Pith. sign in

REVIEW 3 major objections 7 minor 46 references

Energy-tilted distributions remove concepts from image models without collateral damage

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-08 05:50 UTC pith:O6ZNIZQL

load-bearing objection Clean KL-projection formulation of concept unlearning; empirical validation needs strengthening but the core idea is sound the 3 major comments →

arxiv 2607.06432 v1 pith:O6ZNIZQL submitted 2026-07-07 cs.LG cs.AIcs.CV

TILDE: TILt-based Distributional Erasure for Concept Unlearning

Naveen George , Naoki Murata , Yuhta Takida , Konda Reddy Mopuri , Yuki Mitsufuji This is my paper
classification cs.LG cs.AIcs.CV
keywords conceptdistributionalmodelunlearningerasuretargettildebenign
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

TILDE argues that concept unlearning in text-to-image diffusion models should be defined by specifying the target post-unlearning distribution before choosing an update rule. The authors derive this target as a constrained KL projection: among all conditional distributions that suppress the unwanted concept, pick the one closest to the pretrained model's distribution. The solution has a clean Gibbs form — the pretrained distribution multiplied by an exponential energy penalty on concept-expressing images, normalized per prompt. This means concept images lose probability mass while benign images keep their pretrained relative proportions, avoiding both the collateral damage of hard suppression methods and the diversity collapse of reward-maximization methods. The authors realize this target in a diffusion model using residual ∇-GFlowNet training, which learns only the score correction (the deviation from the pretrained denoiser) needed to realize the energy-tilted distribution, rather than training a new sampler from scratch. A thresholded CLIP-based forget energy creates a no-penalty zone for benign images below the threshold, so they receive zero gradient and stay anchored to pretrained behavior.

Core claim

The paper's central object is the energy-tilted target distribution p*_C(x|y) ∝ p_pre(x|y) exp(−βE_C(x))/Z, derived as the unique solution to a constrained KL projection that minimizes deviation from the pretrained model subject to a forgetting constraint. The key mechanistic finding is that this target can be realized in diffusion latent space via residual ∇-GFlowNet training: the pretrained model supplies the base distribution, and the learner estimates only the score correction induced by the forget-energy tilt. The thresholded forget energy is load-bearing — without the threshold, every sample receives a penalty and retention collapses (RRacc drops to 0.08), while with it, benign images'

What carries the argument

Constrained KL projection yielding a Gibbs-form tilted target; thresholded CLIP-based forget energy with a no-penalty zone; residual ∇-GFlowNet detailed-balance score matching in diffusion latent space; forward-looking residual parameterization of the continuation score

Load-bearing premise

The method depends on a thresholded CLIP similarity score to cleanly separate concept-expressing images from benign ones. The threshold τ is hand-tuned per category (e.g., 0.21 for objects, 0.22 for characters), and removing the threshold causes retention to collapse catastrophically. If CLIP similarity does not cleanly separate concept from non-concept images for a given concept, the energy tilt misallocates probability mass and the entire approach fails.

What would settle it

Find a concept where CLIP similarity cannot cleanly separate concept-expressing from benign images (e.g., a highly compositional or abstract concept), and show that no single threshold τ simultaneously achieves high unlearning accuracy and acceptable retention — or that the threshold must be individually tuned per concept with no stable within-category value.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the distributional alignment formulation is correct, then existing unlearning methods can be classified by where they deviate from it: hard suppression corresponds to an extreme tilt, anchor-based methods substitute a manually chosen target distribution, and reward maximization drops the proportional-sampling property that preserves diversity.
  • The thresholded energy design implies that retain prompts can be mixed into training as ordinary samples with no extra loss term, since below-threshold samples receive zero concept-suppression gradient — a free Pareto improvement when retain supervision is available.
  • The residual ∇-GFlowNet machinery is energy-agnostic: replacing the CLIP-based forget energy with a stronger concept detector (VLM ensemble, task-specific classifier) would transfer without modification, extending the approach to ambiguous or compositional concepts where CLIP similarity is unreliable.
  • The framework predicts that distributional fidelity should be measured locally (per-prompt) rather than via coarse aggregate metrics like FID, because collateral damage is easiest to hide in semantically adjacent prompts — motivating metrics like FADE that compare against a retain-only reference.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes TILDE, a concept-unlearning method for text-to-image diffusion models that formulates unlearning as a constrained KL projection of the pretrained conditional distribution onto a forget-energy-tilted target. The target distribution takes the Gibbs form p*_C(x|y) ∝ p_pre(x|y) exp(−βE_C(x))/Z, which suppresses concept-expressing images while preserving benign relative mass. The authors instantiate this target using residual ∇-GFlowNet training (building on Liu et al., ICLR 2025), which learns only the score correction relative to the pretrained model. The forget energy is a thresholded CLIP-based surrogate that applies zero penalty below a similarity threshold τ and an exponential penalty above it. Experiments across objects, characters, and artistic styles show strong forgetting (UAcc 0.97–0.99) with improved retention over baselines (RRacc 0.64–0.76, GRAcc 0.84–0.87), and the method reports favorable FADE and FID scores on style concepts.

