Pith. sign in

REVIEW 3 major objections 5 minor 49 references

Memories of Forgotten Concepts

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Concept erasure methods for text-to-image diffusion models do not erase concepts: diffusion inversion recovers high-likelihood latent seeds that regenerate erased images with high fidelity across all nine tested methods.

desk verdict A real vulnerability in concept erasure, but the 'intractable' conclusion needs a no-concept control to separate memory from inversion power. read the letter →

arxiv 2412.00782 v1 pith:7CRDAHNO submitted 2024-12-01 cs.CV

Matan Rusanovsky , Shimon Malnick , Amir Jevnisek , Ohad Fried , Shai Avidan This is my paper · ORCID
classification cs.CV
keywords concepterasurediffusionmodelsmachineunlearninginversionlatentspacetext-to-imagegenerationmodelsafetylikelihoodanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether concept-erasure methods actually remove a concept from a text-to-image diffusion model, or merely make it harder to summon with text. Its answer, tested on nine published ablation methods and six concepts, is that the concept remains accessible: inverting an erased image back to a seed latent yields a seed that is both likely under the model's Gaussian prior and capable of regenerating the image at high fidelity (mean PSNR around 23 to 34 dB). On the paper's relative-likelihood measure, erased-concept seeds land as close to the normal prior as seeds of ordinary non-erased images. The paper concludes that fully erasing concept information from such models may be intractable, and that current ablation evaluations miss a whole class of latent routes to forbidden content.

What carries the argument

The argument runs on three pieces. First, diffusion inversion (Renoise, an iterative noising procedure) maps a query image to a seed latent $z_T$. Second, likelihood is measured as the negative log-likelihood of $z_T$ under the standard normal prior, and the paper's relative distance $d_N(E,R)$ is the ratio of the Earth Mover's Distance between the erased set's NLL distribution and the normal prior to the same EMD for a reference set; this ratio turns raw likelihood values into a unitless criterion where values near 1 mean erased-concept seeds are as plausible as reference seeds, and values below 1 mean they are even more plausible. Third, the Sequential Inversion Block (a decoder inversion that moves an initial latent toward the query image, followed by diffusion inversion) produces many distant high-likelihood seeds for a single erased image.

What would settle it

Run the same inversion and likelihood protocol on a diffusion model that was retrained from scratch without the target concept in its training data: if that model also yields high-PSNR reconstructions of the concept and a $d_N(E,R)$ near 1, the paper's central inference fails, whereas poor reconstructions or a large $d_N(E,R)$ would confirm that the failure is specific to ablation methods. A second check is to invert random reference images and compare their PSNR distribution to erased images under the same ablated model.

Watch

Extended reading notes

Core claim

The paper's central finding is that, for every image in an erased-concept set and across the nine ablation methods examined, there exists at least one latent seed $z_T$ such that running the ablated model from that seed reconstructs the erased image with high quality, and the seed's negative log-likelihood under the standard normal prior is comparable to seeds of reference images. Across concepts and methods the relative distance $d_N(E,R)$ ranges from 0.42 to 2.49, meaning the erased set is about as likely as the reference set; in several cases it is even closer to the prior than the reference set. The paper also shows that one erased image has many distinct memories: starting from different support images, a sequential inversion procedure produces multiple well-separated seeds, with average pairwise cosine distances of 0.58 and 0.69 in the two concepts shown, that all regenerate the same erased image. The intended conclusion is that ablated models have not forgotten the concept; the concept information persists in latent space.

Load-bearing premise

The load-bearing premise is that a model which truly erased a concept would not admit a high-likelihood seed that reconstructs the erased image, a premise the paper invokes when it interprets high reconstruction PSNR at Section 3.2 as evidence of persistence; the study includes no positive control such as a model retrained from scratch without the concept.

