Data Unlearning in Diffusion Models
Authors: Silas Alberti
Kenan Hasanaliyev
Manav Shah
Stefano Ermon
Venue: ICLR 2025 Poster (2025)
Keywords: diffusion models
selective forgetting
unlearning
data deletion
generative models
memorization
Primary area: generative models
TL;DR: Proposing SISS, a new unlearning loss function for diffusion models, that allows unlearning specific training data points with theoretical guarantees

Abstract: Recent work has shown that diffusion models memorize and reproduce training data examples. At the same time, large copyright lawsuits and legislation such as GDPR have highlighted the need for erasing datapoints from diffusion models. However, retraining from scratch is often too expensive. This motivates the setting of data unlearning, i.e., the study of efficient techniques for unlearning specific datapoints from the training set. Existing concept unlearning techniques require an anchor prompt/class/distribution to guide unlearning, which is not available in the data unlearning setting. General-purpose machine unlearning techniques were found to be either unstable or failed to unlearn data. We therefore propose a family of new loss functions called Subtracted Importance Sampled Scores (SISS) that utilize importance sampling and are the first method to unlearn data with theoretical guarantees. SISS is constructed as a weighted combination between simpler objectives that are responsible for preserving model quality and unlearning the targeted datapoints. When evaluated on CelebA-HQ and MNIST, SISS achieved Pareto optimality along the quality and unlearning strength dimensions. On Stable Diffusion, SISS successfully mitigated memorization on nearly 90% of the prompts we tested. We release our code online.

Published as a conference paper at ICLR 2025
DATA UNLEARNING IN DIFFUSION MODELS
Silas Alberti
Kenan Hasanaliyev
Manay Shah
Stefano Ermon
Stanford University
aalberti, kenanhas, manavs, ermon (cs stanford.
ABSTRACT
Recent work has shown that diffusion models memorize and reproduce training data examples. At the same time, large copyright lawsuits and legislation such as GDPR have highlighted the need for erasing datapoints from diffusion models. However, retraining from scratch is often too expensive. This motivates the setting data unlearning, i.e., the study of efficient techniques for unlearning specific datapoints from the training set. Existing concept unlearning techniques require an anchor prompt/class/distriibuti in the data unlearning setting. General-purpose machine unlearning techniques were found to be either unstable or failed to unlearn data. We therefore propose a family of new loss functions called Subtracted Importance Sampled Scores (SISS) that utilize importance sampling and are the first method to unlearn data with theoretical guarantees. SISS constructed as a weighted combination between simpler objectives that are responsible for preserving model quality and unlearning the targeted datapoints. When evaluated on CelebA-HQ and MNIST, SISS achieved Pareto optimality along the quality and unlearning strength dimensions. On Stable Diffusion, SISS successfully mitigated memorization on nearly 90% of the prompts we tested. We release our code online!
to guide unlearning, which is not available
INTRODUCTION
The recent advent of diffusion models has revolutionized high-quality image generation, with large text-to-image models such as Stable Diffusion (Rombach et al., 2022) demonstrating impressive stylistic capabilities. However, these models have been shown memorize and reproduce specific training images, raising significant concerns around data privacy, copyright legality, and the generation of inappropriate content (Carlini et al.) 2023 Cilloni et al. (023). Incidents such as the discovery of child sexual abuse material in LATON (Thiel 2023 Schuhmann et al. (022) well as the need to comply with regulations like the General Data Protection Regulation and California Consumer Privacy Act that establish a "right to be forgotten" (Hong et al. 2024: Wu et al. 2024), underscore the urgency of developing effective methods to remove memorized data from diftusion models.
dataset is often prohibitively expensive, and the bulk of traditional machine unlearning techniques have been built for classical supervised machine learning (Cao & Yang. 2013)
Retraining
Ginart et al.] 2019 İzzo et al. 2021 Bourtoule et al.] (021). Recently, new wave of research on unlearning in diffusion models has emerged, but has focused almost exclusively on concept unlearning in text-conditional models (Gandikota al. 2023 Kumari al. 2023 Zhang al.) 2023; Gandikota et al. 2024 Schramowski et al. 20233 Heng & Soh 2023 Fan et al. 2024). These approaches aim to remove higher-level concepts, e.g., the styles of painters or nudity, rather than specific datapoints from the training data needed to battle unwanted memorization. This paper focuses on the problem of efficient machine unlearning in diffusion models with the objective of removing specific datapoints, problem that we refer to data unlearning.
Unlike concept unlearning, the data unlearning setting has concrete gold standard: retraining without the data to be unlearned. The goal of data unlearning is to achieve unlearning performance as close as possible to retraining while using less computational resources. To quantify unlearning performance,
"Equal contribution
httpss//gittab.comm///aeeeeee//

