Where Should Knowledge Enter? A Layered Framework for Knowledge Infusion in Multimodal Iterative Generative Models Renjith Prasad1 Chathurangi Shyalika1 Anushka Pawar2 Aahan Rathod1 Amit Sheth1,2 1
arXiv:2606.06356v1 [cs.AI] 4 Jun 2026
2
University of South Carolina Indian AI Research Organization
Abstract Multimodal generative models produce fluent outputs but remain unreliable when generation must respect structured, domain-specific, or safety-critical knowledge. Existing methods incorporate knowledge through mechanisms such as prompt augmentation, guidance, latent editing, or fine-tuning, yet they are typically categorized by technique rather than by the component of the generative process they modify. We argue that knowledge infusion in iterative generative models is fundamentally an interventionlayer problem. Since the generative process unfolds as a trajectory of internal states, knowledge can act on four structurally distinct components of this process: the input/output boundary, the transition function, the intermediate state, and the model parameters. This maps to four intervention layers: surface, trajectory, latent, and parametric infusion. We instantiate the framework in diffusion models, map representative methods to all four layers, and derive design principles for multi-layer composition. In a controlled safety-alignment experiment using a multimodal knowledge graph with two diffusion backbones, we implement three of the four layers cumulatively, surface (input-side and output-side) and trajectory–latent (mid-generation). We show empirically that each additional layer addresses failure classes that prior layers cannot reach, reducing knowledge-violating outputs by 70.97% compared to vanilla generation and empirically confirming the framework’s complementarity prediction.
1. Introduction Multimodal generative models have achieved impressive fluency in text-to-image synthesis [25, 27], vision-language generation [20], and cross-modal reasoning [17]. Yet, fluency is not fidelity; these models remain unreliable when generation must respect domain-specific knowledge, such as anatomical constraints, scene structure, safety ontolo-
gies, or physical laws [13, 14]. As multimodal systems move into knowledge-intensive domains [10, 21], the central challenge is no longer whether they can generate, but whether they can do so consistently with what is known. A growing body of work addresses this challenge by incorporating external knowledge into the generation process. In practice, however, these approaches are discussed in terms of mechanism, such as prompting and retrieval [5, 15], guidance [3, 8], latent editing [7, 18], or finetuning [12, 26, 32], rather than at the level of the generative process each mechanism modifies. This makes it difficult to answer basic design questions: if a diffusion model generates an image that violates a known spatial relation, should one revise the prompt, steer the sampler, edit a latent, or retrain the model? These interventions act at different points in the generative process and offer fundamentally different guarantees, yet no existing framework provides a principled basis for choosing among them. We argue that knowledge infusion in iterative generative models is fundamentally an intervention-layer problem. Iterative generators like diffusion models, autoregressive decoders, and flow models produce outputs through a trajectory of internal states: h0 → h1 → · · · → hT = x,
(1)
where h0 is an initial state, each transition ht → ht+1 is governed by a learned function fθ (·, t), and x is the generated output. This process admits four formal intervention points at which an external knowledge signal can act, the boundary (what enters or exits), the transition (the rule that advances the process), the state (the representation being propagated), and the parameters (the model that defines fθ ), thereby yielding four intervention layers (Figure 1): • Surface infusion transforms the conditioning input or post-processes the output without altering the generator’s internal dynamics. • Trajectory infusion modifies the transition function at inference time, steering how the process evolves.
Figure 1. Four intervention layers for knowledge infusion in iterative generative models. External knowledge acts on four structurally distinct components of the generation trajectory: surface (input/output boundary), trajectory (transition rule fθ ), latent (intermediate states ht ), and parametric (model weights θ). This enables complementary coverage of prompt-level, structural, and distributional violations.
• Latent infusion directly reshapes the intermediate state ht , changing what is being evolved. • Parametric infusion internalizes knowledge into the parameters θ or architecture, altering the generator itself. These four layers are grounded in the formal structure of iterative generation: boundary, transition, state, and parameters. All methods examined in this work map to either a single layer or a composition of layers, and moving between layers changes what can be controlled, what persists across generations, and which knowledge violations can be corrected. Our framework complements the knowledgeinfused learning (KiL) continuum of Sheth et al. [29], which organizes knowledge integration in discriminative models along a shallow-to-deep axis. Complementing this view, our decomposition is defined not by depth, but by which formal component of a dynamical process is modified. Since feedforward models lack a generation trajectory, they do not distinguish between modifying a transition rule and a propagated state; these distinctions arise only in iterative generators. The four-layer framework thus provides a complementary decomposition enabled by the trajectory structure of generation. We instantiate the framework in diffusion models [9, 25], map representative methods to each layer, and analyze trade-offs across five axes: controllability, interpretability, persistence, computational cost, and failure-correction scope. To validate the framework, we conduct a controlled safety-alignment experiment using a multimodal knowl-
edge graph (MMKG) as a structured knowledge source with two frozen diffusion backbones. We implement surface (input), trajectory–latent (mid-generation), and surface (output) interventions, leaving parametric infusion for future work as it requires retraining. Each added layer addresses failure classes that prior layers cannot reach, and the full multi-layer stack reduces knowledge-violating outputs by 70.97% compared to vanilla generation, confirming that no single layer is sufficient and that principled composition yields complementary coverage. Our key contributions are: • We formulate knowledge infusion in iterative generative models as an intervention-layer problem over the generation trajectory. • We introduce a four-layer framework—surface, trajectory, latent, and parametric—grounded in the formal components of iterative generation, and show that existing methods map naturally onto this space. • We provide a comparative analysis of the four layers along five operational axes, with representative methods mapped to each layer in diffusion models. • We derive three design principles for composing multilayer knowledge infusion: matching layers to failure classes, composing for complementary coverage, and managing inter-layer interference. • We validate the framework empirically through a controlled safety-alignment experiment with two frozen diffusion backbones, demonstrating that each additional layer yields monotonically stronger knowledge consis-
tency while maintaining generation quality.
