Pith. sign in

REVIEW 4 major objections 5 minor 84 references

Rethinking Machine Unlearning in Image Generation Models

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that current evaluation of machine unlearning in image generators is built on unreliable detectors and single-metric checks, and that measured with a comprehensive five-aspect framework, most state-of-the-art unlearning…

desk verdict A useful benchmark and evaluation framework for IGMU, but the preservation metrics are under-specified and uncalibrated, so the headline 'fail at preservation' finding is not yet established. read the letter →

arxiv 2506.02761 v2 pith:J7PSSN7O submitted 2025-06-03 cs.AI cs.CLcs.CRcs.CV

Renyang Liu , Wenjie Feng , Tianwei Zhang , Wei Zhou , Xueqi Cheng , See-Kiong Ng This is my paper
classification cs.AIcs.CLcs.CRcs.CV
keywords machineunlearningimagegenerationmodelsconcepterasurediffusionevaluationbenchmarkcontentdetectionAIsafetyadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the field's measurement of machine unlearning in image generation models is unreliable, and that when the measurement is fixed, most published unlearning methods stop looking successful. To do this it proposes a hierarchical taxonomy of unlearning tasks (CatIGMU: global vs. local scope, abstract vs. concrete target, then task type), a five-aspect evaluation framework (EvalIGMU: forgetting, preservation, image quality, robustness, efficiency), and a multi-source dataset (DataIGM) spanning four tasks. Benchmarking ten state-of-the-art unlearning algorithms under this framework, the paper finds that most cannot forget reliably while preserving the remaining content, keeping image quality, and withstanding adversarial prompts that re-elicit the forgotten concept. If correct, the consequence is that single-metric success claims (for example, a low target-detection rate) are misleading, and that unlearning algorithms need task-dependent design and multi-dimensional reporting before they can serve privacy and safety regulations.

What carries the argument

The load-bearing machinery has three parts. CatIGMU is a two-tier taxonomy that sorts every unlearning target by spatial scope (global vs. local on the canvas) and perceptual attribute (abstract vs. concrete), then by task type, and it specifies what a good unlearned output is for each cell, for example, dressing a nude subject rather than deleting her, or replacing a church with another object while keeping the river. MultiClf, a CLIP-ViT backbone with per-task classification heads trained on the multi-source DataIGM, is the forgetting evaluator, chosen because existing detectors collapse on generated data. The preservation and image-quality metrics are reference-based: CSDR, the difference rate between the unlearned model's text-image CLIP alignment and the original model's for the same prompt, and LPIPS, the perceptual distance between the two image sets, with FID measuring the distribution gap, and robustness measured by UnlearnDiffAtk's attack success rate.

What would settle it

Compare EvalIGMU preservation scores (CSDR and LPIPS against the original model's outputs) with human judgments: for images generated by each of the ten unlearned models on DataIGM prompts, ask raters whether the target is gone and the remaining scene is undamaged. If human raters accept a benign but re-composed output as a good unlearning result while CSDR and LPIPS flag it as a preservation failure, the original-model reference is not a valid ground truth and the headline finding is an artifact of the metric.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the standard tools used to judge whether an image generator has forgotten a concept, style classifiers, nude detectors, object recognizers, CLIP Score, and CLIP Accuracy, fail under distribution shift: they are trained on real images and are unreliable on both the wider real data and the generated images that unlearning actually concerns. The paper replaces them with MultiClf, a multi-head classifier built on CLIP-ViT that reaches roughly 93 to 100 percent accuracy across REAL, LAION, and generated data, plus CSDR and LPIPS against the original model's outputs for preservation, and FID and UnlearnDiffAtk for quality and robustness. Re-evaluating ten state-of-the-art unlearning methods with these instruments, the paper claims that most methods achieve some forgetting on easy tasks but degrade sharply on preservation and robustness: YOLO-based human detection shows up to 38.58 percent of generated images lose the human subject that should have been preserved, and adversarial prompts re-elicit supposedly erased content, especially for artist-style unlearning. The performance varies by task in ways that a single 'concept erasure' label hides, which the CatIGMU taxonomy is meant to make visible.

Load-bearing premise

The preservation and image-quality metrics take the original model's outputs as the correct reference, so an unlearned model that deletes the target and substitutes a different but perfectly benign composition is scored as a failure rather than as a valid outcome.