Significance. The paper's main conceptual contribution is the explicit formulation of concept unlearning as a distributional alignment problem with a closed-form target, rather than leaving the post-unlearning distribution implicit. The KL projection (Proposition 4, Appendix D.1) is standard but correctly applied, and the connection to GFlowNet proportional sampling is well-motivated. The thresholded energy design is a practical and sensible choice for separating concept-expressing from benign images. The ablation in Table 2 isolates the contributions of the ∇ form, the residual parameterization, and the gϕ correction, which is informative. The paper honestly acknowledges in Appendix C.6 that score-matching loss alone does not guarantee the integrated ratio-form DB condition (Theorem 1), stating only that L=0 implies gradient equality, not full distributional correctness. The evaluation uses VLM-based accuracy metrics (Qwen2.5-VL) alongside CLIP scores and the FADE distributional metric against retain-only references, which is more thorough than many prior works. The method is evaluated across multiple diffusion architectures (Appendix F) and provides per-concept breakdowns (Appendix G).

major comments (3)
  1. Section 2.2, Eq. (3), and Figure 3: The thresholded CLIP energy is load-bearing for all results. The paper demonstrates that removing the threshold causes catastrophic retention collapse (RRacc=0.08, GRacc=0.49), and τ is hand-tuned per category (0.21/0.22/0.20 for objects/characters/style). However, the sensitivity analysis (Figure 3) is conducted on Pikachu only. The per-category thresholds are close together, but the paper does not test whether a single threshold generalizes across concepts within a category, nor whether the CLIP similarity distributions for concept vs. benign images overlap substantially for concepts with high semantic overlap (e.g., 'cat' vs. other animals). The paper states (Appendix E.6) that τ is set at the 90–95th percentile of benign CLIP similarities, meaning 5–10% of benign images fall above τ and receive energy penalties. For concepts where the separation is
  2. Appendix E.1: The same CLIP model (openai/clip-vit-large-patch14) is used for both the forget-energy computation during training and the CLIP-score evaluation metrics (Uclip, RRclip, GRclip). This creates a shared-embedding-space bias: if CLIP systematically misranks concept evidence in a particular direction, both the training signal and the evaluation metric inherit the same bias. The primary accuracy metrics (UAcc, RRacc, GRAcc) use Qwen2.5-VL instead, which mitigates but does not eliminate this concern. The paper should explicitly discuss this potential circularity and consider reporting CLIP-score results with a different CLIP variant, or at minimum acknowledge the limitation more prominently than in Appendix E.1.
  3. Table 1 and Appendix G: The per-concept results reveal notable variability that the category-level averages partially obscure. For example, on 'Cat' (Table 9), TILDE achieves UAcc=0.96 but RRacc=0.82, while on 'Dog' (Table 10), UAcc=0.94 but RRacc=0.59—a substantial retention gap. On 'Cartoon Style' (Table 8), UAcc drops to 0.82, the lowest among all TILDE results. The paper briefly notes that 'on objects, related-retain remains harder due to tighter semantic coupling' (Section 5.3, Q2), but does not analyze which concept properties predict success or failure. A brief discussion of when the method is expected to struggle would strengthen the paper.
minor comments (7)
  1. Section 2.2: The descriptor set Q_C is mentioned with an example for Pikachu, but the paper does not specify how many descriptors are used per concept or how sensitive the method is to the choice of descriptors. Appendix E.3 mentions 'the canonical text descriptor of C' is used unless stated otherwise, but Table 2 and Figure 3 use Pikachu with a 4-descriptor set. Clarify which experiments use single vs. multi-descriptor sets.
  2. Table 1: The 'Avg. FADE↓' and 'Avg. FID↓' columns are reported only for style concepts. The paper should state this limitation more visibly in the table caption rather than only in the text (Section 5.2).
  3. Table 1, ESD-x row for Pikachu (Appendix G, Table 14): Uclip=0.0, RRclip=0.0, GRclip=0.0 appears to be a data error or degenerate output. This should be checked.
  4. Section 3, Eq. (8): The notation ĉ_EC is used in the equation but Ê_C is used in the surrounding text. Standardize the notation.
  5. Figure 2: The caption references 'hϕ(zt, t, y)' but the figure label uses 'hϕ'. Minor inconsistency.
  6. Appendix C.5, Proposition 3: The energy is stated as non-differentiable at s_C(x)=τ, with the implementation using the zero subgradient. This is a reasonable practical choice but should be mentioned in the main text (Section 2.2) for completeness, as it affects gradient flow during training.
  7. References: The paper cites [14] (George et al., ECCV 2026) and [13] (George et al., CVPR 2025), which appear to include the first author of this manuscript. This should be disclosed for transparency.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for a careful and constructive report. The three major comments all identify legitimate gaps: (1) the threshold sensitivity analysis is limited to one concept and does not test single-threshold generalization or high-overlap concepts; (2) the same CLIP model is used for both training and evaluation, creating a potential shared-embedding-space bias; (3) per-concept variability is not analyzed for predictive concept properties. We agree with all three and will revise accordingly. We can partially address comments 1 and 2 with additional experiments and discussion, and fully address comment 3 with added analysis.

