Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

Safety alignment in text-to-image models can silently collapse after fine-tuning on harmless data, and the paper packages this as the SPQR benchmark with a single score for Safety, Prompt adherence, Quality, and Robustness.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

SPQR is a benchmark that scores safety, prompt adherence, quality, and post-fine-tuning robustness of text-to-image safety methods, and it shows benign fine-tuning often collapses safety alignment.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection The safety-collapse phenomenon looks real and the benchmark direction is worth pursuing, but Eq. (3) defines Robustness as a one-sided drift score — zero drift scores 0.5 and improvement scores above 0.5 — so the headline LoRA-stability finding is not supported by the metric as written. the 4 major comments →

arxiv 2511.19558 v2 pith:X4QILAKK submitted 2025-11-24 cs.CR cs.AIcs.CVcs.LG

SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptation

Mohammed Talha Alam , Nada Saadi , Fahad Shamshad , Nils Lukas , Karthik Nandakumar , Fahkri Karray , Samuele Poppi This is my paper
classification cs.CR cs.AIcs.CVcs.LG
keywords safety alignmenttext-to-image diffusion modelsbenign fine-tuningunintentional attackerrobustness to fine-tuningSPQR benchmarkconcept erasureLoRA
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that safety alignment in text-to-image diffusion models is not stable under benign, non-adversarial fine-tuning: models that look safe at release frequently begin producing harmful or explicit images after being fine-tuned on harmless data, even while their prompt adherence and image quality improve. Because this regression is invisible to standard utility metrics, the paper builds SPQR, a benchmark and single-score metric combining Safety, Prompt adherence, Quality, and Robustness, where Robustness measures how much the safety score drifts after benign fine-tuning. Tested across general, multilingual, and domain-specific fine-tuning profiles, many current alignment methods lose safety after such updates, and the failure persists across unseen harmful-prompt sets and newer Stable Diffusion versions. The paper argues this matters because routine post-deployment adaptation, such as LoRA personalization or style and domain adapters, can silently undo safety mechanisms without any malicious intent.

Core claim

The central claim is that benign fine-tuning can destabilize safety alignment while improving utility, across multiple methods and datasets. The paper formalizes benign fine-tuning as training on data containing no harmful content and quantifies its effect by the safety drift Delta_h = h(after BFT) - h(before), measured on a harmful-prompt test set. It finds that many alignment methods that score well on Safety at release regress substantially under this drift, while CLIP score and FID improve, so the regression is silent to standard quality metrics. The paper also reports that the failure is adaptation-dependent: full-parameter fine-tuning tends to break alignment more than low-rank LoRA up

What carries the argument

The load-bearing mechanism is the harmfulness score h together with the robustness definition R = 1/(1+exp(Delta_h)), where Delta_h is the change in h after benign fine-tuning. h is computed by a nudity detector plus a vision-language guard, and the sigmoid maps drift into a 0-to-1 stability score so that small safety erosion incurs large robustness penalties. The other axes are Safety = 1 - h/100, Prompt-adherence = CLIP cosine similarity, Quality = a normalized inverted FID, and the final SPQR = harmonic mean of S, P, Q, R. Benign fine-tuning is operationalized as three reproducible profiles, Lite with LoRA adapters, Moderate with cross-attention layers, and Standard with full UNet updates

Load-bearing premise

The central claim collapses if the harmfulness score h from the two automated detectors does not stay calibrated after fine-tuning: if post-fine-tuning distribution shift changes what those detectors flag, the measured safety drift is not true safety drift, and every SPQR leaderboard number inherits the detectors' errors.