Editorial extensions

If this is right

  • A high forgetting score on a single detector no longer counts as evidence of successful unlearning: the paper's benchmark shows methods can score well on forgetting while failing preservation, quality, or robustness, so published single-metric claims are unverified until all five aspects are reported.
  • Performance is task-dependent in a structured way: global-abstract targets like artist style are the hardest, and even same-type tasks such as church vs. parachute diverge, so results from one unlearning task should not be extrapolated to another.
  • Adversarial prompt attacks re-elicit supposedly erased content from most unlearned models, which means concept deletion in diffusion models is reversible with crafted text prompts and needs robustness training to hold.
  • Efficiency is a decisive dimension: runtimes range from about 40 seconds to 7 hours, so the methods that are most robust are the least scalable, and multi-task support varies across approaches.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the reference-based preservation metrics are taken at face value, the benchmark implicitly rules out legitimate alternative compositions; a complementary reference-free test, 'is the target absent and is the rest of the prompt still honored,' would be needed to separate true preservation failure from benign re-composition.
  • The CatIGMU taxonomy suggests a testable design principle: category-aware algorithms (surgical edits for local-concrete targets, whole-canvas re-rendering for global-abstract targets) should outperform the universal one-size-fits-all fine-tuning that dominates the ten benchmarked methods.
  • Because the robustness threat model is keyword-based, the attack-success numbers are likely a lower bound; paraphrase-based prompts or multimodal jailbreaks would probably push attack success rates higher for every method.
  • The DataIGM protocol, three data sources with paired target and retained prompts, is directly portable to tasks the paper did not test, such as violence, celebrity identity, and brand logos, so the framework's claim that current methods fail preservation and robustness can be checked on new categories without new machinery.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper targets image generation model unlearning (IGMU) and makes three contributions: CatIGMU, a hierarchical taxonomy of unlearning tasks (global/local, abstract/concrete, with finer task types); EvalIGMU, an evaluation framework covering forgetting, preservation, image quality, robustness, and efficiency; and DataIGM, a multi-source dataset for training detectors and benchmarking. The authors empirically critique existing detectors (Style Classifier, NudeNet, Q16, ResNet-50) and task-free metrics (CLIP Score, CLIP Accuracy), then use their own MultiClf detector and EvalIGMU metrics to evaluate ten state-of-the-art unlearning methods on four tasks (Nudity, Van Gogh style, Church, Parachute). The main claim is that most existing IGMU methods perform poorly, especially on preservation and robustness.

Significance. If the empirical conclusions are valid, this is a valuable contribution: it documents distribution shift problems in existing detectors, provides a reusable multi-source dataset, and makes a concrete case that single-metric evaluations of unlearning are misleading. The taxonomy and implementation guidelines are also useful for structuring future work. The paper ships code/models and uses a consistent experimental setup across ten methods, which is a strength. However, the headline finding, particularly the 'especially for preservation' conclusion, depends on preservation metrics that are not calibrated or validated in the manuscript; the central evaluative claim is therefore not yet established.

