Pith. sign in

REVIEW 3 major objections 3 minor 61 references

SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing

T0 review · 3 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes SAGE, which replaces word-level concept erasure with domain-level erasure and reports a 98.01% reduction in detected nudity on the I2P benchmark.

desk verdict Strong empirical results and a genuinely new inside-out attack-prompt idea, but the printed H2 objective is self-similarity (identically 1), so the paper's own equations do not realize its central boundary-exploration claim. read the letter →

arxiv 2506.09363 v1 pith:NIU7ZNMJ submitted 2025-06-11 cs.CV cs.AIcs.CR

Hongguang Zhu , Yunchao Wei , Mengyu Wang , Siyu Jiao , Yan Fang , Jiannan Huang , Yao Zhao This is my paper
classification cs.CVcs.AIcs.CR
keywords diffusionmodelsconcepterasuresafetext-to-imagegenerationadversarialpromptlearningtextencoderfine-tuningCLIPfeaturespacered-teamingrobustnessunlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SAGE is a method for unlearning unsafe concepts from text-to-image diffusion models without fixing the concept to a single word. The paper's central claim is that erasing a word like "nudity" again and again leaves the model vulnerable to paraphrases, suggestive phrasing, and attack prompts, so SAGE instead erases the whole concept domain by alternating between finding prompts near the domain boundary and training the model to refuse them. On the I2P benchmark it reports a 98.01% relative reduction in detected nudity, a 2.81% attack success rate under Ring-A-Bell, and FID 19.21 / CLIP-S 29.53 for common-concept retention, beating nine baselines on a composite score it introduces, $H_o$. A second contribution is that only the text encoder is fine-tuned, so the edited text encoder transfers to other models sharing that encoder without retraining the denoiser.

What carries the argument

The central object is the self-augment token embedding, which is the template token embedding optimized inside-out from the target concept rather than from random perturbations, and the cyclic loop it creates between attack-prompt generation and erasure. The mechanism uses the CLIP text encoder's pooled feature $g(\cdot)$ to form an anchor $f_p^o = g(T_{\theta_o}(\tau_p))$ from the original model and a current-model feature $f_p^n = g(T_{\theta_n}(\tau_p))$; the attack loss $L_{\mathrm{attack}} = -H_1 + H_2/H_1$ combines closeness to the anchor with a boundary-exploration term $H_2$. The optimized prompt $\tau_p$ then replaces the concept word in the negative-guidance erasure objective, and a global graph alignment $L_{\mathrm{graph}}$ plus local noise consistency $L_{\mathrm{image}}$ on the top-k drifted retain prompts protects unrelated concepts. Only the text encoder is updated, so the same encoder can be reused across models with the same text-encoder architecture.

What would settle it

Run the attack-prompt optimization exactly as printed in Eqs. (8)-(10): if $H_2$ is constant because it is a self-similarity, the reported attack-success-rate drop cannot come from boundary exploration, and the central mechanism is vacuous. In the intended version, measure the cosine distance between $f_p^n$ and $f_p^o$ across attack steps and check whether optimized prompts land on the concept-domain boundary: if all generated attacks sit at the anchor or drift to unrelated concepts, the domain-erasure claim fails.

Watch

Extended reading notes

Core claim

SAGE's core discovery is that a diffusion model's own text-feature space can supply the erased examples, turning concept-word erasure into concept-domain erasure. The method freezes the UNet denoiser and finetunes only the CLIP text encoder. Starting from the target concept, it optimizes the template token embedding so that the current model's pooled text feature stays close to the original model's anchor feature while a second boundary-exploration term pushes the attack prompt away from the anchor; the attack loss is $L_{\mathrm{attack}} = -H_1 + H_2/H_1$. Each found attack prompt replaces the concept word in the negative-guidance erasure loss, and the two phases alternate cyclically as self-check and self-erasure. The paper then adds a global-local retention mechanism: a graph of pairwise text-feature similarities among retained prompts is aligned, and the prompts with the largest semantic drift are selected for additional noise-prediction consistency. The paper reports that this combination removes nudity and styles like Van Gogh and Monet while keeping common concepts and other styles close to the original model's outputs.

