Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

GIFT: Gradient-aware Immunization of diffusion models against malicious Fine-Tuning with safe concepts retention

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read GIFT immunizes text-to-image diffusion models so that malicious fine-tuning cannot re-introduce protected objects, artist styles, or NSFW content, while preserving safe-concept generation.

desk verdict GIFT is a plausible hybrid of IMMA and RepNoise that buys a better trade-off in the reported experiments, but the representation-noising loss has a possible trivial collapse solution that the paper leaves unexamined. read the letter →

arxiv 2507.13598 v1 pith:RUG5MSHA submitted 2025-07-18 cs.CR cs.AIcs.CVcs.LG

Amro Abdalla , Ismail Shaheen , Dan DeGenaro , Rupayan Mallick , Bogdan Raita , Sarah Adel Bargal This is my paper
classification cs.CRcs.AIcs.CVcs.LG
keywords diffusionmodelsmodelimmunizationmaliciousfine-tuningconcepterasurerepresentationnoisingbi-leveloptimizationDreamBoothLoRA
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a diffusion model can be immunized before release so that later fine-tuning attempts with DreamBooth or LoRA cannot reintroduce harmful or copyrighted concepts, while the model remains fully usable for safe content. The proposed method, GIFT, frames immunization as a two-level optimization: an inner step preserves performance on safe data, and an outer step degrades the model's internal representations of malicious concepts by combining loss maximization with representation noising. Experiments on 26 objects, 10 artistic styles, and NSFW content report that GIFT blocks re-learning of the protected concepts but, unlike the IMMA baseline, keeps safe-concept generation close to the undefended model. If correct, the result gives model owners a practical pre-release defense that does not sacrifice benign fine-tuning ability.

What carries the argument

The load-bearing mechanism is a bi-level optimization with an immunization upper level and a prior-preservation lower level, iterated as $\theta' = \theta - \alpha_P \nabla L_P(\theta)$ followed by $\psi'' = \psi' - \alpha_I \nabla L_I(\psi')$, where $\psi$ are cross-attention parameters. A Taylor expansion of the immunization gradient produces a second-order correction term $\alpha_P \alpha_I \nabla^2 L_I(\psi) \nabla_\psi L_P(\theta)$, which steers the immunization update along the prior-preservation gradient, preventing the two objectives from fighting. The immunization loss itself is $L_{\text{immunize}} = L_{\max} + \beta \, L_{\text{noise}}$, where $L_{\max}$ is the negative diffusion denoising loss on malicious data and $L_{\text{noise}}$ is a sum over U-Net layers of the mean squared error between activation $z_m^{(j)}$ and noise sampled from that activation's own empirical mean and variance. Representation noising is what targets residual mutual information in intermediate representations; the paper adapts this technique from the language-model domain to text-to-image diffusion.

What would settle it

Measure intermediate U-Net activations, their mean and variance, for malicious and safe prompts before and after GIFT, and estimate mutual information between maliciously conditioned inputs and those activations; if post-immunization activations have near-zero variance or mutual information on malicious concepts is not substantially lower than in the undefended model, the central claim collapses. Alternatively, fine-tune a GIFT-immunized model for substantially more steps than the reported sweet spot, such as over 2000 DreamBooth steps, and check whether a protected artist style regains prompt-aligned generalization; the paper's own plots show GIFT begins overfitting at later steps, so a longer attack is a direct test of persistence.

Watch

Extended reading notes

Core claim

The central discovery is that immunization against malicious fine-tuning can be achieved by a bi-level optimization whose outer objective adds a representation-noising term to loss maximization, so that mutual information about the malicious concept is reduced in intermediate U-Net activations, not just in outputs. The paper argues that maximizing the denoising loss alone leaves $MI(x_m|c_m; z_m)$ intact, and the data processing inequality says that information in intermediate representations upper-bounds what can reach outputs. GIFT targets cross-attention layers, which are most responsible for concept encoding, and the bi-level scheme's second-order Taylor correction term makes the immunization update aware of prior-preservation updates, coordinating the two objectives. The empirical claim is that after GIFT, DreamBooth or LoRA fine-tuning on protected objects, artist styles, and NSFW content yields noisy or overfit generations that fail to generalize the malicious concept, while fine-tuning on safe concepts remains effective.

Load-bearing premise

The method assumes that adding noise matched to a layer's own activation statistics destroys the malicious concept's mutual information without collapsing the activation statistics that safe concepts depend on; if the noising loss instead just drives activation variance to zero, the reported safe-generation and benign fine-tuning results would not hold beyond the tested concepts.