Layer
2. Problem Formulation We formalize knowledge infusion in iterative generative models by characterizing the generator, the knowledge source, and the intervention-layer structure that governs how knowledge interacts with the generation process.
2.1. Iterative Generative Model We consider a multimodal generative model that produces an output x conditioned on an input prompt p by iterating through a sequence of internal states: h0 → h1 → · · · → hT = x,
(2)
where h0 = Init(p, z) is an initial state derived from the prompt p and a stochastic seed z (e.g., sampled noise in diffusion, a start token in autoregressive decoding), and each transition is governed by ht+1 = fθ (ht , ct ),
(3)
with learnable parameters θ and a conditioning context ct that may include the step index, the prompt encoding, or other auxiliary signals. The final state hT is either the output itself or is decoded into x by a fixed readout. This formulation encompasses diffusion models (where ht is a noisy latent and fθ is the denoising step), autoregressive decoders (where ht is a partial sequence and fθ appends the next token), flow-based models (where ht is a point on a learned flow trajectory), among others.
2.2. Knowledge Source Let K denote an external knowledge source encoding domain-specific information relevant to an underlying use case. K may be structured or unstructured and take diverse forms, including knowledge graphs, ontologies, rule systems, or multimodal knowledge bases linking visual and textual concepts. We assume that K induces a consistency predicate C(x, K) ∈ {0, 1} that evaluates whether a generated output x satisfies the constraints encoded in K. The goal of knowledge infusion is to increase the probability that C(x, K) = 1 without sacrificing output quality.
2.3. Knowledge Infusion as Intervention Given the trajectory in Eq. 2, knowledge-infusion transforms the generation process to improve consistency with K. The key observation is that, such a strategy must target one or more of the formal components that define the trajectory. An iterative generator exposes four such components: 1. The boundary: the input p that initializes generation and the output x that results from it. 2. The transition function: the map fθ (·, ct ) that advances the process at each step.
Target
Timing
Formal operation
SURFACE
Boundary
Pre/post
p 7→ p′ or x 7→ x′
TRAJECTORY
Transition Per-step
fθ 7→ f˜θ,K
LATENT
State
ht 7→ h′t
PARAMETRIC
Parameters Pre-inference θ 7→ θ′
Per-step
Table 1. The four intervention layers. Each layer modifies a different formal component of the iterative generator.
3. The intermediate state: the hidden representation ht being propagated through the trajectory. 4. The parameters: the weights θ and architectural components that define fθ . Each component yields a distinct intervention layer, defined as follows. The four layers are summarized in Table 1. Definition 1 (Surface Infusion). A knowledge-infusion strategy is surface if it acts only on the boundary of the trajectory: transforming the input p 7→ p′ = gK (p) before generation begins, or post-processing the output x 7→ x′ = rK (x) after generation completes, without modifying fθ , any ht , or θ. Definition 2 (Trajectory Infusion). A knowledge-infusion strategy is trajectory if it modifies the transition function at inference time, fθ 7→ f˜θ,K , thereby altering how the state evolves from step to step, while leaving the current state ht and the stored parameters θ unchanged. Definition 3 (Latent Infusion). A knowledge-infusion strategy is latent if it directly modifies the intermediate state, ht 7→ h′t = ℓK (ht ), at one or more steps during generation, changing what is being evolved, while leaving the transition function fθ and the parameters θ unchanged. Definition 4 (Parametric Infusion). A knowledgeinfusion strategy is parametric if it modifies the parameters θ 7→ θ′ = θ + ∆θK or the architecture of the generator prior to inference, altering the learned dynamics of fθ .