major comments (4)
  1. [Sec. 5.3.1, Preservation; Fig. 8(b)] The CSDR and LPIPS preservation metrics are not adequately specified or calibrated. The CSDR formula compares CS(M(p)_i, p) with CS(M^u(t)_j, p) without stating which prompt p is used for each task. If p is the target prompt t (i.e., S⊕t), then a successful unlearned model M^u is expected to reduce alignment with t, so CSDR will increase precisely when R1 is satisfied; the paper's own Table 4 expectation of 'a clothed girl playing on a beach' would score as a large CSDR/LPIPS deviation from the original 'naked girl' output. If p is instead a non-target prompt, the metric still lacks a within-model baseline: LPIPS between two independent samples from the same model and prompt is nonzero, and no such floor is reported. The skeptical concern that the preservation finding may be an artifact of generative stochasticity or of successful erasure is therefore valid. This is load-bearing because the abstract's 'especially for preservation' claim is the paper's most consequential empirical assertion.
  2. [Sec. 6.2, Fig. 8] Figure 8 reports normalized averages with no error bars, significance tests, or per-cell sample sizes. The text says 286,000 paired images were sampled, but it does not state how many images per method, per prompt, or per task underlie each bar. The normalization to [0,1] is not described (e.g., whether CSDR and LPIPS are normalized per task or across methods, and how the '1−value' transformation is applied). The efficiency aspect in EvalIGMU is also absent from Figure 8, despite being listed as one of the five evaluation dimensions. Without uncertainty quantification, the broad claim that 'most existing IGMU algorithms cannot handle unlearning well across different evaluation dimensions' exceeds what the figure can support.
  3. [Secs. 4.2, 5.3.2, Table 4] The forgetting evaluation via MultiClf is trained on DataIGM, whose labels are derived from author-defined 'Expectation' outputs (Sec. 4.2, Table 4) and whose SD-GEN portion is produced by the same base model M that all unlearning methods start from. Using MultiClf as the forgetting oracle is therefore not an independent assessment of the ten methods; it is a detector fitted to the same generative pipeline and to the authors' chosen ground-truth semantics. The paper's own Discussion in Sec. 5.3.1 narrows the threat model to keyword-based terms, which further limits the scope of the forgetting/robustness claims. No sensitivity analysis with alternative detectors or ground-truth definitions is reported, so the reader cannot tell how strongly the benchmark conclusions depend on these choices.
  4. [Sec. 5.3.1, Image Quality; Fig. 8(c)] The FID reference for image quality is not comparable across task categories. For Abstract tasks the reference is M(do(T='none')), while for Concrete tasks it is M(do(T≠t)). Consequently, Figure 8(c) mixes two different notions of quality change: for abstract tasks it measures distance to a prompt with the target removed, and for concrete tasks it measures distance to a prompt with the target replaced by a different object. The reported gap between abstract and concrete tasks could be an artifact of this reference choice rather than a property of the unlearning methods. The paper should either use a common reference or analyze the two categories separately.
minor comments (5)
  1. [Sec. 5.3.1, LPIPS formula] The LPIPS formula uses the summation index j=i+1, which is not well-defined when K and N differ; it should presumably read j=1 to K with a double sum over i and j.
  2. [Secs. 3.2 and 5.3.1] The notation for prompts is overloaded: Sec. 3.2 says t is used to denote S⊕t, but the preservation formulas then refer to 'an arbitrary task t and the corresponding p' without defining p. This ambiguity matters because the CSDR interpretation depends on whether p is the target prompt or a non-target prompt.
  3. [Fig. 8 caption] The normalization and aggregation details are missing: for CSDR and LPIPS lower values are better, but the caption only says 'higher values indicate better performance (for smaller-is-better metrics, 1−value is used)' without stating the normalization range, the aggregation rule across tasks, or the number of images per cell.
  4. [Table 8] Runtime values are labeled as estimates from the original papers and official code, but no standard deviation, number of runs, or exact hardware configuration beyond 'single A6000 GPU' is given; consider reporting measured runtimes with variance.
  5. [Sec. 4.3.1 and throughout] There are minor typos and naming inconsistencies: 'SG-GEN' appears where 'SD-GEN' is meant, and the classifier is sometimes written 'MultClf' and sometimes 'MultiClf'.

Circularity Check

1 steps flagged · score 6.0 of 10

The headline 'especially for preservation' is built into the CSDR/LPIPS metric: preservation is measured against the original model's output on the same target prompt, so successful forgetting must score as poor preservation.

  1. self definitional [Sec. 5.3.1 (Preservation: CSDR and LPIPS equations); Sec. 6.2 finding (2)]
    "average CSDR= 1/N^2 Σ_{i=1}^N Σ_{j=1}^N |CS(M(p)_i,p)−CS(M^u(t)_j,p)| / CS(M(p)_i,p) ×100. ... Figure 8(b) shows the averaged 'CSDR + LPIPS' ... It shows that existing methods perform poorly in preservation regarding semantic alignment (CSDR) and perceptual similarity (LPIPS)."

    The preservation metrics compare M^u(t), the unlearned model's output for the target-containing prompt, against M(p), the original model's output for the same prompt. By the paper's own R1 (Sec. 3.2), successful forgetting requires M^u(t)∩M(t)=∅, so any method that actually erases the target must produce large CLIP/LPIPS distance from the original target-prompt output. The central finding that methods 'perform poorly in preservation' is therefore forced by the metric's choice of reference, not established by the benchmark; even the paper's ideal Expectation output ('A clothed girl playing on a beach') would be scored as a preservation failure relative to the original 'naked girl' image. The preservation conclusion reduces by construction to measuring R2 on an R1 prompt.

full rationale

The paper's benchmark contains one load-bearing circular step. In Sec. 5.3.1, preservation is operationalized as CSDR and LPIPS between the unlearned model's output for the target prompt t and the original model's output for the same prompt. Because Sec. 3.2 defines forgetting (R1) as M^u(t)∩M(t)=∅, successful erasure necessarily moves M^u(t) away from M(t); the reported 'poor preservation' is thus guaranteed by the definition of the metric and would also apply to the paper's own ideal Expectation examples. This affects the abstract's headline claim that current IGMU methods 'cannot handle unlearning well ... especially for preservation.' The other evaluation axes are not circular in this way: forgetting is measured by MultClf trained on DataIGM but evaluated on generated images from held-out unlearning methods, image quality uses FID against external/reference distributions, robustness uses the externally defined UnlearnDiffAtk attack, and efficiency is directly measured. No load-bearing self-citation chain or uniqueness import was found. Overall partial circularity, centered on the preservation finding.