Editorial extensions

If this is right

  • A GIFT-immunized Stable Diffusion v1.5 resists DreamBooth and LoRA fine-tuning intended to re-introduce protected objects, artist styles, and NSFW content, based on CLIP, LPIPS, DINO, and NudeNet metrics across the tested setups.
  • Unlike ESD, whose erased concepts are re-acquired within roughly 100 fine-tuning steps, GIFT prevents generalized style re-acquisition; outputs either stay noise-like or overfit to individual training images without prompt alignment.
  • Unlike IMMA, which degrades safe-concept generation, GIFT keeps CLIP and LPIPS scores on safe data close to the undefended checkpoint, and remains fine-tunable on benign concepts.
  • Applying a post-immunization fine-tuning step on a generic benign prompt strengthens both safe retention and malicious re-adaptation resistance, an effect the paper reports but does not explain.
  • GIFT is agnostic to the attack algorithm: a single immunization works for both DreamBooth and LoRA, whereas the IMMA baseline requires per-attack immunization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If representation noising is truly what blocks re-learning, its effect should scale with the number and placement of noised U-Net layers; the paper does not ablate this, so a natural extension is to pinpoint which layers carry the concept information and whether noising only those layers yields the same protection with less safe-side cost.
  • The reported post-immunization strengthening hints that immunization updates and benign fine-tuning interact through the same second-order correction; one testable extension is to vary the benign prompt used for post-immunization and measure whether protection correlates with that prompt's similarity to the malicious concept.
  • Because the method assumes pre-collected representative malicious datasets, an adversary could target concepts absent from those sets; extending GIFT to protect a broader concept space or updating immunization as new harmful concepts are identified would test whether the defense is more than dataset-specific.
  • The mutual-information argument treats activations as the bottleneck; a direct information-theoretic test could estimate the mutual information before and after immunization and check whether $L_{\text{noise}}$ actually reduces it, or merely increases activation variance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes GIFT, a bi-level immunization framework for text-to-image diffusion models. The lower-level objective applies a prior-preservation (denoising) loss on safe data, while the upper-level objective applies an immunization loss on malicious data, combining loss maximization with representation noising of intermediate U-Net activations. Experiments on Stable Diffusion v1.5 cover objects, artistic styles, and NSFW content, comparing GIFT with IMMA and ESD under DreamBooth and LoRA fine-tuning. The central claim is that GIFT impairs malicious re-learning while preserving generation quality and benign fine-tunability better than IMMA, and is more robust than ESD.

Significance. If the empirical claims are substantiated, GIFT would be a practically relevant improvement over existing immunization and erasure baselines for diffusion models, offering a better safety-utility trade-off than IMMA and resisting fine-tuning circumvention better than ESD. The paper adapts representation noising from LLMs to diffusion U-Nets, targets cross-attention layers, and evaluates across multiple concept categories, which are useful contributions. However, the evidence is currently limited by single-run experiments, missing quantitative NSFW results, and an unverified mechanism for representation noising; these gaps prevent the paper from fully supporting its central claim as presented.