read point-by-point responses

  1. Referee: Section 2.2, Eq. (3), Figure 3: Threshold sensitivity analysis conducted on Pikachu only; per-category thresholds close but not tested for single-threshold generalization within a category; no test of CLIP similarity overlap for high-semantic-overlap concepts (e.g., 'cat' vs. other animals); Appendix E.6 notes 5-10% of benign images fall above tau.

    Authors: The referee is correct that the sensitivity analysis in Figure 3 is limited to Pikachu and that we do not test single-threshold generalization or high-overlap concepts. We will address this in revision as follows. First, we will add threshold-sensitivity sweeps for at least two additional concepts from different categories (e.g., Cat from objects, Van Gogh from styles) to test whether the trade-off curve shape and optimal-tau neighborhood generalize. Second, we will report results using a single shared threshold across all concepts within a category (rather than the slightly different per-category values 0.21/0.22/0.20) to show that the method does not require per-concept tuning. Third, we will add a CLIP-similarity histogram analysis for high-overlap cases such as Cat vs. other animals, showing the degree of separation between concept-expressing and benign images and explicitly discussing cases where overlap is substantial. We acknowledge that for concepts with deep semantic overlap, the thresholded energy may penalize a non-trivial fraction of benign images, and we will state this limitation explicitly. We note that the per-category thresholds are already close together (0.20-0.22), which provides some evidence that a single threshold may suffice, but we agree this must be demonstrated empirically rather than asserted. revision: partial

  2. Referee: Appendix E.1: Same CLIP model (openai/clip-vit-large-patch14) used for both forget-energy computation during training and CLIP-score evaluation metrics (Uclip, RRclip, GRclip), creating shared-embedding-space bias. Primary accuracy metrics use Qwen2.5-VL, which mitigates but does not eliminate the concern. Paper should discuss this circularity and consider reporting CLIP-score results with a different CLIP variant.