Assumptions & free parameters 2 free parameters · 5 assumptions · 1 invented entities

The framework's benchmark conclusion rests on several constructed resources and assumptions: a taxonomy whose global/local split needs an unspecified threshold, a preservation ground truth defined by the original model's outputs, a classifier trained on DataIGM, and a dataset covering only four tasks. The most fragile piece is the author-defined 'Expectation' behavior, which the paper itself describes as non-unique and subjective. On the positive side, the paper ships code and data claims and uses an external adversarial attack for robustness, which limits purely circular reasoning.

free parameters (2)
  • Global/Local coverage threshold = not specified
    CatIGMU's first split depends on a threshold for whether the forget target fills the image canvas; the paper only says a threshold-based approach is used (Sec 5.1 footnote 4), so the threshold is an unspecified free choice that changes task assignment.
  • Preservation similarity threshold sigma = not specified
    Relaxed R2 requires sim(M_u(p), M(p)) >= sigma; no sigma is set in the evaluation, so preservation scores are relative and not calibrated.
assumptions (5)
  • domain assumption CLIP Score, LPIPS, and FID are reliable proxies for semantic alignment, perceptual preservation, and image quality.
    EvalIGMU's preservation and image quality metrics rely on these learned metrics; the paper does not validate them against human judgment beyond citing prior use.
  • domain assumption Images generated by the original model M with modified prompts are the correct reference for preservation.
    CSDR and LPIPS compare M_u(t) against M(p); this assumes M's outputs are the ground truth for what should be preserved.
  • domain assumption The four tasks in DataIGM (Van Gogh, Nudity, Church, Parachute) are representative enough to support generalizations about IGMU algorithms.
    Section 6.1 selects only four tasks and the paper later acknowledges more tasks are needed (Sec. 7).
  • domain assumption MultiClf trained on DataIGM generalizes to unseen generated images from unlearned models.
    Used as the forgetting evaluator; its accuracy on DataIGM test sets (Table 6) is good, but no independent validation on out-of-distribution unlearned images.
  • ad hoc to paper For Global-Abstract tasks, the target content is assumed to be a transformation over a real scene, so the expected unlearned output is the scene without the style.
    Sec 5.2 states this assumption and admits it is a simplification, but the evaluation uses it to define expected outputs for style removal.
invented entities (1)
  • Task-dependent 'Expectation' ground-truth outputs
    purpose: Define what an unlearned model should generate for each CatIGMU category, used to interpret forgetting and preservation.
    Authors state expectations are non-unique and subjective (Sec 4.2, Sec 5.2); no external benchmark verifies these are the correct outputs.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rethinking Machine Unlearning in Image Generation Models." pith.science (2026). https://pith.science/paper/J7PSSN7O

@misc{pith2026250602761,
  author       = {Pith},
  title        = {Pith review of: Rethinking Machine Unlearning in Image Generation Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J7PSSN7O}},
  note         = {Machine review of arXiv:2506.02761}
}
read the original abstract

With the surge and widespread application of image generation models, data privacy and content safety have become major concerns and attracted great attention from users, service providers, and policymakers. Machine unlearning (MU) is recognized as a cost-effective and promising means to address these challenges. Despite some advancements, image generation model unlearning (IGMU) still faces remarkable gaps in practice, e.g., unclear task discrimination and unlearning guidelines, lack of an effective evaluation framework, and unreliable evaluation metrics. These can hinder the understanding of unlearning mechanisms and the design of practical unlearning algorithms. We perform exhaustive assessments over existing state-of-the-art unlearning algorithms and evaluation standards, and discover several critical flaws and challenges in IGMU tasks. Driven by these limitations, we make several core contributions, to facilitate the comprehensive understanding, standardized categorization, and reliable evaluation of IGMU. Specifically, (1) We design CatIGMU, a novel hierarchical task categorization framework. It provides detailed implementation guidance for IGMU, assisting in the design of unlearning algorithms and the construction of testbeds. (2) We introduce EvalIGMU, a comprehensive evaluation framework. It includes reliable quantitative metrics across five critical aspects. (3) We construct DataIGM, a high-quality unlearning dataset, which can be used for extensive evaluations of IGMU, training content detectors for judgment, and benchmarking the state-of-the-art unlearning algorithms. With EvalIGMU and DataIGM, we discover that most existing IGMU algorithms cannot handle the unlearning well across different evaluation dimensions, especially for preservation and robustness. Code and models are available at https://github.com/ryliu68/IGMU.