Load-bearing premise

The load-bearing premise is that CLIP text-feature cosine similarity between the original and edited text encoders, applied to optimized attack prompts, tells whether a prompt lies inside or outside the target concept domain; the boundary-exploration term $H_2$ as printed in Eqs. (8)-(9) compares a feature with itself and cannot perform that function, so the intended non-degenerate version must be used for the claimed generalization to concealed, suggestive, and attack prompts to go through.

Editorial extensions

If this is right

  • If the domain-boundary search works as claimed, concept erasure no longer requires preprocessed image-mask pairs or predefined target-to-benign prompt pairs; the model generates its own erased examples from the concept anchor.
  • The reported 2.81% ASR under Ring-A-Bell and low rates under MMA, P4D, and UnlearnDiff imply the erased model resists both black-box and white-box jailbreak attempts better than word-only erasure, because the erased region is the whole concept domain rather than a point.
  • Because only the text encoder is fine-tuned, the same edited text encoder can be dropped into other models sharing that encoder; the paper reports nudity reductions of 86.49%, 96.67%, and 95.68% on three SD v1.4 variants and 49.29% on SDXL when only one of its dual text encoders is replaced.
  • The $H_o$ composite metric, averaging normalized RER, FID, CLIP-S, and $(1 - \text{ASR})$, gives SAGE 94.28 versus 93.01 for the strongest baseline, suggesting that erasure, retention, and robustness can be improved together rather than traded off.
  • The same framework extends beyond nudity: on the I2P categories hate, harassment, violence, self-harm, sexual, shocking, and illegal activity, SAGE reports the lowest inappropriate proportion in every category, with an overall rate of 2.61%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because the attack-prompt search only needs text features, it could be applied to concepts that have no single canonical word, such as artist mimicry or a person's likeness, with the same boundary-exploration loop; the paper's style experiments are an initial sign.
  • Editorial inference: the reported transfer numbers suggest a practical deployment path where one edited text encoder is shared across a family of diffusion models, but the paper does not test whether erasing multiple concepts in the same encoder creates interference; measuring cross-concept retention after multi-concept erasure would be a natural next experiment.
  • Editorial inference: the method's reliance on CLIP text-feature cosine similarity implies that concepts without a separable CLIP direction will be hard to bound; a stress test on abstract, composite, or non-visual concepts would reveal the limits of the domain-boundary assumption.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper proposes SAGE, a method for concept erasing in text-to-image diffusion models that aims to replace fixed-word erasure with concept-domain erasure. The method alternately optimizes attack prompts (by updating only the template token embedding) and fine-tunes the text encoder, using a semantic relationship between the original and current models to explore the concept boundary. It also introduces a global-local collaborative retention mechanism to preserve unrelated concepts, and evaluates on nudity and artistic style erasure, reporting strong results on RER, ASR, FID, CLIP-S, and a new unified metric H_o. The central novelty is the boundary-exploration objective H2 in Eq. (8)-(9), which is claimed to push attack prompts away from the concept anchor while remaining inside the concept domain.

Significance. If the method works as described, it would be a notable contribution: it addresses the well-recognized limitation of concept erasing that focuses only on a fixed word, and it does so with a text-encoder-only update that offers efficient training and zero-cost transfer across models sharing the same text encoder. The paper provides extensive experiments with nine baselines, multiple detectors (NudeNet, Q16, style classifier), and multiple red-teaming attacks, and also proposes a new evaluation metric H_o that could be useful to the community. The training-efficiency comparison and cross-model transfer results are also valuable. However, the central mechanism for boundary exploration is not correctly specified in the manuscript, which substantially undermines confidence in the claimed results.

