Pith. sign in

REVIEW 4 major objections 5 minor 41 references

Adversarial concept erasure in diffusion models becomes far more robust when attack prompts are seeded with language-model-generated keywords for the target concept and optimized with a text-encoder distance term.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

S-GRACE generates semantically guided adversarial prompts and fine-tunes only the text encoder, reporting stronger concept-erasure robustness and ~90% lower training time than prior adversarial erasure methods.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection A plausible, well-engineered adversarial concept erasure method with a useful semantic-guidance idea; the headline gains are probably real, but the paper's central 'concept-space fitting' evidence is weaker than it looks. the 4 major comments →

arxiv 2510.27285 v4 pith:DPRYEKER submitted 2025-10-31 cs.CV cs.CR

Rethinking Robust Adversarial Concept Erasure in Diffusion Models

Qinghong Yin , Yu Tian , Heming Yang , Xiang Chen , Xianlin Zhang , Yue Ming , Xueming Li , Yue Zhang This is my paper
classification cs.CV cs.CR
keywords concept erasurediffusion modelsadversarial trainingsemantic guidancetext-to-imagemachine unlearningconcept spacerobustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that existing adversarial concept erasure methods fail because their adversarial samples—random perturbations around the target prompt—do not cover the target concept's full semantic space, leaving recoverable remnants. It proposes S-GRACE, which seeds attack prompts from LLM-generated keyword variants of the target concept, optimizes perturbations using both diffusion reconstruction loss and a text-encoder distance to the target, then fine-tunes only the text encoder with losses that preserve target-space integrity and non-target consistency. Reported results show erasure robustness improves by at least 26% across NSFW, artistic style, and object concepts, while training time drops by about 90% relative to prior adversarial erasure methods. A sympathetic reader would care because robust concept erasure is a practical safety mechanism for text-to-image models, and the paper's central bet is that semantic coverage, not sample count, is what makes adversarial erasure work.

Core claim

S-GRACE's core claim is that adversarial samples optimized with semantic guidance fit the target concept space far better than randomly perturbed samples, and this fit directly determines erasure success. The method builds a set of N related keywords for the target concept using a language model, forms adversarial embeddings by concatenating sampled keywords and adding perturbations, optimizes those embeddings against a joint objective of noise-prediction error and text-encoder distance from the target prompt, and then fine-tunes only the text encoder with three losses: keep erased samples semantically close to their pre-erasure selves, push them away from the target concept, and keep unrela

What carries the argument

Semantics-guided adversarial optimization: the perturbation objective L1 + L2, where L1 is the diffusion noise-prediction error and L2 is the squared distance between the current and frozen text-encoder embeddings of the adversarial embedding and the target prompt, plus the semantics-guided training objective in Eq. 4 that maps the target concept toward a surrogate in the text-encoder subspace. The LLM-generated keyword set W is the seed distribution that makes a single batch of 32 adversarial samples cover the concept space.

Load-bearing premise

The method assumes that roughly 50 AI-generated keywords, averaged through the text encoder, fully and unbiasedly capture any target concept; if those keywords miss major facets of a broad concept, the measured 'fit' and the attack coverage are both biased and the central mechanism loses support.