    Authors: This is a valid concern. The shared-embedding-space bias means that if CLIP systematically misranks concept evidence, both the training signal and the CLIP-based evaluation metrics inherit the same bias. We will take two steps in revision. First, we will add an explicit discussion of this limitation in the main text (Section 5.2 or the Limitations section), rather than burying it in Appendix E.1. Second, we will report CLIP-score evaluation results using a different CLIP variant (e.g., openai/clip-vit-base-patch32 or laion/CLIP-ViT-H-14) for at least a subset of concepts, to verify that the CLIP-score trends are not artifacts of the shared embedding space. We note that our primary accuracy metrics (UAcc, RRacc, GRAcc) use Qwen2.5-VL, which is architecturally independent of the CLIP model used in training, so the core forgetting/retention claims do not depend on the shared embedding space. However, we agree that the CLIP-score metrics (Uclip, RRclip, GRclip) are potentially affected and that this should be both tested and discussed prominently. revision: partial

  3. Referee: Table 1 and Appendix G: Per-concept results reveal notable variability obscured by category-level averages (e.g., Cat: UAcc=0.96, RRacc=0.82 vs. Dog: UAcc=0.94, RRacc=0.59; Cartoon Style: UAcc=0.82, lowest among all TILDE results). Paper does not analyze which concept properties predict success or failure. A brief discussion of when the method is expected to struggle would strengthen the paper.

    Authors: We agree that the per-concept variability deserves explicit analysis. The referee's examples are apt: Dog has substantially lower RRacc (0.59) than Cat (0.82), and Cartoon Style has the lowest UAcc (0.82) among all TILDE results. We will add a discussion paragraph analyzing the concept properties that predict difficulty. Our interpretation, supported by the per-concept tables, is that retention suffers most when the forget concept is semantically coupled to many neighboring concepts in CLIP space (e.g., 'Dog' overlaps with many animal-related prompts, so the thresholded energy may penalize some benign animal images), and forgetting is harder when the concept is visually diffuse or stylistic rather than a concrete object (e.g., 'Cartoon Style' is a broad visual category without a single canonical referent, making the CLIP-based energy less discriminative). We will also note that for 'Dog' specifically, the low RRacc is partly because related-retain concepts for Dog include other animals whose CLIP similarity to 'Dog' descriptors may exceed tau, causing collateral suppression. This analysis will be added to Section 5.3 and connected to the Limitations section's discussion of energy quality. revision: yes

Circularity Check

0 steps flagged

No significant circularity: the KL projection derivation is self-contained, the GFlowNet backbone is externally cited, and the CLIP-energy/CLIP-metric overlap is a correctness concern rather than a definitional reduction.

full rationale

The paper's central derivation chain is not circular. The constrained KL projection (Eq. 1) yields the Gibbs-form target (Eq. 2) via a standard Lagrangian argument, fully proven in Appendix D.1 (Proposition 4) using Slater's condition and KKT — no self-citation is invoked for this result. The residual ∇-GFlowNet optimization backbone is cited to Liu et al. [23] (ICLR 2025), an external work; the paper applies it rather than re-deriving it, and Theorem 1 (Appendix C.2) provides a self-contained telescoping proof that the residual DB condition yields the desired tilted marginal. The thresholded CLIP forget energy (Eq. 3) is a design choice, not defined in terms of the evaluation metrics. The shared use of CLIP for both the training energy and some evaluation metrics (Uclip, RRclip, GRclip) is a potential measurement-bias concern, but the primary accuracy metrics (UAcc, RRacc, GRacc) use a separate VLM (Qwen2.5-VL), and the paper explicitly acknowledges this limitation in Section 6. This is a correctness risk, not circularity: the training signal does not reduce to the evaluation metric by construction. The per-category threshold τ is hand-tuned, but it is tuned on benign-prompt CLIP distributions (Appendix E.6), not on the reported evaluation outcomes. No step in the derivation chain reduces to its own inputs by definition or by self-citation.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 0 invented entities

The paper introduces no new physical entities, particles, or forces. The 'residual continuation weight' F̃_t and 'continuation score' h_ϕ are mathematical constructs within the GFlowNet framework, not new ontological entities. The thresholded forget energy ẽ_C is a functional form, not a postulated object. All free parameters are hyperparameters tuned to data or fixed by convention. The key axiom—that score-matching loss minimization implies integrated ratio-form DB—is flagged by the authors themselves as not guaranteed (Appendix C.6).