major comments (4)
  1. [§3.3, Eq. (7)] The representation noising loss in Eq. (7) can be minimized by driving each activation z toward its empirical mean and shrinking its variance, rather than by selectively removing concept-specific mutual information. Since the noise is sampled from the same activation's mean and variance, the expected loss for fixed z is ||z - μ_z||² + σ²_z, so a global collapse of activation statistics is a valid minimizer. The paper reports no per-layer activation statistics before and after immunization, no ablation over the chosen set of noised layers, and no sensitivity analysis for the weighting hyperparameter β in Eq. (8). This makes the safe-concept-retention half of the central claim unverified: the observed preservation on tested safe concepts could be consistent with a mild global collapse. I request an ablation study of the noised layer set, a β sweep, and a comparison against a variance-collapse baseline (e.g., an L2 penalty toward the mean activation) to show that the noising mechanism is doing something beyond activation shrinkage.
  2. [§4, Figs. 3 and 5] All quantitative results appear to be single-run averages without error bars, confidence intervals, or significance tests. For example, Fig. 3 reports averaged per-epoch CLIP and LPIPS scores across 26 objects, and Fig. 5 reports averaged CLIP, LPIPS, and DINO scores across artists, but there is no indication of variance across seeds, random subsets, or initialization states. Given that the claimed advantage over IMMA is a matter of degree, the absence of uncertainty quantification makes it impossible to assess whether GIFT's improvements are reliable. The authors should rerun the main comparisons with multiple seeds and report means and standard deviations, or at least report the range across objects/styles.
  3. [§4.3, Fig. 6] The NSFW evaluation is only qualitative. The paper lists NudeNet as an evaluation metric in Section 4 but never reports NudeNet scores or any other quantitative measure of explicit-content suppression after malicious fine-tuning. Figure 6 shows sample images, but the claim that GIFT 'consistently suppresses' NSFW re-adaptation and preserves safe learning needs a quantitative table with NudeNet detection rates (or similar) across methods, fine-tuning steps, and the safe/malicious splits. Please also state the exact sizes of the DM and DA splits for the NSFW experiments and the number of evaluation prompts.
  4. [§3.1 and §5] The problem statement in §3.1 claims resistance under 'any subsequent fine-tuning,' and §5 claims that GIFT 'does not depend on the attack algorithm during immunization.' The experiments, however, only test DreamBooth and a single LoRA adapter configuration, over relatively short training horizons. This is too narrow to support the universal phrasing. The authors should either temper these claims to the evaluated adaptation methods and compute budgets, or add experiments with additional fine-tuning methods (e.g., Textual Inversion, full fine-tuning) and longer training horizons to demonstrate persistence.
minor comments (6)
  1. [§3.3] The notation in Eq. (7) is slightly inconsistent: z_m^(j) and ε_m^(j) use parentheses for layer indices, while the sum index is written 'j = 1, ..., n'; please make the dependency on j explicit in the loss expression for clarity.
  2. [§3.2] The text says 'Full derivation can be found in the appendix,' but the arXiv version does not seem to include an appendix with this derivation. Either include the appendix or remove the pointer.
  3. [§4, Algorithm 1] Algorithm 1 does not specify the number of inner-loop steps per outer-loop step, the batch sizes for DM and DS, or whether gradients are taken through the lower-level parameter update when computing the upper-level gradient; these details are needed to reproduce the bi-level updates described in Eqs. (2)-(4).
  4. [§4.3] The 'post-immunization (PI) fine-tuning' step is described only briefly. Please specify the exact prompt(s), number of steps, learning rate, and whether this step is applied to all objects/styles or only the NSFW experiments, because GIFT+PI appears in Fig. 6 as a recommended variant.
  5. [Figures 3 and 5] The y-axis label 'LPIPS Similarity' is misleading: LPIPS is a distance/dissimilarity metric. Use 'LPIPS distance' or 'LPIPS dissimilarity' to avoid confusion about whether higher values are better.
  6. [References] Reference [12] has formatting artifacts (e.g., 'Imagen-Team-Google, :' and the author list), and reference [39] lacks author and publication details; these should be cleaned up before publication.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found: GIFT's central claims are tested on held-out attack splits and the derivation does not reduce to its inputs.

full rationale

Walking the derivation chain: the bi-level objective in Eq. (1) optimizes an immunization loss (Eqs. 5–8) on the malicious split DM and a prior preservation loss (Eq. 9) on the safe split DS, with evaluation on disjoint attack splits DA for objects, art styles, and NSFW content. The Taylor expansion in Eqs. (2–4) is a standard algebraic identity and does not assume the conclusion. The representation-noising loss in Eq. (7) is adopted from external prior work (RepNoise [23]) and is not a self-citation; while its mechanism is an assumption, the reported resistance is not equivalent by construction to the loss itself, because the attack evaluation generalizes to unseen data. No fitted constant is renamed as a prediction, and no load-bearing step depends on a self-citation. The limitations stated in Section 6 (e.g., overlap between safe and unsafe visual features) are honest caveats about robustness, not circular steps. Therefore the paper's derivation is self-contained with respect to the charged circularity patterns, and the appropriate score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new physical or model entities are introduced. The ledger is dominated by unspecified hyperparameters and the implicit assumption that the representation-noising loss does not collapse activations.