What would settle it

Take a fixed set of models before and after benign fine-tuning, generate images from a harmful-prompt set, and have independent human annotators label safety. If human ratings are unchanged while the automated harmfulness detectors increase, the measured Delta_h and the resulting SPQR robustness scores are classifier artifacts. A second check: run the full SPQR pipeline with a different off-the-shelf safety detector or with human labels; if the ranking of the top two methods changes, the benchmark's conclusions are detector-dependent.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Safety alignment becomes a lifecycle property: release-time safety scores are incomplete predictors, and deployment pipelines that fine-tune a model even benignly should re-certify its safety.
  • Utility improvements cannot certify safety: in the paper's experiments, benign fine-tuning raises prompt adherence and lowers FID while safety collapses, so standard quality metrics are blind to the failure.
  • Leaderboards that include a robustness axis will re-rank alignment methods; methods with strong safety-at-release but weak post-fine-tuning stability fall, while distribution-aware methods rise.
  • Parameter-efficient fine-tuning (LoRA) is generally safer than full fine-tuning, though methods with brittle, localized safety mechanisms remain vulnerable even to low-rank updates.
  • The safety collapse generalizes out-of-distribution: it appears on unseen harmful-prompt benchmarks and after multilingual or domain-specific fine-tuning, not just in the exact training distribution.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If this fragility is widespread, any provider that fine-tunes an aligned image model should treat safety as a measurement taken after each adaptation, not as a static guarantee from release.
  • The benchmark's rankings depend on the harmfulness detectors it chose; the paper's Limitations section concedes those classifiers 'may misclassify nuanced or context-dependent content,' so replacing them with human labels could plausibly reorder methods.
  • A direct testable extension of the paper's LoRA-rank ablation: robustness should decline monotonically as adapter rank grows, so very-low-rank adapters should be nearly stability-saturated, a prediction one could check on newer backbones and unseen alignment methods.
  • The 'unintentional attacker' framing transfers to other modalities: the same silent drift may occur in safety-aligned language models or multimodal assistants whenever they are fine-tuned on benign, off-distribution data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper introduces SPQR, a benchmark for evaluating safety-alignment methods in text-to-image diffusion models under "benign fine-tuning" (BFT) performed by unintentional, non-adversarial users (e.g., LoRA personalization, style/domain adapters). The authors benchmark eleven erasure/unlearning methods on Stable Diffusion v1.5 (plus v2.1/SDXL in the appendix) across three fine-tuning profiles (LoRA, cross-attention-only, full-UNet) and three scenarios (general COCO, multilingual, domain-specific). SPQR aggregates four normalized axes — Safety (1−h/100 with h from NudeNet+LLaVA-Guard), Prompt adherence (CLIP score), Quality (min-max normalized FID), and Robustness (1/(1+exp(Δh)), with Δh the signed safety drift after BFT) — into a harmonic mean. The central empirical claim is that BFT destabilizes safety alignment while improving utility, that PEFT/LoRA is more stable than full fine-tuning, and that distribution-aware methods (RECE, UCE, MACE) are the most robust. The finding is supported by qualitative examples (Figure 2) and by consistent ranking patterns across tables.

Significance. The paper addresses a timely and practically important question: whether safety alignment in text-to-image models persists across the deployment lifecycle, not merely at release. If the headline finding is correct, release-time safety evaluations of diffusion models are insufficient, and robustness to benign adaptation should be a standard evaluation axis. Strengths include broad method coverage (11 methods), three fine-tuning profiles and three adaptation scenarios, category-wise analyses, and the appendix's cross-backbone validation (SD2.1/SDXL, Table D) and LoRA-rank ablation (Table E), which support the qualitative phenomenon. The protocol is specified in reasonable detail. However, the quantitative claims rest on metric definitions that need correction and validation: the Robustness score as written rewards safety improvement rather than stability, the Quality score is relative to the arbitrary method set, the safety oracle is unvalidated, and no variance estimates are reported. If these issues are fixed, the benchmark could be a useful community resource.