Figures

Figures reproduced from arXiv: 2506.02761 by the authors.

Figure 1
Figure 1. Core components of IGMU. ➊ CatIGMU: a framework for unlearning task categorization and definition. ➋ EvalIGMU: a framework for evaluating IGMU algorithms with various metrics at both task-specific and general-purpose measurement. ➌ DataIGM: a new dataset for exploring existing evaluation measures, training new content detectors, and benchmarking SOTA unlearning algorithms. Machine Unlearning (MU) [3] emerges as a pr… view at source ↗
Figure 2
Figure 2. Case study showcasing various post-unlearning candidates and images from existing unlearned models. Columns from left to right: [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The performance of Style Classifier on DataIGM [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: CLIP Score distribution for Nudity unlearning and Van [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Overview of CatIGMU framework. Based on the spatial relationship between the unlearning target 𝑡 and image canvas (global vs. local), the perceptual attributes of the unlearning target 𝑡 (abstract vs. concrete), and different unlearning tasks (style, object, identity, …
Figure 6
Figure 6. Figure 6: The overview and implementation of the proposed evalu [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: The human detection results of YOLO v8 on the images [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Performance evaluation for ten unlearning methods on four unlearning tasks ( [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: The results of Nude Detector on selected dataset [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: Examples of images generated by the original Stable Diffusion model and unlearned models for various unlearning tasks. The [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

84 extracted references · 61 canonical work pages

  1. [1]

    Tianyi Bai, Hao Liang, Binwang Wan, Ling Yang, Bozhou Li, Yifan Wang, Bin Cui, Conghui He, Binhang Yuan, and Wentao Zhang. 2024. A Survey of Multimodal Large Language Model from A Data-centric Perspective.CoRRabs/2405.16640 (2024)

    arXiv 2024

  2. [2]

    Florian Bordes, Richard Yuanzhe Pang, Anurag Ajay, Alexander C. Li, Adrien Bardes, Suzanne Petryk, Oscar Mañas, Zhiqiu Lin, Anas Mahmoud, Bargav Ja- yaraman, Mark Ibrahim, Melissa Hall, Yunyang Xiong, Jonathan Lebensold, Can- dace Ross, Srihari Jayakumar, Chuan Guo, Diane Bouchacourt, Haider Al-Tahan, Karthik Padthe, Vasu Sharma, Hu Xu, Xiaoqing Ellen Tan...

    arXiv 2024

  3. [3]

    Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine Unlearning. InS&P, 141–159

    2021

  4. [4]

    Anh Bui, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. 2024. Removing Undesirable Concepts in Text-to-Image Generative Models with Learnable Prompts.arXiv preprint arXiv:2403.12326(2024)

    work page Pith review arXiv 2024

  5. [5]

    Yu Cao and Qiang Yang. 2015. Towards Selective Data Acquisition for Large-Scale Machine Learning.IEEE Transactions on Knowledge and Data Engineering27, 5 (2015), 1183–1196

    2015

  6. [6]

    Hospedales

    Ruchika Chavhan, Da Li, and Timothy M. Hospedales. 2024. ConceptPrune: Con- cept Editing in Diffusion Models via Skilled Neuron Pruning.CoRRabs/2405.19237 (2024). IGMU Conference’17, July 2017, Washington, DC, USA

    arXiv 2024

  7. [7]

    Haoxing Chen, Zhuoer Xu, Zhangxuan Gu, Jun Lan, Xing Zheng, Yaohui Li, Changhua Meng, Huijia Zhu, and Weiqiang Wang. 2023. DiffUTE: Universal Text Editing Diffusion Model. InNeurIPS

    2023

  8. [8]

    Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin-Yu Chen, and Wei-Chen Chiu. 2024. Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts. InICML

    2024

Show all 84 references
  1. [9]

    Feder Cooper, Christopher A

    A. Feder Cooper, Christopher A. Choquette-Choo, Miranda Bogen, Matthew Jagielski, Katja Filippova, Ken Ziyu Liu, and et al. 2024. Machine Unlearning Doesn’t Do What You Think: Lessons for Generative AI Policy, Research, and Practice.CoRRabs/2412.06966 (2024)

    2024

  2. [10]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Ima- geNet: A large-scale hierarchical image database. InCVPR, 248–255

    2009

  3. [11]

    Ihor Kroosh Dmitry Voitekh Nick Hasty and Dmytro Korduban. 2019. Giphy’s open source celebrity detection deep learning model and code. https://github. com/Giphy/celeb-detection-oss

    2019

  4. [12]

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xi- aohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. 2021. An Image is Worth 16x16 Words: Transformers for Image Recogn...