free parameters (3)
  • beta (representation noising weight) = not reported
    Weights Lnoise in Limmunize = Lmax + beta * Lnoise; no value, grid, or sensitivity analysis given.
  • inner/outer learning rates alpha_inner, alpha_outer = not reported
    Used in Algorithm 1 and Eq. (2); no values reported, so re-implementation requires guessing.
  • set and number n of noised U-Net layers = not reported
    Eq. (7) sums over layers j=1..n, but the text says the loss is applied to cross-attention layers; the exact layers are not specified.
assumptions (4)
  • standard math Data processing inequality: MI(x|cm; zm) >= MI(x|cm; ym)
    Invoked in Section 3.3 to justify reducing MI between inputs and intermediate representations as a way to reduce MI with outputs.
  • domain assumption Cross-attention layers are the primary locus of concept encoding in Stable Diffusion
    Used to restrict the upper-level immunization update to psi (cross-attention layers), based on a citation to [15].
  • domain assumption A representative malicious dataset DM can be curated for each concept to immunize
    Stated as a limitation in Section 6; if the attacker uses a concept not represented in DM, the defense has no handle on it.
  • ad hoc to paper Minimizing MSE(z, epsilon) with epsilon sampled from the activation's own mean/variance destroys concept information without collapsing activations
    The Lnoise objective in Eq. (7) has a trivial global minimum at zero-variance activations; the paper assumes this does not happen in practice and does not report activation statistics.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GIFT: Gradient-aware Immunization of diffusion models against malicious Fine-Tuning with safe concepts retention." pith.science (2026). https://pith.science/paper/RUG5MSHA

@misc{pith2026250713598,
  author       = {Pith},
  title        = {Pith review of: GIFT: Gradient-aware Immunization of diffusion models against malicious Fine-Tuning with safe concepts retention},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RUG5MSHA}},
  note         = {Machine review of arXiv:2507.13598}
}
read the original abstract

We present GIFT: a {G}radient-aware {I}mmunization technique to defend diffusion models against malicious {F}ine-{T}uning while preserving their ability to generate safe content. Existing safety mechanisms like safety checkers are easily bypassed, and concept erasure methods fail under adversarial fine-tuning. GIFT addresses this by framing immunization as a bi-level optimization problem: the upper-level objective degrades the model's ability to represent harmful concepts using representation noising and maximization, while the lower-level objective preserves performance on safe data. GIFT achieves robust resistance to malicious fine-tuning while maintaining safe generative quality. Experimental results show that our method significantly impairs the model's ability to re-learn harmful concepts while maintaining performance on safe content, offering a promising direction for creating inherently safer generative models resistant to adversarial fine-tuning attacks.

Figures

Figures reproduced from arXiv: 2507.13598 by the authors.

Figure 2
Figure 2. Models immunized with GIFT achieve CLIP and LPIPS scores similar to the undefended [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 1
Figure 1. GIFT Immunizes Similarly to IMMA. Here, we treat the tortoise plushie as a malicious concept using the prompt <a *s tortoise plushie on the beach> where *s is DreamBooth’s special token. Top row: Reference images used to fine-tune via DreamBooth. Second row: Results of fine-tuning the undefended SD. Third row: Results of fine-tuning after 1K steps of immunization with GIFT. Bottom row: Results of fine-tuning after 1… view at source ↗
Figure 2
Figure 2. GIFT Retains Safe Concepts Better than IMMA. Here, we treat the bass guitar as a safe concept unrelated to the malicious concept from [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figures from the paper (5 more)
Figure 3
Figure 3. Figure 3 [PITH_FULL_IMAGE:figures/full_fig_p009_3.png]
Figure 4
Figure 4. Figure 4: GIFT Prevents Artistic Style Adaption. We fine-tune each model on a dataset of 20 Van Gogh generations (reference images included) and validate using the prompt <a painting of a cat in [artist] style>. On the left is the CLIP score for each method over the duration of …
Figure 5
Figure 5. Figure 5: Quantitative Results for All Artists. Comparison of CLIP Score, LPIPS Similarity, and DINO Similarity over fine-tuning steps for all evaluated artists. GIFT maintains lower LPIPS and DINO similarity than ESD, indicating reduced memorization of training data. The CLIP s…
Figure 6
Figure 6. Figure 6: GIFT Blocks Malicious Fine-Tuning While Preserving Safe Adaptation. We fine-tune each NSFW-immune model on a safe concept (A) and a malicious one (B), evaluating at steps 500, 1000, and 2500. ESD permits safe learning but fails to block unsafe content; IMMA blocks unsa…
Figure 7
Figure 7. Figure 7: GIFT Immunization with LoRA. GIFT can prevent model adaption using LoRA. 11 [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Video Deepfake Abuse: How Company Choices Predictably Shape Misuse Patterns

    cs.CY 2025-11 conditional novelty 6.0 of 10

    A few open-weight video models and distribution platforms dominate the creation and spread of NSFW AI video, making developer and platform choices the main intervention points for reducing non-consensual deepfake abuse.