Editorial extensions

If this is right

  • Safety evaluations that only sample text prompts with random seeds undercount the model's ability to produce erased content; a latent-space probe should be part of the evaluation.
  • The relative-distance metric $d_N(E,R)$ offers a quantitative way to compare erasure methods by how far erased-concept latents sit from the prior, relative to reference images.
  • Because each erased image has many distant high-likelihood seeds, a successful erasure method must suppress a region of latent space, not a single seed or prompt.
  • White-box access to a model is enough to regenerate erased content, so erasure guarantees should be assumed limited for open models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not include a positive control such as a model retrained from scratch without the concept; until that control is tested, the high-PSNR inversions could reflect a general property of diffusion inversion rather than a specific failure of ablation.
  • A testable extension would run the same inversion and likelihood protocol on a model trained without the target concept and compare its $d_N(E,R)$ to the ablated models.
  • The many-memories result suggests that the volume of latent space assigned to a concept is large; future erasure methods could be scored by the volume of reconstructing seeds, not just the likelihood of individual ones.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a latent-space evaluation protocol for concept erasure in text-to-image diffusion models. For each erased-concept image, the authors use diffusion inversion (Renoise) to recover a latent seed, then measure the seed's likelihood under the model's Gaussian prior and the reconstruction quality (PSNR) of the generated image. Across nine erasure methods and six concepts, they report mean PSNR values around 23-34 dB and relative distance values d_N between 0.42 and 2.49, which they interpret as evidence that erased concepts remain accessible. They further introduce a Sequential Inversion Block to retrieve multiple distinct, likely seeds for a single query image and conclude that fully erasing concept information may be intractable.

Significance. If the interpretation holds, the paper provides a broadly applicable evaluation tool and a concrete demonstration that current concept erasure methods may be circumvented through latent-space inversion. The breadth of methods and concepts is commendable, and the inversion-based analysis is an original angle compared with prior image-space or text-space evaluations. The main value is empirical: it surfaces a specific attack surface for ablated LDMs. The strength of the central conclusion, however, depends critically on whether the observed reconstructions reflect true persistence of erased concepts or simply the general power of diffusion inversion, and the manuscript currently lacks the control needed to separate these explanations.

major comments (3)
  1. [Sec. 3.2, Fig. 5] The central claim that erased concepts persist rests on the absence of a positive control. The only baseline is the unablated 'Vanilla' model, which shares the base weights and still contains the target concept. A model that genuinely lacks the concept (e.g., retrained on a dataset without the concept) could plausibly yield the same high PSNR and overlapping likelihood values, because diffusion inversion is designed to find a seed for any given image. The scrambled-image control in Sec. 4 shows lower NLL and PSNR, but scrambled images are out-of-distribution, not a no-concept baseline. Without such a control, the inference that erased concepts persist is not established; the result may characterize diffusion inversion rather than residual memory.
  2. [Eq. (5), Fig. 2] The likelihood comparison against N(0,I) is likely non-informative. Inversion methods such as Renoise are explicitly designed to produce latents near the typical set of the prior, so overlap between NLL→zT(E), NLL→zT(R), and NLL(N) is expected by construction for any diffusion model, ablated or not. The scrambled-image example in Sec. 4 still yields a seed with NLL 23.89K, which is within the high-likelihood region. The d_N metric therefore does not provide evidence that the erased set is specifically more plausible than the reference set; it may simply reflect the inversion procedure's constraint. A more discriminative test would compare inversion of erased-concept images against inversion of control images on a model that is known to lack the concept.
  3. [Sec. 3.2, Fig. 5] The paper reports mean PSNR and d_N without error bars, sample counts, or per-image distributions. The abstract claims 'for every image from the erased concept set' seeds can be found, but the experimental section does not state how many images are in each concept set or whether the reported means reflect the worst case. Without such statistics, the strength of the existence claim cannot be assessed. Please provide the number of query images, per-image results (e.g., box plots or scatter plots), and confidence intervals.
minor comments (5)
  1. [Fig. 2 and Fig. 3] The histograms and the Gaussian fits are not labeled with sample sizes, and the symbol 'N' is overloaded (normal distribution vs. sample count). Please clarify.
  2. [Sec. 3.1] The phrase 'a value smaller than 1 ... indicates that something is wrong with the model' is vague; please specify what 'wrong' means in the context of the hypothesis.
  3. [References] References [30] and [31] point to the same paper (Rombach et al.) and are cited separately; please consolidate.
  4. [Fig. 5] The x-axis label 'Tench' appears with a space in the figure caption; please fix the typo.
  5. [Supplementary Sec. E] The choice of 5 renoising steps is justified in the Supplementary, but the main text does not mention sensitivity of the results to this parameter; consider a brief robustness statement.