What would settle it

Take a broad concept such as violence, build the keyword set from only one narrow facet (e.g., 'punch'), run S-GRACE, and measure attack success on held-out prompts about guns, riots, and war. If ASR stays low despite the missing facets, the semantic-coverage mechanism is not the driver; if ASR rises sharply, the paper's fit-based explanation is confirmed.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If adversarial samples fit the concept space, erasure can be made robust with very few samples; S-GRACE uses 32 samples versus hundreds or thousands.
  • Training only the text encoder means the erased text encoder transfers to other UNet models; the paper reports transfer to SD v1.5, DreamShaper, and Protogen with maintained erasure.
  • Robustness generalizes across NSFW, artistic styles, and object concepts under P4D, Ring-A-Bell, and UnlearnDiff attacks.
  • Semantic initialization explains why sample count matters less than semantic coverage; the ablation shows increasing sample count beyond a threshold hurts utility.
  • The 90% training-time reduction arises because semantic guidance avoids expensive adversarial search.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If LLM keyword coverage is the real driver, then erasure quality for broad concepts like violence likely depends on the LLM's completeness; an incomplete keyword set would degrade S-GRACE toward baselines, giving a testable scaling law.
  • The same semantic-coverage principle may apply to other unlearning domains: target-class space coverage by natural-language paraphrases could replace random adversarial sampling for classifier or LLM unlearning.
  • The transfer result implies a decoupling: text-encoder erasure may be model-agnostic, so a single erased text encoder could serve multiple diffusion backbones—worth testing against attacks that target cross-attention layers specifically.
  • Since S-GRACE uses LLM-generated keywords and LLM-generated GT prompts, the 'fitting degree' metric is partly circular; an independent human-authored concept prompt set would cleanly separate the semantic-coverage effect from the LLM's prior.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes S-GRACE, a semantics-guided adversarial concept erasure method for text-to-image diffusion models. It argues that existing adversarial concept erasure methods generate adversarial samples that poorly fit the target concept space, and introduces (i) LLM-generated keyword initialization for adversarial samples, (ii) an additional text-encoder distance term in the adversarial attack objective, and (iii) a multi-term training objective on the text encoder that simultaneously erases the target concept and preserves unrelated concepts. Experiments across NSFW attributes, artistic styles, and object-related concepts report improved ASR robustness under P4D, Ring-A-Bell, and UnlearnDiff attacks, maintained generation utility, and a 90% reduction in training time compared to prior adversarial erasure methods.

Significance. If the reported results are reproducible, S-GRACE is a practically valuable contribution to robust concept erasure: it reports large ASR improvements over seven baselines across nine concepts and three attacks, requires only text-encoder fine-tuning, and reduces training time from 40–1170 minutes to 4 minutes for the nudity case. The paper includes a broad comparison, an ablation study, a transferability study, and a public code link. The main weakness is evidential: the central mechanistic claim—that S-GRACE's adversarial samples better fit the target concept space—rests on a centroid-distance metric that is constructed from the same LLM prior that S-GRACE explicitly optimizes against, and all headline comparisons are single-run point estimates without error bars or statistical support. The usefulness of the method is plausible, but the paper's conceptual contribution is not yet established.

major comments (4)
  1. [§2.2, Appendix B.1, Eq. (3)] The pilot CD metric is circular with respect to S-GRACE's design. The 'ground-truth' concept space is constructed from 200 GPT-4-generated prompts, while S-GRACE's adversarial initialization set W is also GPT-4-generated using a near-identical prompt ('Please give me N keywords describing target concept...'). Moreover, Eq. (3) explicitly minimizes ||Tθ(c')−T(p)||²₂, i.e., the distance from the adversarial embedding to the LLM-informed target prompt embedding. Thus S-GRACE is the only method optimized to be close to the same LLM-based proxy that defines the 'GT' centroid, so lower CD in Tables 1 and 6–13 does not establish better true concept-space fitting. This is load-bearing because the Motivation claims that fitting degree is positively correlated with erasure effect. Please either define CD formally, construct the GT space from an independent source (e.g., human annotations or image-
  2. [§4.2, Tables 2–4] All reported ASR, FID, and CLIP numbers are single-run point estimates with no seeds, error bars, or confidence intervals. The central claim of 'significantly improves erasure performance (≥26%)' rests on differences that may be within sampling noise; for example, ASR on 50-prompt sets is quantized in steps of 2 percentage points, and several comparisons in Tables 3–4 differ by only 1–2 points. Please report means and standard deviations over at least three seeds, and state the exact prompt sets and detector thresholds used. Without this, 'consistently superior' cannot be assessed.
  3. [Table 14, §4.1] The loss weights α and β in Eq. (4) are tuned separately for every concept (e.g., 5/6 for Nudity, 10/11 for Violence, 2/3 for Garbage Truck), but the paper gives no selection protocol, validation split, or sensitivity analysis. If these hyperparameters were selected using the same attack sets on which the method is evaluated, the robustness comparisons are optimistic. Please describe how α and β were chosen and report how sensitive the results are to their values; ideally also evaluate a fixed setting across all concepts.
  4. [Tables 2–4] The abstract states that comparisons are made with seven SOTA methods, but only the Nudity row includes all seven baselines. For Violence, Illegal Activity, Picasso, and others, only 2–4 baselines are reported (e.g., Illegal Activity has only ESD, R.A.C.E., and Ours; Picasso has only ESD, R.A.C.E., and Ours). This limits the cross-concept generalization claim. Please either reproduce the missing baselines for the remaining concepts or clearly explain why they are omitted.
minor comments (5)
  1. [§2.2] The CD metric is never formally defined. Please state explicitly whether it is the Euclidean distance between the mean adversarial embedding and the mean GT embedding, and over which text-encoder representation it is computed.
  2. [Table 5] The ablation labels L_sim and L_anc are not defined in the text; they presumably correspond to L2 and L3 in Eq. (4). The column heading N_c′ is also unexplained.
  3. [Algorithm 1] The lines 'c′ ← −c′' and 'θ ← −θ' are confusing and appear to denote alternating optimization rather than negating parameters. Please clarify the intended update notation.
  4. [General] There are numerous typos, including 'Roubust' in Section 3, 'concepet' in Section 4.2, 'cocnept' in Appendix B.1, and 'leaning rate' in Section 4.1. Please copyedit the manuscript.
  5. [Appendix B.1] The sentence 'We set N=50, M=50 for NSFW erasure and object-related erasure, and N=10, M=50 for artist styles erasure' appears twice after the two prompt templates; remove the duplicate.