3. The Four Layers: Methods and Trade-offs We examine each intervention layer in terms of its concrete instantiation in existing methods and its profile along five operational axes. (i) Controllability: how precisely a practitioner can direct the intervention toward a specific knowledge constraint. (ii) Interpretability: whether the intervention and its effect on the output can be directly inspected. (iii) Persistence: whether the effect holds within a single generation (transient) or across all future generations (permanent). (iv) Computational cost: the additional compute required, at inference time or training time. (v) Failurecorrection scope: which classes of knowledge violation,
prompt-level, structural, or distributional, the layer can address, defined relative to the consistency predicate C(x, K) from Section 2. Table 2 provides a consolidated summary; ratings are analytical assessments derived from formal layer properties, not empirical measurements. For concreteness, we note that diffusion models instantiate Eq. 2 as t ϵ (h , t, c) + σt z, where the four ht−1 = √1αt ht − √1−α θ t 1−ᾱt layers correspond to modifying c (surface), replacing ϵθ (·) (trajectory), editing ht (latent), and updating θ (parametric). The methods below are drawn primarily from diffusion but the definitions apply to any iterative generator.
3.1.
SURFACE
Infusion
Surface infusion operates at the boundary of the generative trajectory. It transforms the input p 7→ p′ = gK (p) before generation begins, or post-processes the output x 7→ x′ = rK (x) after generation completes. The internal dynamics, fθ , every ht , and θ, remain untouched. On the input side, retrieval-augmented generation (RAG) [15] prepends knowledge-relevant context to the prompt; knowledge-graph-grounded prompt rewriting [33] restructures conditioning using entities and relations from K. In autoregressive models, few-shot exemplar selection from a knowledge base serves the same role. On the output side, post-hoc verification checks the generated output against K and either rejects or locally repairs inconsistencies [14], and safety filters [24] screen outputs against constraint ontologies. Surface infusion is the cheapest and most interpretable layer. Every modification is visible in the input or output, no model access is needed, and it composes trivially with any generator. Its corrective reach, however, is limited to prompt-level violations which are errors caused by missing or ambiguous conditioning. Once generation begins, internal dynamics may override the conditioning signal, producing violations that surface methods cannot detect or correct until after the output materializes.
3.2.
using knowledge-derived constraints, altering the sampling rule rather than any hidden state. Trajectory infusion provides high controllability, as the practitioner specifies how the update rule changes, and strong persistence within a generation, since the modified transition applies at every step and enables continuous steering. Its corrective reach extends to structural violations, including incorrect spatial relations, compositional errors, and emerging constraint violations. The cost is moderate (additional forward passes per step), and interpretability is limited since the intervention operates in the model’s internal prediction space.
TRAJECTORY
Infusion
Trajectory infusion modifies the transition function at inference time, fθ 7→ f˜θ,K , while leaving the state ht and stored parameters θ unchanged. The model sees the same latent but computes a different update direction. Classifier-free guidance [8] replaces the standard noise prediction with a weighted combination of conditional and unconditional estimates, modifying the update rule to amplify prompt-aligned directions. Classifier-based guidance [3] adds an external classifier’s gradient to the score function. Diffusion posterior sampling (DPS) [2] augments the transition with a likelihood-gradient term to enforce measurement consistency. In autoregressive models, constrained decoding [11] and knowledge-grounded logit adjustment modify the next-token distribution at each step
3.3.
LATENT
Infusion
Latent infusion directly modifies the intermediate state, ht 7→ h′t = ℓK (ht ), at one or more steps during generation. The transition function fθ and the parameters θ are unchanged, the model applies its usual dynamics, but to an altered state. Prompt-to-Prompt editing [7] overwrites cross-attention maps within the denoising network, surgically redirecting which spatial regions attend to which semantic concepts. SDEdit [18] re-noises a reference image to produce a modified h′0 and runs standard denoising from there—a latent intervention at t = 0. Latent projection [4] maps intermediate representations onto or away from knowledge-defined subspaces. In autoregressive models, activation editing [16] and representation engineering [34] directly modify internal hidden states during the forward pass. Latent infusion offers the most fine-grained controllability. The practitioner can target specific features, spatial regions, or semantic dimensions of the hidden state. Its corrective reach also covers structural violations, but through a different mechanism than trajectory infusion: rather than changing the direction of travel, it moves the traveler to a different position. The critical limitation is persistence: latent edits are pointwise perturbations, and the unmodified dynamics at subsequent steps may attenuate or override them. This challenge has motivated steprange-controlled attention injection [7], per-step null-text optimization [19], and noise-level-dependent faithfulness– realism tradeoffs [18].
3.4.
PARAMETRIC
Infusion
Parametric infusion modifies the parameters θ 7→ θ′ = θ + ∆θK or the architecture of the generator prior to inference. Unlike the three inference-time layers, parametric infusion permanently changes the generator’s learned dynamics. DreamBooth [26] fine-tunes the full denoising network on concept-specific images, embedding new knowledge into θ. LoRA [12] injects trainable low-rank matrices into attention layers with minimal overhead. ControlNet [32] adds a parallel encoder branch that injects spatial condi-
tioning, permanently extending the model’s input interface. Concept erasure [4] fine-tunes θ to remove specific concepts from the generative distribution entirely. In autoregressive models, knowledge-grounded fine-tuning and adapter injection [12] serve the same role. Parametric infusion is the only layer with permanent persistence, with knowledge encoded in θ and applied to all future generations without per-instance cost. Its corrective reach extends to distributional violations, systematic biases or missing concepts in the model’s learned distribution that no inference-time intervention can address. The cost is highest (training compute, data curation), and flexibility is lowest, as updating or retracting knowledge requires retraining.
