels.
AC-3	Every successful image carries visible UI disclosure and `ai_generated: true` metadata.
AC-4	Audit fields include model id, backend, prompt hash (and seed if used).
AC-5	Prompt length and concurrency/quota are capped; no unbounded GPU/API loop.
AC-6	README names licenses/ToS for the chosen API or checkpoint; no fake commercial indemnity.
AC-7	No watermark-stripping feature; no real-private-person deepfake mode.

Eval + HITL / Safety

Gate	What you measure	Hook
Prompt adherence	Human rubric: subject, style, obvious misses	Human evaluation — not fake FID
Filter catch	Instructor refuse-canaries all refuse	Vol. 20 AI safety
Disclosure	100% of returned stills labeled AI-generated	Transparency
License / ToS	Checkpoint or API license recorded	Copyright; Vol. 22.2 vendor cards
Cost / latency	Your token-or-GPU time per still; p95 wait	Vol. 19 latency / token usage
HITL (stretch)	Abuse/report queue; human review before public gallery	Vol. 15 HITL

Vol. 17 explains samplers and latent space; Vol. 22.2 explains which vendor you buy. This capstone is the product wrapper: filters, disclosure, audit, quota.

Related Lectures

Lecture	Role
Diffusion / Stable Diffusion / SDXL	Local generation mechanism
ComfyUI / ControlNet	Stretch local graph + conditioning
Vol. 22.2 Image AI	Vendor catalog (Stability, FLUX, MJ, Firefly, …)
OpenAI SDK / Replicate / FastAPI	Hosted API + demo backend
AI safety / copyright / transparency	Filters, licenses, disclosure
AI Research Assistant	Next: citation-locked text again

Common Misconception

“Provider safety means I can skip my own filter.” You still own product claim and residual risk. Second: local SD has no ToS so commercial use is automatic—read the checkpoint license (Vol. 22.2 / Vol. 20 copyright). Third: stripping watermarks makes the product more professional. Fourth: a photoreal still of a private person is “just art.” Fifth: fake FID tables prove the capstone. Sixth: Vol. 17 samplers replace product disclosure.

Knowledge Check

Short Answer: What are the two acceptable generation backends for this capstone? Answer: A hosted image API, or local Stable Diffusion / SDXL (or compatible local stack).
True/False: Every returned still must disclose that it is AI-generated. Answer: True.
Multiple Choice: Safety filters should run: (a) before generate (and optionally after), (b) never, to preserve quality, (c) only if CSAT is low. Answer: (a).
Short Answer: Name one Vol. 17 lecture that explains local diffusion stills. Answer: Diffusion, Stable Diffusion, SDXL, ComfyUI, or ControlNet (any valid).
True/False: Students should invent jailbreak prompts to bypass the filter in lab. Answer: False—use instructor canaries only; do not write exploits.
Multiple Choice: Vol. 22.2 is primarily: (a) the Image AI vendor catalog, (b) a medical device spec, (c) BLEU tables. Answer: (a).
Short Answer: Why store prompt hash + model id on each artifact? Answer: Audit / reproducibility / incident review without always logging raw sensitive prompts.
True/False: Stretch may add a watermark-stripping tool for “cleaner” exports. Answer: False.
Multiple Choice: Commercial-use claims require: (a) reading API/checkpoint licenses and ToS, (b) a high CFG scale, (c) fake FID. Answer: (a).
Short Answer: Which Vol. 20 lectures constrain filters, licenses, and labeling? Answer: AI safety, copyright, and transparency (any reasonable subset).

Key Takeaways

Image capstone = prompt → safety filter → hosted API or local SD → watermark/disclosure + metadata.
Vol. 17 is mechanism; Vol. 22.2 is vendor choice; Vol. 20 is filters, copyright, and transparency.
MVP can be API-only; stretch adds local SD queue—not deepfakes or filter evasion.
No fake FID, prices, or “beats Midjourney” claims; licenses travel with the checkpoint or API.
Next: AI Research Assistant — citation-locked research UX.

Trainer’s Guide

Lab: Teams pick one backend (hosted API or local SD if GPUs exist). Ship FastAPI + a minimal UI: prompt, generate, refuse card, disclosure badge. Instructor provides a small refuse-canary list—students do not write new jailbreaks. Grade AC-1–AC-7. Optional watermark overlay with Pillow; optional C2PA only if the toolchain already supports it.

Whiteboard: API vs local SD cost/ops/license. Arrow “pretty still” $\to$ still needs disclosure. Preview research assistant next: citations instead of pixels.

Recap: The image generator capstone wraps Vol. 17/22.2 generation with filters, quotas, and mandatory AI disclosure. Continue to AI Research Assistant.