Circularity Check

1 steps flagged

Pilot CD evidence is partially circular: S-GRACE's adversarial samples are initialized from LLM-generated concept keywords and optimized by a text-encoder distance term in the same embedding space used to compute centroid distance to the 'ground-truth' concept space, so the claimed concept-space-fitting advantage is partly built into the evaluation.

specific steps
  1. self definitional [Section 2.2 (Data and Metrics; Experimental Details; Table 1), Section 3.1 (Eq. 3), Appendix B.1]
    "we construct a ground-truth concept space (GT) by generating 200 relevant prompts that can create the target images... we generate adversarial samples using these methods and input them into SD v1.4 to obtain both the concept representations (the mean pooling of the final hidden state)... we generate a set of N relevant concept prompts W={w_i}_{i∈[N]} through large language model (LLM) [21] based on the target prompt p... ∥T_θ(c′)−T(p)∥_2^2 ... The second term encourages adversarial samples to approximate the target concept in the concept space."

    The pilot's CD metric measures distance in the text-encoder concept space between S-GRACE's adversarial samples and a GT set of target-relevant prompts. S-GRACE's own construction is the same kind of object: W is an LLM-generated set of target-relevant prompts, and Eq. (3) explicitly minimizes the text-encoder distance between the adversarial embedding and the target prompt embedding in that same space. Thus the low CD of S-GRACE in Table 1 largely reflects that the evaluation metric coincides with the optimization objective and the initialization prior, not that the samples independently cover a broader or more faithful concept space. The paper then relies on this CD to conclude that erasure effectiveness is positively correlated with concept-space fitting, making the stated fitting mecha

full rationale

The main erasure results (Tables 2-4, 16) are measured against external adversarial prompt generators (P4D, Ring-A-Bell, UnlearnDiff) with external detectors, so those outcomes are independent and not circular. The circularity found is confined to the pilot study that motivates the method: the 'ground-truth' concept space and S-GRACE's adversarial initialization are both defined from target-relevant prompt sets, and the L2 term in Eq. (3) pushes adversarial embeddings toward the target prompt in the same text-encoder space in which CD is measured. Consequently, the pilot's CD comparison is not an independent confirmation of superior concept-space coverage; it is a partially in-construction measure. This does not by itself invalidate the ASR/FID/CLIP results, but it weakens the paper's explanatory claim that better concept-space fitting is what drives the observed gains. No load-bearing self-citation chain was identified.

Axiom & Free-Parameter Ledger

6 free parameters · 6 axioms · 0 invented entities

The method introduces no new physical or architectural entities; the target concept space is a distributional construct, not an independently evidenced entity. The main hidden load is the assumption that LLM-generated keyword sets define the target concept space, plus per-concept loss weights fitted to the evaluation metrics.