Circularity Check

0 steps flagged · score 1.0 of 10

No load-bearing circularity; the likelihood comparison is empirical and falsifiable.

full rationale

The paper's central inference is not equivalent to its inputs. The relative-distance metric d_N (Eq. 5) is a fixed ratio of EMDs over measured NLL distributions of inverted seeds; no parameter is fitted to force the reported values, and the outcome could have been high d_N values if ablated models truly had erased the concepts. The likelihood overlap between erased-set and reference-set seeds is a measured property, not an assumption. The scrambled-image control in Sec. 4 provides a partial falsification check: shuffled church images yield lower NLL and worse PSNR, showing that the inversion pipeline does not automatically produce likely, high-quality seeds for every image. The reconstruction PSNR is partly constructed by inversion and by the Sequential Inversion Block (Eqs. 6-7 optimize Dec(z) toward I_q), so high PSNR alone would be a weak signal, but the paper does not rest on PSNR alone and explicitly acknowledges inversion's power in the Limitations section. Self-citations (refs [23] and [34]) appear in background or as alternative inversion methods and are not load-bearing. The absence of a concept-free control, such as a model retrained without the concept, is a genuine scope/correctness concern—high-PSNR inversion may be a generic property of diffusion models—but that is an experimental-control gap, not a circular derivation.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the experimental setup: white-box diffusion inversion with fixed hyperparameters and a definitional criterion for memory based on latent likelihood. No new theoretical entities are introduced; the Sequential Inversion Block is a procedure, not an entity.

free parameters (4)
  • Renoise renoising steps count = 5
    Chosen by hand in Appendix E; 10 steps gives PSNR 16.9 dB (low), 5 steps gives 26.3 dB, favoring the paper's conclusion that high-quality reconstructions are possible.
  • Renoise inversion steps count = 50
    Number of diffusion steps used for inversion and inference, chosen to balance reconstruction quality and compute.
  • VAE decoder optimization steps (SIB) = 3000
    Number of optimization steps in the Sequential Inversion Block to map support images toward the query image; chosen to reach convergence.
  • Query images per concept for multi-seed analysis = 5
    Randomly selected query images; the 'for every image' claim in the abstract is extrapolated from these 5.
assumptions (5)
  • domain assumption White-box access to the ablated model and ability to invert images is assumed
    Stated in Limitations; the entire analysis operates in a white-box setting with the query image provided.
  • domain assumption The latent prior remains N(0,I) after concept ablation, and NLL of zT is computed against this fixed prior
    Used in Eq. (5) and throughout Sec. 3.1; weight-based ablations do not change the sampling distribution of zT, so typical-NLL seeds are expected.
  • domain assumption An effectively erased concept should correspond to low-likelihood zT seeds
    This is the paper's criterion for memory (Sec. 3.1); it is a definitional premise, not a proven property of erasure.
  • standard math Central Limit Theorem approximation of NLL distribution as Gaussian
    Appendix D derives NLL(Z) ~ N(1.42k, 0.5k) for the 16K-dimensional latent space; used to interpret histograms and compute EMD.
  • domain assumption Inversion (Renoise) reliably recovers latents that faithfully reconstruct the input image
    The whole analysis depends on the fidelity of Renoise inversion; the paper validates this with PSNR but does not bound failure cases.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Memories of Forgotten Concepts." pith.science (2026). https://pith.science/paper/7CRDAHNO

@misc{pith2026241200782,
  author       = {Pith},
  title        = {Pith review of: Memories of Forgotten Concepts},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7CRDAHNO}},
  note         = {Machine review of arXiv:2412.00782}
}
read the original abstract

Diffusion models dominate the space of text-to-image generation, yet they may produce undesirable outputs, including explicit content or private data. To mitigate this, concept ablation techniques have been explored to limit the generation of certain concepts. In this paper, we reveal that the erased concept information persists in the model and that erased concept images can be generated using the right latent. Utilizing inversion methods, we show that there exist latent seeds capable of generating high quality images of erased concepts. Moreover, we show that these latents have likelihoods that overlap with those of images outside the erased concept. We extend this to demonstrate that for every image from the erased concept set, we can generate many seeds that generate the erased concept. Given the vast space of latents capable of generating ablated concept images, our results suggest that fully erasing concept information may be intractable, highlighting possible vulnerabilities in current concept ablation techniques.

Figures

Figures reproduced from arXiv: 2412.00782 by the authors.