major comments (3)
  1. [§4.1, Eq. (8)-(9), Algorithm 1 line 7] The objective H2 is defined as Sim(f_o^p, f_o^p), the cosine similarity of the anchor feature with itself. This quantity is identically 1 and has zero gradient with respect to the optimized template embedding τ_t. Consequently, substituting into Eq. (10) gives L_attack = -H1 + 1/H1, which is strictly decreasing in H1; minimizing it is equivalent to maximizing H1 alone. No term in the printed objective pushes the attack prompt away from the concept anchor, so the 'inside-out boundary exploration' described in the text and Fig. 3 is not realized by the mathematics. This is a load-bearing error because the paper's central claim of generalized concept-domain erasing depends on this exploration term.
  2. [Table 6, ablation of L_attack] The ablation results are inconsistent with the printed formulation. If H2 is the self-similarity term, the row labeled 'H2' should be indistinguishable from a setting where H2 contributes no update; yet it reports an ASR of 30.99, differing substantially from ESD. Similarly, the row '-H1 + H2' should be equivalent to '-H1' (up to a constant offset), but it reports different RER (96.03 vs. 93.73) and ASR (2.11 vs. 7.04). These discrepancies suggest that the actual implementation uses an H2 different from the one in Eq. (8)-(9), but the manuscript does not provide the corrected definition. The ablation therefore cannot be used to validate the proposed objective.
  3. [§4.1, notation of τ_p and f_o^p] The notation is ambiguous: τ_p is used both for the original attack prompt (described as 'remains unchanged') and for the optimized attack prompt, and f_o^p is computed both before the inner optimization loop (Algorithm 1 line 4) and inside the loop (line 6). This ambiguity is directly relevant to the H2 error: it is unclear whether H2 is meant to compare the anchor feature from line 4 with a current feature from line 6, or whether the same symbol denotes the same quantity. A precise definition of the anchor and the optimized feature is required for the method to be reproducible.
minor comments (3)
  1. [§1, Introduction] The phrase 'we introducesemantic-augment erasing' is missing a space between 'introduce' and 'semantic'.
  2. [§5.2, heading] The heading 'Quatitative Results' should be spelled 'Quantitative Results' (also in §5.3).
  3. [Eq. (19), H_o metric] It would be helpful to state explicitly the value ranges of the four components of H_o and to justify the equal weighting; as written, it is not clear whether all components are normalized to the same scale.

Circularity Check

1 steps flagged · score 6.0 of 10

The printed H2 objective is self-similarity (Sim(f_o^p,f_o^p)≡1), so Lattack reduces to -H1 + 1/H1 and the claimed boundary-exploration term has zero gradient; the central inside-out mechanism is vacuous as written.

  1. self definitional [Section 4.1, Eqs. (8)-(9); Algorithm 1 line 7]
    "For encouraging τ_p to explore the boundary of the concept domain, criterion H_2 is further proposed to ensure that f_o^p is as far as possible from the anchor feature f_o^p. minimize_{τ_t} H_2 = Sim(f_o^p, f_o^p), (8) = Sim(g(T_{θ_o}(τ_p)), g(T_{θ_o}(τ_p))), (9)"

    H2 is defined as Sim(g(T_θo(τ_p)), g(T_θo(τ_p))): both arguments are the same frozen text-encoder output on the same prompt, so by definition cosine similarity ≡ 1 and ∇_{τ_t}H2 = 0. 'Minimizing H2' therefore cannot move the attack prompt away from the anchor. Because Eq. (10) then reads Lattack = -H1 + 1/H1, which is strictly decreasing in H1, optimizing it is equivalent to maximizing H1 alone; no term realizes the claimed inside-out boundary exploration. Table 6 is consistent: the H2-only row (RER 85.81, ASR 30.99) is close to ESD's no-attack row (RER 88.77, ASR 40.84), as expected if H2 is inert. The central 'semantic-augment erasing' mechanism is vacuous by construction as printed.

