Pith. sign in

REVIEW 5 major objections 5 minor 47 references

ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Models

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial attacks on unlearned image models can be made zero-shot and intent-aware by optimizing a single captioning-plus-projection module per removed concept.

desk verdict Clever per-concept alignment module and a promising zero-shot attack idea, but the evaluation doesn't yet prove the transfer claim. read the letter →

arxiv 2507.21985 v1 pith:WEUGNNBH submitted 2025-07-29 cs.CV cs.CR

Hyun Jun Yook , Ga San Jhun , Jae Hyun Cho , Min Jeon , Donghyun Kim , Tae Hyung Kim , Youn Kyu Lee This is my paper
classification cs.CVcs.CR
keywords machineunlearningtext-to-imagediffusionmodelsadversarialattackszero-shotattackconcepterasureuserintentcustomizationclassifierimagecaptioning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ZIUM claims that an attacker can defeat concept-erasing machine unlearning in text-to-image models with almost no per-attack cost. The method takes a target attack image that still contains the removed concept, converts its visual embedding into a text embedding through an image-captioning and projection module, and concatenates that embedding with the text embedding of a user-intent prompt. A one-time optimization of the captioning and projection modules per unlearned concept makes the attack zero-shot: after that single optimization, unseen target images and new user-intent prompts for the same concept can be attacked without further optimization. The paper reports an average attack success rate of 87.8%, compared with 65.2% for the strongest existing baseline, and zero-shot attacks that run roughly 45 to 150 times faster than re-optimizing per attack. If true, this means unlearning a concept is not enough to stop cheap, customizable regeneration of it.

What carries the argument

The load-bearing object is the visual-text alignment network $f_{\theta'}$: a frozen visual encoder that extracts a $k$-dimensional embedding from the target attack image, a query-based image-captioning module pretrained with image-text contrastive, image-text matching, and image-grounded text-generation losses, and a trainable projection layer that maps the resulting text embedding to the dimension expected by the unlearned diffusion model's text encoder. Its parameters are the only ones updated during the initial attack. The zero-shot claim rests entirely on $f_{\theta'}$ generalizing the unlearned concept across images: once optimized on one image of the concept, the same frozen network is expected to turn any unseen image containing that concept into a usable conditioning embedding.

What would settle it

Run the initial per-concept attack on a single target image, freeze the resulting module, and evaluate it on held-out target images drawn from a deliberately different visual distribution (for example, heavily compressed images, artwork, or synthetic avatars). If the zero-shot attack success rate on that held-out set drops to the no-attack level while remaining high on near-distribution images, the zero-shot claim is conditional on visual similarity rather than general.

Watch

Extended reading notes

Core claim

On its own terms, ZIUM's central discovery is that the expensive part of an adversarial attack on an unlearned diffusion model can be moved into a reusable per-concept adapter. For each removed concept, ZIUM optimizes only the parameters $\theta'$ of the image-captioning-plus-projection network so that the condition $c_i = f_{\theta'}(E(x_i))$, concatenated with the user-intent prompt embedding $p$, minimizes the expected denoising error $\mathbb{E}_{t,\epsilon} \| \epsilon - \epsilon_\theta(x_t \mid f_{\theta'}(e_i), p) \|_2^2$ of the unlearned model. After this initial attack phase, the optimized $f_{\theta'}$ is frozen and applied to any unseen target image of the same concept, which is what the paper calls the zero-shot attack phase. The reported result is consistently high attack success across nudity, violence, illegal activity, style, and object scenarios, with an average of 87.8% against four representative unlearned models, and zero-shot attack time near 0.2 minutes.

Load-bearing premise

The zero-shot phase assumes that the captioning-and-projection module optimized on one image of a removed concept still produces a usable text embedding for other images of that concept it has never seen; the paper reports high average success but does not analyze when this transfer breaks.