major comments (4)
  1. [§3.3, Eq. (3)] The Robustness score R=1/(1+exp(Δh)) is a monotone transform of the signed drift Δh=h(after)−h(before), not a stability measure. Δh=0 yields R=0.5, while negative Δh (safety improvement) yields R>0.5; the paper's own definition of robust, "negligible Δh" (§3.2), corresponds to mid-scale 0.5. Thus the high LoRA values in Table 3 (SalUn 1.000, ESD 0.950, RECE 0.980) mean those models became safer after BFT, not that they were stable, and the PEFT-superiority conclusion is not supported by the metric as written. A two-sided measure (e.g., |Δh|) or separate reporting of Δh is needed.
  2. [§3.3, Eq. (6)] Quality is min-max normalized over the evaluated method set M, so Q and the SPQR leaderboard depend on which methods happen to be included: adding or removing a method changes every method's Q and final score, and the formula is undefined for single-method evaluation. This contradicts the claim of a "standardized, reproducible" single score. A reference-anchored quality metric, or raw FID reported alongside, is required for cross-paper comparability.
  3. [§3.3, Safety (Eq. 4) and Robustness (Eq. 3) via h] Both S and R are defined entirely through the harmfulness signal h=NudeNet+LLaVA-Guard, yet LLaVA-Guard is introduced without a reference, version, or human validation, and the Limitations (F.2) concede that the classifiers "may misclassify nuanced or context-dependent content." Every leaderboard entry inherits h, so classifier calibration under post-BFT distribution shift must be checked (e.g., a human-annotated subset or classifier-agreement analysis); without this, Δh cannot be interpreted as true safety drift.
  4. [Tables 1, 3, 4, 5] All results are single-seed point estimates (Random Seed 42, Table B), despite Contribution 2 claiming aggregation "across seeds." No variance, confidence intervals, or significance tests appear anywhere, so the headline ranking differences (e.g., RECE 0.980 vs. UCE 0.942 in Table 5; MACE Arabic 0.979) are unassessable. At minimum, run several seeds and report mean±std, and state whether rank differences survive.
minor comments (5)
  1. [Figure 3] The axis label "h (Higher is Better)" is inconsistent with h being a harmfulness score (lower is better) and with the displayed 0.1→0.0 range. The scale of h used in Eqs. (2)–(4) (apparently percentage, since Safety=1−h/100) should be stated explicitly.
  2. [Table 3 caption] The caption states "The baseline score (Before FT) is shown for reference," but no Before-FT column appears in the table. Add the baseline or correct the caption; without it the reader cannot see whether R>0.5 reflects improvement or stability.
  3. [Table 2] ΔFID values are extremely large (e.g., −216.8 for EraseDiff) and the FID protocol (reference set, number of generated images, resolution) is not described. Since the "utility improves while safety collapses" narrative relies on these numbers, the protocol must be specified.
  4. [§3.3 / Table 1] It is unclear which harmful prompt set H is used to compute the single reported R in Table 1 (VISU? I2P? RAB? a union?). Table 4 shows R varies substantially across H, so this must be specified for reproducibility.
  5. [General] No code/data release URL is provided. For a benchmark paper claiming reproducibility, releasing datasets, fine-tuning configurations, and checkpoints is important. Also, the header title ("A Standardized Benchmark...") differs from the arXiv abstract title ("A Multi-Dimensional Benchmark..."); unify them.

Circularity Check

0 steps flagged

No circularity: the benchmark is built from external measurements and an independently formalized threat model; the Eq. (3) caveat is a metric-validity concern, not a circular derivation.