free parameters (6)
  • τ (CLIP threshold) = 0.21 (objects), 0.22 (characters), 0.20 (style)
    Hand-tuned per category from the 90-95 percentile of benign CLIP similarities (Appendix E.6). Controls the no-penalty region. Figure 3 shows performance is sensitive to this choice.
  • λ_scale (energy scale) = Swept over {0.5, 1, 2, 5}, smallest stable value chosen
    Absorbs the Lagrange multiplier β and controls overall tilt magnitude. Tuned per concept to achieve stable forget rate (Appendix E.6).
  • α (exponential slope) = 10
    Controls sharpness of energy above threshold. Stated as less sensitive; fixed throughout (Appendix E.6).
  • λ_rev (reverse loss weight) = 1.0
    Balancing weight for L_rev in Eq. 9. Fixed across all experiments.
  • λ_term (terminal loss weight) = 0.1
    Balancing weight for L_term in Eq. 9. Fixed across all experiments.
  • r (LoRA rank) = 8
    Rank of LoRA adapters on attention layers. Standard choice, not tuned.
axioms (4)
  • domain assumption The pretrained diffusion model's denoising transitions approximately satisfy detailed balance with the DDPM noising kernel.
    Appendix D.3 acknowledges the pretrained model was trained with a denoising objective, not a GFlowNet objective, so it only approximately satisfies DB. The residual g_ϕ is introduced to parameterize this discrepancy.
  • domain assumption CLIP similarity is a faithful measure of concept evidence for the evaluated concepts (objects, characters, styles).
    Section 2.2 instantiates E_C using CLIP similarity. Section 6 acknowledges this may fail for 'ambiguous or highly compositional concepts.'
  • standard math The prompt population π(y) is held fixed; unlearning only modifies conditional distributions p(·|y).
    Eq. 1 optimizes over conditional generators with π(y) fixed. This is a standard assumption for conditional generation but excludes prompt-level mitigation.
  • ad hoc to paper The score-matching surrogate loss L = L_fwd + λ_rev L_rev + λ_term L_term, when minimized, yields transitions satisfying the integrated ratio-form DB condition (Eq. 32).
    Appendix C.6 explicitly states: 'We do not claim a general if and only if theorem from L=0 to distributional correctness.' The paper claims only that IF the learned transitions satisfy Eq. 32, THEN the target is achieved, not that gradient descent on L reaches L=0.

pith-pipeline@v1.1.0-glm · 32807 in / 3561 out tokens · 530847 ms · 2026-07-08T05:50:58.341358+00:00 · methodology

0 comments
read the original abstract

Concept unlearning in text-to-image diffusion models is critical for safe and practical deployment: with rising privacy concerns, copyright disputes, trademark constraints, and safety regulations, deployed systems must be able to suppress unwanted concepts after training. Existing methods often remove the target concept effectively, but practical unlearning also requires an equally fundamental property: the unlearned model should retain quality, diversity, and semantic coverage on benign generation. The gold standard is a retain-only model trained from scratch without the unwanted data. However, common erasure objectives do not specify which post-unlearning distribution should approximate this reference, leaving retention as an implicit consequence of the update rule. We propose TILDE, TILt-based Distributional Erasure, which formulates concept unlearning as a distributional alignment problem: the desired target is the minimum-deviation conditional distribution from the pretrained model under a forgetting constraint. This energy-tilted, anchor-free target suppresses concept-expressing images while preserving benign relative mass for each prompt. We instantiate this principle with residual $\nabla$-GFlowNet training, which learns the score correction induced by the forget energy relative to the pretrained diffusion model. Across objects, artistic styles, and characters, TILDE achieves strong forgetting while improving retention and distributional fidelity over prior baselines.

Figures

Figures reproduced from arXiv: 2607.06432 by Konda Reddy Mopuri, Naoki Murata, Naveen George, Yuhta Takida, Yuki Mitsufuji.

