Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

LoReUn: Data Itself Implicitly Provides Cues to Improve Machine Unlearning

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a data point's loss on the original model encodes how hard it is to unlearn, and that reweighting the forgetting loss by an exponential decay in that loss closes much of the gap between approximate and exact…

desk verdict Fig. 2's loss–difficulty correlation is partly an artifact of counting 'already wrong' as success; the reweighting heuristic still shows modest gains and deserves a revision, not a desk reject. read the letter →

arxiv 2507.22499 v1 pith:W725KRUK submitted 2025-07-30 cs.LG cs.AI

Xiang Li , Qianli Shen , Haonan Wang , Kenji Kawaguchi This is my paper
classification cs.LGcs.AI
keywords machineunlearningdatareweightingloss-basedweightingexactgapdiffusionmodelsafetyNSFWconcepterasureimageclassificationrandomlabeling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the loss a model assigns to a data point carries information about how hard that point is to unlearn: points with large loss on the original model are usually forgotten successfully, while small-loss points tend to survive unlearning. Building on that empirical pattern, the authors propose LoReUn, a plug-in reweighting scheme that gives more weight to small-loss, hard-to-forget samples during gradient-based unlearning, using $w = \exp(-\ell_{\mathrm{eval}}/\tau)$ normalized within each batch. They report that LoReUn reduces the gap between approximate unlearning and exact retraining on image classification and generation, and that it cuts the number of harmful NSFW images produced by Stable Diffusion under I2P prompts. A careful reader would care because it suggests a cheap, universal way to improve approximate unlearning without extra inference cost.

What carries the argument

The machinery is an exponential decay weight function $w(\theta;x,y) = \exp(-\ell_{\mathrm{eval}}(\theta;x,y)/\tau)$, normalized to sum to one within each forgetting batch, multiplied into the forgetting loss term. LoReUn-s evaluates $\ell_{\mathrm{eval}}$ on the original model; LoReUn-d evaluates it on the current unlearned model. For diffusion models, the evaluation loss is averaged over timesteps, and to keep the dynamic estimate cheap and low-variance, timesteps are importance-sampled according to the original model's loss scale. The weight function's job is to concentrate optimization on samples whose small loss marks them as well-memorized and therefore hard to forget.

What would settle it

Measure, on a held-out model and dataset, the correlation between original-model loss and whether a data point is forgotten after a fixed unlearning run; if hard-to-forget points do not concentrate at the low-loss end, or the correlation flips, then LoReUn's weight assignment should be inverted. A direct test is to run LoReUn with high-loss samples weighted more and show that the reported gains persist, which would disprove the claimed monotone relationship.

Watch

Extended reading notes

Core claim

The central discovery is an empirical regularity and an algorithm built on it. Across several unlearning methods, data points that are successfully forgotten have, on average, higher loss on the original model than data points that fail to be forgotten; the same pattern appears in class-wise forgetting for diffusion models, where low-loss classes are harder to erase. The paper's claim is that this loss signal can be used directly: reweighting the forgetting loss so that low-loss, hard samples receive more gradient makes approximate unlearning behave more like exact retraining, improving both forgetting and retaining metrics. The authors argue the signal is implicit in the loss already being computed, so the reweighting adds minimal overhead.

Load-bearing premise

The whole method rests on an empirical correlation: data with smaller loss on the original model are harder to forget, and data with larger loss are easier to forget; if that ordering breaks down, the reweighting moves gradient to the wrong points.