    2021

  5. [13]

    Frederick Eberhardt and Richard Scheines. 2007. Interventions and causal infer- ence.Philosophy of science74, 5 (2007), 981–995

    2007

  6. [14]

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion English, and Robin Rombach. 2024. Scaling Rectified Flow Transformers for High-Resolution Image S...

    2024

  7. [15]

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. 2024. SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation. InICLR

    2024

  8. [16]

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau

  9. [17]

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzynska, and David Bau. 2024. Unified Concept Editing in Diffusion Models. InW ACV, 5099–5108

    2024

  10. [18]

    Tony Ginart, Melody Guan, Gregory Valiant, and James Zou. 2019. Making AI Forget You: Data Deletion in Machine Learning. InNeurIPS, 3518–3529

    2019

  11. [19]

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. 2024. Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models. In ECCV, Vol. 15111, 73–88

    2024

  12. [20]

    Xiaoxuan Han, Songlin Yang, Wei Wang, Yang Li, and Jing Dong. 2024. Probing Unlearned Diffusion Models: A Transferable Adversarial Attack Perspective. CoRR(2024)

    2024

  13. [21]

    Sebastian Hartwig, Dominik Engel, Leon Sick, Hannah Kniesel, Tristan Payer, Timo Ropinski, et al . 2024. Evaluating Text to Image Synthesis: Survey and Taxonomy of Image Quality Metrics.arXiv preprint arXiv:2403.11821(2024)

    2024 arXiv

  14. [22]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. InCVPR, 770–778

    2016

  15. [23]

    Alvin Heng and Harold Soh. 2023. Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Models. InNeurIPS

    2023

  16. [24]

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. 2021. CLIPScore: A Reference-free Evaluation Metric for Image Captioning.arXiv preprint arXiv:2104.08718(2021)

    2021 arXiv

  17. [26]

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium. InNeurIPS, 6626–6637

    2017

  18. [27]

    Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, Fu-En Yang, and Yu-Chiang Frank Wang. 2024. Receler: Reliable Concept Erasing of Text-to- Image Diffusion Models via Lightweight Erasers. InECCV, Vol. 15098, 360–376

    2024

  19. [28]

    Montreal AI Ethics Institute. 2023. Unstable Diffusion: Ethical Challenges and Some Ways Forward. https://montrealethics.ai/unstable-diffusion-ethical- challenges-and-some-ways-forward/. Accessed: 2024-12-31

    2023

  20. [29]

    Glenn Jocher, Abhiram Chaurasia, Jiuan Qiu, and Robby Stoken. 2023. YOLOv8: The Next Generation of YOLO. https://github.com/ultralytics/ultralytics

    2023

  21. [30]

    Sanghyun Kim, Seohyeon Jung, Balhae Kim, Moonseok Choi, Jinwoo Shin, and Juho Lee. 2023. Towards Safe Self-Distillation of Internet-Scale Text-to-Image Diffusion Models.CoRR(2023)

    2023

  22. [31]

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. 2023. Ablating Concepts in Text-to-Image Diffusion Models. InICCV, 22634–22645

    2023

  23. [32]

    Senmao Li, Joost van de Weijer, Taihang Hu, Fahad Shahbaz Khan, Qibin Hou, Yaxing Wang, and Jian Yang. 2024. Get What You Want, Not What You Don’t: Image Content Suppression for Text-to-Image Diffusion Models. InICLR

    2024

  24. [33]

    Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. 2024. SafeGen: Mitigating Unsafe Content Generation in Text-to-Image Models. InCCS

    2024

  25. [34]

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. 2024. MACE: Mass Concept Erasure in Diffusion Models. InCVPR, 6430–6440

    2024

  26. [35]

    Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timo- fte, and Luc Van Gool. 2022. RePaint: Inpainting Using Denoising Diffusion Probabilistic Models.arXiv preprint arXiv:2201.09865(2022)