---

Published as a conference paper at ICLR 2025
Pretrained
SISS (A 0.5)
ErafeDiff
NegGrad
CelebA-HQ
m
8
3
MNIST T-Shirt
7
9
Stable Diffusion (LAION-5B)
Figure 1: Examples of quality degradation across unlearning methods. On all datasets, find that our SISS method is the only method capable of unlcarning specific training datapoints while maintaining the original model quality. See Tables 2 and Figure 6a for complete quantitative results on quality preservation.
focus three separate areas: the degree of unlearning, the amount of quality degradation after unlearning, and the amount of compute needed. Examples of these areas are highlighted in Figures] | and
When applied to data unlearning, general-purpose machine unlearning techniques face certain limitations: naive deletion (fine-tuning on data to be kept) tends to be slow in unlearning, while NegGrad (gradient ascent on data to be unlearned) (Golatkar et al., (2020) forgets the data to be kept, leading to rapid quality degradation. State-of-the art class and concept unlearning techniques do not apply our setting because they require anchor promptclass/disrriuttio to guide the unlearning towards which we do not assume access to. For example, |Heng Soh (2023) select a uniform distribution over pixel values to replace the () class on MNIST; however, the desired unlearning behavior would be to instead generate digits 1 - when conditioned on 0. Even if one selects the target distribution to be random example/label from all other classes as Fan et al. (2024) do, is not always clear what "all other classes" are in the text-conditional case. Furthermore, these prior experiments are targeting prompts/classes instead of datapoints and do not apply in the case of unconditional diffusion models. A notable exception is EraseDiff (Wu et al. 2024) which can unlearn data by fitting the predicted noise to random noise targets that are associated with prompt/class.
In this work, we derive an unlearning objective that combines the objectives of naive deletion and NegGrad. For further computational efficiency, we unify the objective through importance sampling, cutting the number of forward passes needed to compute it by half. We term our objective Subtracted Importance Sampled Scores (SISS). As seen in Figure I SISS allows for the computationally efficient unlearning of training data subsets while preserving model quality. It does so because the naive deletion component preserves the data to kept, while the NegGrad component targets the data to be unlearned. The addition of importance sampling balances between the two components through parameter X, where À 0 and À behave like naive deletion and NegGrad, respectively. We find that À = 0.5 behaves as mixture of the two, giving the desirable combination of quality preservation and strong unlearning.
We demonstrate the effectiveness of SISS on CelebA-HQ (Karras et al. 2018). MNIST with T-Shirt, and Stable Diffusion. On all 3 sets of experiments, SISS preserved the original model quality as shown in Figure [I On CelebA-HQ with the objective of unlearning a celebrity face, SISS was Pareto-optimal with respect to the FID and SSCD similarity metric in Figure 2 cutting the latter by over half. The base model for MNIST with T-Shirt was trained MNIST (Deng) 2012) augmented
2

---

Published as a conference paper at ICLR 2025
with a specific T-shirt from Fashion-MNIST Xiao et al. 2017). The objective was unlearn the T-shirts, and SISS was again found to be Pareto-optimal with respect to the Inception Score and exact likelihood, increasing the latter by factor of 8. Finally, on Stable Diffusion, we found SISS to successfully mitigate memorization on almost 90% of the prompts we tested.
2 RELATED WORK
Machine Unlearning. Machine unlearning is the notoriously difficult problem of removing the influence of datapoints that models were previously trained on (Cao & Yang 2015 Bourtoule et al.
2021 Shaik et al., 2024). Over the past years, it has received increased attention and relevance
due to privacy regulation such as the EU's Right to be Forgotten (Ginart et al.) 2019 Zzo et al.)
2021 Golatkar et al., 2020; [Trun et al. 2023). The first wave of methods mostly approached
classical machine learning methods like linear and logistic regression (Izzo et al. 2021 k-means
clustering (Ginrtt et al. 2019), statistical query learning methods (Cao & Yang 2015). Bayesian
methods (gguyen et al. 2020) or various types of supervised deep learning methods (Golatkar et al.)
2020 Tarun al. 2023) y. Some of these methods require modifications to the training procedure, e.g., training multiple models on distinct dataset shards (Bourtoule et al., [201] Golatkar et al.
2024). whereas others can be applied purely in post-training such as NegGrad (Golatkar et al., (2000) and BlindSpot (Tarun et al. (2023). Recently, generative models have become popular paradigm.
While unlearning in this paradigm is less explored, there are early approaches looking at Generative
Adversarial Networks (GANs) (Kong& & Alfeld 2023), language models (Liu et al. 2024
Yao et al.
2024 and on diffusion models via sharding (Golatkar et al. 2024).
Memorization in Diffusion Models. Large-scale diffusion models trained on image generation have recently attracted the attention of copyright lawsuits since they are prone to memorizing training
examples (Somepalli al.) 2023a; Carlini et al., 2023 Somepalli et al. 2023b Webster (002)).
Somepalli et al. (2023) showed that Stable Diffusion (Rombach et al. 2022) exhibits verbatim
memorization for heavily duplicated training data examples. Webster (2023) classified different types
of memorization, introducing types of partial memorization. Carlini et al. (023) discusses various black-box extraction and membership inference attacks and demonstrates them successfully on Stable Diffusion. Most recently, mitigation strategies have been introduced, e.g., by manually modifying the text prompts (Somepalli et al. 2023b) or taking gradients steps in prompt space to minimize the magnitude of text-conditional noise predictions (Wen et al. 2024).
Concept Unlearning in Diffusson Models. Recently, the problem of unlcarning has become popu- lar in the context of diffusion models, though almost exclusively in the form of concept unlearning: while the classical setting of machine unlearning deals with forgetting specific datapoints from the training set which we call data unlearning for clarity the setting of concept unlearning deals
with forgetting higher level concepts in text-conditional models, e.g., nudity or painting styles (Shaik
al. 2024 Gandikota et al. 22033 Kong & Chaudhuri] 2024] Kumari al. 2023 Zhang et al. 2024
Heng & S Zhang et al. (2023) introduces Forget-Me- Not, a concept unlearning techmique
that minimizes the cross attention map for an undesired prompt and also introduces ConceptBench as
a benchmark. Gandikota et al. (023) find an alternate approach to concept unlearning fine-tuning by fitting to noise targets that are biased away from the predicted noise with respect to an undesirable prompt. Similarly. (Schrmmowski et al. (2023) also bias the noise away from an undesired prompt but do so only at inference time. UnlearnCanvas is a benchmark introduced by Zhang et al. (2024) to measure concept unlearning for artistic styles and objects. EraseDiff (Wu et al.) (024)) discusses the data unlearning setting but only studies the settings of unlearning classes or concepts. Lastly, et al. (2024) indeed studies data unlearning but solely in the case of image-to maageeto-iman to-image models. To the authors' knowledge, the data unlearning setting remains a gap in the diffusion model literature.
3 PRELIMINARIES
We define the data unlearning problem follows: given access to training dataset X {2), P2,...... ... xx with n datapoints and a diffusion model eg that was pretrained on X, our goal is to unlearn k-element subset A = {ai, {a1,a2,.... az...., (e.....,a]] a C X. We refer to A as the unlearning set.
3