Editorial extensions

If this is right

  • Plugging LoReUn into gradient-based unlearning methods such as RL, SalUn, GAR, and GAR-m moves their unlearning-accuracy, retaining-accuracy, testing-accuracy, and membership-inference gaps with Retrain toward zero, with only a few minutes of added runtime.
  • In class-wise forgetting, LoReUn reaches near-zero unlearning accuracy much earlier in training, so the same number of epochs yields faster and more stable forgetting than the base method alone.
  • In text-to-image models, LoReUn erases the nudity concept with fewer harmful images than ESD, FMN, and SalUn, while keeping FID close to or better than the baselines and preserving the prompt's subject.
  • LoReUn also improves gradient ascent unlearning without access to a retaining set, which means the reweighting idea is not tied to having retaining data available.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The monotone loss-difficulty link suggests a broader design principle: any cheap proxy for memorization, such as prediction confidence or influence estimates, could replace loss in the weight function; a testable extension is to compare $\exp(-\ell/\tau)$ weights against confidence-based or influence-based weights on the same benchmarks.
  • Because LoReUn-d tracks the evolving loss on the unlearned model, it resembles a curriculum that progressively focuses on lingering hard points; one could couple the temperature $\tau$ to a schedule or to per-sample uncertainty to reduce sensitivity to tuning, which the paper lists as a limitation.
  • The paper does not evaluate language or graph domains; transferring the weight function to LLM unlearning would require defining sequence-level loss and may fail if low loss there reflects short length rather than memorization, so that transfer is an open question rather than a consequence.
  • An inverse design, upweighting high-loss data to poison unlearning, is a possible attack surface the paper does not discuss: if loss is observable to an adversary, it tells them which points the unlearner will struggle with.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes LoReUn, a plug-and-play reweighting strategy for gradient-based machine unlearning. The central empirical premise, developed in Sec. 4, is that a data point's loss on the original model implicitly reflects how hard it is to unlearn: points with larger loss are easier to forget, and points with smaller loss are harder. Based on this, LoReUn assigns weight w = exp(-l_eval/tau), normalized per batch, to each forgetting-sample loss term, with static (original-model) and dynamic (unlearned-model) variants. The method is evaluated on CIFAR-10, SVHN, CIFAR-100, and Tiny ImageNet classification tasks, on class-wise forgetting for DDPM and Stable Diffusion, and on NSFW concept erasure from Stable Diffusion using I2P prompts and the NudeNet detector. The paper reports that LoReUn reduces the gap to exact retraining on accuracy-related metrics and improves the tug-of-war trade-off, while adding minimal runtime overhead.

Significance. If the loss-difficulty premise were established, LoReUn would be a valuable low-cost improvement: it is simple, model-agnostic, applicable to several gradient-based unlearning objectives, and the generation experiments address a practically important safety application (reducing NSFW outputs). The paper also evaluates against many baselines and includes additional datasets and ablations, which is a strength. However, the load-bearing evidence for the premise is currently confounded, and the reported improvements over strong baselines are often modest (e.g., random-forgetting Avg.G for GAR-m decreases from 1.32 to 0.99, and class-wise Avg.G from 0.31 to 0.28). Because the weighting rule is derived directly from the confounded correlation, the significance of the method is conditional on a corrected analysis. The paper does not provide machine-checked proofs or released code, but the experiments are described in sufficient detail to be largely reproducible.