3.5. Borderline Cases Not every method maps to a single layer. Attend-andExcite [1] computes a loss over attention maps (a function of ht ) and backpropagates through it to update ht : the loss design is a trajectory-layer choice (it shapes the update rule), while the gradient step that modifies ht is a latentlayer operation. We classify it as a trajectory–latent composition. Similarly, DPS [2] augments the score function with a likelihood gradient, primarily a trajectory intervention, but the gradient is applied directly to ht , producing a secondary latent effect. The framework accommodates these cases as multi-layer compositions with a primary and secondary layer, rather than demanding single-label classification.
3.6. Cross-Layer Insights Persistence separates trajectory from latent. Both layers intervene during generation with comparable controllability, but trajectory infusion modifies the map fθ 7→ f˜θ,K continuously across its active window, while latent infusion perturbs the argument ht at discrete points. The unmodified dynamics may attenuate latent edits; they cannot attenuate a trajectory modification that is reapplied at every step. This persistence gap is the principal operational reason to distinguish the two layers. No single layer dominates. Surface infusion is cheap and interpretable but shallow in corrective reach. Parametric infusion is permanent and broad but expensive and inflexible. Trajectory and latent infusion offer fine-grained inferencetime control but are transient. This complementarity follows from the fact that each layer targets a different formal component of the generator.
4. Use Cases We instantiate the framework in two domains with differing knowledge types, architectures, and failure modes. This
demonstrates that our framework generalizes across openended generation and structured process simulation.
4.1. Knowledge-Constrained Process Simulation in Rocket Assembly We ground the proposed framework in a smart manufacturing testbed based on a rocket assembly pipeline from the Future Factories (FF) lab [6]. The process consists of assembly cycles, each divided into 21 discrete cycle states (S) representing sequential operations such as component placement, alignment, and attachment. Each cycle produces a multimodal record comprising synchronized images from multiple cameras and sensor measurements (e.g., robot joint angles, conveyor states, and actuator signals) [22, 30]. A key characteristic of this process is that valid system evolution is highly structured, which means only specific components can be present at each cycle state. Transitions between states must follow predefined procedural constraints. These constraints, along with anomaly definitions (e.g., missing nose cone or body segments), are encoded in a process ontology that serves as the knowledge source K. We consider a generative simulation setting in which the model predicts future process states (e.g., next visual frame or structured configuration) given the current state. Formally, starting from an initial state h0 derived from the current cycle (image, sensors, and metadata), the model generates a trajectory: h0 → h1 → · · · → hT , where each state corresponds to a candidate configuration of the assembly process. Inputs and Outputs. The input consists of (i) the current cycle state (e.g., S4 or S9 ), (ii) synchronized multimodal observations (images and sensor values), and (iii) ontology constraints specifying valid components and transitions. The output is a sequence of images representing the predicted future states of the assembly process. How Knowledge Acts in This System (Figure 2) Surface infusion. At the boundary, ontology knowledge is used to constrain valid initializations and outputs. For example, given a current cycle state, the ontology restricts which components can appear (e.g., a nose component cannot be present before a certain stage). Generated outputs that violate these rules (e.g., predicting a component too early in the sequence) are filtered and rejected. Trajectory infusion. The assembly process follows strict procedural transitions (e.g., component attachment must precede inspection). These transition rules are injected into the generation process to prevent invalid state evolution, such as skipping required steps or generating incom-
Layer
Controllability Interpretability Persistence
Cost
Failure Scope Representative Methods
Low
Prompt-level RAG [15], KG-grounded prompting [33], output filtering [24]
SURFACE
Low
High
Transient
TRAJECTORY
High
Low
Transient Moderate (continuous)
Structural
LATENT
High
Low
Transient Moderate (attenuating)†
Structural
PARAMETRIC
Low
Low
Permanent
High
Classifier- and classifier-free guidance [3, 8], DPS [2], constrained decoding [11]
Prompt-to-Prompt [7], SDEdit [18], latent projection [4], activation editing [16] Distributional DreamBooth [26], LoRA [12], ControlNet [32], concept erasure [4]
Table 2. Unified summary of the four intervention layers. Ratings are analytical assessments derived from the formal properties of each layer (Section 2), not empirical measurements; empirical validation is presented in Section 5. Failure classes are defined in Section 3.6. † Latent edits are subject to attenuation by subsequent unmodified dynamics [7, 19], making their effective persistence weaker than trajectory infusion at
the same number of active steps.