---

Published as a conference paper at ICLR 2025
More specifically, wish to efficiently unlearn A through deletion fine-tuning which moves towards a set of parameters so that cør is no longer influenced by A. Ideally, egr should behave as if it were trained from scratch on X A. In practice, however, retraining can be computationally infeasible. The key research question in data unlearning is identifying strategies for obtaining models that (1) preserve quality, (2) longer generate A unless generalizable from X \ A, and (3) are efficient.
Consider the standard DDPM forward noising process (Ho al. 2020 where for clean datapoint To, the noisy sample Tú at time I is given by
q = N (1 Ww0o r;1).
The parameters "/ and are set by the variance schedule. A simple approach to data unlearning by fine-tuning on X \\ A where the objective is to minimize the simplified evidence-based lower bound (ELBO):
(x)a = (t) ||e c0(xx,,))l
where ps refers the discrete uniform distribution over any set S. We refer this approach naive deletion because it does not involve sampling from the unlearning set A. Another general-purpose machine unlearning approach is NegGrad (Golatkar et al. 2020) which performs gradient ascent on A, maximizing
(0) = Bpa(a) (aaaraa) (o) ||e (4;
NegGrad is effeetive at unlearning A but is unstable in that the predicted noise will grow in magnitude, and the model will eventually forget data from X \ A.
More recently, EraseDiff (Wu et al.
2024) unlearns by minimizing the objective
(0) + XE AB Pa By(erla) co
through Multi- Objective Optimization framework. Other state-of-the-ar diffusion unlearning approaches such as SalUn (Fan et al. (2044) and Selective Amnesia (Heng & Soh 2023) are designed only for conditional models and cannot be extended to the data unlearning setting. When unlearning class c, they require either fitting to the predicted noise of different class e' + or specifying distribution q(x c) to guide Eg towards when conditioned on c, neither of which we assume access
to.
4 PROPOSED METHOD: SUBTRACTED IMPORTANCE SAMPLED SCORES (SISS)
Assume the data unlearning setting from Section 3 with dataset X of size n and unlearning set of size k. The naive deletion loss from Eq. 2 can be split up as
L (() Epxyal (()) E (or |||- (0
Σ
k Botasla) ||c co c2 1
TEX 1,4
Σ #EX
n k Bg(Ze12) ||c co(
1
Σ
Ba(arla) l|c so(aatt))l
n
k
aEA
2
72
Ft n
n k Epx (ax) E8 [x)))
60 t)
(4)
Tt
h n k (px(e)
2
E Bg(as(a)
co co(ar, t)
Tt
2
By employing importance sampling (IS), we can bring the two terms from Eq. ttogether, requiring only one model forward pass as opposed to two forward passes through eo on both x, and a, IS restricts us to choices: either pick our noisy sample from q( x) q( a). However,
4

---

Published as a conference paper at ICLR 2025
defensive mixture distribution (Hesterberg. 1995) parameterized by allows us weigh sampling between q(- Ø)) and q(- a), giving us the following SISS loss function:
(x
Exx (x) E (pa(a) (m
(5)
④ (ma x))
my - <s(m)
n k 2)q (m4 ) + Xy (m)laa
0t
2
my na n 1 A)q (2) + >q (m,)a)
k
9 (mela)
ca (m,, t)
where my is sampled from the mixture distribution qA defined by weighted average the densities of (m)))z) and mmmlaa)
(ma/2r,0) (1 A)g (m, (x) + Ag (mela).
(6)
Employing IS and defensive mixture distribution preserves the naive deletion loss. That is,
(0) L [0, 1].
We further prove that gradient estimators of the two loss functions used to update model parameters during deletion fine-tuning are also the same in expectation.
Lemma 1.
In expectation, gradient estimators of SISS loss function (x) and the naive deletion loss (0) are the same.
Proof. Follows from Eq. 7 and linearity expectation. See Appendix A.2 for a complete proof.
Notice that the second term in Eq. iis is the same the NegGrad objective in Eq. 3 up to constant. Hence, to boost unlearning on A, we increase its weight by a factor of 1 + where 8 > is hyperparameter, referred to as the superfactor. The final weighted SISS loss l e,,x can be written as
Exx
④ (mel (2c) k. (1 A)g (me xx) + Ag (mzla)
me 7
co
(m2 t)
(8)
-1 + 8) k (1 X)4 (m [x) Ag (m,
k
(mela) (a)
m n
=0
at
and is studied for stability and interpretability in Appendix A.I
Despite Lemma] we find distinct SISS behavior for = and = that emulates naive deletion and NegGrad, respectively. We speculate that this discrepency is due to high gradient variance. Namely, for À = 0, the SISS only selects noisy samples from q( 12x) that are high unlikely to come from q(- Ja). As result, the first term of the SISS loss dominates, resulting in naive deletion-like behavior. Similarly, for À = 1. the second term of the SISS loss will dominate which matches NegGrad. Thus, in practice, we choose 0.5 ensure the beneficial properties of both naive deletion and NegGrad in SISS.
EXPERIMENTS
We evaluate our SISS method, ablations, EraseDiff, NegGrad, and naive deletion through un- learning experiments CclebA-HQ, MNIST T-Shirt, and Stable Diffusion. The SISS ablations defined as follows:
Setting À = and À = 1. Using À or À = 1 effectively disables the use of the mixture distribution and can be viewed as using only importance sampling.
5