    2022 arXiv

  27. [36]

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. 2024. One-dimensional Adapter to Rule Them All: Concepts, Diffusion Models and Erasing Applications. InCVPR, 7559–7568

    2024

  28. [37]

    Rui Ma, Qiang Zhou, Bangjun Xiao, Yizhu Jin, Daquan Zhou, Xiuyu Li, Aishani Singh, Yi Qu, Kurt Keutzer, Xiaodong Xie, et al. 2024. A Dataset and Benchmark for Copyright Protection from Text-to-Image Diffusion Models.arXiv preprint arXiv:2403.12052(2024)

    2024 arXiv

  29. [38]

    Nithin Gopalakrishnan Nair, Jeya Maria Jose Valanarasu, and Vishal M. Patel

  30. [39]

    OpenAI. 2023. ChatGPT-4: A Large-Scale Multimodal Language Model. https: //openai.com. Accessed: 2024-08-31

    2023

  31. [40]

    OpenAI. 2023. DALL-E 3: Text-to-Image Generation and Editing.OpenAI Techni- cal Report(2023)

    2023

  32. [41]

    Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde

    Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde

  33. [42]

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. 2024. SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis. InICLR

    2024

  34. [43]

    Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, Rita Cucchiara, et al. 2024. Safe-CLIP: Removing NSFW Concepts from Vision- and-Language Models. InECCV

    2024

  35. [44]

    Circumventing Concept Erasure Methods For Text-To-Image Generative Models. InICLR

  36. [45]

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. 2023. Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models. InCCS, 3403–3417

    2023

  37. [46]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sand- hini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al

  38. [47]

    Bedapudi Praneeth. 2023. NudeNet: Deep Learning Model for Nudity Detection. https://github.com/notAI-tech/NudeNet

    2023

  39. [48]

    Jie Ren, Kangrui Chen, Yingqian Cui, Shenglai Zeng, Hui Liu, Yue Xing, Jiliang Tang, and Lingjuan Lyu. 2024. Six-CD: Benchmarking Concept Removals for Benign Text-to-image Diffusion Models.CoRR(2024)

    2024

  40. [49]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjorn Ommer. 2022. High-Resolution Image Synthesis with Latent Diffusion Models. InCVPR, 10684–10695

    2022

  41. [50]

    Kevin Roose. 2022. A.I. Generated Art Won an Art Prize. Artists Aren’t Happy. The New York Times(2022). https://www.nytimes.com/2022/09/02/technology/ai- artificial-intelligence-artists.html Accessed: 2024-12-31

    2022

  42. [51]

    Protection Regulation. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council.Regulation (eu)679 (2016), 2016

    2016

  43. [52]

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, Sharan Vaswani Mahdavi, Tim Salimans, et al. 2022. Photorealistic text-to-image diffusion models with deep language understanding. InAdvances ...

    2022

  44. [53]

    Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David J Fleet, and Mohammad Norouzi. 2022. Image Super-Resolution via Iterative Refinement. In CVPR, 14171–14180

    2022

  45. [54]

    Babak Saleh and Ahmed Elgammal. 2015. WikiArt: Visual Art Dataset for Recog- nition and Aesthetics Analysis. InECCV, 3–10

    2015

  46. [55]

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J Fleet, et al. 2022. Palette: Image-to-Image Diffusion Models for High Fidelity and Diverse Image Synthesis.ar...

    2022 arXiv

  47. [56]

    Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. 2022. Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?. InFAccT, 1350–1361

    2022

  48. [57]

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Lud- wig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. 202...

    2022

  49. [58]

    Juwon Seo, Sung-Hoon Lee, Tae-Young Lee, Seungjun Moon, and Gyeong-Moon Park. 2024. Generative Unlearning for Any Identity. InCVPR, 9151–9161

    2024

  50. [59]

    Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting

  51. [60]

    InCVPR, 22522–22531

    Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models. InCVPR, 22522–22531

  52. [61]

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?. InICLR

    2024

  53. [62]

    Hongyu Wang, Qing Li, Xiangyu Liu, Tong Lu, and Hao Zhou. 2023. Zero-Shot Image Restoration Using Denoising Diffusion Models. InICCV, 2029–2038

    2023

  54. [63]

    Peng Wang, Lingzhi Zhang, Yanghua Li, Yuming Jiang, Huachun Yang, and Li Liu. 2021. Text-Driven Image Manipulation by Predicting Image Representations in Textual Semantic Space.IEEE Transactions on Image Processing30 (2021), 7213–7228

