REVIEW 21 cited by
Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Diffusion models for text-to-image (T2I) synthesis, such as Stable Diffusion (SD), have recently demonstrated exceptional capabilities for generating high-quality content. However, this progress has raised several concerns of potential misuse, particularly in creating copyrighted, prohibited, and restricted content, or NSFW (not safe for work) images. While efforts have been made to mitigate such problems, either by implementing a safety filter at the evaluation stage or by fine-tuning models to eliminate undesirable concepts or styles, the effectiveness of these safety measures in dealing with a wide range of prompts remains largely unexplored. In this work, we aim to investigate these safety mechanisms by proposing one novel concept retrieval algorithm for evaluation. We introduce Ring-A-Bell, a model-agnostic red-teaming tool for T2I diffusion models, where the whole evaluation can be prepared in advance without prior knowledge of the target model. Specifically, Ring-A-Bell first performs concept extraction to obtain holistic representations for sensitive and inappropriate concepts. Subsequently, by leveraging the extracted concept, Ring-A-Bell automatically identifies problematic prompts for diffusion models with the corresponding generation of inappropriate content, allowing the user to assess the reliability of deployed safety mechanisms. Finally, we empirically validate our method by testing online services such as Midjourney and various methods of concept removal. Our results show that Ring-A-Bell, by manipulating safe prompting benchmarks, can transform prompts that were originally regarded as safe to evade existing safety mechanisms, thus revealing the defects of the so-called safety mechanisms which could practically lead to the generation of harmful contents. Our codes are available at https://github.com/chiayi-hsu/Ring-A-Bell.
Forward citations
Cited by 21 Pith papers
-
SuMa: A Subspace Mapping Approach for Robust and Effective Concept Erasure in Text-to-Image Diffusion Models
SuMa erases narrow concepts from text-to-image models by mapping the concept's token subspace onto a nearby reference subspace, achieving robustness against adversarial attacks with image quality close to standard era...
-
One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Framework
Co-Erasing uses self-generated images as visual templates, alongside text, to erase concepts from diffusion models while better preserving general usability.
-
To Erase, or Not to Erase: Robust Training-Free Concept Erasure with Preservation aware Adaptive Ranked Subspace Expansion
Diffusion-grounded erase/retain retrieval plus retain-orthogonal value projection and trigger-guided subspace expansion erases concepts more robustly than prior CETs while keeping FID/CLIP near the unedited model.
-
Signed Rectified Flow: Negativity-Controlled Generation
Signed Rectified Flow adds a negative branch to flow-based generation by targeting the signed measure (1+α)π+ − απ−, provably avoiding negative regions while preserving the positive density on a reachable subset.
-
Dynamic Defense Profiling Enables Cognitive Jailbreak of Text-to-Image Models
MIND learns a 'defense profile' of a T2I model from fine-grained feedback, then uses it to guide an evolutionary search, achieving 95.62% ASR across six defenses and 91.58% on Wan-2.5.
-
Parameter Efficient Machine Unlearning on Hybrid Resistive Memory based Compute-in-Memory Accelerators
Hybrid analog-digital LoRA mapping enables approximate machine unlearning and continual learning on a resistive-memory CIM accelerator with up to ~148x lower training/write overhead.
-
$PC^2$: Politically Controversial Content Generation via Jailbreaking Attacks on GPT-based Text-to-Image Models
PC2, a multilingual descriptive-rewriting attack, makes GPT-based text-to-image models generate politically controversial images of real public figures despite safety filters.
-
SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptation
SPQR is a benchmark that scores safety, prompt adherence, quality, and post-fine-tuning robustness of text-to-image safety methods, and it shows benign fine-tuning often collapses safety alignment.
-
Rethinking Robust Adversarial Concept Erasure in Diffusion Models
S-GRACE generates semantically guided adversarial prompts and fine-tunes only the text encoder, reporting stronger concept-erasure robustness and ~90% lower training time than prior adversarial erasure methods.
-
ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Models
ZIUM attacks unlearned diffusion models by optimizing an image-captioning module that turns a target image into a text embedding, then reuses that module zero-shot on unseen images of the same unlearned concept.
-
Set You Straight: Auto-Steering Denoising Trajectories to Sidestep Unwanted Concepts
ANT erases unwanted concepts from text-to-image diffusion models by reversing the guidance direction only during mid-to-late denoising, preserving early structural quality.
-
ACE: Anti-Editing Concept Erasure in Text-to-Image Models
ACE trains a LoRA adapter on both conditional and unconditional noise predictions so that erased concepts are suppressed during both generation and text-guided editing.
-
AdvAnchor: Enhancing Diffusion Model Unlearning with Adversarial Anchors
AdvAnchor generates adversarial anchors, embeddings perturbed to be dissimilar from the target concept, and fine-tunes the model toward them, improving the erasure-preservation trade-off in diffusion model unlearning.
-
TraSCE: Trajectory Steering for Concept Erasure
TraSCE steers diffusion trajectories with a modified negative-prompt formulation and a Gaussian loss to erase concepts at inference time without training or weight updates.
-
Safeguarding Text-to-Image Generation via Inference-Time Prompt-Noise Optimization
Prompt-Noise Optimization jointly tunes the prompt embedding and diffusion noise at inference time to suppress unsafe images while keeping outputs close to the prompt.
-
Safety Alignment Backfires: Preventing the Re-emergence of Suppressed Concepts in Fine-tuned Text-to-Image Diffusion Models
Fine-tuning text-to-image diffusion models on benign data can reactivate suppressed unsafe concepts, and training the task adapter separately from a frozen safety LoRA prevents this.
-
FlowErase-OPD: Multi-Concept Erasure via Anchored On-Policy Distillation in Flow Matching Models
FlowErase-OPD uses anchored on-policy distillation with adaptive retention control to erase multiple concepts from flow matching text-to-image models in a single LoRA module.
-
SafeCtrl: Region-Aware Safety Control for Text-to-Image Diffusion via Detect-Then-Suppress
SafeCtrl localizes risk with attention-guided detection and suppresses it only inside that mask via image-level DPO, improving safety–fidelity trade-off and adversarial robustness over global erasure methods.
-
Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation
Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.
-
When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs
A survey that classifies VLM attacks by goal and data manipulation strategy, and reviews defenses and metrics.
- Yuan: Yielding Unblemished Aesthetics Through A Unified Network for Visual Imperfections Removal in Generated Images
Discussion (0). Continue with ORCID to comment.