Figure 2. Ontology-guided knowledge infusion for process simulation in a rocket assembly pipeline. The process ontology serves as structured knowledge K and constrains generation at four layers: surface gating at input/output boundaries, trajectory constraints over valid procedural transitions, latent repair of intermediate structural inconsistencies, and Parametric learning from valid assembly trajectories. This illustrates the framework in a highly structured domain where knowledge is tied to temporal ordering and process physics.
patible component configurations. This ensures that predicted trajectories respect the temporal ordering of the manufacturing process. Latent infusion. Intermediate states may contain localized inconsistencies, such as partial and missing components in the generated representation. These are corrected by enforcing ontology constraints at the representation level, for instance ensuring that if a body segment is present, its corresponding supporting components must also exist. This enables fine-grained correction of structural errors during generation. Parametric infusion. The generative model is trained
on trajectories derived from valid assembly cycles, allowing it to internalize common patterns such as typical component configurations at each cycle state and the progression of assembly steps. This enables the model to produce plausible states even before explicit constraints are applied. Discussion. This use case highlights that knowledge in manufacturing is tightly coupled to process structure: constraints arise from physical assembly rules and temporal ordering rather than abstract semantics. Surface constraints eliminate invalid configurations at the boundaries, trajectory constraints enforce correct sequencing, latent correc-
tions fix local structural violations, and parametric learning captures recurring process dynamics. These mechanisms ensure that generated trajectories remain consistent with both the physical and procedural requirements of the assembly pipeline.
Layer
Control Interp. Persistence Cost
Surface Trajectory Latent Parametric
Low High High Low
High Low Low Low
Low High Med High
Low Med Med High
4.2. Multi-Layer Safety Alignment We instantiate the framework for safety alignment in textto-image diffusion, where a multimodal knowledge graph (MMKG) serves as the structured knowledge source K (Figure 3). Knowledge source. The MMKG encodes approximately 104 textual nodes and 103 visual prototypes as a typed graph. Hate concepts are linked to surface forms (slurs, trope phrases), CLIP ViT-L/14 visual centroids, safecontext concepts, and explicit neutral counterparts via typed relations (Indicates, Counter to, Mitigates). Consistency predicate C(x, K) = 1 holds if and only if the generated image x contains no visual realization of any hate concept in K, as determined by an external multimodal safety classifier. Layer instantiation. Using frozen SDXL and SD-v1.5 backbones, we activate three layers cumulatively: Surface (input-side): MMKG-guided prompt neutralization detects hate-concept surface forms via obfuscationtolerant graph lookup and a RoBERTa-based clause-level stance classifier, replacing hateful spans with MMKGprovided neutral terms while preserving identity mentions: p 7→ p′ = gK (p). Trajectory–latent (mid-generation): At a late denoising step (tcheck ≈ 0.9T ), a decoded preview is scored against MMKG hate prototypes via CLIP. If activation exceeds a calibrated threshold, the system rewinds the latent to trewind ≈ 0.3T by re-noising and blending with a neutral reference latent (latent: ht 7→ h′t ), then resumes with MMKGderived neutral conditioning (trajectory: fθ 7→ f˜θ,K ). Surface (output-side): A 7 × 7 CLIP patch grid scores local image regions against MMKG hate and safe-context prototypes. Patches closer to hate than safe prototypes are locally inpainted using MMKG-derived neutral prompts: x 7→ x′ = rK (x). All modules are training-free with respect to the diffusion backbone. Parametric infusion is not evaluated in this experiment as it requires retraining; the design holds backbones frozen to isolate inference-time layer composition. Baselines and metrics. We evaluate on the Detonate benchmark [23] (25K prompts) against vanilla generation, SAFREE [31] (embedding-space steering), and SLD [28] (safety-guided diffusion). We report toxicity (fraction flagged as hateful; lower is better), CLIP score (text–image
SDXL
SD-v1.5
Config.
Tox↓ CLIP↑ AQI↑ Tox↓ CLIP↑ AQI↑
Vanilla SAFREE [31] SLD [28]
.31 .22 .18
.310 .305 .320
.23 .28 .31
.28 .21 .17
.330 .320 .335
.22 .27 .30
Surface (input) +Traj.–latent +Surface (output)
.17 .11 .09
.330 .340 .335
.32 .37 .36
.16 .10 .08
.345 .360 .350
.31 .36 .35
Table 3. Multi-layer safety alignment on Detonate. Each row adds one layer cumulatively. All methods use frozen backbones.
alignment; higher is better), and AQI (aesthetic quality; higher is better), generating 4 samples per prompt and reporting means.
5. Empirical Results We evaluate the multi-layer safety system described in Section 4.2. Table 3 reports results for both backbones; the pattern is consistent across architectures. Finding 1: Different layers correct different failure classes. Surface input infusion reduces toxicity from 0.31 to 0.17 (SDXL) by neutralizing prompt-level triggers, but 17% of outputs remain toxic, reflecting structural violations where pretrained weights hallucinate hateful motifs despite a clean prompt. Trajectory–latent intervention catches these mid-generation failures (0.11). Output-side surface infusion removes residual artifacts surviving both prior layers (0.09). This layered pattern matches the framework’s prediction that prompt-level, structural, and residual violations require distinct layers (Section 3.6). Finding 2: Multi-layer composition outperforms any single layer. The full stack (0.09) halves the best single-layer toxicity (0.17) and outperforms both baselines (SAFREE: 0.22, SLD: 0.18) while maintaining higher CLIP and AQI, confirming complementary coverage (Section 3.6). Finding 3: Shared knowledge structure prevents interlayer conflict. All layers query the same MMKG, with shared hate concepts, neutral counterparts, and a consistency predicate driving prompt neutralization, trajectory
Content advisory: Includes violence, sexually explicit imagery, and harmful stereotypes.