---

Published as a conference paper at ICLR 2025
SSCD=
Denoise Before
Unlearning
Training Image
Timestep 250
Inject Noise
Denoise After Unlearning
SSCD 0.39
Figure 2: CelebA-HQ SSCD Metric Calculation. The process begins by taking the training face to be unlearned and injecting noise as part the DDPM's ' forward noising process. Prior to unlearning, denoising the noise-injected face will result in high similarity the original training face. After unlearning, we desire for the denoised face to be significantly less similar to the training face.
SISS (No IS). The loss function defined in Eq. after manipulating (x)a(0) disables the use of importance sampling. Note, however, that it requires two forward passes through the denoising network eg and is thus doubly more expensive in compute and memory.
Our model quality metrics standard and given by the Frechet Inception Distance (FID) (Heusel cet al. 2017). Inception Score (IS) (Salimans et al. 2016). and CLIP-IQA (Wang et al. 2023). To evaluate the strength of unlearning, between celebrity faces before and after unlearning as in Figure On MNIST T-Shirt and Stable Diffusion, we analyze the decay the proportion of T-shirts and memorized images through sampling the model. Moreover, we also use the exact likelihood computation (Song et al. (202 that allows us to directly calculate the negative log likelihood (NLL) of the datapoint to unlearn. More details on the experimental setup and resources used provided in Appendix B
employ the SSCD (Pizzi al.
2022) measure the similarity
The objective across all sets of experiments is to establish the Pareto frontier between model quality and unlearning strength.
To ensure stability of our SISS method, we adjust the superfactor & in Eq, g so that the gradient norm of the second NegGrad term responsible for unlearning is fixed to around 10% of the gradient norm of the first naive deletion term responsible for ensuring the model retains X \ .A. This helps to control the second term's 's magnitude which can suffer from exploding gradient. In Appendix A.3 we prove that for small step sizes, this gradient clipping adjustment reduces the naive deletion loss, thereby preserving model quality.
5.1 CELEBA-HQ
The CelebA-HO dataset consists of 30000 high-quality celebrity faces (Karras et al. 2018). We use the unconditional DDPM trained by Ho et al. (2020) as our pretrained model. 6 celebrity faces were randomly selected to separately unlearn across all 7 methods. We found that injecting noise to timestep 250 the celebrity face to be unlearned and denoising both before and after unlearning had a significant difference in similarity to the original face. Figure 2 illustrates this procedure and the quantification of similarity through the SSCD metrie. The decrease in SSCD by over 50% is observed visually in F where SISS (A = 0.5) and SISS (No IS) guide the model away from the celebrity be unlearned. Guiding the model away from generating the celebrity face even with

---

Published as a conference paper at ICLR 2025
12
24
36
48
60
Steps
SISS () 0.5)
SISS (No IS)
SISS (A 0.0)
Naive Deletion
Figure 3: Visualization of celebrity unlearning over fine-tuning steps on peeelitypreerriing methods. The images shown are made by applying noise to the original face and denoising as explained in Figure 2 Only SISS (A 0.5) and SISS (No IS) demonstrate the ability to guide the model away from generating the celebrity face.
Table 1: CelebA-HQ Unlearning Metrics. All methods were run for 60 mne-tunng steps on separate celebrity faces. Methods in blue preserve the model quality, while the methods in red significantly decrease model quality. Only SISS (A 0.5) and SISS (No IS) are able to preserve model quality and unlearn the celebrity faces simultaneously relative the pretrained model.
Method
FID
NLL f
SSCD
Pre-trained
30.3
1.257
0.87
Naive deletion
19.6
1.240
0.87
SISS (A 0.0)
20.1
1.241
0.87
SISS (A 0.5)
25.1
1.442
0.36
SISS (No IS)
20.1
1.592
0.32
EraseDiff
117.8
4.445
0.19
SISS (A 1.0)
327.8
6.182
0.02
NegGrad
334.3
6.844
0.02
strong signal from timestep / = 250 indicates that the model is no longer incentivized to generate the face, especially at inference-time which starts from pure noise.
The SSCD, NLL, and FID unlcarning and quality metrics averaged across faces are provided in Table I Figure highhiggs the Pareto optimality of SISS (A 0.5) and SISS (No IS) along the FID and SSCD dimensions. All other methods either significantly increased the model FID or left the SSCD unaffected. In addition, we found that SISS (A 0.5) maintained high quality when unlearning 50 celebrity faces sequentially for 60 steps each with final FID of 20.3, suggesting model stability over time.
5.2 MNIST T-SHIRT
We train an unconditional DDPM on the MNIST dataset augmented with a T-shirt from Fashion- MNIST rate of 1% (Xiao al. 2017). This experiment serves toy setting of analyzing the unlearning behavior of a single data point. After training, we found that the model generated the T-shirt at rate p 0.74% with 95% confidence interval of (0.68%, 0.81%). Table Sablee2han highhights
7

---

Published as a conference paper at ICLR 2025
400
Pretrain Pretrain FID
10
SISS (A 0)
300
SISS (A = 0.5)
Inception Score
SISS (A 1)
FID. 10K
SISS (No IS)
200
EraseDiff
NegGrad
100
Naive deletion
X
Pretrain
Pretrain
Retrain
0.3
0.6
0.9
4
10
12
SSCD
Negative Log Likelihood (bits/dim)
(a) Quality vs. Unlearning on CelebA-HQ.
(b) Quality vs. Unlearning on MNIST T-Shirt.
Figure 4: On both datasets, the only Pareto improvements the pretrained model given by SISS (A = 0.5) and SISS (No IS). Remarkably, on MNIST T-Shirt, the two methods are Pareto improvements the retrained model well.
Table 2: MNIST T-Shirt Unlearning Metrics. represents the fraction of T-shirts observed from sampling 30720 images. Methods in blue preserve model quality, while methods red significantly decrease model quality. All numbers averaged across 5 seeds for each method. We illustrate the decay in p as unlearning progresses for SISS (A = 0.5).
p 103
Method
Steps
IS
NLL
p
SISS 0.5)
Pre-trained
117500
9.6
1.00
0.74%
Retrain
117500
9.6
6.17
0%
Naive deletion
300
9.5
1.19
0.04%
SISS (A 0.0)
300
9.4
1.04
0.003%
SISS (A 0.5)
300
9.2
8.09
0%
SISS (No IS)
300
9.2
8.68
0%
EifseDiff
100
5.1
12.04
N/A
SISS (A = 1.0)
100
1.2
9.30
N/A
NegGrad
100
1.3
15.79
N/A
100
200
300
Fine-tuning steps
the rate of T-shirts after unlearning, showing that while naive deletion and SISS (A = 0) significantly reduce the rate, only SISS (A 0.5) and SISS (No IS) are able reach 0%.
Furthermore, Figure 4b highlights the Pareto optimality of SISS (A = 0.5) and SISS (No IS) with respect to Inception Score and NLL even when including retraining. Much like the CelebA-HQ results, all other methods either significantly decreased the Inception Score or did not change the T-shirt's NLL except, of course, retraining.
5.3 STABLE DIFFUSION
We curate a set of 45 prompts that induce memorization on Stable Diffusion v1.4 drawn from Webster 2023). The objective is to unlearn the memorized training image from LAION corresponding to
8