Reference graph

Works this paper leans on

39 extracted references · 25 canonical work pages · cited by 1 Pith paper

  1. [1]

    Data unlearning in diffusion models

    Silas Alberti, Kenan Hasanaliyev, Manav Shah, and Stefano Ermon. Data unlearning in diffusion models. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=SuHScQv5gP

    work page 2025

  2. [2]

    Nudenet: Neural nets for nudity classification, detection and selective censoring

    Praneet Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring. https://github.com/platelminto/NudeNetClassifier, 2019

    work page 2019

  3. [3]

    Stable diffusion license, 2022

    CompVis. Stable diffusion license, 2022. URL https://github.com/CompVis/ stable-diffusion/blob/main/LICENSE. CreativeML OpenRAIL-M License

    work page 2022

  4. [4]

    Model-agnostic meta-learning for fast adap- tation of deep networks

    Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adap- tation of deep networks. InInternational conference on machine learning, pages 1126–1135. PMLR, 2017

    2017

  5. [5]

    An image is worth one word: Personalizing text-to-image generation using textual inversion

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit Haim Bermano, Gal Chechik, and Daniel Cohen-or. An image is worth one word: Personalizing text-to-image generation using textual inversion. InThe Eleventh International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=NAQvF08TcyG

    work page 2023

  6. [6]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 2426–2436, October 2023

    work page 2023

  7. [7]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyńska, and David Bau. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 5111–5120, January 2024

    work page 2024

  8. [8]

    Hts-attack: Heuristic token search for jailbreaking text-to-image models, 2024

    Sensen Gao, Xiaojun Jia, Yihao Huang, Ranjie Duan, Jindong Gu, Yang Bai, Yang Liu, and Qing Guo. Hts-attack: Heuristic token search for jailbreaking text-to-image models, 2024. URL https://arxiv.org/abs/2408.13896

    arXiv 2024

Show all 39 references
  1. [9]

    Reliable and efficient concept erasure of text-to-image diffusion models

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors,Computer Vision – ECCV 2024, pag...

    2024

  2. [10]

    Clipscore: A reference-free evaluation metric for image captioning.ArXiv, abs/2104.08718, 2021

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning.ArXiv, abs/2104.08718, 2021. URL https://api.semanticscholar.org/CorpusID:233296711

    2021 arXiv

  3. [11]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. InInternational Conference on Learning Representations, 2022. URL https://openreview.net/forum?id= nZeVKeeFYf9

    2022

  4. [12]

    Imagen-Team-Google, :, Jason Baldridge, Jakob Bauer, Mukul Bhutani, Nicole Brichtova, Andrew Bunner, Lluis Castrejon, Kelvin Chan, Yichang Chen, Sander Dieleman, Yuqing Du, Zach Eaton-Rosen, Hongliang Fei, Nando de Freitas, Yilin Gao, Evgeny Gladchenko, Sergio Gómez Colmenarej...

    2024

  5. [13]

    Ablating concepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 22691–22702, October 2023

    2023

  6. [14]

    Multi- concept customization of text-to-image diffusion

    Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun-Yan Zhu. Multi- concept customization of text-to-image diffusion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 1931–1941, June 2023. 13

    1931

  7. [15]

    Towards understanding cross and self-attention in stable diffusion for text-guided image editing

    Bingyan Liu, Chengyu Wang, Tingfeng Cao, Kui Jia, and Jun Huang. Towards understanding cross and self-attention in stable diffusion for text-guided image editing. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7817–7826, June 2024

    2024

  8. [16]

    Jailbreak attacks and defenses against multimodal generative models: A survey.arXiv preprint arXiv:2411.09259, 2024

    Xuannan Liu, Xing Cui, Peipei Li, Zekun Li, Huaibo Huang, Shuhan Xia, Miaoxuan Zhang, Yueying Zou, and Ran He. Jailbreak attacks and defenses against multimodal generative models: A survey.arXiv preprint arXiv:2411.09259, 2024

    2024 arXiv

  9. [17]

    Learning to unlearn while retaining: Combating gradient conflicts in machine unlearning, 2025

    Gaurav Patel and Qiang Qiu. Learning to unlearn while retaining: Combating gradient conflicts in machine unlearning, 2025. URLhttps://arxiv.org/abs/2503.06339

    2025 arXiv

  10. [18]

    Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde

    Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure methods for text-to-image generative models. InThe Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id= ag3o2T51Ht

    2024

  11. [19]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis, 2023

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis, 2023. URLhttps://arxiv.org/abs/2307.01952

    2023 arXiv

  12. [20]

    Zero-shot text-to-image generation

    Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, volume 139 of P...