free parameters (6)
  • α (target-removal loss weight) = 5/6 to 10/11 per concept (Table 14)
    Hand-tuned per concept; directly controls the strength of the L2 erasure loss in Eq. (4).
  • β (unrelated-preservation loss weight) = 5/6 to 20/11 per concept (Table 14)
    Hand-tuned per concept; directly controls the L3 preservation loss in Eq. (4).
  • N relevant keywords = N=50 for NSFW/objects, N=10 for artist styles
    LLM keyword count for adversarial initialization; coverage of the target concept space depends on this choice.
  • M unrelated keywords = M=50
    LLM keyword count for the unrelated-concept preservation loss; not derived from any principle.
  • Number of adversarial samples = 32 (8 samples at each of 4 intervals)
    Chosen as a plateau point; the ablation shows 16 and 64 degrade either robustness or utility.
  • Fine-tune and attack training hyperparameters = text-encoder LR 1e-5, 200 steps; attack LR 5e-3, 10 steps
    Standard-seeming but tuned for the reported results; no sensitivity analysis.
axioms (6)
  • domain assumption Mean-pooled final hidden states of the frozen CLIP text encoder define a meaningful concept space; PCA/Euclidean distances in this space reflect semantic similarity.
    Used to build the GT concept space, the CD metric, and both semantic losses in Eq. (3) and Eq. (4); no external validation that these distances correspond to concept overlap.
  • ad hoc to paper LLM-generated keyword lists are sufficient and unbiased representations of target and unrelated concept spaces.
    Both the GT space (§2.2) and S-GRACE initialization (§3.1) use GPT-4 prompts; if the lists miss aspects of broad concepts such as violence or illegal activity, the pilot fitting conclusion and erasure coverage are compromised.
  • domain assumption Detector outputs (NudeNet, Q16, WikiArt ViT, ResNet-50) accurately measure whether the target concept was erased.
    All ASR numbers rely on these detectors; no probing for detector evasion or alternate concept surfaces.
  • domain assumption Stable Diffusion v1.4 results generalize to other diffusion models.
    Main experiments are on SDv1.4 only; the transfer study covers nudity with text-encoder transfer to SDv1.5/DreamShaper/Protogen, but not other concepts or attack types.
  • domain assumption The selected attacks (P4D, Ring-A-Bell, UnlearnDiff) with the specified hyperparameters are sufficient to estimate adversarial robustness.
    No adaptive attack targets the text-encoder-only erasure; robustness is defined relative to these three attack families.
  • domain assumption Marked baseline reproductions are faithful to the original methods.
    Several baseline numbers are self-reproduced with unexplained settings; comparisons could be biased by reproduction choices.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Rethinking Robust Adversarial Concept Erasure in Diffusion Models." pith.science (2026). https://pith.science/paper/DPRYEKER

@misc{pith2026251027285,
  author       = {Pith},
  title        = {Pith review of: Rethinking Robust Adversarial Concept Erasure in Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DPRYEKER}},
  note         = {Machine review of arXiv:2510.27285}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Concept erasure methods aim to remove specific unsafe target concepts in diffusion models while preserving image generation utility. To address the vulnerability that erased concepts can be easily recovered under adversarial attacks, adversarial concept erasure methods integrate adversarial optimization into the concept erasure process. However, existing adversarial concept erasure methods face a trade-off between robustness and computational cost. We attribute this to adversarial optimization techniques that use random samples to approximate the adversarial objective function. Adversarial optimization that uses a small number of samples fails to produce adversarial embeddings that accurately capture the target concept space. To mitigate this limitation, we propose Semantic-Guided Adversarial Optimization, which uses a single sample to produce adversarial embeddings that better capture the target concept space. We also propose Semantic-Guided Concept Erasure, which automatically maps the target concept to a semantically similar surrogate. Extensive experiments on not-safe-for-work content, artistic styles, and object-related concepts demonstrate that our method, S-GRACE (Semantic-Guided Robust Adversarial Concept Erasure) achieves state-of-the-art erasure robustness and superior image generation utility, with significantly lower computational cost than existing methods. Our code is available at https://github.com/Qhong-522/S-GRACE.

Figures

Figures reproduced from arXiv: 2510.27285 by Heming Yang, Qinghong Yin, Xiang Chen, Xianlin Zhang, Xueming Li, Yue Ming, Yue Zhang, Yu Tian.