Figure 3. Multi-layer knowledge infusion for safety alignment in text-to-image diffusion using a multimodal knowledge graph (MMKG). Input-side surface infusion neutralizes unsafe prompt spans using graph-linked counterparts; trajectory–latent intervention detects harmful activation during denoising, rewinds and repairs the latent, and resumes sampling with neutral conditioning; output-side surface infusion identifies unsafe local regions and repairs them via targeted inpainting. MMKG provides a shared control signal across all active layers.
steering, and output repair. This shared grounding ensures complementary rather than conflicting effects, supporting the principle that structured knowledge should function as a unified control signal across the trajectory.
6. Discussion and Future work Limitations. The trade-off ratings in Table 2 are analytical; controlled empirical measurement of controllability, interpretability, and persistence across standardized benchmarks would strengthen these claims. Our treatment of autoregressive and flow-based generators is less developed than the diffusion setting, and extending the case study to these families would strengthen generality. Finally, our empirical validation covers a single task (safety), knowledge modality (MMKG), and model family (latent diffusion); generalization to other domains requires further study. Open problems. The framework surfaces research questions that, to our knowledge, have not been explicitly posed. Adaptive layer selection. Given a knowledge source K and a detected violation of C(x, K), can the appropriate intervention layer be selected automatically? This requires learning a mapping from violation type to intervention target, a diagnostic problem that the four-layer vocabulary makes precise but does not solve. Inter-layer interference. Our experiment used a shared MMKG to ensure coherent multi-layer composition (Find-
ing 3), but independently designed layers may conflict, as trajectory guidance and latent edits push in different directions. Characterizing when composition is synergistic versus destructive, and developing scheduling or jointoptimization strategies, is an open problem with practical consequences for modular knowledge-grounded systems. Knowledge-aware trajectory design. Current generators are trained without awareness of the knowledge constraints they must satisfy. Designing objectives that make trajectories more amenable to inference-time infusion is a promising direction, for example by learning disentangled latent dimensions aligned with knowledge-graph relations. Evaluation protocol. The framework’s comparative claims call for a standardized benchmark. A knowledgeconsistency evaluation could pair a structured knowledge source K with generation prompts whose outputs must satisfy specific relational or attributive constraints derived from K. Violation rates under the consistency predicate C(x, K) could then be compared across single-layer and multi-layer configurations, controlling for output quality via standard metrics (FID, CLIPScore). Designing such a benchmark is a concrete next step toward comprehensive empirical validation.
7. Conclusion We formulate knowledge infusion in iterative generative models as an intervention-layer problem and introduce a
four-layer framework grounded in the formal components of generation. The framework provides a principled design space for analyzing and composing knowledge-integration strategies. We instantiate it in diffusion models and validate its predictions in a controlled safety-alignment setting, showing that different layers address distinct failure classes and that multi-layer composition yields complementary gains. More broadly, the framework shifts the question from which knowledge source to use to where and how that knowledge should enter the generative process. An important direction for future work is adaptive selection and coordination of intervention layers based on violation type, model architecture, and deployment constraints.