full rationale

The paper's erasure and retention losses are externally anchored: Lerase distills the frozen original model's own negative-guidance noise (Eqs. 11-12), Lgraph and Limage compare the edited text encoder / UNet predictions against the original model on retain prompts (Eqs. 13-17), and results are judged by external detectors (NudeNet, Q16, style classifier) and external red-team attacks (Ring-A-Bell, MMA, P4D, UnlearnDiff). These parts are not circular, and there is no load-bearing self-citation chain. The circularity is localized but central: the boundary-exploration criterion H2 (Eq. 8-9) and Algorithm 1 line 7 compare a feature vector with itself, making H2 ≡ 1 by definition and ∇_{τ_t}H2 = 0. The attack loss then degenerates to maximizing H1 alone, so the paper's advertised 'cyclic self-check and self-erasure' exploration of the concept-domain boundary is not realized by the printed mathematics. Since this is the mechanism that supposedly lifts SAGE out of the 'word concept abyss', the strongest generalization claim reduces, as written, to a self-similarity constant inside the attack objective. Score 6 reflects one load-bearing step that degenerates by construction while the remaining evaluation pipeline has independent external content.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The method relies on several domain assumptions about CLIP text-space geometry and the transferability of text-encoder edits to the frozen UNet, plus a set of task-dependent hyperparameters. The most serious entry is the H2 objective, which is intended to encode the boundary-exploration premise but is degenerate in the printed equations.

free parameters (7)
  • erasing guidance scale eta = 1.0
    Chosen by hand following ESD [11]; controls the strength of negative guidance in the erasure loss (Eq. 11).
  • graph consistency weight gamma_t = 0.4 (nudity), 3.0 (style)
    Regularization weight in Eq. (18); set differently per task with no selection procedure described.
  • image retention weight gamma_v = 1.0
    Weight for the local predicted-noise retention loss in Eq. (18).
  • warm-up iterations = 200 of 1000 steps
    Chosen to endow initial erasure capability before attack optimization; ablation shows a marginal effect.
  • attack steps J and attack learning rate beta = 30, 1e-3
    Hyperparameters for template token optimization in Algorithm 1.
  • Top-k image retain subset size = 4
    Number of retain prompts with the lowest H3 selected for L_image.
  • retain batch size b_retain = 32
    Batch size for the semantic graph consistency loss.
assumptions (5)
  • domain assumption CLIP text-encoder cosine similarity is a reliable proxy for membership in the target concept's image-generation domain.
    The H1/H2 objectives assume that moving prompts in text-feature space corresponds to moving within or outside a concept domain in generated images (Sec. 4.1, Eq. 6-9).
  • domain assumption Fine-tuning only the text encoder is sufficient to erase concepts that are also stored in UNet cross-attention weights.
    SAGE freezes the UNet and updates only T_theta; the paper provides no analysis of how much concept knowledge resides in the text encoder versus the UNet (Sec. 4, Algorithm 1).
  • domain assumption Adversarial training on self-generated attack prompts transfers to unseen concealed, suggestive, and attack prompts.
    The generalization claim is empirical; no formal mechanism is given for why the explored boundary covers all user rephrasings (Sec. 4.1, 5.2).
  • ad hoc to paper The template token embedding can be optimized to stay within the concept domain while moving away from the anchor.
    This is the intended role of H2, but Eq. (8) as written makes H2 constant, so the premise is not actually formalized.
  • standard math Standard diffusion and classifier-free guidance equations from prior work (ESD) are correct and applicable.
    Preliminary equations (1)-(3) are taken from existing literature and used without modification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing." pith.science (2026). https://pith.science/paper/NIU7ZNMJ

@misc{pith2026250609363,
  author       = {Pith},
  title        = {Pith review of: SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NIU7ZNMJ}},
  note         = {Machine review of arXiv:2506.09363}
}
read the original abstract