full rationale

SPQR's central claim—that benign fine-tuning can destabilize safety alignment while improving utility—is supported by direct empirical comparisons using external quantities: harmfulness scores from NudeNet and LLaVA-Guard on external prompt sets (VISU, I2P, RAB), CLIPScore for prompt adherence, and FID for quality. The Safety, Prompt-adherence, Quality, and Robustness formulas (Eqs. 3-6) are defined from these external measurements, and no parameter is fitted to the reported leaderboard rankings. The unintentional-attacker threat model is formalized independently of the outcome, and the finding is presented as an experimental observation rather than as a consequence of a fitted definition. The paper's self-citations (e.g., STEREO as a benchmarked method, SafeCLIP/ViSU as a dataset, and the authors' prior multilingual fragility study) are not load-bearing: they are used as objects of evaluation or as motivation, not to force the conclusion. The Eq. (3) robustness score is a potential construct-validity issue because zero drift yields R = 0.5 and positive R can reflect safety improvement, meaning 'high robustness' does not strictly correspond to 'stability'; however, this is a measurement-design concern rather than a circular step in the derivation chain. Likewise, the min-max normalization in Eq. (6) makes Quality relative to the compared method set, but it remains a transformation of external FID values and does not make the benchmark's conclusions equivalent to its inputs. Overall, no claim in the paper reduces by construction to its own assumptions or to a self-citation chain.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The paper's headline is an empirical finding about existing models, so it mostly borrows categories from prior work. The main ledger items are benchmark choices: min-max FID normalization, the logistic R transform, profile intensities, and the unvalidated harmfulness classifier stack. These choices are not fitted to reproduce a particular ranking, but the panel-relative Q range makes the single SPQR score non-portable across independent benchmark runs.

free parameters (4)
  • Q normalization range (min_M FID, max_M FID) = varies per benchmark panel; not reported numerically
    Equation (6) min-max normalizes FID using the best and worst FID among the evaluated methods, so every SPQR score depends on which methods are in the panel.
  • epsilon in Q normalization = unspecified
    Equation (6) uses epsilon to avoid zero division, but its value is never given; it affects Q and therefore the final SPQR score.
  • BFT profile intensity (epochs and sample counts) = 1-3, 3-8, 10-20 epochs over 1k-50k samples
    The three profiles are hand-chosen to represent 'benign' adaptation; the Standard profile (10-20 full-UNet epochs on ~5k COCO pairs) is a substantial update, and the rankings may depend on this intensity.
  • LoRA rank, alpha, and dropout = r=8, alpha=16, dropout=0.1
    These Lite-profile hyperparameters are chosen by the authors, and Table E shows that robustness scores change with LoRA rank, so the benchmark score is sensitive to this choice.
axioms (5)
  • domain assumption NudeNet and LLaVA-Guard's classification of harmfulness matches the paper's intended safety categories.
    Safety (Eq. 4) and Robustness (Eq. 3) are both defined through harmfulness score h; the paper provides no validation or citation for LLaVA-Guard and admits classifier limitations.
  • domain assumption Benign fine-tuning on COCO, translated COCO, artistic images, and medical images is representative of real post-deployment adaptation.
    Section 4.1 and Supplementary B.2 define the BFT scenarios; the entire relevance claim rests on these datasets standing in for routine practice.
  • domain assumption VISU, I2P, and RAB prompt sets are the right harmful test sets H for measuring safety drift.
    These external benchmarks define the harmfulness evaluation; different H sets could give different Δh and different R rankings.
  • ad hoc to paper The logistic transform R = 1/(1+exp(Δh)) is a valid normalization of safety drift.
    Equation (3) is an arbitrary monotone transform; it is not derived from any threat model and its scaling directly determines leaderboard spacing.
  • domain assumption Stable Diffusion v1.5 is a sufficient common backbone; results generalize to SD2.1 and SDXL.
    All main comparisons use SDv1.5; appendix results cover only a subset of methods, so the broad claim of generalization is assumed.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptation." pith.science (2026). https://pith.science/paper/X4QILAKK

@misc{pith2026251119558,
  author       = {Pith},
  title        = {Pith review of: SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X4QILAKK}},
  note         = {Machine review of arXiv:2511.19558}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Text-to-image diffusion models can emit copyrighted, unsafe, or private content. Safety alignment aims to suppress specific concepts, yet evaluations seldom test whether safety persists under benign downstream fine-tuning routinely applied after deployment (e.g., LoRA personalization, style/domain adapters). We study the stability of current safety methods under benign fine-tuning and observe frequent breakdowns. As true safety alignment must withstand even benign post-deployment adaptations, we introduce the SPQR benchmark (Safety, Prompt adherence, Quality, and Robustness). SPQR is a single-scored metric that provides a unified, reproducible framework to evaluate how well safety-aligned diffusion models preserve safety, utility, and robustness under benign fine-tuning, by reporting a single leaderboard score to facilitate comparisons. We conduct multilingual, domain-specific, and out-of-distribution analyses, along with category-wise breakdowns, to identify when safety alignment fails after benign fine-tuning, ultimately showcasing SPQR as a concise yet comprehensive benchmark for T2I safety alignment techniques for T2I models.