Figure 1
Figure 1. Figure 1: Comparison of the performance between S-GRACE and several DM-based adversarial con￾cept erasure baselines in removing the nudity con￾cept under the SD v1.4. Inspired by these findings, we introduce S-GRACE (Semantics-Guided Roubust Adversarial Concept Erasure). It aims to leverage semantic guidance to generate adver￾sarial samples and perform adversarial erasure training, thereby better aligning with the t… view at source ↗
Figure 2
Figure 2. Figure 2: Visualization of target concept space fitting. S-GRACE generates adversarial samples [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Visualizations of generated images by various methods under the UnlearnDiff [ [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: S-GRACE disentanglement in concept erasure. It can effectively erase target concept [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Pilot experiments PCA visualization results for concepts "picasso", "church", "parachute", [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Extensive experiments visualization for concept "Nudity". [PITH_FULL_IMAGE:figures/full_fig_p014_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Extensive experiments visualization for concept "Van Gogh". [PITH_FULL_IMAGE:figures/full_fig_p014_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Extensive experiments visualization for concept "Church". [PITH_FULL_IMAGE:figures/full_fig_p015_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 10 linked inside Pith

  1. [1]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  2. [2]

    Hierarchical text-conditional image generation with clip latents.arXiv preprint arXiv:2204.06125, 1(2):3, 2022

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents.arXiv preprint arXiv:2204.06125, 1(2):3, 2022

    Pith/arXiv arXiv 2022

  3. [3]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    Pith/arXiv arXiv 2023

  4. [4]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023

    2023

  5. [5]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 2426–2436, 2023

    2023

  6. [6]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 5111–5120, 2024

    2024

  7. [7]

    Explaining and harnessing adversar- ial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples.arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  8. [8]

    Adversarial training for free!Advances in neural information processing systems, 32, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free!Advances in neural information processing systems, 32, 2019

    2019

  9. [9]

    Advfas: A robust face anti-spoofing framework against adversarial examples.Computer Vision and Image Understanding, 235:103779, 2023

    Jiawei Chen, Xiao Yang, Heng Yin, Mingzhi Ma, Bihui Chen, Jianteng Peng, Yandong Guo, Zhaoxia Yin, and Hang Su. Advfas: A robust face anti-spoofing framework against adversarial examples.Computer Vision and Image Understanding, 235:103779, 2023

    2023

  10. [10]

    Defensive unlearning with adversarial training for robust 15 concept erasure in diffusion models.Advances in Neural Information Processing Systems, 37:36748–36776, 2024

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust 15 concept erasure in diffusion models.Advances in Neural Information Processing Systems, 37:36748–36776, 2024

    2024

  11. [11]

    Concept pinpoint eraser for text-to-image diffusion models via residual attention gate

    Byung Hyun Lee, Sungjin Lim, Seunggyu Lee, Dong Un Kang, and Se Young Chun. Concept pinpoint eraser for text-to-image diffusion models via residual attention gate. InThe Thirteenth International Conference on Learning Representations, 2025

    2025

  12. [12]

    Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models.arXiv preprint arXiv:2408.16807, 2024

    Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer, Vishal M Patel, and Karthik Nandaku- mar. Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models.arXiv preprint arXiv:2408.16807, 2024

    Pith/arXiv arXiv 2024

  13. [13]

    Auto-encoding variational bayes, 2013

    Diederik P Kingma, Max Welling, et al. Auto-encoding variational bayes, 2013

    2013

  14. [14]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pages 8748–8763. PmLR, 2021

    2021

  15. [15]

    Race: Robust adversarial concept erasure for secure text-to-image diffusion model

    Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Robust adversarial concept erasure for secure text-to-image diffusion model. InEuropean Conference on Computer Vision, pages 461–478. Springer, 2024

    2024

  16. [16]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision, pages 385–403. Springer, 2024

    2024

  17. [17]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    2017

  18. [18]

    Clipscore: A reference-free evaluation metric for image captioning.arXiv preprint arXiv:2104.08718, 2021

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning.arXiv preprint arXiv:2104.08718, 2021

    Pith/arXiv arXiv 2021

  19. [19]

    Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers

    Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, Fu-En Yang, and Yu- Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. InEuropean Conference on Computer Vision, pages 360–376. Springer, 2024

    2024

  20. [20]

    Karl Pearson. Liii. on lines and planes of closest fit to systems of points in space.The London, Edinburgh, and Dublin philosophical magazine and journal of science, 2(11):559–572, 1901

    1901

  21. [21]

    Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    1901

  22. [22]

    Fantastic targets for concept erasure in diffusion models and where to find them

    Anh Bui, Trang Vu, Long Vuong, Trung Le, Paul Montague, Tamas Abraham, Junae Kim, and Dinh Phung. Fantastic targets for concept erasure in diffusion models and where to find them. arXiv preprint arXiv:2501.18950, 2025

    Pith/arXiv arXiv 2025

  23. [23]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. InComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, pages 740–755. Springer, 2014

    2014

  24. [24]

    Reliable and efficient concept erasure of text-to-image diffusion models

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. InEuropean Conference on Computer Vision, pages 73–88. Springer, 2024

    2024

  25. [25]

    Prompt- ing4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts

    Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin-Yu Chen, and Wei-Chen Chiu. Prompt- ing4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.06135, 2023. 16

    arXiv 2023

  26. [26]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?arXiv preprint arXiv:2310.10012, 2023

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models?arXiv preprint arXiv:2310.10012, 2023

    Pith/arXiv arXiv 2023

  27. [27]

    Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980, 2014

    Pith/arXiv arXiv 2014

  28. [28]

    Ai art generators hit with copyright suit over artists’ images.Bloomberg Law

    Riddhi Setty. Ai art generators hit with copyright suit over artists’ images.Bloomberg Law. Accessed on February, 1:2023, 2023

    2023

  29. [29]

    Ablating concepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691–22702, 2023

    2023

  30. [30]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7559–7568, 2024

    2024

  31. [31]

    Bspa: Exploring black-box stealthy prompt attacks against image generators.arXiv preprint arXiv:2402.15218, 2024

    Yu Tian, Xiao Yang, Yinpeng Dong, Heming Yang, Hang Su, and Jun Zhu. Bspa: Exploring black-box stealthy prompt attacks against image generators.arXiv preprint arXiv:2402.15218, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Forget-me- not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me- not: Learning to forget in text-to-image diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1755–1764, 2024

    2024

  33. [33]

    Mace: Mass concept erasure in diffusion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6430–6440, 2024

    2024

  34. [34]

    Scissorhands: Scrub data influence via connection sensitivity in networks

    Jing Wu and Mehrtash Harandi. Scissorhands: Scrub data influence via connection sensitivity in networks. InEuropean Conference on Computer Vision, pages 367–384. Springer, 2024

    2024

  35. [35]

    Local- izing and editing knowledge in text-to-image generative models

    Samyadeep Basu, Nanxuan Zhao, Vlad I Morariu, Soheil Feizi, and Varun Manjunatha. Local- izing and editing knowledge in text-to-image generative models. InThe Twelfth International Conference on Learning Representations, 2023

    2023

  36. [36]

    On mechanistic knowledge localization in text-to-image generative models

    Samyadeep Basu, Keivan Rezaei, Priyatham Kattakinda, Vlad I Morariu, Nanxuan Zhao, Ryan A Rossi, Varun Manjunatha, and Soheil Feizi. On mechanistic knowledge localization in text-to-image generative models. InForty-first International Conference on Machine Learning, 2024

    2024

  37. [37]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. InArtificial intelligence safety and security, pages 99–112. Chapman and Hall/CRC, 2018

    2018

  38. [38]

    Autobreach: Universal and adaptive jailbreaking with efficient wordplay-guided optimization

    Jiawei Chen, Xiao Yang, Zhengwei Fang, Yu Tian, Yinpeng Dong, Zhaoxia Yin, and Hang Su. Autobreach: Universal and adaptive jailbreaking with efficient wordplay-guided optimization. arXiv preprint arXiv:2405.19668, 2024

    Pith/arXiv arXiv 2024

  39. [39]

    Exploring the robustness of decision-level through adversarial attacks on llm-based embodied models

    Shuyuan Liu, Jiawei Chen, Shouwei Ruan, Hang Su, and Zhaoxia Yin. Exploring the robustness of decision-level through adversarial attacks on llm-based embodied models. InProceedings of the 32nd ACM International Conference on Multimedia, pages 8120–8128, 2024

    2024

  40. [40]

    Dreamshaper, 2023

    Lykon. Dreamshaper, 2023

    2023

  41. [41]

    Protogen, 2023

    Lykon. Protogen, 2023. 17

    2023

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.