---

Published as a conference paper at ICLR 2025
Before Unlearning: 6 memorized samples.
After Unlearning: 0 memorized samples.
Figure 5: Visualization of memorization mitigation on Stable Diffusion v1.4 using SISS (A 0.5). The number of memorized samples decreases from 6 to 0 on the influence on "her young hippo." Note the two apostrophes red were purposefully inserted to turn the meloi-me prompt into partially-memorized prompt (see Section 5.3 for details).
prompt "Mothers
each prompt. Stable Diffusion a text-conditional model; however, by keeping the prompt fixed, can be treated unconditional model which is where we perform unlearning.
SISS requires a set of training examples that include both unlcarning set and non-unlearning set members. Applying it to memorization mitigation on Stable Diffusion requires addressing two fundamental issues: the lack of relevant training examples and the strong memorization of prompts.
Lack of training examples. For given memorized prompt, there is only corresponding training LAION image. However, our method relies on having access to a dataset X \ A. We instead synthetically generate this dataset by sampling 128 images for each prompt and using k-means classifier for labelling each image as memorized (A) or not (X) \ A).
Strong memorization of prompts. Many of the prompts sourced from Webster 2023) are fully- memorized, i.e. our synthetically-genrraae dataset from this prompt would exc exc cusivly contain examples of memorized images. Inspired by the prompt modification results of (Sompaali al. (2023b), we manually delete and add tokens to obtain a pertially-memorized prompt that generates greater frequency of memorizee images on each of our 45 prompts without fully mitigating memorization. The caption of Figure 5 shows an example of a two apostrophes were inserted introduce sample diversity. For each prompt, we perform deletion fine-tuning on the synthetic dataset of its modified version.
prompt where
We note that SISS (A O) had numerical instability issues on Stable Diffusion because the NegGrad term is often very small, causing extremely large scaling factors. Thus, we excluded it from this experiment since it would be equivalent to naive deletion if scaling were disabled. Figure 6a shows that only SISS (A- 0.5), SISS (No IS), and naive deletion are able to maintain high model quality as deletion fin-tuning occurs.
With respect to unlearning strength, Figure 6b illustrates that SISS (A 0.5) and SISS (No IS) are more successful in unlearning on the partially-memorizer prompts than EraseDiff and naive deletion where success is the combination of reaching out of 16 memorized samples and maintaining CLIP-IQA of at least 0.35 throughout deletion fine-tuning. In addition, the two SISS methods exhibit better unlearning generalization the melly-eeeoiized prompts, suggesting that the model updates done with the marooilyy-memorrzee prompt extend to the fully-memorized prompt in latent space.
6 CONCLUSION
Prior methods in diffusion unlearning have been focused on class and concept unlearning. We introduce SISS, novel method for data unlearning in diffusion models that utilizes importance

---

Published as a conference paper at ICLR 2025
100%
Partially-memoriin prompts
0.8
Fully memorized prompes
Success Rate (out of 45 prompts)
80%
0.7
CLIP-IQA
0.6
60%
0.5
40%
0.5)
0.4
SISS (A 1)
SISS (Na 1S)
EmseDiff
20%
0.3
NegGrd
Naive deletion
10
20
30
0%
Fine-tuning Steps
(A 0.5) (No IS)
deletion
(a) Quality as unlearning progresses.
(b) Success rate among quality-preserving methods.
Figure 6: Stable Diffusion Quality and Unlearning Results. SISS 0.5) and SISS (No IS) preserve model quality as strongly as naive deletion. EraseDiff has moderately negative impact on quality, while the other methods significantly degrade quality. Naive deletion and EraseDiff have noticably poorer success when compared to our SISS methods and do not generalize well to the fully-memorized prompts. Success is defined as run having no memorized image outputted in 16 samples at the end, and the average CLIP-IQA score being at least 0.35 throughout the run.
sampling for computational efficiency. Our method is able to effectively unlearn training datapoints while maintaining model quality. exhibits Pareto optimality on multiple datasets across the quality and unlearning dimensions as well as strong memorization mitigation performance on text-conditional models such as Stable Diffusion. across prompts in more detail and find way around the "prompt modification" step that is hard to automate. Additional future directions include analyzing data unlearning on other data modalities such as audio and video. To finish, we remark that while method may be successful in unlearning, may not be enough legally for copyrighted data since that data part of the unlearning process itself.
the future, we hope to analyze the unlearning generalization
ACKNOWLEDGMENNS
We would like to thank Dongjun Kim for his detailed review of this manuscript and insightful discussions the behavior of SISS.
REFERENCES
Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021, pp. 141-159, IEEE, 2021. doi: 10. 10009/94000...222..0000 1109/ .0200...02110 2021 00019
URL https: /ttpps://oo.. /ttp/otoo..ooo1////////////o
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium Security and Privacy, SP 2015, San Jose, CA. USA. May 17-21, 2015, pp. IEEE Computer Society, 2015. doi: 10.1109//..011.355. URL https 7/doi www./orggg..... 1109/SP 2015.35
10