Figure 1
Figure 1. Evaluation of concept erasure models: Prior Art vs. Our Analysis. Prior art analyzes the image generated by an ablated model using the text (or textual embeddings) and a random seed. Instead, we assume that both text and ablated image are given and analyze the likelihood of the corresponding seed, in the latent space of the model, as well as the quality of the generated image. We find that ablated models contain see… view at source ↗
Figure 2
Figure 2. NLL histogram: For a model that erased the concept Nudity (EraseDiff [43]), the likelihood distribution fits different Gaussians (NLL→zT (E), NLL→zT (R)), that are different from the sampling distribution of the LDM which is standard normal distribution (NLL(N )). 22.0K 24.0K 26.0K 28.0K 30.0K 32.0K 34.0K 36.0K NLL 0.000 0.001 0.002 0.003 0.004 Probability Density d =2.49 d =43.03 E1 NLL( (34.4K, 81.6K)) E2 NLL( (25… view at source ↗
Figure 3
Figure 3. Visualizing our distance measure: Our relative dis￾tance measure is the ratio of EMD(E, N )) to EMD(R, N )), where E is the erased set, R is the reference set, N is the normal distribution, and EMD is Earth Movers Distance. As can be seen, the erased model E1 is much farther than E2, suggesting that the model that forgot E1 did a much better job. as a simple way to invert. Subsequent work [25] has shown that this si… view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: Memory of an ablated image: Given an ablated query image Iq, our goal is to find a likely latent zT that can accurately reconstruct the image when processed through an ablated diffusion model. We start by encoding Iq into a latent z0 with the encoder, then apply diffus…
Figure 5
Figure 5. Figure 5: A concept erased model remembers: We report the mean reconstruction PSNR (a) and our proposed relative distance (b) for six concept datasets {Nudity, Van Gogh, Church, Garbage Truck, Parachute, Tench} across nine different concept ablation methods {EraseDiff [43], ESD …
Figure 6
Figure 6. Figure 6: The many memories of an ablated image: (Left) The latent seed z q T of the query image Iq can be obtained from various support images: Is1 , ..., Isk . For support image Isi , we apply the sequential inversion block shown on the right to map it to the seed z (si→q) T .…
Figure 7
Figure 7. Figure 7: Reconstruction from different seeds: Reconstructions from multiple zT seeds were generated via the Sequential Inversion Block (see Sec. 3.3) using 10 different support images (left) for two target concepts: Van Gogh and Tench. While preserving each concept’s core appea…
Figure 8
Figure 8. Figure 8: Distant latents reconstruct erased images: We report the mean reconstruction PSNR (a) and our proposed relative distance (b), for different models and concepts (see [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: Average Pairwise Cosine Distance: For each model that ablated each concept, and for each target image Iq, we av￾erage the pairwise cosine distance (1 − cosine similarity) between all the produced z (si→q) T seed latents. Then, we average the results over all target ima…
Figure 10
Figure 10. Figure 10: Ablated models generalize to shuffled images: For a diffusion model that ablates the concept Church, we take a church image in (a), split it to patches of shape 8 × 8 and shuffle them to obtain image (b). Then, we invert the image in (b) and regenerate it to obtain th…
Figure 12
Figure 12. Figure 12: Generation using latents with varying likelihoods: Using the same caption “cat”, the likelihood of the initial latent seed controls the generation quality. This is done by sampling z ∼ N (0, 1) and applying Y = α · z ||z|| (i.e., using the same vector with a scaled no…
Figure 11
Figure 11. Figure 11: Inversion of low likelihood images. A low likelihood latent can be used to generate an image (left). The image can be inverted to find a latent that generates a similar image (right), with PSNR=19.64[dB]. In this section, we focus on further examining the effect of th…
Figure 13
Figure 13. Figure 13: Sample near: randomly sample 10 latents from N (µ = Enc(Iq), ΣIq ). 12.9 13.0 13.1 13.2 13.3 PSNR 0.00 0.25 0.50 0.75 1.00 1.25 1.50 1.75 2.00 Frequency Mean: 13.11 std: 0.14 Histogram of PSNR Values (a) PSNR [dB] 0 2 4 6 8 Sample Index 0 2 4 6 8 Sample Index Mean: 0.…
Figure 14
Figure 14. Figure 14: Sample far: randomly sample 10 latents from N (µ = Enc(Iq), ΣIq ). For each sample, add a random noise. C. Further analysis Next, we present additional analysis regarding the exper￾iments in Sec. 3. Specifically, Tabs. 1 to 6 and Tabs. 7 to 12 contain extended results…
Figure 15
Figure 15. Figure 15: SIB on random noise: randomly sample 10 initializations for SIB. are: 1. E, N — The EMD between the NLL of latents in the erased set E and the NLL of standard normal samples, i.e., EMD (NLL→zT (E), NLL(N )). 2. R, N — The same as above, using latents from the ref￾eren…
Figure 16
Figure 16. Figure 16: Choosing the right renoising parameter. Using Renoise [9], we see that after a certain amount of iterations, the NLL drops dramatically, making it harder to perform a likelihood analysis. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_16.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 32 canonical work pages