Editorial extensions

If this is right

  • After one optimization per removed concept, an attacker can run new attacks on unseen target images and new user-intent prompts with no further optimization.
  • Zero-shot attack time falls to roughly 0.2 minutes per attack, compared with 9 to 30 minutes for methods that re-optimize each attack.
  • Attack success becomes more consistent across unlearned models and concept categories: ZIUM averages 87.8% with 39.4 percentage points of variation, while existing methods vary by at least 62.0 points.
  • User-intent prompts change backgrounds, objects, styles, and behaviors of the regenerated image while the removed concept is preserved, so attacks are customizable rather than fixed to one image.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the reusable per-concept adapter behaves like a concept-level direction in the model's embedding space; if so, probing that direction with held-out images could predict when zero-shot transfer will fail, which the paper does not analyze.
  • Editorial inference: the same optimization only requires a differentiable denoising objective and a text-conditioning interface, so the mechanism should transfer to other conditional generative models such as image-to-image or video generators.
  • Editorial inference: a direct test of generality would be to run the initial attack on one image of a concept and then evaluate the frozen module on target images drawn from a deliberately different distribution, such as heavy compression, different art styles, or synthetic avatars; the paper reports averages but not failure distribution.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes ZIUM, a two-phase adversarial attack against unlearned text-to-image diffusion models. In the initial phase, a visual-text alignment module (a frozen visual encoder plus an optimized Q-former and projection layer) maps a target attack image into a text embedding, which is concatenated with a user-intent prompt and used as a conditioning signal to generate images containing the unlearned concept; the module is optimized with a diffusion-classifier objective (Eq. 7). In the zero-shot phase, the same optimized module is reused on unseen target images and prompts without further optimization. Experiments on ESD, FMN, SLD, and AdvUnlearn across nudity, violence, illegal activity, style, and object concepts report high attack success rates (e.g., 87.8% average in Table 1) and large reductions in attack time (Table 2).

Significance. If the zero-shot transfer claim is valid, ZIUM would be a meaningful advance in adversarial attacks on unlearned diffusion models, reducing per-attack optimization cost substantially while retaining high success rates. The use of an image-captioning module for adversarial conditioning is a novel idea, and the paper covers multiple unlearned models and concept classes, which is a strength. However, the central claim is currently under-supported: the zero-shot evaluation lacks a defined held-out split and any statistical uncertainty quantification, and the qualitative customization claims are not quantified. The contribution is promising but requires a substantially strengthened evaluation before it can be considered established.

major comments (5)
  1. [Section 3.2 / Table 2] The zero-shot claim, which is the paper's main contribution, requires a clearly defined held-out evaluation, but the manuscript never states how the target attack images were split between the initial-phase optimization set and the zero-shot test set, how many images were used to optimize f_theta', or whether the same user-intent prompts were used in both phases. Without this information, the zero-shot ASR values in Table 2 (84.5% for nudity, 50.0% for Van Gogh, 48.0% for parachute) cannot be distinguished from in-distribution results, and the claim that the optimized module generalizes to unseen images is unsubstantiated. The authors must report the exact split, the per-concept optimization set size, and a confirmation that the test images are disjoint from the optimization set.
  2. [Section 4.2.3 / Table 2] No variance, confidence intervals, or multiple seeds are reported for any ASR number. With only 50 prompts for Van Gogh and parachute, the differences between ZIUM zero-shot (50.0% and 48.0%) and UnlearnDiffAtk (36.0% and 48.0%) may not be statistically meaningful, and the claim that zero-shot outperforms all existing methods is not supported. The authors should provide error bars or significance tests, and ideally repeat the initial-phase optimization over several seeds to show the sensitivity of the learned module.
  3. [Sections 3.1.2 and 4.2.1 / Eq. (7) and Table 1] The initial-phase ASR is a fitted result, not a prediction: Eq. (7) directly minimizes the denoising error on the target attack image x_i, and Table 1 reports ASR on images generated from the same optimization setting. The paper should explicitly frame Table 1 as in-distribution fitting performance and Table 2 as the held-out transfer result. It should also clarify whether baseline methods are given an analogous optimization budget (e.g., number of steps and prompts per image) so that the comparison in Table 1 is fair.
  4. [Section 4.1 (Prompt Datasets)] For violence and illegal activity, the authors filter the I2P dataset to only prompts where the Q16 classifier deems more than 50% of generated images inappropriate, keeping only 334 of 756 and 248 of 727 prompts respectively. This is a biased subsample that can inflate absolute ASR values and may affect relative method rankings if the discarded prompts behave differently. The authors should justify this filtering or also report results on the full I2P set to allow comparison with prior work.
  5. [Sections 4.2.1, 4.2.2, and Appendix A1] Qualitative claims such as 'perfectly reflected the nudity concept' and 'successfully generates customized images' are based only on visual inspection; no quantitative similarity metric, concept-preservation metric, or user-intent-alignment metric is provided. For the customization claims (RQ#2 and the zero-shot customization shown in Fig. 4), some quantitative evidence is needed to rule out the possibility that the optimized f_theta' has collapsed to a universal adversarial text embedding that triggers the unlearned concept regardless of the input image, which would undermine the 'intent-aware' and 'customized' aspects of the contribution.
minor comments (5)
  1. [Section 3.1.1] The concatenation of the L-dimensional text embedding with the user-intent prompt embedding is not dimensionally specified; please clarify how the two embeddings are combined (e.g., along the sequence dimension) and how the combined condition is processed by the CLIP text encoder.
  2. [Acknowledgments] The heading 'Acknowledegments' contains a typo and should be corrected to 'Acknowledgments'.
  3. [Table 1] The column header 'V a vg.' appears malformed; it should be 'Avg.'.
  4. [References] Reference [33] lists page numbers inconsistently (the citation appears as both page 1 and with other page ranges); please check the reference formatting.
  5. [Section 4.2.1] The text acknowledges that for illegal activity, church, and parachute, ZIUM produced 'comparable results' rather than superior results, with differences of about two or three images per concept; this caveat should be reflected in the abstract's 'superior attack success rate' claim, which currently overstates the consistency of the advantage.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ZIUM's zero-shot generalization is an empirical transfer claim, and the initial-phase optimization is a standard attack objective, not a renamed prediction.