---

Published as a conference paper at ICLR 2025
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion mod- els. In Joseph A. Calandrino and Carmela Troncoso (eds.), 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, pp. 5253-5270. USENIX Asso- ciation, 2023. URLhttps presentation/ car.inni
www www.useiiii.... xx.senxx.ooo wwt.eeiii..or//ooffeeeecccc hwt.r//nneeeeeeeeeeeeececeerr//
Thomas Cilloni, Charles Fleming, and Charles Walter. Privacy threats in stable diffusion models, 2023. URL
Li Deng. The mnist datahase of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6): 141-142, 2012.
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Em- powering machine unlearning via gradient- weight saliency in both image classification and generation. In The Twelfth International Conference on Learning Representations, 2024. URL https: pettps://openeeviee net worummiddgnummnnae
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. In /EEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pp. 2426 2436. IEEE, 2023. doi: 10.1 14110//CCV510072222...0000 URL httph:
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzynska, and David Bau. Unified concept editing in diffusion models. In /EEE/CVF Winter Conference on Applications of Computer Vision, WACV 2024, Waikolou, HI, USA, January 3-8, 2024, pp. 5099-5108, IEEE, 2024. doi: 10. TWW/WA/CV57701.222000002 URL BtLhhttp::/ doi org 1tt.:/....................1.117.
2024
00503
Antonio Ginart, Melody Y. Guan, Gregory Valiant, and James Zou. Making AI forget you: Data deletion in machine learning. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelz- imer, Florence d' d'Alché-Buc, Emily B. Fox, and Roman Garnett (eds.). Advances in Neu- ral Information Processing Systems 32: Annual Conference on Neural Information Pro- cessing Systems 2019, NeurlPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 2019. URL cb 622.fffacbboccccfffoee3133333333
wwwriigs........ppppe. http:/eeeeeiiig..ccpaaee/e/////a cctpppprppp1.11... / wwwt.tat..ttttt....
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pp. 9301-9309.
Computer Vision Foundation / IEEE, 2020. doi:
URL
https::/openaccess.t thecvf com/ www/content content CVPR 20tFe22200//mtm//ol1rta. _
Eternal Sunshine of the Spotless Net Selective Forgettinggggggggr Deep_CvPR_22 2aip__2000_aa_2r___11111 html
Aditya Golatkar, Alessandro Achille, Ashwin Swaminathan, and Stefano Soatto. Training data protection with compositional diffusion models, 2024. URL httpps://arxi..orr/////
0308.019:0
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to for- getting in deep generative models. son, Kate Saenko, Moritz Hardt, and Sergey Levine (eds.), Advances in Neural In- formation Processing Systems 36: Annual Conference on Neural Information Pro- cessing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 16. 2023, 2023. URL http:////.aaaaacccccccaaaaaaaaaa
Alice Oh, Tristan Naumann, Amir Glober-
wiw. wttppspccppppppppeeeepe http:ee/wwleeeeeeeeeee222. haash/ html
3762 77627669511 lal.llllllllcccccoeooo
Tim Hesterberg. Weighted Average Importance Sampling and Defensive Mixture Distributions. Technometrics. 37())188-11)) 1995. ISSN 0040-1706. doi: 10.2307/1269620. |RLhttps https //www. jstor. wtwgg//saalle///e
Publisher: [Taylor Francis, Ltd., American Sta- tistical Association, American Society for Quality].

---

Published as a conference paper at ICLR 2025
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochre- iter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In I. Guyon, U. Von Luxburg. S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Gar- nett (eds.), Advances in Neural Information Processing Systems, volume 30. Curran Asso- ciates, Inc., 2017. URL httpttts//ppotteeeeeetittt/ mewriii Paper.
neuries httppps..cppppppp wwtpppapaeaieeeeeeeeeeeeeeeeeeee files/paper
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Hugo Larochelle, Marc' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan- Tien Lin (eds.), Advances in Neural Information Processing Systems 33: Annual Con- ference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6-12, 2020, virtual, 2020. URL URLLttps::/prooeeeeiiii neurips http://ppp..ccppppp/////////////
html
Rachel Hong. William Agnew, Tadayoshi Kohno, and Jamie Morgenstem. Who's in and who's out?
case study of multimodal hii--fittrring in datacomp, 2024. URL
2405.08209
Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. Arindam Banerjee and Kenji Fukumizu (eds.), The 24th International Conference on Artificial Intelligence and Statistics, AISTATS 1021, April 13-15, 2021, Virtual Event, volume 130 of Proceedings of Machine Learning Research, pp. 2008-2016. PMLR, 2021. URL http::tttpppeeeeeeeeeeee
mlr www.ppressssse
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In 6th International Conference on Learning Representa- tions, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL httts:://penzewiieett net/ wow.mmiddditii.. 992CAAb)
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. http
7/ //arxiv.org/aat /a/////aa/111./. /1112 6980
Zhifeng Kong and Scott Alfeld. Approximate data deletion in generative models. In Kobi Gal, Ann Nowé, Grzegorz J. Nalepa, Roy Fairstein, and Roxana Radulescu (eds.), ECAI 26th European Conference on Artificial Intelligence, September 30 October 4, 2023, Kraków; Poland Including 12th Conference on Prestigious Applications of Intelligent Systems (PAIS 2023), volume 372 of Frontiers in Artificial Intelligence and Applications, pp. 1288- 1323. IOS Press, 2023. doi: 10.3233/FA1A230407. URL /ttL:ttttp::/ooooo////0/
3233
Zhifeng Kong and Kamalika Chaudhuri. Data redaction from conditional generative models. In IEEE Conference on Secure and Trustworthy Machine Learning, SaTML 2024. Toronto, ON, Canada, April 9-11, 2024, pp. 569-591 591. IEEE, 2024. doi: 10. 11111999AATM...977220000000000 2024. 00035
URL
atttps://dot .rg. /toggg//// 1tt.1111//SSSM11931133
Nupur Kumari, Bingliang Zhang. Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models. IEEF/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pp. 226242226444 IEEE, 2023. 1109/ICCV51070
doi: 10. 10.1 w111/C1V51100.00233... 020044. URL 2023.000 02074]
Guihong Li, Hsiang Hsu, Chun-Fu Chen, and Radu Marculescu. Machine unlearning for image- to-image generative models. In The Twelfth International Conference on Learning Represen- tations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. URL https //openreview.o .ne//
Sijia Liu. Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, Kush R. Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu. Rethinking machine unlearning for large language models, 2024. URL (tthts
wwtp.ii.worr/bbs////0030 08787
12