References [1] Hila Chefer, Yuval Alaluf, Yael Vinker, Lior Wolf, and Daniel Cohen-Or. Attend-and-excite: Attentionbased semantic guidance for text-to-image diffusion models. ACM transactions on Graphics (TOG), 42 (4):1–10, 2023. 5 [2] Hyungjin Chung, Jeongsol Kim, Michael T Mccann, Marc L Klasky, and Jong Chul Ye. Diffusion posterior sampling for general noisy inverse problems. arXiv preprint arXiv:2209.14687, 2022. 4, 5, 6 [3] Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis, 2021. 1, 4, 6 [4] Rohit Gandikota, Joanna Materzynska, Jaden FiottoKaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, pages 2426– 2436, 2023. 4, 5, 6 [5] Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, Meng Wang, and Haofen Wang. Retrieval-augmented generation for large language models: A survey, 2024. 1 [6] Ramy Harik, Fadi El Kalach, Jad Samaha, Devon Clark, Drew Sander, Philip Samaha, Liam Burns, Ibrahim Yousif, Victor Gadow, Theodros Tarekegne, et al. Analog and multi-modal manufacturing datasets acquired on the future factories platform. arXiv preprint arXiv:2401.15544, 2024. 5 [7] Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Promptto-prompt image editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022. 1, 4, 6 [8] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance, 2022. 1, 4, 6 [9] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. 2 [10] Aidan Hogan, Eva Blomqvist, Michael Cochez, Claudia D’amato, Gerard De Melo, Claudio Gutierrez,
Sabrina Kirrane, José Emilio Labra Gayo, Roberto Navigli, Sebastian Neumaier, Axel-Cyrille Ngonga Ngomo, Axel Polleres, Sabbir M. Rashid, Anisa Rula, Lukas Schmelzeisen, Juan Sequeda, Steffen Staab, and Antoine Zimmermann. Knowledge graphs. ACM Computing Surveys, 54(4):1–37, 2021. 1 [11] Chris Hokamp and Qun Liu. Lexically constrained decoding for sequence generation using grid beam search. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1535–1546, 2017. 4, 6 [12] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Liang Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. Iclr, 1(2):3, 2022. 1, 4, 5, 6 [13] Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and Ting Liu. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems, 43 (2):1–55, 2025. 1 [14] Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12):1–38, 2023. 1, 4 [15] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrievalaugmented generation for knowledge-intensive nlp tasks, 2021. 1, 4, 6 [16] Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference-time intervention: Eliciting truthful answers from a language model. Advances in Neural Information Processing Systems, 36:41451–41530, 2023. 4, 6 [17] Pan Lu, Swaroop Mishra, Tony Xia, Liang Qiu, KaiWei Chang, Song-Chun Zhu, Oyvind Tafjord, Peter Clark, and Ashwin Kalyan. Learn to explain: Multimodal reasoning via thought chains for science question answering, 2022. 1 [18] Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations, 2022. 1, 4, 6 [19] Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6038–6047, 2023. 4, 6
[20] OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, Irwan Bello, Jake Berdine, Gabriel Bernadett-Shapiro, Christopher Berner, Lenny Bogdonoff, Oleg Boiko, Madelaine Boyd, Anna-Luisa Brakman, Greg Brockman, Tim Brooks, Miles Brundage, Kevin Button, Trevor Cai, Rosie Campbell, Andrew Cann, Brittany Carey, Chelsea Carlson, Rory Carmichael, Brooke Chan, Che Chang, Fotis Chantzis, Derek Chen, Sully Chen, Ruby Chen, Jason Chen, Mark Chen, Ben Chess, Chester Cho, Casey Chu, Hyung Won Chung, Dave Cummings, Jeremiah Currier, Yunxing Dai, Cory Decareaux, Thomas Degry, Noah Deutsch, Damien Deville, Arka Dhar, David Dohan, Steve Dowling, Sheila Dunning, Adrien Ecoffet, Atty Eleti, Tyna Eloundou, David Farhi, Liam Fedus, Niko Felix, Simón Posada Fishman, Juston Forte, Isabella Fulford, Leo Gao, Elie Georges, Christian Gibson, Vik Goel, Tarun Gogineni, Gabriel Goh, Rapha GontijoLopes, Jonathan Gordon, Morgan Grafstein, Scott Gray, Ryan Greene, Joshua Gross, Shixiang Shane Gu, Yufei Guo, Chris Hallacy, Jesse Han, Jeff Harris, Yuchen He, Mike Heaton, Johannes Heidecke, Chris Hesse, Alan Hickey, Wade Hickey, Peter Hoeschele, Brandon Houghton, Kenny Hsu, Shengli Hu, Xin Hu, Joost Huizinga, Shantanu Jain, Shawn Jain, Joanne Jang, Angela Jiang, Roger Jiang, Haozhun Jin, Denny Jin, Shino Jomoto, Billie Jonn, Heewoo Jun, Tomer Kaftan, Łukasz Kaiser, Ali Kamali, Ingmar Kanitscheider, Nitish Shirish Keskar, Tabarak Khan, Logan Kilpatrick, Jong Wook Kim, Christina Kim, Yongjik Kim, Jan Hendrik Kirchner, Jamie Kiros, Matt Knight, Daniel Kokotajlo, Łukasz Kondraciuk, Andrew Kondrich, Aris Konstantinidis, Kyle Kosic, Gretchen Krueger, Vishal Kuo, Michael Lampe, Ikai Lan, Teddy Lee, Jan Leike, Jade Leung, Daniel Levy, Chak Ming Li, Rachel Lim, Molly Lin, Stephanie Lin, Mateusz Litwin, Theresa Lopez, Ryan Lowe, Patricia Lue, Anna Makanju, Kim Malfacini, Sam Manning, Todor Markov, Yaniv Markovski, Bianca Martin, Katie Mayer, Andrew Mayne, Bob McGrew, Scott Mayer McKinney, Christine McLeavey, Paul McMillan, Jake McNeil, David Medina, Aalok Mehta, Jacob Menick, Luke Metz, Andrey Mishchenko, Pamela Mishkin, Vinnie Monaco, Evan Morikawa, Daniel Mossing, Tong Mu, Mira Murati, Oleg Murk, David Mély, Ashvin Nair, Reiichiro Nakano, Rajeev Nayak, Arvind Neelakantan, Richard Ngo, Hyeonwoo Noh, Long Ouyang, Cullen O’Keefe,