major comments (4)
  1. [Sec. 4, Fig. 2] The operational definition of 'success to forget' as 'predictions become wrong after unlearning' confounds the reported loss-difficulty correlation. A point that the original model already misclassifies has high loss on the original model and is counted as successfully forgotten even if the unlearning update leaves its prediction unchanged; on CIFAR-10 these initially wrong points populate the high-loss tail, while low-loss points are mostly initially correct and must be flipped to be counted as successes. The observed gap between success and fail is therefore partly a restatement of 'already wrong vs. correct before unlearning' rather than evidence about intrinsic unlearning difficulty. In the random-forgetting setting this is especially problematic because Retrain has UA = 94.51 in Table 2, so an exact unlearned model is expected to keep most predictions on the forgetting set correct, and 'becoming wrong' cannot be the success criterion there.
  2. [Sec. 4, Fig. 3] The easy/hard forgetting-set comparison inherits the same confound. The sets are selected by loss on the original model, so the hard set consists of points the original model classifies correctly; for methods whose forgetting loss drives predictions away from the original label (RL, SalUn, GAR), such points are harder to flip by construction. This does not establish that loss is a proxy for intrinsic memorization or entanglement, as claimed. The authors should re-analyze with a Retrain-relative definition of forgetting, for example by measuring whether the unlearned model's prediction changes relative to the exact retrained model, or by measuring loss increase on the forgetting set relative to Retrain, and should report confidence intervals or significance tests for the Fig. 2 and Fig. 3 comparisons.
  3. [Sec. 5, Eq. (6)] The weight function w = exp(-l_eval/tau) upweights low-loss, initially correct points. Given the confound described above, the improved Avg.G and ToW in Table 2 may reflect a correctness-aware weighting that focuses gradient on points whose labels must be flipped, rather than a difficulty-aware weighting tied to the paper's premise. The authors should test the monotone loss-difficulty assumption directly, for example by correlating per-point original loss with per-point forgetting success measured against Retrain, and by ablating with alternative weight functions based on the original model's margin or prediction correctness to see whether the observed gains persist.
  4. [Sec. 6.2, Fig. A1 and Table 3] The transfer of the classification evidence to diffusion models is not currently supported. Fig. A1 reports class-level average loss versus unlearning accuracy for ten ImageNette classes without error bars or a significance test, and the NSFW concept-erasure setting does not have per-point labels whose predictions can be flipped in the classification sense. The paper should provide per-prompt loss-difficulty evidence in the generation setting, or explicitly soften the claim that the same mechanism drives the generation results and frame the generation gains as an empirical property of the weighting heuristic.
minor comments (6)
  1. [Sec. 6.2, text after Fig. 4] The sentence 'Our dynamic strategy (LoReUn-s) outperforms the static one (LoReUn-d)' reverses the variant names; LoReUn-s is the static variant and LoReUn-d is the dynamic variant.
  2. [Table 2] The grouping of the '+RL', '+SalUn', '+GAR', and '+GAR-m' rows under LoReUn-s and LoReUn-d is ambiguous; the row labels should explicitly repeat the variant name for each block so the reader can tell which results correspond to which variant.
  3. [Appendix B] The exponential fit that produces the estimated loss curve in Fig. A2b is reported only qualitatively; please report the fitted functional form, coefficients, number of seeds, fit error, and whether the same fitted curve is used for both LoReUn-s weights and the reference loss in Eq. (10).
  4. [Sec. 4, Fig. 2] The loss distributions for success and fail groups do not include error bars or significance tests; please add standard errors across the random seeds and a paired test of the success-vs-fail loss difference.
  5. [Algorithm 1 and Sec. 5] The notation in Algorithm 1 line 1, computing reference losses l(theta_o; D_f), is inconsistent with the per-point definition of l_eval(theta; x, y); please use per-point notation and specify how the reference losses are aggregated.
  6. [Conclusion and Limitations] The sentence 'AsLoReUn requires careful tuning' appears to contain a missing space; additionally, the temperature sensitivity shown in Appendix C.3 (ToW declines sharply at small tau for RL-based models) is important enough to be stated in the main text, not only in the limitations paragraph.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found; LoReUn is a heuristic reweighting strategy evaluated against external benchmarks, with no derivation reducing to its own inputs.

full rationale

The paper's load-bearing claim is an empirical observation: loss values on the original model correlate with unlearning difficulty (Sec. 4, Fig. 2), and this motivates the reweighting w = exp(-l_eval/tau) in Eq. 6. This is not presented as a derivation, and no quantity in the paper is defined in terms of the claimed result. The reweighted objective in Eq. 7 uses l_eval computed from the original or current unlearned model, but the success metrics are external: UA, RA, TA, MIA, ToW in classification, and FID, external classifiers, and NudeNet counts in generation, all compared against Retrain or independent baselines. No parameter is fitted to the evaluation outcome; the temperature tau is a tuned hyperparameter and the weights are normalized per batch. The paper does not claim to derive the weight formula from first principles, and no 'prediction' is a renamed fitted input. There are also no load-bearing self-citations: references to prior difficulty analyses [1, 8, 59] are external works, not by the present authors. A possible threat to validity is that 'success' in Fig. 2 is defined as predictions becoming wrong after unlearning, so already-misclassified high-loss points may be counted as forgotten without any change; however, that is a confound in the empirical premise rather than a case where the conclusion is equivalent to the premise by construction. Since the hard rule requires exhibiting a specific reduction and none exists, the appropriate finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