Diffusion models (DMs) have achieved significant progress in text-to-image generation. However, the inevitable inclusion of sensitive information during pre-training poses safety risks, such as unsafe content generation and copyright infringement. Concept erasing finetunes weights to unlearn undesirable concepts, and has emerged as a promising solution. However, existing methods treat unsafe concept as a fixed word and repeatedly erase it, trapping DMs in ``word concept abyss'', which prevents generalized concept-related erasing. To escape this abyss, we introduce semantic-augment erasing which transforms concept word erasure into concept domain erasure by the cyclic self-check and self-erasure. It efficiently explores and unlearns the boundary representation of concept domain through semantic spatial relationships between original and training DMs, without requiring additional preprocessed data. Meanwhile, to mitigate the retention degradation of irrelevant concepts while erasing unsafe concepts, we further propose the global-local collaborative retention mechanism that combines global semantic relationship alignment with local predicted noise preservation, effectively expanding the retentive receptive field for irrelevant concepts. We name our method SAGE, and extensive experiments demonstrate the comprehensive superiority of SAGE compared with other methods in the safe generation of DMs. The code and weights will be open-sourced at https://github.com/KevinLight831/SAGE.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

61 extracted references · 48 canonical work pages

  1. [1]

    Bedapudi, P.: Nudenet: Neural nets for nudity classifica- tion, detection and selective censoring (2019) 7

    work page 2019

  2. [2]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Cherti, M., Beaumont, R., Wightman, R., Worts- man, M., Ilharco, G., Gordon, C., Schuhmann, C., Schmidt, L., Jitsev, J.: Reproducible scaling laws for con- trastive language-image learning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2818–2829 (2023) 12

    work page 2023

  3. [3]

    In: International Conference on Machine Learning (ICML) (2024) 3, 4, 12

    Chin, Z.Y., Jiang, C.M., Huang, C.C., Chen, P.Y., Chiu, W.C.: Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. In: International Conference on Machine Learning (ICML) (2024) 3, 4, 12

    work page 2024

  4. [4]

    Accessed: 2024-08-15 1

    CNBC: Microsoft AI engineer says Copilot designer cre- ates ’disturbing’ images (2024). Accessed: 2024-08-15 1

    work page 2024

  5. [5]

    Advances in Neural Information Pro- cessing Systems34, 8780–8794 (2021) 1

    Dhariwal, P., Nichol, A.: Diffusion models beat gans on image synthesis. Advances in Neural Information Pro- cessing Systems34, 8780–8794 (2021) 1

    work page 2021

  6. [6]

    Advances in Neural Information Pro- cessing Systems35, 16890–16902 (2022) 1

    Ding, M., Zheng, W., Hong, W., Tang, J.: Cogview2: Faster and better text-to-image generation via hierarchi- cal transformers. Advances in Neural Information Pro- cessing Systems35, 16890–16902 (2022) 1

    work page 2022

  7. [7]

    https://huggingface.co/dreamlike-art/ dreamlike-photoreal-2.0(2023) 12

    dreamlike.art: Dreamlike photoreal v2.0. https://huggingface.co/dreamlike-art/ dreamlike-photoreal-2.0(2023) 12

    work page 2023

  8. [8]

    In: Forty-first International Conference on Machine Learning (2024) 2

    Esser, P., Kulal, S., Blattmann, A., Entezari, R., M¨ uller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F., et al.: Scaling rectified flow transformers for high- resolution image synthesis. In: Forty-first International Conference on Machine Learning (2024) 2

    work page 2024

Show all 61 references
  1. [9]

    In: Proceedings of SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing 13 the IEEE/CVF conference on computer vision and pat- tern recognition, pp

    Esser, P., Rombach, R., Ommer, B.: Taming transform- ers for high-resolution image synthesis. In: Proceedings of SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing 13 the IEEE/CVF conference on computer vision and pat- tern recognition, pp. 1...