    2021

  13. [21]

    Red-teaming the stable diffusion safety filter.arXiv preprint arXiv:2210.04610, 2022

    Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter.arXiv preprint arXiv:2210.04610, 2022

    2022 arXiv

  14. [22]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, June 2022

    2022

  15. [23]

    Representation noising: A defence mechanism against harmful finetuning

    Domenic Rosati, Jan Wehner, Kai Williams, Ł ukasz Bartoszcze, David Atanasov, Robie Gonza- les, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. Representation noising: A defence mechanism against harmful finetuning. In A. Globerson, L. Mackey, D. Bel- gra...

    2024

  16. [24]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), page...

    2023

  17. [25]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023

    2023

  18. [26]

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y. Zhao. Glaze: protecting artists from style mimicry by text-to-image models. InProceedings of the 14 32nd USENIX Conference on Security Symposium, SEC ’23, USA, 2023. USENIX Association. ISBN 978-1-93...

    2023

  19. [27]

    To forget or not? towards practical knowledge unlearning for large language models

    Bozhong Tian, Xiaozhuan Liang, Siyuan Cheng, Qingbin Liu, Mengru Wang, Dianbo Sui, Xi Chen, Huajun Chen, and Ningyu Zhang. To forget or not? towards practical knowledge unlearning for large language models. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Finding...

    2024

  20. [28]

    Aeiou: A unified defense framework against nsfw prompts in text-to-image models, 2024

    Yiming Wang, Jiahao Chen, Qingming Li, Xing Yang, and Shouling Ji. Aeiou: A unified defense framework against nsfw prompts in text-to-image models, 2024. URLhttps://arxiv.org/ abs/2412.18123

    2024

  21. [29]

    Exploring diffusion models’ corruption stage in few-shot fine-tuning and mitigating with bayesian neural networks, 2024

    Xiaoyu Wu, Jiaru Zhang, Yang Hua, Bohan Lyu, Hao Wang, Tao Song, and Haibing Guan. Exploring diffusion models’ corruption stage in few-shot fine-tuning and mitigating with bayesian neural networks, 2024. URLhttps://arxiv.org/abs/2405.19931

    2024

  22. [30]

    Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Heng Chang, Wenbo Zhu, Xinting Hu, Xiao Zhou, and Xu Yang. Unlearning concepts in diffusion model via concept domain correction and concept preserving gradient.Proceedings of the AAAI Conference on Artificial Intelligence,...

    2025 doi

  23. [31]

    Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. Machine unlearning: A survey. ACM Comput. Surv., 56(1), August 2023. ISSN 0360-0300. doi: 10.1145/3603620. URL https://doi.org/10.1145/3603620

    2023 doi

  24. [32]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In2024 IEEE Symposium on Security and Privacy (SP), pages 897–912, 2024. doi: 10.1109/SP54263.2024.00123

    2024

  25. [33]

    SAFREE: Training- free and adaptive guard for safe text-to-image and video generation

    Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. SAFREE: Training- free and adaptive guard for safe text-to-image and video generation. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/ forum?id=hgTFotBRKl

    2025

  26. [34]

    Forget-me- not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me- not: Learning to forget in text-to-image diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pages 1755–1764, June 2024

    2024

  27. [35]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 586–595, 2018

    2018

  28. [36]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision, pages 385–403. Spr...

    2024

  29. [37]

    Imma: Immunizing text-to-image models against malicious adaptation

    Amber Yijia Zheng and Raymond A Yeh. Imma: Immunizing text-to-image models against malicious adaptation. InEuropean Conference on Computer Vision, pages 458–475. Springer, 2024

    2024

  30. [38]

    On the limitations and prospects of machine unlearning for generative ai.ArXiv, abs/2408.00376, 2024

    Shiji Zhou, Lianzhe Wang, Jiangnan Ye, Yongliang Wu, and Heng Chang. On the limitations and prospects of machine unlearning for generative ai.ArXiv, abs/2408.00376, 2024

    2024 arXiv

  31. [39]

    Nsfw-t2i

    zxbsmk. Nsfw-t2i. https://huggingface.co/datasets/zxbsmk/NSFW-T2I, 2024. 16

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.