LoReUn introduces no new physical or architectural entities. Its central dependence is on the empirical loss-difficulty relationship and on two hyperparameters (tau and the loss-curve fit) that are tuned by the authors, so the honest contribution is the observation plus the heuristic, not a parameter-free derivation.

free parameters (2)
  • temperature tau = tuned per baseline; e.g., tau=10 for GAR-based models (Appendix C.3)
    Controls sensitivity of the exponential weight function in Eq 6; the paper shows ToW varies sharply with tau, especially for RL-based baselines, so the central results depend on this hand-chosen hyperparameter.
  • exponential fit coefficients for diffusion loss curve = estimated from 50 sampled data points and 10 sampled time steps (Fig A2b)
    The evaluation loss over time steps in diffusion models is estimated by fitting an exponential curve to a small sample; this fit is used to set weights for all forgetting data, and the approximation error is not quantified.
assumptions (3)
  • domain assumption Data points with smaller loss on the original model are harder to unlearn than those with larger loss.
    This empirical correlation (Sec 4, Fig 2) is the motivation for the weight function; it is presented as a universal property for the considered models and tasks, without theoretical proof.
  • ad hoc to paper The exponential decay weight function w = exp(-l/tau) is an appropriate mapping from loss to difficulty.
    Eq 6 is chosen without derivation; the paper shows sensitivity to tau, indicating the functional form is not uniquely justified.
  • domain assumption Batch-wise normalization of weights approximates full-set normalization.
    Eq 7 normalizes within a sampled batch; the paper reports that batch size affects results (Appendix C.3), so this approximation is load-bearing for the reported efficiency.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LoReUn: Data Itself Implicitly Provides Cues to Improve Machine Unlearning." pith.science (2026). https://pith.science/paper/W725KRUK

@misc{pith2026250722499,
  author       = {Pith},
  title        = {Pith review of: LoReUn: Data Itself Implicitly Provides Cues to Improve Machine Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W725KRUK}},
  note         = {Machine review of arXiv:2507.22499}
}
read the original abstract

Recent generative models face significant risks of producing harmful content, which has underscored the importance of machine unlearning (MU) as a critical technique for eliminating the influence of undesired data. However, existing MU methods typically assign the same weight to all data to be forgotten, which makes it difficult to effectively forget certain data that is harder to unlearn than others. In this paper, we empirically demonstrate that the loss of data itself can implicitly reflect its varying difficulty. Building on this insight, we introduce Loss-based Reweighting Unlearning (LoReUn), a simple yet effective plug-and-play strategy that dynamically reweights data during the unlearning process with minimal additional computational overhead. Our approach significantly reduces the gap between existing MU methods and exact unlearning in both image classification and generation tasks, effectively enhancing the prevention of harmful content generation in text-to-image diffusion models.

Figures

Figures reproduced from arXiv: 2507.22499 by the authors.

Figure 1
Figure 1. Given a forgetting set (data to be unlearned) and a retaining set (remaining training data), [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Loss of data in the forgetting set evaluated on the original model [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The performance on sets with different difficulty levels of the CIFAR10 dataset. The data with larger loss values on the original model are selected in the easy forgetting set, while those with smaller loss values form the hard forgetting set. The unlearned models show a worse performance on the hard forgetting set. In [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Performance visualization of the classification task. Performance in image classification As shown in Tab. 2, we present the results for random data unlearning and class-wise unlearning scenarios on the CIFAR-10 dataset. The results underline that our proposed LoReUn a…
Figure 5
Figure 5. Figure 5: Unlearning accuracy over unlearning epoch in the class-wise forgetting scenario. In (a) [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Examples of generated images using different models with the same prompt (denoted by Pi) [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Performance of removing the ‘nudity’ concept measured by the number of generated harmful images with I2P prompts for each nudity category. LoReUn outperforms all three baseline unlearned models. Performance in NSFW removal For concept￾wise forgetting, we evaluate our p…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Multimodal Unlearning Across Vision, Language, Video, and Audio: Survey of Methods, Datasets, and Benchmarks

    cs.LG 2026-07 conditional novelty 5.0 of 10

    A system-first taxonomy and literature synthesis of multimodal unlearning across vision, language, video, and audio, with datasets, benchmarks, metrics, applications, and open challenges.