Figures

Figures reproduced from arXiv: 2511.19558 by Fahad Shamshad, Fahkri Karray, Karthik Nandakumar, Mohammed Talha Alam, Nada Saadi, Nils Lukas, Samuele Poppi.

Figure 1
Figure 1. Figure 1: Illustration of the SPQR benchmark. (Left) Example of a benign fine-tuning (BFT) causing safety regression: before BFT, Stable Diffusion produces a safe image, while after BFT, the same prompt yields a harmful one. (Center) SPQR evaluates models along four axes—Safety (S), Prompt Adherence (P), Quality (Q), and Robustness (R)—and aggregates them into a single harmonic mean score. (Right) Representative com… view at source ↗
Figure 2
Figure 2. Figure 2: Qualitative Examples of Safety Failure After Be￾nign Fine-Tuning. Models that were initially safe (top row) generate harmful or explicit outputs after benign fine-tuning (bottom row), revealing a breakdown of safety across methods (ESD, AdvUnlearn, STEREO, RECE). while maintaining high visual quality, making the re￾gression hard to detect and raising legal, ethical, and operational risks. In everyday pract… view at source ↗
Figure 3
Figure 3. Figure 3: Example visualization of the trade-off between [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: S-P-Q-R Performance Profiles for Key Methods. Each radar plot shows the performance signature across five harmful categories. The colored polygons show Safety (blue), Prompt Adherence (orange), Quality (green), and Robustness (red). 7 [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. SafeDiffusion-R1: Online Reward Steering for Safe Diffusion Post-Training

    cs.CV 2026-05 unverdicted novelty 6.0

    SafeDiffusion-R1 uses online GRPO with CLIP embedding steering to cut inappropriate content from 48.9% to 18.07% and nudity detections from 646 to 15 in diffusion models while raising GenEval scores from 42.08% to 47....

  2. Projected Gradient Unlearning for Text-to-Image Diffusion Models: Defending Against Concept Revival Attacks

    cs.CV 2026-04 unverdicted novelty 6.0

    PGU projects unlearning gradients orthogonal to a retain-concept Core Gradient Space, eliminating style-concept revival and delaying object-concept revival while running in minutes and complementing prior methods.

Reference graph

Works this paper leans on

47 extracted references · 10 linked inside Pith · cited by 2 Pith papers

  1. [1]

    Qwen-image technical re- port.arXiv preprint arXiv:2508.02324, 2025

    Chenfei Wu, Jiahao Li, Jingren Zhou, Junyang Lin, Kaiyuan Gao, Kun Yan, Sheng-ming Yin, Shuai Bai, Xiao Xu, Yilei Chen, et al. Qwen-image technical re- port.arXiv preprint arXiv:2508.02324, 2025. 2

    Pith/arXiv arXiv 2025

  2. [2]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InCVPR, 2022. 2, 3, 15

    2022

  3. [3]

    Safe latent diffusion: Mitigat- ing inappropriate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigat- ing inappropriate degeneration in diffusion models. In CVPR, 2023. 2, 6, 7, 8, 11

    2023

  4. [4]

    Extracting training data from diffusion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In32nd USENIX security symposium (USENIX Security 23), 2023. 2

    2023

  5. [5]

    Understanding and mitigating copying in diffusion models.NeurIPS, 2023

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models.NeurIPS, 2023. 2

    2023

  6. [6]

    Memorized images in diffusion models share a subspace that can be located and deleted.arXiv preprint arXiv:2406.18566, 2024