Figure 1
Figure 1. Figure 1: Concept unlearning failure modes and qualitative examples for Van Gogh style removal. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of TILDE training in diffusion latent space. Given a target concept C and a sampled prompt y, the LoRA-adapted denoiser samples a trajectory zT → · · · → z0, and evaluates the thresholded forget energy EeC(xˆ) from CLIP concept evidence. Residual ∇-GFlowNet training then matches the score correction between P θ F (zt−1 | zt, y) and P pre F (zt−1 | zt, y) using the continuation score hϕ(zt, t, y), … view at source ↗
Figure 3
Figure 3. Figure 3: Effect of the energy threshold τ on Pikachu concept unlearning. Stars mark our chosen τ=0.22 (TILDE). Removing the threshold entirely yields (U, RR, GR) = (1.00, 0.08, 0.49) (off-axis) [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

46 extracted references · 46 canonical work pages · 2 internal anchors

  1. [1]

    Erasing more than intended? how concept erasure degrades the generation of non-target con- cepts

    Ibtihel Amara, Ahmed Imtiaz Humayun, Ivana Kajic, Zarana Parekh, Natalie Harris, Sarah Young, Chirag Nagpal, Najoung Kim, Junfeng He, Cristina Nader Vasconcelos, Deepak Ra- machandran, Golnoosh Farnadi, Katherine Heller, Mohammad Havaei, and Negar Rostamzadeh. Erasing more than intended? how concept erasure degrades the generation of non-target con- cepts...

    work page 2025

  2. [2]

    Qwen2.5-VL Technical Report

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al. Qwen2.5-VL technical report.arXiv preprint arXiv:2502.13923, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  3. [3]

    GFlowNet foundations.Journal of Machine Learning Research, 24(210):1–55, 2023

    Yoshua Bengio, Salem Lahlou, Tristan Deleu, Edward J Hu, Mo Tiwari, and Emmanuel Bengio. GFlowNet foundations.Journal of Machine Learning Research, 24(210):1–55, 2023

    work page 2023

  4. [4]

    Training diffusion models with reinforcement learning

    Kevin Black, Michael Janner, Yilun Du, Ilya Kostrikov, and Sergey Levine. Training diffusion models with reinforcement learning. InInternational Conference on Learning Representations (ICLR), 2024

    work page 2024

  5. [5]

    Fantastic targets for concept erasure in diffusion models and where to find them

    Anh Tuan Bui, Thuy-Trang Vu, Long Tung Vuong, Trung Le, Paul Montague, Tamas Abraham, Junae Kim, and Dinh Phung. Fantastic targets for concept erasure in diffusion models and where to find them. InThe Thirteenth International Conference on Learning Representations,

    work page

  6. [6]

    URLhttps://openreview.net/forum?id=tZdqL5FH7w

    work page

  7. [7]

    Reference-specific unlearning metrics can hide the truth: A reality check.arXiv preprint arXiv:2510.12981, 2025

    Sungjun Cho, Dasol Hwang, Frederic Sala, Sangheum Hwang, Kyunghyun Cho, and Sungmin Cha. Reference-specific unlearning metrics can hide the truth: A reality check.arXiv preprint arXiv:2510.12981, 2025

    work page arXiv 2025

  8. [8]

    Directly fine-tuning diffusion models on differentiable rewards

    Kevin Clark, Paul Vicol, Kevin Swersky, and David J Fleet. Directly fine-tuning diffusion models on differentiable rewards. InInternational Conference on Learning Representations (ICLR), 2024

    work page 2024

  9. [9]

    Regulation (EU) 2016/679 of the european parliament and of the council of 27 april 2016

    European Parliament and Council of the European Union. Regulation (EU) 2016/679 of the european parliament and of the council of 27 april 2016. Official Journal of the Euro- pean Union, 2016. URL https://eur-lex.europa.eu/legal-content/EN/TXT/?uri= CELEX:32016R0679. General Data Protection Regulation, Article 17: Right to erasure

    work page 2016

  10. [10]

    Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. InThe Twelfth International Conference on Learning Representations, 2024. URLhttps://openreview.net/forum?id=gn0mIhQGNM. 10

    work page 2024

  11. [11]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF international conference on computer vision, pages 2426–2436, 2023

    work page 2023

  12. [12]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 5111–5120, 2024

    work page 2024

  13. [13]