    2021

  2. [10]

    arXiv preprint arXiv:2208.01618 (2022) 3

    Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A.H., Chechik, G., Cohen-Or, D.: An image is worth one word: Personalizing text-to-image generation using tex- tual inversion. arXiv preprint arXiv:2208.01618 (2022) 3

    2022 arXiv

  3. [11]

    In: Pro- ceedings of the IEEE/CVF International Conference on Computer Vision, pp

    Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., Bau, D.: Erasing concepts from diffusion models. In: Pro- ceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2426–2436 (2023) 1, 3, 4, 7, 8, 9, 12

    2023

  4. [12]

    In: Proceedings of the IEEE/CVF Winter Conference on Ap- plications of Computer Vision, pp

    Gandikota, R., Orgad, H., Belinkov, Y., Materzy´ nska, J., Bau, D.: Unified concept editing in diffusion models. In: Proceedings of the IEEE/CVF Winter Conference on Ap- plications of Computer Vision, pp. 5111–5120 (2024) 1, 3, 7, 8, 9, 12

    2024

  5. [13]

    In: European Conference on Computer Vision, pp

    Gong, C., Chen, K., Wei, Z., Chen, J., Jiang, Y.G.: Re- liable and efficient concept erasure of text-to-image dif- fusion models. In: European Conference on Computer Vision, pp. 73–88. Springer (2024) 1, 3, 7, 8, 9, 12

    2024

  6. [14]

    arXiv preprint arXiv:2307.04725 (2023) 1

    Guo, Y., Yang, C., Rao, A., Liang, Z., Wang, Y., Qiao, Y., Agrawala, M., Lin, D., Dai, B.: Animatediff: Animate your personalized text-to-image diffusion models without specific tuning. arXiv preprint arXiv:2307.04725 (2023) 1

    2023 arXiv

  7. [15]

    Hero, P.: Openjourney v4.https://huggingface.co/ prompthero/openjourney-v4(2023) 12

    2023

  8. [16]

    arXiv preprint arXiv:2104.08718 (2021) 7

    Hessel, J., Holtzman, A., Forbes, M., Bras, R.L., Choi, Y.: Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2104.08718 (2021) 7

    2021 arXiv

  9. [17]

    Advances in neural information processing systems30(2017) 7

    Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., Hochreiter, S.: Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems30(2017) 7

    2017

  10. [18]

    Advances in neural information process- ing systems33, 6840–6851 (2020) 3

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion proba- bilistic models. Advances in neural information process- ing systems33, 6840–6851 (2020) 3

    2020

  11. [19]

    In: NeurIPS 2021 Workshop on Deep Generative Models and Downstream Applications (2021) 4

    Ho, J., Salimans, T.: Classifier-free diffusion guidance. In: NeurIPS 2021 Workshop on Deep Generative Models and Downstream Applications (2021) 4

    2021

  12. [20]

    In: European Conference on Computer Vision, pp

    Huang, C.P., Chang, K.P., Tsai, C.T., Lai, Y.H., Yang, F.E., Wang, Y.C.F.: Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. In: European Conference on Computer Vision, pp. 360–376. Springer (2024) 1, 3, 4, 7, 8, 9, 12

    2024

  13. [21]

    In: Proceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pp

    Jiang, H.H., Brown, L., Cheng, J., Khan, M., Gupta, A., Workman, D., Hanna, A., Flowers, J., Gebru, T.: Ai art and its impact on artists. In: Proceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pp. 363–374 (2023) 1

    2023

  14. [22]

    In: European Conference on Computer Vision, pp

    Kim, C., Min, K., Yang, Y.: Race: Robust adversarial concept erasure for secure text-to-image diffusion model. In: European Conference on Computer Vision, pp. 461–

  15. [23]

    arXiv preprint arXiv:2307.05977 (2023) 3

    Kim, S., Jung, S., Kim, B., Choi, M., Shin, J., Lee, J.: To- wards safe self-distillation of internet-scale text-to-image diffusion models. arXiv preprint arXiv:2307.05977 (2023) 3

    2023 arXiv

  16. [24]

    arXiv preprint arXiv:1312.6114 (2013) 4

    Kingma, D.P.: Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 (2013) 4

    2013 arXiv

  17. [25]

    In: Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision, pp

    Kumari, N., Zhang, B., Wang, S.Y., Shechtman, E., Zhang, R., Zhu, J.Y.: Ablating concepts in text-to-image diffusion models. In: Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision, pp. 22691– 22702 (2023) 3

    2023

  18. [26]