Reference graph

Works this paper leans on

59 extracted references · 40 canonical work pages · cited by 1 Pith paper

  1. [1]

    Barbulescu and P

    G.-O. Barbulescu and P. Triantafillou. To each (textual sequence) its own: Improving memorized-data unlearning in large language models.arXiv preprint arXiv:2405.03097, 2024

    arXiv 2024

  2. [2]

    Bedapudi

    P. Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019

    work page 2019

  3. [3]

    Bourtoule, V

    L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot. Machine unlearning. In2021 IEEE Symposium on Security and Privacy (SP), pages 141–159. IEEE, 2021

    work page 2021

  4. [4]

    Carlini, S

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer. Membership inference attacks from first principles. In2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE Computer Society, 2022

    work page 1914

  5. [5]

    Carlini, J

    N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V . Sehwag, F. Tramer, B. Balle, D. Ippolito, and E. Wallace. Extracting training data from diffusion models. In32nd USENIX Security Symposium (USENIX Security 23), pages 5253–5270, 2023

    work page 2023

  6. [6]

    M. Chen, W. Gao, G. Liu, K. Peng, and C. Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7766–7775, 2023

    work page 2023

  7. [7]

    C. Fan, J. Liu, Y . Zhang, E. Wong, D. Wei, and S. Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. InThe Twelfth International Conference on Learning Representations, 2023

    work page 2023

  8. [8]

    C. Fan, J. Liu, A. Hero, and S. Liu. Challenging forgets: Unveiling the worst-case forget sets in machine unlearning.arXiv preprint arXiv:2403.07362, 2024

    arXiv 2024

Show all 59 references
  1. [9]

    S. Fan, M. Pagliardini, and M. Jaggi. DOGE: Domain reweighting with generalization estimation. In R. Salakhutdinov, Z. Kolter, K. Heller, A. Weller, N. Oliver, J. Scarlett, and F. Berkenkamp, editors, Proceedings of the 41st International Conference on Machine Learning, volume...

    2024

  2. [10]

    T. Fang, N. Lu, G. Niu, and M. Sugiyama. Rethinking importance weighting for deep learning under distribution shift.Advances in neural information processing systems, 33:11996–12007, 2020

    2020

  3. [11]

    Gandikota, J

    R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2426–2436, 2023

    2023

  4. [12]

    Gandikota, H

    R. Gandikota, H. Orgad, Y . Belinkov, J. Materzy´nska, and D. Bau. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 5111–5120, 2024

    2024

  5. [13]

    Ginart, M

    A. Ginart, M. Guan, G. Valiant, and J. Y . Zou. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019

    2019

  6. [14]

    Golatkar, A

    A. Golatkar, A. Achille, and S. Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304–9312, 2020

    2020

  7. [15]

    Graves, V

    L. Graves, V . Nagisetty, and V . Ganesh. Amnesiac machine learning. InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 11516–11524, 2021

    2021

  8. [16]

    C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten. Certified data removal from machine learning models.arXiv preprint arXiv:1911.03030, 2019

    1911 arXiv

  9. [17]

    K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  10. [18]

    Heng and H

    A. Heng and H. Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models.Advances in Neural Information Processing Systems, 36, 2024

    2024

  11. [19]

    J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  12. [20]

    Howard and S

    J. Howard and S. Gugger. Fastai: a layered api for deep learning.Information, 11(2):108, 2020. 10

    2020

  13. [21]

    Z. Izzo, M. A. Smart, K. Chaudhuri, and J. Zou. Approximate data deletion from machine learning models. InInternational Conference on Artificial Intelligence and Statistics, pages 2008–2016. PMLR, 2021

    2008

  14. [22]

    A. H. Jiang, D. L.-K. Wong, G. Zhou, D. G. Andersen, J. Dean, G. R. Ganger, G. Joshi, M. Kaminksy, M. Kozuch, Z. C. Lipton, et al. Accelerating deep learning by focusing on the biggest losers.arXiv preprint arXiv:1910.00762, 2019

    1910 arXiv

  15. [23]