full rationale

The derivation chain is self-contained. Equations (1)-(4) import the standard diffusion-classifier objective from external prior work, and Equation (7) defines the initial-attack optimization of the image-captioning module and projection layer fθ' against a target attack image. The initial-phase ASR in Tables 1 and 2 evaluates the attack itself, i.e., whether the optimized condition successfully induces the unlearned model to generate the unlearned concept; this is the method's objective, not a generalization prediction, so it is not a fitted input renamed as a prediction. The actual predictive claim is the zero-shot phase in Section 3.2: the same fθ' is applied to unseen target attack images and new user-intent prompts without further optimization. That claim is not forced by construction; Equation (7) does not mathematically imply transfer to unseen images, and the reported zero-shot ASR is an empirical result that could have failed. The paper does describe the zero-shot phase as using 'unseen target attack images' (e.g., Fig. 4(d)-(f)), so there is no definitional identity between optimization inputs and zero-shot test inputs. The absence of an explicit held-out split, error bars, or failure-case analysis is a legitimate experimental-reporting concern, but it is not evidence of circularity under the required standard: no quoted equation or cited result reduces the zero-shot claim to its own fit. No load-bearing self-citations appear; the cited BLIP2, diffusion-classifier, and MU baselines are external and independently established. The central novelty, cross-image and cross-prompt transfer of a per-concept optimized alignment module, remains a genuinely testable claim rather than a tautology.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim depends on the fitted parameters of the image captioning module and projection layer, on the assumption that image-derived text embeddings can be concatenated with prompt embeddings inside the unlearned diffusion model, and on the assumption that the denoising objective is a faithful proxy for attack success. No new physical or architectural entities are introduced.

free parameters (3)
  • θ' (Q-former and projection layer weights) = Optimized per unlearned concept via Eq. 7
    These weights are fit by minimizing denoising error on target attack images; the initial-phase ASR on those images is a fit diagnostic rather than a prediction.
  • NudeNet confidence threshold = 0.45
    Hand-chosen threshold determines whether a generated image counts as a successful nudity attack.
  • Q16 prompt selection threshold = >50%
    Hand-chosen filter selects the violence and illegal-activity prompts used to build target images and evaluate ASR, potentially biasing results toward easy cases.
assumptions (5)
  • domain assumption Uniform prior p(c) over conditions in the diffusion classifier (Eq. 2)
    Used to simplify Bayes' rule; if priors are not uniform, the estimated optimal condition changes.
  • domain assumption Image-derived text embeddings from fθ' are compatible with the CLIP text encoder and can be concatenated with prompt embeddings
    The method assumes the unlearned diffusion model accepts a concatenation of the projected caption embedding and the user-intent prompt embedding as a conditioning signal.
  • domain assumption Minimizing Eq. 7 denoising error increases the probability that generated images contain the unlearned concept
    Attack success rate is assumed to track the diffusion-classifier objective; the paper does not measure this correlation independently.
  • domain assumption Vanilla Stable Diffusion target images are valid exemplars of each unlearned concept
    Target attack images are generated by the vanilla model and used as ground truth for what the attacker wants to reproduce.
  • domain assumption Transfer of fθ' from training images to unseen images of the same concept
    Zero-shot attacks rely on this generalization; no failure analysis is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Models." pith.science (2026). https://pith.science/paper/WEUGNNBH