Jakub Pachocki, Alex Paino, Joe Palermo, Ashley Pantuliano, Giambattista Parascandolo, Joel Parish, Emy Parparita, Alex Passos, Mikhail Pavlov, Andrew Peng, Adam Perelman, Filipe de Avila Belbute Peres, Michael Petrov, Henrique Ponde de Oliveira Pinto, Michael, Pokorny, Michelle Pokrass, Vitchyr H. Pong, Tolly Powell, Alethea Power, Boris Power, Elizabeth Proehl, Raul Puri, Alec Radford, Jack Rae, Aditya Ramesh, Cameron Raymond, Francis Real, Kendra Rimbach, Carl Ross, Bob Rotsted, Henri Roussez, Nick Ryder, Mario Saltarelli, Ted Sanders, Shibani Santurkar, Girish Sastry, Heather Schmidt, David Schnurr, John Schulman, Daniel Selsam, Kyla Sheppard, Toki Sherbakov, Jessica Shieh, Sarah Shoker, Pranav Shyam, Szymon Sidor, Eric Sigler, Maddie Simens, Jordan Sitkin, Katarina Slama, Ian Sohl, Benjamin Sokolowsky, Yang Song, Natalie Staudacher, Felipe Petroski Such, Natalie Summers, Ilya Sutskever, Jie Tang, Nikolas Tezak, Madeleine B. Thompson, Phil Tillet, Amin Tootoonchian, Elizabeth Tseng, Preston Tuggle, Nick Turley, Jerry Tworek, Juan Felipe Cerón Uribe, Andrea Vallone, Arun Vijayvergiya, Chelsea Voss, Carroll Wainwright, Justin Jay Wang, Alvin Wang, Ben Wang, Jonathan Ward, Jason Wei, CJ Weinmann, Akila Welihinda, Peter Welinder, Jiayi Weng, Lilian Weng, Matt Wiethoff, Dave Willner, Clemens Winter, Samuel Wolrich, Hannah Wong, Lauren Workman, Sherwin Wu, Jeff Wu, Michael Wu, Kai Xiao, Tao Xu, Sarah Yoo, Kevin Yu, Qiming Yuan, Wojciech Zaremba, Rowan Zellers, Chong Zhang, Marvin Zhang, Shengjia Zhao, Tianhao Zheng, Juntang Zhuang, William Zhuk, and Barret Zoph. Gpt-4 technical report, 2024. 1 [21] Shirui Pan, Linhao Luo, Yufei Wang, Chen Chen, Jiapu Wang, and Xindong Wu. Unifying large language models and knowledge graphs: A roadmap. IEEE Transactions on Knowledge and Data Engineering, 36 (7):3580–3599, 2024. 1 [22] Renjith Prasad, Chathurangi Shyalika, Fadi El Kalach, Revathy Venkataramanan, Ramtin Zand, Ramy Harik, and Amit Sheth. Assemai: Interpretable image-based anomaly detection for manufacturing pipelines. In 2024 International Conference on Machine Learning and Applications (ICMLA), pages 1720–1727. IEEE, 2024. 5 [23] Renjith Prasad, Abhilekh Borah, Hasnat Md Abdullah, Chathurangi Shyalika, Gurpreet Singh, Ritvik Garimella, Rajarshi Roy, Harshul Surana, Nasrin Imanpour, Suranjana Trivedy, et al. Detonate: A benchmark for text-to-image alignment and kernelized direct preference optimization. arXiv preprint arXiv:2506.14903, 2025. 7 [24] Javier Rando, Daniel Paleka, David Lindner, Lennart
Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022. 4, 6 [25] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models, 2022. 1, 2 [26] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500–22510, 2023. 1, 4, 6 [27] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, S. Sara Mahdavi, Rapha Gontijo Lopes, Tim Salimans, Jonathan Ho, David J Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding, 2022. 1 [28] Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22522–22531, 2023. 7 [29] Amit Sheth, Manas Gaur, Ugur Kursuncu, and Ruwan Wickramarachchi. Shades of knowledge-infused learning for enhancing deep learning. IEEE Internet Computing, 23(6):54–63, 2020. 2 [30] Chathurangi Shyalika, Renjith Prasad, Fadi El Kalach, Revathy Venkataramanan, Ramtin Zand, Ramy Harik, and Amit Sheth. Nsf-map: neurosymbolic multimodal fusion for robust and interpretable anomaly prediction in assembly pipelines. In Proceedings of the ThirtyFourth International Joint Conference on Artificial Intelligence, pages 9330–9338, 2025. 5 [31] Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. arXiv preprint arXiv:2410.12761, 2024. 7 [32] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, pages 3836– 3847, 2023. 1, 4, 6 [33] Qinggang Zhang, Junnan Dong, Hao Chen, Daochen Zha, Zailiang Yu, and Xiao Huang. Knowgpt: Knowledge graph based prompting for large language models. Advances in neural information processing systems, 37:6052–6080, 2024. 4, 6
[34] Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach to ai transparency, 2023. URL https://arxiv. org/abs/2310.01405, 97, 2022. 4