    Ruchika Chavhan, Ondrej Bohdal, Yongshuo Zong, Da Li, and Timothy Hospedales. Memorized images in diffusion models share a subspace that can be located and deleted.arXiv preprint arXiv:2406.18566, 2024. 2

    Pith/arXiv arXiv 2024

  7. [7]

    Latent guard: a safety framework for text-to-image generation

    Runtao Liu, Ashkan Khakzar, Jindong Gu, Qifeng Chen, Philip Torr, and Fabio Pizzati. Latent guard: a safety framework for text-to-image generation. InECCV, 2024. 2

    2024

  8. [8]

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models

    Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. InProceedings of the 2023 ACM SIGSAC conference on computer and communica- tions security, 2023. 2

    2023

  9. [9]

    Safe vision- language models via unsafe weights manipulation.arXiv preprint arXiv:2503.11742, 2025

    Moreno D’Incà, Elia Peruzzo, Xingqian Xu, Humphrey Shi, Nicu Sebe, and Massimiliano Mancini. Safe vision- language models via unsafe weights manipulation.arXiv preprint arXiv:2503.11742, 2025. 2

    arXiv 2025

  10. [10]

    Safe- clip: Removing nsfw concepts from vision-and-language models

    Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, and Rita Cucchiara. Safe- clip: Removing nsfw concepts from vision-and-language models. InECCV, 2024. 2, 6, 7, 8, 14, 20

    2024

  11. [11]

    Reliable and efficient concept erasure of text-to-image diffusion models

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. InECCV, 2024. 3, 4, 6, 7, 8, 15

    2024

  12. [12]

    Mace: Mass concept erasure in diffusion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. InCVPR, 2024. 2, 3, 4, 6, 7, 8, 14, 15

    2024

  13. [13]

    Salun: Empowering ma- chine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508, 2023

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Empowering ma- chine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508, 2023. 2, 3, 4, 6, 7, 8, 14, 15

    Pith/arXiv arXiv 2023

  14. [14]

    Scissorhands: Scrub data influence via connection sensitivity in networks

    Jing Wu and Mehrtash Harandi. Scissorhands: Scrub data influence via connection sensitivity in networks. In ECCV, 2024. 3, 4, 6, 7, 8

    2024

  15. [15]

    Erasing undesirable influence in diffusion models

    Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Ha- randi. Erasing undesirable influence in diffusion models. InCVPR, 2025. 2, 3, 4, 6, 7, 8, 14, 15

    2025

  16. [16]

    Erasing concepts from dif- fusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from dif- fusion models. InICCV, 2023. 2, 3, 4, 6, 7, 8, 15, 16

    2023

  17. [17]

    Stereo: Towards adversari- ally robust concept erasing from text-to-image genera- tion models.arXiv e-prints, 2024

    Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer, and Karthik Nandakumar. Stereo: Towards adversari- ally robust concept erasing from text-to-image genera- tion models.arXiv e-prints, 2024. 2, 3, 4, 6, 7, 8, 14, 15

    2024

  18. [18]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?arXiv preprint arXiv:2310.10012, 2023

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models?arXiv preprint arXiv:2310.10012, 2023. 2, 3, 6, 7, 8, 11, 12

    Pith/arXiv arXiv 2023

  19. [19]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In2024 IEEE Symposium on Secu- rity and Privacy, 2024. 2

    2024

  20. [20]

    Modifier unlocked: Jailbreaking text-to-image models through prompts

    Shuofeng Liu, Mengyao Ma, Minhui Xue, and Guang- dong Bai. Modifier unlocked: Jailbreaking text-to-image models through prompts. In2024 IEEE Symposium on Security and Privacy, 2025

    2025

  21. [21]

    Jailbreaking prompt attack: A controllable adversarial attack against diffu- sion models

    Jiachen Ma, Yijiang Li, Zhiqing Xiao, Anda Cao, Jie Zhang, Chao Ye, and Junbo Zhao. Jailbreaking prompt attack: A controllable adversarial attack against diffu- sion models. InFindings of the Nations of the Americas Chapter of the Association for Computational Linguis- tics, 2025. 2