@misc{pith2026250721985,
  author       = {Pith},
  title        = {Pith review of: ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WEUGNNBH}},
  note         = {Machine review of arXiv:2507.21985}
}
read the original abstract

Machine unlearning (MU) removes specific data points or concepts from deep learning models to enhance privacy and prevent sensitive content generation. Adversarial prompts can exploit unlearned models to generate content containing removed concepts, posing a significant security risk. However, existing adversarial attack methods still face challenges in generating content that aligns with an attacker's intent while incurring high computational costs to identify successful prompts. To address these challenges, we propose ZIUM, a Zero-shot Intent-aware adversarial attack on Unlearned Models, which enables the flexible customization of target attack images to reflect an attacker's intent. Additionally, ZIUM supports zero-shot adversarial attacks without requiring further optimization for previously attacked unlearned concepts. The evaluation across various MU scenarios demonstrated ZIUM's effectiveness in successfully customizing content based on user-intent prompts while achieving a superior attack success rate compared to existing methods. Moreover, its zero-shot adversarial attack significantly reduces the attack time for previously attacked unlearned concepts.

Figures

Figures reproduced from arXiv: 2507.21985 by the authors.

Figure 1
Figure 1. Examples of generated images by ZIUM: 1st adversarial [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An overview of the ZIUM’s initial attack phase and zero-shot attack phase. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Examples of generated images for ESD by ZIUM and existing adversarial attack methods under NSFW unlearned concept [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Examples of generated images by ZIUM: 1st attack utilizing various user-intent prompts and 2nd attack utilizing ZIUM’s zero [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Examples of generated images for ESD by ZIUM and existing adversarial attack methods under style unlearned concept scenario [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Examples of generated images for ESD by ZIUM and existing adversarial attack methods under object unlearned concept sce [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Examples of generated images for FMN by ZIUM and existing adversarial attack methods under NSFW unlearned concept [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Examples of generated images for FMN by ZIUM and existing adversarial attack methods under style unlearned concept scenario [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Examples of generated images for FMN by ZIUM and existing adversarial attack methods under object unlearned concept [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Examples of generated images for SLD by ZIUM and existing adversarial attack methods under NSFW unlearned concept [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: Examples of generated images by ZIUM: Each row shows nudity, church, and violence concepts, respectively, generated by [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: Examples of generated images by ZIUM: Each row shows nudity, church, and violence concepts, respectively, generated by [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

47 extracted references · 35 canonical work pages

  1. [1]

    Nudenet: Neural nets for nudity classification, detection and selective censoring

    P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring. 2019. 5

    work page 2019

  2. [2]

    Towards making systems for- get with machine unlearning

    Yinzhi Cao and Junfeng Yang. Towards making systems for- get with machine unlearning. In IEEE Symposium on Secu- rity and Privacy, pages 463–480. IEEE, 2015. 2

    work page 2015

  3. [3]

    Robust clas- sification via a single diffusion model

    Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang, Chengqi Duan, Hang Su, and Jun Zhu. Robust clas- sification via a single diffusion model. arXiv preprint arXiv:2305.15241, 2023. 4

    arXiv 2023

  4. [4]

    Internvl: Scaling up vision foundation mod- els and aligning for generic visual-linguistic tasks

    Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, et al. Internvl: Scaling up vision foundation mod- els and aligning for generic visual-linguistic tasks. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24185–24198, 2024. 4

    work page 2024

  5. [5]

    Prompting4debugging: Red- teaming text-to-image diffusion models by finding problem- atic prompts

    Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin- Yu Chen, and Wei-Chen Chiu. Prompting4debugging: Red- teaming text-to-image diffusion models by finding problem- atic prompts. arXiv preprint arXiv:2309.06135, 2023. 1, 3, 5

    arXiv 2023

  6. [6]

    DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimization

    Pucheng Dang, Xing Hu, Dong Li, Rui Zhang, Qi Guo, and Kaidi Xu. Diffzoo: A purely query-based black-box attack for red-teaming text-to-image generative model via zeroth order optimization. arXiv preprint arXiv:2408.11071, 2024. 3

    work page Pith review arXiv 2024

  7. [7]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE/CVF IEEE Conference on Computer Vision and Pattern Recognition , pages 248–

    work page

  8. [8]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representa- tions, 2021. 5, 6

    work page 2021

Show all 47 references
  1. [9]