    Jiang and C

    J. Jiang and C. Zhai. Instance weighting for domain adaptation in nlp. InProceedings of the 45th Annual Meeting of the Association of Computational Linguistics, pages 264–271, 2007

    2007

  16. [24]

    Katharopoulos and F

    A. Katharopoulos and F. Fleuret. Not all samples are created equal: Deep learning with importance sampling. InInternational conference on machine learning, pages 2525–2534. PMLR, 2018

    2018

  17. [25]

    P. W. Koh and P. Liang. Understanding black-box predictions via influence functions. InInternational conference on machine learning, pages 1885–1894. PMLR, 2017

    2017

  18. [26]

    Krizhevsky, G

    A. Krizhevsky, G. Hinton, et al. Learning multiple layers of features from tiny images, 2009

    2009

  19. [27]

    Kumari, B

    N. Kumari, B. Zhang, S.-Y . Wang, E. Shechtman, R. Zhang, and J.-Y . Zhu. Ablating concepts in text-to- image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691–22702, 2023

    2023

  20. [28]

    Le and X

    Y . Le and X. Yang. Tiny imagenet visual recognition challenge.CS 231N, 7(7):3, 2015

    2015

  21. [29]

    Liang and X

    C. Liang and X. Wu. Mist: Towards improved adversarial examples for diffusion models.arXiv preprint arXiv:2305.12683, 2023

    2023 arXiv

  22. [30]

    Liang, X

    C. Liang, X. Wu, Y . Hua, J. Zhang, Y . Xue, T. Song, Z. Xue, R. Ma, and H. Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett, editors...

    2023

  23. [31]

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick. Microsoft coco: Common objects in context. InComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, pages 740–755. ...

    2014

  24. [32]

    T.-Y . Lin, P. Goyal, R. Girshick, K. He, and P. Dollár. Focal loss for dense object detection. InProceedings of the IEEE international conference on computer vision, pages 2980–2988, 2017

    2017

  25. [33]

    Z. Lin, Z. Gou, Y . Gong, X. Liu, yelong shen, R. Xu, C. Lin, Y . Yang, J. Jiao, N. Duan, and W. Chen. Not all tokens are what you need for pretraining. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URLhttps://openreview.net/forum?id=0NMzBwqaAJ

    2024

  26. [34]

    F. Liu, B. Han, T. Liu, C. Gong, G. Niu, M. Zhou, M. Sugiyama, et al. Probabilistic margins for instance reweighting in adversarial training.Advances in Neural Information Processing Systems, 34:23258–23269, 2021

    2021

  27. [35]

    J. Liu, P. Ram, Y . Yao, G. Liu, Y . Liu, P. SHARMA, S. Liu, et al. Model sparsity can simplify machine unlearning.Advances in Neural Information Processing Systems, 36, 2024

    2024

  28. [36]

    Loshchilov and F

    I. Loshchilov and F. Hutter. Online batch selection for faster training of neural networks.arXiv preprint arXiv:1511.06343, 2015

    2015 arXiv

  29. [37]

    S. Neel, A. Roth, and S. Sharifi-Malvajerdi. Descent-to-delete: Gradient-based methods for machine unlearning. InAlgorithmic Learning Theory, pages 931–962. PMLR, 2021

    2021

  30. [38]

    Netzer, T

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, A. Y . Ng, et al. Reading digits in natural images with unsupervised feature learning, 2011

    2011

  31. [39]

    Rando, D

    J. Rando, D. Paleka, D. Lindner, L. Heim, and F. Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022

    2022 arXiv

  32. [40]

    M. Ren, W. Zeng, B. Yang, and R. Urtasun. Learning to reweight examples for robust deep learning. In J. Dy and A. Krause, editors,Proceedings of the 35th International Conference on Machine Learning, volume 80 ofProceedings of Machine Learning Research, pages 4334–4343. PMLR, ...

    2018

  33. [41]

    Rombach, A

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  34. [42]

    Salman, A

    H. Salman, A. Khaddaj, G. Leclerc, A. Ilyas, and A. Madry. Raising the cost of malicious ai-powered image editing. In A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett, editors, International Conference on Machine Learning, ICML 2023, 23-29 July 2023, ...