    2025

  22. [22]

    The illusion of unlearning: The unstable nature of machine unlearning in text-to-image diffusion models

    Naveen George, Karthik Nandan Dasaraju, Rutheesh Reddy Chittepu, and Konda Reddy Mop- uri. The illusion of unlearning: The unstable nature of machine unlearning in text-to-image diffusion models. InCVPR, 2025. 2, 3, 4, 11

    2025

  23. [23]

    Unstable un- learning: The hidden risk of concept resurgence in diffu- sion models

    Vinith Menon Suriyakumar, Rohan Alur, Ayush Sekhari, Manish Raghavan, and Ashia C Wilson. Unstable un- learning: The hidden risk of concept resurgence in diffu- sion models. InICLRW, 2024. 4

    2024

  24. [24]

    To- wards resilient safety-driven unlearning for diffusion models against downstream fine-tuning.arXiv preprint arXiv:2507.16302, 2025

    Boheng Li, Renjie Gu, Junjie Wang, Leyi Qi, Yiming Li, Run Wang, Zhan Qin, and Tianwei Zhang. To- wards resilient safety-driven unlearning for diffusion models against downstream fine-tuning.arXiv preprint arXiv:2507.16302, 2025. 2, 4, 11 9

    arXiv 2025

  25. [25]

    Lora: Low-rank adaptation of large language mod- els.ICLR, 2022

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language mod- els.ICLR, 2022. 2, 6

    2022

  26. [26]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. InCVPRW,

  27. [27]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. NeurIPS, 2024. 3, 4, 6, 7, 8, 14, 15, 16

    2024

  28. [28]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. InCVPR, 2024. 3, 4, 6, 7, 8, 14, 15, 16

    2024

  29. [29]

    Unified con- cept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy ´nska, and David Bau. Unified con- cept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Com- puter Vision, 2024. 3, 4, 6, 7, 8, 15, 16

    2024

  30. [30]

    Learning transferable visual models from natural lan- guage supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sas- try, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural lan- guage supervision. 2021. 3

    2021

  31. [31]

    Unlearning vision trans- formers without retaining data via low-rank decomposi- tions

    Samuele Poppi, Sara Sarto, Marcella Cornia, Lorenzo Baraldi, and Rita Cucchiara. Unlearning vision trans- formers without retaining data via low-rank decomposi- tions. InICLR, 2024. 3

    2024

  32. [32]

    Harmbench: A standardized evaluation framework for automated red teaming and ro- bust refusal.arXiv preprint arXiv:2402.04249, 2024

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and ro- bust refusal.arXiv preprint arXiv:2402.04249, 2024. 3

    Pith/arXiv arXiv 2024

  33. [33]

    Beavertails: Towards im- proved safety alignment of llm via a human-preference dataset.NeurIPS, 2023

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards im- proved safety alignment of llm via a human-preference dataset.NeurIPS, 2023

    2023

  34. [34]

    To- wards understanding the fragility of multilingual llms against fine-tuning attacks

    Samuele Poppi, Zheng-Xin Yong, Yifei He, Bobbie Chern, Han Zhao, Aobo Yang, and Jianfeng Chi. To- wards understanding the fragility of multilingual llms against fine-tuning attacks. InFindings of the Nations of the Americas Chapter of the Association for Compu- tational Linguistics, 2025. 3

    2025

  35. [35]

    Unlearncanvas: Stylized image dataset for en- hanced machine unlearning evaluation in diffusion mod- els.arXiv preprint arXiv:2402.11846, 2024

    Yihua Zhang, Chongyu Fan, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Gaoyuan Zhang, Gaowen Liu, Ramana Rao Kompella, Xiaoming Liu, et al. Unlearncanvas: Stylized image dataset for en- hanced machine unlearning evaluation in diffusion mod- els.arXiv preprint arXiv:2402.11846, 2024. 3, 11, 12