    Vlrm: Vision-language models act as reward models for image captioning

    Maksim Dzabraev, Alexander Kunitsyn, and Andrei Ivani- uta. Vlrm: Vision-language models act as reward models for image captioning. arXiv preprint arXiv:2404.01911, 2024. 4

    2024 arXiv

  2. [10]

    Salun: Empowering machine unlearn- ing via gradient-based weight saliency in both image classi- fication and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Den- nis Wei, and Sijia Liu. Salun: Empowering machine unlearn- ing via gradient-based weight saliency in both image classi- fication and generation. arXiv preprint arXiv:2310.12508 ,

    arXiv

  3. [11]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 1, 2, 5

    2023

  4. [12]

    Rt-attack: Jailbreak- ing text-to-image models via random token

    Sensen Gao, Xiaojun Jia, Yihao Huang, Ranjie Duan, Jin- dong Gu, Yang Liu, and Qing Guo. Rt-attack: Jailbreak- ing text-to-image models via random token. arXiv preprint arXiv:2408.13896, 2024. 1, 3

    2024 arXiv

  5. [13]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 770–778, 2016. 6

    2016

  6. [14]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598, 2022. 2

    2022 arXiv

  7. [15]

    Model sparsity can simplify machine unlearning

    Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning. Advances in Neu- ral Information Processing Systems, 36:51584–51605, 2023. 2

    2023

  8. [16]

    Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model

    Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model. In European Conference on Computer Vision, pages 461–478. Springer, 2024. 5

    2024

  9. [17]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 1

    2023

  10. [18]

    Your diffusion model is secretly a zero-shot classifier

    Alexander C Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. Your diffusion model is secretly a zero-shot classifier. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pages 2206–2217,

  11. [19]

    Blip-diffusion: Pre- trained subject representation for controllable text-to-image generation and editing

    Dongxu Li, Junnan Li, and Steven Hoi. Blip-diffusion: Pre- trained subject representation for controllable text-to-image generation and editing. Advances in Neural Information Pro- cessing Systems, 36:30146–30166, 2023. 4

    2023

  12. [20]

    Machine unlearning for image-to-image generative models

    Guihong Li, Hsiang Hsu, Chun-Fu Chen, and Radu Mar- culescu. Machine unlearning for image-to-image generative models. arXiv preprint arXiv:2402.00351, 2024. 1

    2024 arXiv

  13. [21]

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In In- ternational Conference on Machine Learning, pages 19730– 19742. PMLR, 2023. 4, 5

    2023

  14. [22]

    Machine unlearning: Taxon- omy, metrics, applications, challenges, and prospects

    Na Li, Chunyi Zhou, Yansong Gao, Hui Chen, Zhi Zhang, Boyu Kuang, and Anmin Fu. Machine unlearning: Taxon- omy, metrics, applications, challenges, and prospects. IEEE Transactions on Neural Networks and Learning Systems ,

  15. [23]

    Riatig: Reliable and imperceptible adversarial text- to-image generation with natural prompts

    Han Liu, Yuhao Wu, Shixuan Zhai, Bo Yuan, and Ning Zhang. Riatig: Reliable and imperceptible adversarial text- to-image generation with natural prompts. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20585–20594, 2023. 1, 2

    2023

  16. [24]

    Threats, attacks, and defenses in machine unlearning: A survey

    Ziyao Liu, Huanyi Ye, Chen Chen, Yongsen Zheng, and Kwok-Yan Lam. Threats, attacks, and defenses in machine unlearning: A survey. IEEE Open Journal of the Computer Society, 2025. 1

    2025

  17. [25]

    Mace: Mass concept erasure in diffu- sion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffu- sion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6430– 6440, 2024. 1

    2024

  18. [26]

    Jailbreaking prompt attack: A controllable adversarial attack against diffusion models

    Jiachen Ma, Anda Cao, Zhiqing Xiao, Yijiang Li, Jie Zhang, Chao Ye, and Junbo Zhao. Jailbreaking prompt attack: A controllable adversarial attack against diffusion models. arXiv preprint arXiv:2404.02928, 2024. 1, 3, 5

    2024 arXiv

  19. [27]