    2023

  35. [43]

    Schramowski, M

    P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023

    2023

  36. [44]

    Schuhmann, R

    C. Schuhmann, R. Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in Neural Information Processing Systems, 35:25278–25294, 2022

    2022

  37. [45]

    Sekhari, J

    A. Sekhari, J. Acharya, G. Kamath, and A. T. Suresh. Remember what you want to forget: Algorithms for machine unlearning.Advances in Neural Information Processing Systems, 34:18075–18086, 2021

    2021

  38. [46]

    S. Shan, J. Cryan, E. Wenger, H. Zheng, R. Hanocka, and B. Y . Zhao. Glaze: Protecting artists from style mimicry by {Text-to-Image} models. In32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023

    2023

  39. [47]

    Somepalli, V

    G. Somepalli, V . Singla, M. Goldblum, J. Geiping, and T. Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, page...

    2023

  40. [48]

    D. Sow, H. Woisetschläger, S. Bulusu, S. Wang, H. A. Jacobsen, and Y . Liang. Dynamic loss-based sample reweighting for improved large language model pretraining. InThe Thirteenth International Conference on Learning Representations, 2025. URLhttps://openreview.net/forum?id=gU4ZgQNsOC

    2025

  41. [49]

    Thudi, G

    A. Thudi, G. Deza, V . Chandrasekaran, and N. Papernot. Unrolling sgd: Understanding factors influencing machine unlearning. In2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 303–319. IEEE, 2022

    2022

  42. [50]

    Ullah, T

    E. Ullah, T. Mai, A. Rao, R. A. Rossi, and R. Arora. Machine unlearning via algorithmic stability. In Conference on Learning Theory, pages 4126–4142. PMLR, 2021

    2021

  43. [51]

    N. Vyas, S. M. Kakade, and B. Barak. On provable copyright protection for generative models. In International Conference on Machine Learning, pages 35277–35299. PMLR, 2023

    2023

  44. [52]

    Warnecke, L

    A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck. Machine unlearning of features and labels.arXiv preprint arXiv:2108.11577, 2021

    2021 arXiv

  45. [53]

    S. M. Xie, H. Pham, X. Dong, N. Du, H. Liu, Y . Lu, P. S. Liang, Q. V . Le, T. Ma, and A. W. Yu. Doremi: Optimizing data mixtures speeds up language model pretraining.Advances in Neural Information Processing Systems, 36:69798–69818, 2023

    2023

  46. [54]

    M. Yi, L. Hou, L. Shang, X. Jiang, Q. Liu, and Z.-M. Ma. Reweighting augmented samples by minimizing the maximal expected loss. InInternational Conference on Learning Representations, 2021. URL https://openreview.net/forum?id=9G5MIc-goqB

    2021

  47. [55]

    H. Zeng, C. Zhu, T. Goldstein, and F. Huang. Are adversarial examples created equal? a learnable weighted minimax risk for robustness under non-uniform attacks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 10815–10823, 2021

    2021

  48. [56]

    Zhang, K

    E. Zhang, K. Wang, X. Xu, Z. Wang, and H. Shi. Forget-me-not: Learning to forget in text-to-image diffusion models.arXiv preprint arXiv:2303.17591, 2023

    2023 arXiv

  49. [57]

    Zhang, J

    J. Zhang, J. Zhu, G. Niu, B. Han, M. Sugiyama, and M. Kankanhalli. Geometry-aware instance-reweighted adversarial training. InInternational Conference on Learning Representations, 2021. URL https: //openreview.net/forum?id=iAX0l6Cz8ub

    2021

  50. [58]

    Zhang, J

    Y . Zhang, J. Jia, X. Chen, A. Chen, Y . Zhang, J. Liu, K. Ding, and S. Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision, pages 385–403, 2024

    2024

  51. [59]

    tug-of-war

    K. Zhao, M. Kurmanji, G.-O. B˘arbulescu, E. Triantafillou, and P. Triantafillou. What makes unlearning hard and what to do about it.arXiv preprint arXiv:2406.01257, 2024. 12 Appendix A Loss Observation in Image Generation In Fig. A1, we illustrate the original loss observed on...

    2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.