    Pith/arXiv arXiv 2024

  36. [36]

    Patrick Schramowski, Christopher Tauchmann, and Kris- tian Kersting. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? InProceedings of the 2022 ACM conference on fairness, accountability, and transparency, 2022. 3, 5

    2022

  37. [37]

    Nudenet: Nsfw object detection for tfjs and nodejs

    Vlad Mandic. Nudenet: Nsfw object detection for tfjs and nodejs. GitHub repository, 2021. 3, 5

    2021

  38. [38]

    Unsafebench: Benchmarking image safety classifiers on real-world and ai-generated images.arXiv preprint arXiv:2405.03486,

    Yiting Qu, Xinyue Shen, Yixin Wu, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafebench: Benchmarking image safety classifiers on real-world and ai-generated images.arXiv preprint arXiv:2405.03486,

    Pith/arXiv arXiv

  39. [39]

    The false sense of safety in ai: Poisoning and behav- ior manipulation via benign fine-tuning.arXiv preprint arXiv:2402.05448, 2024

    Kaixuan Zheng, Yiqin Chai, Zifan Xu, and Bo Li. The false sense of safety in ai: Poisoning and behav- ior manipulation via benign fine-tuning.arXiv preprint arXiv:2402.05448, 2024. 5

    Pith/arXiv arXiv 2024

  40. [40]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. InECCV, 2014. 7, 14

    2014

  41. [41]

    Comprehensive assessment and analysis for nsfw content erasure in text-to-image diffusion models.arXiv preprint arXiv:2502.12527, 2025

    Die Chen, Zhiwen Li, Cen Chen, Xiaodan Li, and Jinyan Ye. Comprehensive assessment and analysis for nsfw content erasure in text-to-image diffusion models.arXiv preprint arXiv:2502.12527, 2025. 11, 12

    Pith/arXiv arXiv 2025

  42. [42]

    T2isafety: Benchmark for assessing fairness, toxicity, and privacy in image generation

    Lijun Li, Zhelun Shi, Xuhao Hu, Bowen Dong, Yiran Qin, Xihui Liu, Lu Sheng, and Jing Shao. T2isafety: Benchmark for assessing fairness, toxicity, and privacy in image generation. 2025. 11, 12

    2025

  43. [43]

    Stable diffusion 2.1 release notes.https: //stability.ai/blog/stable-diffusion- 2-1-release, 2022

    Stability AI. Stable diffusion 2.1 release notes.https: //stability.ai/blog/stable-diffusion- 2-1-release, 2022. Accessed: 2025-10-15. 14

    2022

  44. [44]

    Nih chest x-ray dataset.https://www.kaggle.com/datasets/ nih-chest-xrays/data, 2018

    National Institutes of Health (NIH). Nih chest x-ray dataset.https://www.kaggle.com/datasets/ nih-chest-xrays/data, 2018. Accessed: 2025- 10-15. 14

    2018

  45. [45]

    Brain tumor mri dataset

    Masoud Nickparvar. Brain tumor mri dataset. https : / / www . kaggle . com / datasets / masoudnickparvar / brain - tumor - mri - dataset, 2023. Accessed: 2025-10-15. 14

    2023

  46. [46]

    Stable diffusion 2.1 release notes.https: //stability.ai/blog/stable-diffusion- 2-1-release, 2022

    Stability AI. Stable diffusion 2.1 release notes.https: //stability.ai/blog/stable-diffusion- 2-1-release, 2022. Accessed: 2025-10-15. 15

    2022

  47. [47]

    Silent Safety Failure

    Dustin Podell, Ruben Vencu, Robin Rombach, Andreas Blattmann, Jonas Tesch, et al. Sdxl: Improving latent dif- fusion models for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023. 15 10 SPQR: A Standardized Benchmark for Modern Safety Alignment Methods in Text-to-Image Diffusion Models Supplementary Material A. Comparison with Existing ...

    Pith/arXiv arXiv 2023

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.