    In: Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp

    Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Doll´ ar, P., Zitnick, C.L.: Microsoft coco: Common objects in context. In: Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740–

    2014

  19. [27]

    arXiv preprint arXiv:2303.05499 (2023) 1

    Liu, S., Zeng, Z., Ren, T., Li, F., Zhang, H., Yang, J., Li, C., Yang, J., Su, H., Zhu, J., et al.: Grounding dino: Marrying dino with grounded pre-training for open-set object detection. arXiv preprint arXiv:2303.05499 (2023) 1

    2023 arXiv

  20. [28]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Lu, S., Wang, Z., Li, L., Liu, Y., Kong, A.W.K.: Mace: Mass concept erasure in diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6430–6440 (2024) 1, 3, 7, 8, 9, 12

    2024

  21. [29]

    arXiv preprint arXiv:2310.04378 (2023) 12

    Luo, S., Tan, Y., Huang, L., Li, J., Zhao, H.: Latent consistency models: Synthesizing high-resolution images with few-step inference. arXiv preprint arXiv:2310.04378 (2023) 12

    2023 arXiv

  22. [30]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Lyu, M., Yang, Y., Hong, H., Chen, H., Jin, X., He, Y., Xue, H., Han, J., Ding, G.: One-dimensional adapter to rule them all: Concepts diffusion models and erasing ap- plications. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7559– ...

    2024

  23. [31]

    In: International Conference on Learning Rep- resentations (2018) 4, 6

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Rep- resentations (2018) 4, 6

    2018

  24. [32]

    com(2023)

    MidJourney, I.: Midjourney.https://www.midjourney. com(2023). V5 1, 3

    2023

  25. [33]

    OpenAI: Dall·e 2.https://openai.com/dall-e-2 (2022). V1 1, 3

    2022

  26. [34]

    OpenAI: Gpt-4 technical report (2023) 7

    2023

  27. [35]

    O’Connor, R.: Stable diffusion 1 vs 2 - what you need to know (2022) 3

    2022

  28. [36]

    arXiv preprint arXiv:2307.01952 (2023) 2, 12

    Podell, D., English, Z., Lacey, K., Blattmann, A., Dock- horn, T., M¨ uller, J., Penna, J., Rombach, R.: Sdxl: Im- proving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952 (2023) 2, 12

    2023 arXiv

  29. [37]

    Accessed: 2024-08-15 1

    Post, T.W.: Ai porn and deepfakes are a growing threat to women’s consent (2023). Accessed: 2024-08-15 1

    2023

  30. [38]

    In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp

    Qu, Y., Shen, X., He, X., Backes, M., Zannettou, S., Zhang, Y.: Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 3403– 3417 (2023) 9

    2023

  31. [39]

    In: International conference on machine learning, pp

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natu- ral language supervision. In: International conference on machine learning, pp. 8748–8763. PMLR (2021) 4, 5, 12

    2021

  32. [40]

    arXiv preprint arXiv:2204.061251(2), 3 (2022) 1

    Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., Chen, M.: Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.061251(2), 3 (2022) 1

    2022 arXiv

  33. [41]

    arXiv preprint arXiv:2210.04610 (2022) 1

    Rando, J., Paleka, D., Lindner, D., Heim, L., Tram` er, F.: Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610 (2022) 1

    2022 arXiv

  34. [42]

    Rombach, R.: Stable diffusion 2.0 release (2022) 1, 3, 7, 8, 9

    2022

  35. [43]

    In: Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Om- mer, B.: High-resolution image synthesis with latent dif- fusion models. In: Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp. 10684–10695 (2022) 1, 2, 3, 8, 9 14 Hongguang Zhu et al

    2022

  36. [44]

    In: Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international confer- ence, Munich, Germany, October 5-9, 2015, proceedings, part III 18, pp

    Ronneberger, O., Fischer, P., Brox, T.: U-net: Convo- lutional networks for biomedical image segmentation. In: Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international confer- ence, Munich, Germany, October 5-9, 2015, proceedings, part III 18,...