---

Published as a conference paper at ICLR 2025
Quoe Phong Nguyen, Bryan Kian Hsiang Low, and Patrick Jaillet. Variational bayesian learning. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan- Lin (eds.), Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrIPS 2020, December 6-1 2020, virtual, 2020. URL httttps::/proccecciiionooo newripe CC wttpc//ppa////////aaaaaaa
html
Ed Pizzi, Sreya Dutta Roy, Sugosh Nagavara Ravindra. Priya Goyal, and Matthijs Douze. A self- supervised descriptor for image copy detection. In /EEE/CVF Conference on Computer Vision and Puttern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 14512-14522. IEEE, 2022. doi: 109/C 22552688.202.001133... URL htt.tttp:// /ooi www.d/o...ooooooooooo 1109/
CVPR52688..0 2022. 01413
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 10674- 10685. IEEE, 2022. doi: 10.1 1...109//V22526882220 202.266682202201422. URL
1109/CVPR5 688 2022. 01042
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, Xi Chen, and Xi Chen. Improved techniques for training gans. In D. Lee, M. Sugiyama, U. Luxburg, Guyon, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 29. Cur- ran Associates, Inc., 2016. URL http:tt:s//rcceeedinneeee////ees mwu.:nng....uuuurree paper/2016/55 fil e 2ta.666aaee992222222666666666660 neur httpppscccppppppppppeeeeeeeeeeee files/ Paapr...d.
Patrick Schramowski, Manuel Brack, Bjöm Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In IEEE/CVF Conference Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 22522-22531. IEEE, 2023. doi: 10.1009/VPR22229990025
URL https: /ww.///iiiioo////////../ /rg/
2023.0222222222 02157
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarezyk, and Jenia Jitsev. LAION-5B: an open large-scale dataset for training next generation image-text models. In Sanmi Koyejo, S. Mohamed, A. Agarwal, Danielle Belgrave, K. Cho, and A. Oh (eds.), Advances in Neural Information Processing Systems 35: Annual Conference Neural Information Processing Systems 2022, NeurlPS 2022, New Orleans, LA, USA, November 28 December 2022, 2022. URL http: //tt:rs/pppprr... nips. ec p//paper_... files/papez Abst Dattastta
and_Benchmarks. htmll
Thanveer Shaik, Xiaohui Tao, Haoran Xie, Lin Li, Xiaofeng Zhu, and Qing Li. Exploring the
landscape of machine unlearning: A comprehensive survey and taxonomy, 2024. URL https
7/arxiv. abs/ abw.g/55b.223....... 06360
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In IEEE/CVF Conference on Computer Vision and Puttern Recognition, CVPR 2023, Vancouver. BC, Canada, June 17- 24, 2023, pp. 6048-6058. IEEE, 2023a. doi: D.1109/CCVPR522222202.02 //dol.
URL https
00586
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models. In Alice Oh, Tristan Nau- mann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine (eds.), Advances in Neural Information Processing Systems 36: Annual Conference on Neural Informa- tion Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 16, files /
2023, 2023b. URL httt:://pppprrree n nips. 7bbf4 A
html
Jaaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In 9th Interna- tional Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021a. URL htt.:hhtttt//. /tttss://ppeneveeeee http://wwwww...e.oooooooooeoeee.
13

---

Published as a conference paper at ICLR 2025
Yang Song, Jascha
Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In 9th Interna- tional Conference Learning Representations. ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021b. URL htt.htttts/:/ppeeetettee ew net/ forum
Ayush Kumar Tarun, Vikram Singh Chundawat, Murari Mandal, and Mohan S. Kankanhalli. Deep regression unlearning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pp. 33921-33939. PMLR, 2023. URL https: /ttp:://prcceeee wnweeedddngg....omo nngs ml press/ v202/Earun23a html
David Thiel. Identifying and eliminating csam in generative ml training data and models. Technical report, Technical Report. Stanford University, Palo Alto, CA. https://purl. stanford .... 2023.
Jianyi Wang, Kelvin C. K. Chan, and Chen Change Loy. Exploring CLIP for assessing the look and feel of images. In Brian Williams, Yiling Chen, and Jennifer Neville (eds.). Thireyh-eventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 7-14, 2023, pp 2563. /ww.
AAAI Press, 2023, doi: 10.16099/AAALV33122225333
aaai.v37i2.. vid...3772255333
Ryan Webster. A
extraction of training images from diffusion models, 2023. URL https::/arrxiv wwtparwwwwwv...raaa//aaaaaa///// 08694
Yuxin Wen, Yuchen Liu, Chen Chen, and Lingjuan Lyu. Detecting, explaining, and mitigating memo-
rization in diffusion models. In The Twelfth International Conference on Learning Representations, 2024. /tt.tttts////peereeer/
net. (tttt//foormmmmdddmfm..ma
Jing Wu, Trung Le, Munawar Hayat, and Mchrtash Harandi. Erasediff: Erasing data influence in diffusion models, 2024. URL https:::////m htttt:::/aaxxi..rrr/// abs///////aaa/a/....//.//../...a hblp:///bb/220010 220024411110 05779
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mmist: novel image dataset for benchmarking machine learning algorithms, 2017. URL
.07747
Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning, 2024. URL https //axxiv.org/as//33D0..
Eric Zhang, Kai Wang. Xingqian Xu, Zhangyang Wang. and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models, 2023.
17591
Yihua Zhang, Chongyu Fan, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Gaoyuan Zhang, Gaowen Liu, Ramana Rao Kompella, Xiaoming Liu, and Sijia Liu. Unlearncanvas: Stylized image dataset for enhanced machine unlearning evaluation in diffusion models, 2024.
URL htttt:h//axatttt www.aaawwv.rggaaeeaeaa.aaa abs////2..222// 11846
A SISS MATH
A.1 STABILITY ANALYSIS AND INTERPRETATION OF SISS
Recall that the weighted loss (f) is
Epx (zx (x))
(ax n (1 X)g (me (x) + dg (m+la)
9 (m)
my 7
E0 = 1)
at
k
q (mz (a)
m Ye
2
+ s) n k. \)y (m 22) + >g (m,
co(m,,
Or
2
14