  1. [26]

    Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde

    Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure meth- ods for text-to-image generative models. In The Twelfth In- ternational Conference on Learning Representations , 2024. 2

    work page 2024

  2. [48]

    To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Con- ference on Computer Vision, pages 385–403. Springer, 2025. 2, 5 10 Appendices In the next sections, we provide addition...

    work page 2025

  3. [1]

    Machine unlearning

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) , pages 141–159. IEEE, 2021. 2

    2021

  4. [2]

    When machine unlearn- ing jeopardizes privacy

    Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. When machine unlearn- ing jeopardizes privacy. In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021. 2

    work page 2021

  5. [3]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural informa- tion processing systems, 34:8780–8794, 2021. 2, 3

    work page 2021

  6. [4]

    Salun: Empowering machine unlearn- ing via gradient-based weight saliency in both image classi- fication and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Den- nis Wei, and Sijia Liu. Salun: Empowering machine unlearn- ing via gradient-based weight saliency in both image classi- fication and generation. arXiv preprint arXiv:2310.12508 ,

    arXiv

  7. [5]

    https://www.iwf.org

    Internet Watch Foundation. https://www.iwf.org. uk / media / q4zll2ya / iwf - ai - csam - report _ public-oct23v1.pdf. 2

    work page

  8. [6]

    An image is worth one word: Personalizing text-to- image generation using textual inversion

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patash- nik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text-to- image generation using textual inversion. arXiv preprint arXiv:2208.01618, 2022. 2

    arXiv 2022

Show all 49 references
  1. [7]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 2, 4, 5, 6, 14, 15, 16

    2023

  2. [8]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision , pages 5111–5120, 2024. 2, 4, 5, 14, 15, 16

    2024

  3. [9]

    Renoise: Real im- age inversion through iterative noising

    Daniel Garibi, Or Patashnik, Andrey V oynov, Hadar Averbuch-Elor, and Daniel Cohen-Or. Renoise: Real im- age inversion through iterative noising. arXiv preprint arXiv:2403.14602, 2024. 3, 5, 14, 16

    2024 arXiv

  4. [10]

    Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks

    Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks. In 2020 IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 9301– 9309, Seattle, W A, USA, 2020. IEEE. 2

    2020

  5. [11]

    Certified Data Removal from Machine Learning Models, 2020

    Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens van der Maaten. Certified Data Removal from Machine Learning Models, 2020. arXiv:1911.03030 [cs, stat]. 2

    2020 arXiv

  6. [12]

    Selective amnesia: A contin- ual learning approach to forgetting in deep generative mod- els

    Alvin Heng and Harold Soh. Selective amnesia: A contin- ual learning approach to forgetting in deep generative mod- els. Advances in Neural Information Processing Systems, 36,

  7. [14]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598, 2022. 3

    2022 arXiv

  8. [15]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In Advances in Neural Infor- mation Processing Systems, pages 6840–6851. Curran Asso- ciates, Inc., 2020. 2, 3

    2020

  9. [16]

    Stochastic gradient vb and the variational auto-encoder

    Diederik P Kingma and Max Welling. Stochastic gradient vb and the variational auto-encoder. In Second International Conference on Learning Representations, ICLR , page 121,

  10. [17]

    Data redaction from pre-trained gans

    Zhifeng Kong and Kamalika Chaudhuri. Data redaction from pre-trained gans. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 2023. 2

    2023

  11. [18]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 4, 5

    2023

  12. [19]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 2, 15, 16

    2023

  13. [20]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceeding...

    2014

  14. [21]

    Mace: Mass concept erasure in diffu- sion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffu- sion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6430– 6440, 2024. 2

    2024

  15. [22]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern R...