    Coljailbreak: Collaborative generation and editing for jailbreaking text-to-image deep generation

    Yizhuo Ma, Shanmin Pang, Qi Guo, Tianyu Wei, and Qing Guo. Coljailbreak: Collaborative generation and editing for jailbreaking text-to-image deep generation. Advances in Neural Information Processing Systems , 37:60335–60358,

  20. [28]

    Hard to forget: Poisoning attacks on certified machine un- learning

    Neil G Marchant, Benjamin IP Rubinstein, and Scott Alfeld. Hard to forget: Poisoning attacks on certified machine un- learning. In Proceedings of the AAAI Conference on Artifi- cial Intelligence, pages 7691–7700, 2022. 3

    2022

  21. [29]

    Direct unlearning optimization for robust and safe text- to-image models

    Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text- to-image models. arXiv preprint arXiv:2407.21035 , 2024. 1

    2024 arXiv

  22. [30]

    Unified prompt attack against text-to-image generation models

    Duo Peng, Qiuhong Ke, Mark He Huang, Ping Hu, and Jun Liu. Unified prompt attack against text-to-image generation models. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025. 1

    2025

  23. [31]

    Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde

    Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure meth- ods for text-to-image generative models. In International Conference on Learning Representations, 2024. 1

    2024

  24. [32]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. In International Conference on Machine Learning...

    2021

  25. [33]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684–10695, 2022. 2, 4, 1

    2022

  26. [34]

    Large-scale classifica- tion of fine-art paintings: Learning the right metric on the right feature

    Babak Saleh and Ahmed Elgammal. Large-scale classifica- tion of fine-art paintings: Learning the right metric on the right feature. arXiv preprint arXiv:1505.00855, 2015. 6

    2015 arXiv

  27. [35]

    Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the ACM Conference on Fairness, Account- ability, and Transparency, pages 1350–1361, ...

    2022

  28. [36]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 2, 5, 1

    2023

  29. [37]

    Exploring the landscape of machine unlearning: A comprehensive survey and taxonomy.(2023)

    Thanveer Shaik, Xiaohui Tao, Haoran Xie, Lin Li, Xiaofeng Zhu, and Qing Li. Exploring the landscape of machine unlearning: A comprehensive survey and taxonomy.(2023). arXiv preprint arXiv:2305.06360, 2023. 1, 2

    2023 arXiv

  30. [38]

    Attacks and defenses for generative diffusion models: A comprehen- sive survey

    Vu Tuan Truong, Luan Ba Dang, and Long Bao Le. Attacks and defenses for generative diffusion models: A comprehen- sive survey. ACM Computing Surveys, 2024. 1

    2024

  31. [39]

    Ring-a-bell! how reliable are concept removal meth- ods for diffusion models? arXiv preprint arXiv:2310.10012,

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia- You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal meth- ods for diffusion models? arXiv preprint arXiv:2310.10012,

    arXiv

  32. [40]

    Review of large vision models and visual prompt engineering

    Jiaqi Wang, Zhengliang Liu, Lin Zhao, Zihao Wu, Chong Ma, Sigang Yu, Haixing Dai, Qiushi Yang, Yiheng Liu, Songyao Zhang, et al. Review of large vision models and visual prompt engineering. Meta-Radiology, 1(3):100047,

  33. [41]

    Machine unlearning: Solutions and challenges

    Jie Xu, Zihan Wu, Cong Wang, and Xiaohua Jia. Machine unlearning: Solutions and challenges. IEEE Transactions on Emerging Topics in Computational Intelligence, 2024. 1, 2

    2024

  34. [42]

    Prompt- driven contrastive learning for transferable adversarial at- tacks

    Hunmin Yang, Jongoh Jeong, and Kuk-Jin Yoon. Prompt- driven contrastive learning for transferable adversarial at- tacks. In European Conference on Computer Vision , pages 36–53. Springer, 2024. 8

    2024

  35. [43]

    Mma-diffusion: Multimodal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024. 3

    2024

  36. [44]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In IEEE Symposium on Security and Privacy, pages 897–912. IEEE, 2024. 1

    2024

  37. [45]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1755–1764, 2024. 1, 2, 5

    2024

  38. [46]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models.Advances in neu- ral information processing systems, 37:36748–36776, 2024

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models.Advances in neu- ral information processing systems, 37:36748–36776,...

    2024

  39. [47]

    Holding a sword,

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Con- ference on Computer Vision, pages 385–4...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.