    2021

  55. [64]

    Yujun Shi, Chuhui Xue, Jun Hao Liew, Jiachun Pan, Hanshu Yan, Wenqing Zhang, Vincent Y. F. Tan, and Song Bai. 2024. DragDiffusion: Harnessing Diffusion Models for Interactive Point-Based Image Editing. InCVPR, 8839–8849. Conference’17, July 2017, Washington, DC, USA Renyang Liu et al

    2024

  56. [65]

    Kihyuk Sohn, Lu Jiang, Jarred Barber, Kimin Lee, Nataniel Ruiz, Dilip Krishnan, Huiwen Chang, Yuanzhen Li, Irfan Essa, Michael Rubinstein, Yuan Hao, Glenn Entis, Irina Blok, and Daniel Castro Chin. 2023. StyleDrop: Text-to-Image Syn- thesis of Any Style. InNeurIPS, Alice Oh, T...

    2023

  57. [66]

    Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. 2024. EraseDiff: Erasing Data Influence in Diffusion Models.CoRR(2024)

    2024

  58. [67]

    Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Heng Chang, Wenbo Zhu, Xinting Hu, Xiao Zhou, and Xu Yang. 2025. Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradient. In AAAI, 8496–8504

    2025

  59. [68]

    Tianwei Xiong, Yue Wu, Enze Xie, Yue Wu, Zhenguo Li, and Xihui Liu. 2024. Editing Massive Concepts in Text-to-Image Diffusion Models.arXiv preprint arXiv:2403.13807(2024)

    2024

  60. [69]

    Jing Wu and Mehrtash Harandi. 2024. MUNBa: Machine Unlearning via Nash Bargaining.arXiv preprint arXiv:2411.15537(2024)

    2024 arXiv

  61. [70]

    Jing Wu and Mehrtash Harandi. 2024. Scissorhands: Scrub Data Influence via Connection Sensitivity in Networks.CoRR(2024)

    2024

  62. [71]

    Chenshuang Zhang, Chaoning Zhang, Mengchun Zhang, and In So Kweon. 2023. Text-to-image Diffusion Models in Generative AI: A Survey.CoRRabs/2303.07909 (2023)

    2023 arXiv

  63. [72]

    Duzhen Zhang, Yahan Yu, Jiahua Dong, Chenxing Li, Dan Su, Chenhui Chu, and Dong Yu. 2024. MM-LLMs: Recent Advances in MultiModal Large Language Models. InACL, Lun-Wei Ku, Andre Martins, and Vivek Srikumar (Eds.), 12401– 12430

    2024

  64. [73]

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi

  65. [74]

    Xingqian Xu, Jiayi Guo, Zhangyang Wang, Gao Huang, Irfan Essa, and Humphrey Shi. 2024. Prompt-Free Diffusion: Taking "Text" Out of Text-to-Image Diffusion Models. InCVPR, 8682–8692

    2024

  66. [75]

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. 2024. MMA-Diffusion: MultiModal Attack on Diffusion Models. InCVPR, 7737–7746

    2024

  67. [76]

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. 2024. Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models.CoRR (2024)

    2024

  68. [77]

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. 2024. To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy to Generate Unsafe Images ... For Now. InCVPR, 385–403

    2024

  69. [78]

    Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu. 2024. Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models.arXiv preprint arXiv:2402.11846(2024)

    2024 arXiv

  70. [79]

    In CVPR, 1755–1764

    Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models. In CVPR, 1755–1764

  71. [82]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang

  72. [83]

    InCVPR, 586–595

    The Unreasonable Effectiveness of Deep Features as a Perceptual Metric. InCVPR, 586–595

  73. [87]

    MALE_BREAST_EXPOSED

    Jiachen Zhao, Zhun Deng, David Madras, James Zou, and Mengye Ren. 2024. Learning and Forgetting Unsafe Examples in Large Language Models. InICML. IGMU Conference’17, July 2017, Washington, DC, USA Appendix A Additional Analysis of Nude Detector 0 1 2 3 4 5 (a) Sample level (Mi...

    2024

  74. [2021]

    InICML, 8748–8763

    Learning Transferable Visual Models from Natural Language Supervision. InICML, 8748–8763

  75. [2023]

    InICCV, 2426–2436

    Erasing Concepts from Diffusion Models. InICCV, 2426–2436

  76. [2024]

    InECCV, Vol

    MaxFusion: Plug&Play Multi-modal Generation in Text-to-Image Diffusion Models. InECCV, Vol. 15096, 93–110

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.