    2024

  16. [23]

    Taming normalizing flows

    Shimon Malnick, Shai Avidan, and Ohad Fried. Taming normalizing flows. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision (WACV), pages 4644–4654, 2024. 2

    2024

  17. [24]

    Negative-prompt inversion: Fast image inversion for editing with text-guided diffusion models

    Daiki Miyake, Akihiro Iohara, Yu Saito, and Toshiyuki Tanaka. Negative-prompt inversion: Fast image inversion for editing with text-guided diffusion models. arXiv preprint arXiv:2305.16807, 2023. 3

    2023 arXiv

  18. [25]

    Null-text inversion for editing real im- ages using guided diffusion models

    Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real im- ages using guided diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6038–6047, 2023. 3, 14

    2023

  19. [27]

    Robust concept erasure using task vectors

    Minh Pham, Kelly O Marshall, Chinmay Hegde, and Niv 9 Cohen. Robust concept erasure using task vectors. arXiv preprint arXiv:2404.03631, 2024. 2

    2024 arXiv

  20. [28]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  21. [29]

    https://gdpr- info.eu/

    General Data Protection Regulation. https://gdpr- info.eu/. 2

  22. [30]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, 2022. 4

    2022

  23. [31]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 2, 3

    2022

  24. [32]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 5, 14, 15, 16

    2022

  25. [33]

    The earth mover’s distance as a metric for image retrieval

    Yossi Rubner, Carlo Tomasi, and Leonidas J Guibas. The earth mover’s distance as a metric for image retrieval. Inter- national journal of computer vision, 40:99–121, 2000. 5

    2000

  26. [34]

    Regularized newton raphson inversion for text-to-image diffusion models

    Dvir Samuel, Barak Meiri, Nir Darshan, Shai Avidan, Gal Chechik, and Rami Ben-Ari. Regularized newton raphson inversion for text-to-image diffusion models. arXiv e-prints, pages arXiv–2312, 2023. 3

    2023

  27. [35]

    Norm-guided latent space exploration for text-to-image generation

    Dvir Samuel, Rami Ben-Ari, Nir Darshan, Haggai Maron, and Gal Chechik. Norm-guided latent space exploration for text-to-image generation. Advances in Neural Information Processing Systems, 36, 2024. 11

    2024

  28. [36]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 1, 2, 5

    2023

  29. [37]

    Deep unsupervised learning using nonequilibrium thermodynamics

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In Proceedings of the 32nd International Conference on Machine Learning, pages 2256–2265, Lille, France, 2015. PMLR. 2, 3

    2015

  30. [38]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020. 3

    2010 arXiv

  31. [39]

    Repairing neural networks by leaving the right past behind

    Ryutaro Tanno, Melanie F Pradier, Aditya Nori, and Yingzhen Li. Repairing neural networks by leaving the right past behind. arXiv preprint arXiv:2207.04806, 2022. 2

    2022 arXiv

  32. [40]

    Edict: Exact diffusion inversion via coupled transformations

    Bram Wallace, Akash Gokul, and Nikhil Naik. Edict: Exact diffusion inversion via coupled transformations. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22532–22541, 2023. 3

    2023

  33. [41]

    Puma: Performance unchanged model augmentation for training data removal

    Ga Wu, Masoud Hashemi, and Christopher Srinivasa. Puma: Performance unchanged model augmentation for training data removal. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 8675–8682, 2022. 2

    2022

  34. [42]

    Scissorhands: Scrub data in- fluence via connection sensitivity in networks.arXiv preprint arXiv:2401.06187, 2024

    Jing Wu and Mehrtash Harandi. Scissorhands: Scrub data in- fluence via connection sensitivity in networks.arXiv preprint arXiv:2401.06187, 2024. 2, 4, 5, 14, 15, 16

    2024 arXiv

  35. [43]

    Erasediff: Erasing data influence in diffusion models

    Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasediff: Erasing data influence in diffusion models. arXiv preprint arXiv:2401.05779, 2024. 3, 4, 5, 14, 15, 16

    2024 arXiv

  36. [44]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1755–1764, 2024. 2, 14, 15, 16

    2024

  37. [45]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1755–1764, 2024. 4, 5

    2024

  38. [47]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. arXiv preprint arXiv:2405.15234, 2024. 4, 5

    2024 arXiv

  39. [49]

    E, N — The EMD between the NLL of latents in the erased set E and the NLL of standard normal samples, i.e., EMD (NLL→zT (E), N LL(N ))

  40. [50]

    R, N — The same as above, using latents from the ref- erence set R, i.e., EMD (NLL→zT (R), N LL(N ))

  41. [51]

    Items 1 and 2 serve as the numerator and denominator of dN (·, ·) (see Eq

    E, R— The EMD between latents in the erased and ref- erence sets, i.e., EMD (NLL→zT (E), NLL→zT (R)). Items 1 and 2 serve as the numerator and denominator of dN (·, ·) (see Eq. (5)), respectively. Tabs. 7 to 12 also contain the average distances between all z(si→q) T and zq T ...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.