    Meta- unlearning on diffusion models: Preventing relearning unlearned concepts

    Hongcheng Gao, Tianyu Pang, Chao Du, Taihang Hu, Zhijie Deng, and Min Lin. Meta- unlearning on diffusion models: Preventing relearning unlearned concepts. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 2131–2141, 2025

    work page 2025

  14. [14]

    The illusion of unlearning: The unstable nature of machine unlearning in text-to-image diffusion models

    Naveen George, Karthik Nandan Dasaraju, Rutheesh Reddy Chittepu, and Konda Reddy Mopuri. The illusion of unlearning: The unstable nature of machine unlearning in text-to-image diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 13393–13402, 2025

    work page 2025

  15. [15]

    Locality-aware continual unlearning for diffusion models

    Naveen George, Naoki Murata, Yuhta Takida, Konda Reddy Mopuri, and Yuki Mitsufuji. Locality-aware continual unlearning for diffusion models. InEuropean Conference on Computer Vision. Springer, 2026

    work page 2026

  16. [16]

    Selective amnesia: A continual learning approach to forgetting in deep generative models.Advances in Neural Information Processing Systems, 36:17170–17194, 2023

    Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models.Advances in Neural Information Processing Systems, 36:17170–17194, 2023

    work page 2023

  17. [17]

    GANs trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs trained by a two time-scale update rule converge to a local nash equilibrium. InAdvances in Neural Information Processing Systems (NeurIPS), 2017

    work page 2017

  18. [18]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    work page 2020

  19. [19]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations (ICLR), 2022

    work page 2022

  20. [20]

    Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers

    Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, Fu-En Yang, and Yu- Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. InEuropean Conference on Computer Vision, pages 360–376. Springer, 2024

    work page 2024

  21. [21]

    Ablating concepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691–22702, 2023

    work page 2023

  22. [22]

    EraseFlow: Learning concept erasure policies via GFlowNet-driven alignment

    Naga Sai Abhiram Kusumba, Maitreya Patel, Kyle Min, Changhoon Kim, Chitta Baral, and Yezhou Yang. EraseFlow: Learning concept erasure policies via GFlowNet-driven alignment. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. URL https://openreview.net/forum?id=igB289kbej

    work page 2025

  23. [23]

    Set you straight: Auto-steering denoising trajectories to sidestep unwanted concepts

    Leyang Li, Shilin Lu, Yan Ren, and Adams Wai-Kin Kong. Set you straight: Auto-steering denoising trajectories to sidestep unwanted concepts. InProceedings of the 33rd ACM Interna- tional Conference on Multimedia, pages 9257–9266, 2025

    work page 2025

  24. [24]

    Xiao, Weiyang Liu, Yoshua Bengio, and Dinghuai Zhang

    Zhen Liu, Tim Z. Xiao, Weiyang Liu, Yoshua Bengio, and Dinghuai Zhang. Efficient diversity- preserving diffusion alignment via gradient-informed GFlowNets. InInternational Conference on Learning Representations (ICLR), 2025

    work page 2025

  25. [25]

    When are concepts erased from diffusion models? In39th Conference on Neural Information Processing Systems (NeurIPS), 2025

    Kevin Lu, Nicky Kriplani, Rohit Gandikota, Minh Pham, David Bau, Chinmay Hegde, and Niv Cohen. When are concepts erased from diffusion models? In39th Conference on Neural Information Processing Systems (NeurIPS), 2025. 11

    work page 2025

  26. [26]

    Mace: Mass concept erasure in diffusion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6430–6440, 2024

    work page 2024

  27. [27]

    Trajectory balance: Improved credit assignment in GFlowNets

    Nikolay Malkin, Moksh Jain, Emmanuel Bengio, Chen Sun, and Yoshua Bengio. Trajectory balance: Improved credit assignment in GFlowNets. InAdvances in Neural Information Processing Systems (NeurIPS), 2022

    work page 2022

  28. [28]

    Ascent fails to forget

    Ioannis Mavrothalassitis, Pol Puigdemont, Noam Itzhak Levi, and V olkan Cevher. Ascent fails to forget. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems,

    work page

  29. [29]

    URLhttps://openreview.net/forum?id=KBJSV1XApq

    work page

  30. [30]