    2015

  37. [45]

    artists aren’t happy (2022) 1

    Roose, K.: An ai-generated picture won an art prize. artists aren’t happy (2022) 1

    2022

  38. [46]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Schramowski, P., Brack, M., Deiseroth, B., Kersting, K.: Safe latent diffusion: Mitigating inappropriate de- generation in diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22522–22531 (2023) 3, 7, 8, 9

    2023

  39. [47]

    1350–1361 (2022) 9

    Schramowski, P., Tauchmann, C., Kersting, K.: Can ma- chines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In: Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pp. 1350–1361 (2022) 9

    2022

  40. [48]

    Advances in Neural Information Processing Systems35, 25278–25294 (2022) 3

    Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., et al.: Laion-5b: An open large-scale dataset for training next generation image- text models. Advances in Neural Information Processing Systems35, 2...

    2022

  41. [49]

    Setty, R.: Ai art generators hit with copyright suit over artists’ images (2023) 1

    2023

  42. [50]

    SmithMano: Tutorial: How to remove the safety filter in 5 seconds (2022) 3

    2022

  43. [51]

    arXiv preprint arXiv:2010.02502 (2020) 7

    Song, J., Meng, C., Ermon, S.: Denoising diffusion im- plicit models. arXiv preprint arXiv:2010.02502 (2020) 7

    2020 arXiv

  44. [52]

    Tsai, Y.L., Hsu, C.Y., Xie, C., Lin, C.H., Chen, J.Y., Li, B., Chen, P.Y., Yu, C.M., Huang, C.Y.: Ring-a-bell! how reliable are concept removal methods for diffusion models? In: The Twelfth International Conference on Learning Representations (2024) 3, 7, 12

    2024

  45. [53]

    In: European Conference on Computer Vision, pp

    Voleti, V., Yao, C.H., Boss, M., Letts, A., Pankratz, D., Tochilkin, D., Laforte, C., Rombach, R., Jampani, V.: Sv3d: Novel multi-view synthesis and 3d generation from a single image using latent video diffusion. In: European Conference on Computer Vision, pp. 439–457. Springe...

    2025

  46. [54]

    In: Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp

    Yang, Y., Gao, R., Wang, X., Ho, T.Y., Xu, N., Xu, Q.: Mma-diffusion: Multimodal attack on diffusion models. In: Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 7737–7746 (2024) 12

    2024

  47. [55]

    arXiv preprint arXiv:2305.12082 (2023) 3

    Yang, Y., Hui, B., Yuan, H., Gong, N., Cao, Y.: Sneakyprompt: Jailbreaking text-to-image generative models. arXiv preprint arXiv:2305.12082 (2023) 3

    2023 arXiv

  48. [56]

    Information Fusion p

    Zhang, C., Hu, M., Li, W., Wang, L.: Adversarial attacks and defenses on text-to-image diffusion models: A survey. Information Fusion p. 102701 (2024) 3

    2024

  49. [57]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Zhang, G., Wang, K., Xu, X., Wang, Z., Shi, H.: Forget- me-not: Learning to forget in text-to-image diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1755– 1764 (2024) 3

    2024

  50. [58]

    arXiv preprint arXiv:2405.15234 (2024) 3, 4, 7, 8, 9, 12

    Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., Hong, M., Ding, K., Liu, S.: Defensive unlearning with adversarial training for robust concept erasure in diffu- sion models. arXiv preprint arXiv:2405.15234 (2024) 3, 4, 7, 8, 9, 12

    2024 arXiv

  51. [59]

    Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., Liu, S.: To generate or not? safety-driven un- learned diffusion models are still easy to generate unsafe images... for now. ECCV (2024) 3, 4, 7, 12

    2024

  52. [60]

    In: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp

    Zhang, Z., Fang, M., Chen, L., Namazi-Rad, M.R., Wang, J.: How do large language models capture the ever- changing world knowledge? a review of recent advances. In: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 8289–8311 (2023) 2

    2023

  53. [478]

    Springer (2024) 3, 4, 7, 8, 9, 12

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.