    Direct unlearning optimization for robust and safe text-to-image models

    Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text-to-image models. InAdvances in Neural Information Processing Systems (NeurIPS), 2024

    work page 2024

  31. [31]

    Learning to unlearn while retaining: Combating gradient conflicts in machine unlearning

    Gaurav Patel and Qiang Qiu. Learning to unlearn while retaining: Combating gradient conflicts in machine unlearning. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 4211–4221, 2025

    work page 2025

  32. [32]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational Conference on Machine Learning (ICML), 2021

    work page 2021

  33. [33]

    Six-cd: Benchmarking concept removals for text-to-image diffusion models

    Jie Ren, Kangrui Chen, Yingqian Cui, Shenglai Zeng, Hui Liu, Yue Xing, Jiliang Tang, and Lingjuan Lyu. Six-cd: Benchmarking concept removals for text-to-image diffusion models. In2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 28769–28778, 2025

    work page 2025

  34. [34]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    work page 2022

  35. [35]

    Score-based generative modeling through stochastic differential equations

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations (ICLR), 2021

    work page 2021

  36. [36]

    Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models

    Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer, Vishal M Patel, and Karthik Nandaku- mar. Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 23765–23774, 2025

    work page 2025

  37. [37]

    Ring-a-bell! how reliable are concept removal methods for diffusion models? In12th International Conference on Learning Representations, 2024

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? In12th International Conference on Learning Representations, 2024

    work page 2024

  38. [38]

    Fine-Tuning of Continuous-Time Diffusion Models as Entropy-Regularized Control

    Masatoshi Uehara, Yulai Zhao, Kevin Black, Ehsan Hajiramezanali, Gabriele Scalia, Nathaniel Lee Diamant, Alex M. Tseng, Tommaso Biancalani, and Sergey Levine. Fine- tuning of continuous-time diffusion models as entropy-regularized control.arXiv preprint arXiv:2402.15194, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  39. [39]

    Scissorhands: Scrub data influence via connection sensitivity in networks

    Jing Wu and Mehrtash Harandi. Scissorhands: Scrub data influence via connection sensitivity in networks. InEuropean Conference on Computer Vision, pages 367–384. Springer, 2024

    work page 2024

  40. [40]

    Erasing undesirable influence in diffusion models

    Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasing undesirable influence in diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 28263–28273, 2025

    work page 2025

  41. [41]

    UnlearnCanvas: A stylized image dataset for enhanced machine unlearning evaluation in diffusion models

    Yihua Zhang, Chongyu Fan, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Gaoyuan Zhang, Gaowen Liu, Ramana Kompella, Xiaoming Liu, and Sijia Liu. UnlearnCanvas: A stylized image dataset for enhanced machine unlearning evaluation in diffusion models. In Thirty-eighth Conference on Neural Information Processing Systems Datasets and Benchmarks Track,...

    work page 2024

  42. [42]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models.Advances in neural information processing systems, 37: 36748–36776, 2024

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models.Advances in neural information processing systems, 37: 36748–36776, 2024

    work page 2024

  43. [43]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision, pages 385–403. Springer, 2024

    work page 2024

  44. [44]

    for free,

    Kairan Zhao, Meghdad Kurmanji, George-Octavian B˘arbulescu, Eleni Triantafillou, and Peter Triantafillou. What makes unlearning hard and what to do about it. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https://openreview. net/forum?id=QAbhLBF72K. 13 Appendix Table of Contents A. Algorithm Pseudocode..............

    work page 2024

  45. [45]

    Pretrained-and-finetuned model (used as the unlearning starting point).Starting from Stable Diffusion v1.5, we finetune on thefullUnlearnCanvas dataset, which covers all styles. Concept unlearning is performed on top of this checkpoint, so all forgetting and retention metrics are measured relative to a model that has been explicitly trained on the target style

    work page

  46. [46]

    Retain-only reference for FADE.For each target style Cstyle, we separately finetune a fresh Stable Diffusion v1.5 on UnlearnCanvas with Cstyle removed (i.e., on UnlearnCanvas\Cstyle). This produces a model whose training distribution matches the pretrained-and-finetuned model in everything except the omitted style, exactly the gold-standard retain-only re...

    work page