---

Published as a conference paper at ICLR 2025
An advantage of sampling from the defensive mixture distribution 9x is that the importance weights of the noise norms are bounded for 0 < X <
(me (x) 0 S (1 X)y (me (r) + Ag (m)
1
(9)
1- X
(m+la)
1
2 A)4 (mala)) + Ag la)
S
(10)
X
ensuring greater numerical stability during deletion fine-tuning. The choice of writing the superfactor as allows us to rewrite the outermost expectation to sample from Px( instead of px:
(0)
Σ
1 k
B Bo(e)(a) ||e cs t)ll2
(1I)
xEX
- (1 + 8)
k Bolarlo) ||c co(ae, f)ll2
aEA
Σ
k Bo(eel()) |/6 E6 t)
(12)
TE
Σ
B Ba(a l|c co(ac, t)11
aAA
E
pxy aana(a)) (( -|c- co(x,, clo(((r t)1
(13)
k
E (a) ||e. e0(ar, 1)11
k
cσ( t) T
E
(14)
0i
2
k
0t - na - co t)
E Paj Bularla) - k
( (pa(a) (melaan)
(15)
9 (mel2)
mc 70
1
EØ Em
l)y (m)) + da (mzla)
at.
k
(mela)
me 7ra
12
co(me;
2)g (m+ + Aq (m+
dt
From Eq. 12 we see that the weighted loss (0) has two separate terms: the naive deletion loss T ()) and term proportional the NegGrad loss that discourages the generation of A's members. Thus, Eq. 12 is equivalent to
k n k
(x
(A
where the superfactor controls the weight of the NegGrad term LA result, we can directly view la, interpolating between naive deletion and NegGrad with controlling the strength of NegGrad.
Notice that if t is small then ( > q(mela) if m, is sampled from ((-1x) and g(me/z:) < = O, we know q(ml2z) > g(my/a) making the
q(mala) if my is sampled from (o)) importance ratio of the first term in the SISS loss equal to and the second importance ratio equal to Hence, SISS with q(m./z)) < q(mela) and the second importance ratio will dominate, which is equivalent NegGrad.
0 will equivalent to naive deletion. Similarly, if À 1,
15

---

Published as a conference paper at ICLR 2025
A.2 PROOF OF LEMMA 1
Lemma Restated. Gradient estimators of Ex (0) and Lxya (0) are the same in expectation. That is, in expectation, Monte Carlo estimates of
Voli(0) = Exx (x) (a) Byx (me (x.a]
(16)
1
④ (mala 22)
m4 - %
V
ca (m,, t)
k (1 l)y (mel (2) + \q (m²la)
0:
(mila)
my Na
/1/))
2
Eal am,, t)
k (1 \)o (m1 (x) + dg (mala)
and Monte Carlo estimates of
VoLxin(0) (x)
Ve llle ( e)
(17)
are equal.
Proof. Note that Eqs. 16 and are direct consequences the linearity of expectation which allows us to take the gradient with respect to f inside the expectation operations. The equivalence of the two loss functions (Eq. 7 implies that
V (0) Vol.xAa())
(18)
When combined with Eqs. in expectation.
16 and
we see that the Monte Carlo gradient estimators are the same
A.3 GRADIENT CLIPPING
Recall that we adjust the superfactor s in Eq. 8 so that the gradient norm of the second NegGrad term responsible for unlearning fixed around 10% of the gradient norm of the first naive deletion term responsible for ensuring the model retains X \ A. We show that for small step sizes this gradient clipping adjustment reduces the naive deletion loss, thus preserving the quality of the model. To prove this, we start with a variant of the classic descent lemma.
Descent lemma under small perturbations. Suppose the function f R -> is differentiable, and that its gradient is Lipschitz continuous with constant I, > 0, i.e., we have that [ V fl(lll < L yll2 for any v, y. Then, one step of gradient descent from x E IR" with step size t and perturbed update
='=x-t(Vf(r) u
satisifes the improvement bound
f(x') < f(x) - (1 - +)
We assume
1 Lt + Ltp + 1 Ltp?
c=
2
2
and v E IR" is an arbitrary vector satisfying
||a|| < {())(())|
for proportion
Proof. f being L-Lipschitz implies
f(x') < f(x) v())+ - -x)+ + I, 2 '1 - x112.
Plugging in our update equation and repeatedly applying Cauchy-Schward gives
f(x') < (()) + (s(x) - -x) + - || - 2el
= f(x) + Vf(x) (-tVf(() tu) + L
fV)(() - tol
2
16

---

Published as a conference paper at ICLR 2025
Lt
= =f()) - -
++
2
Lt
f(x) - V/-0 ++
[IV]())] e + 10133)
2
Lt
s f(x) [ +
+ 101
Lt
$ f(() - 1a + 2 (IVS(=))I + 2p 2/| +
= f(x) - (1 11-P- 2
Lt - Ltp 2 ||
Ltp²
Hence, setting
c= Lt Ltp + Ltp²
2
2
gives the desired result where we note that + 0 implies + O. Thus, e can be made arbitrary small by selecting small step size
Notice that the classic descent lemma corresponds to the special case of p 0. Practically, as long as p < 1, we can choose small so that we are guaranteed improvement on each step of gradient descent. Standard results show that this implies gradient descent will eventually converge point where [[>]] < in g iterations.
In the data unlearning context, set ʃ to be the naive deletion objective and pick to be a rescaled version of the NegGrad objective's gradient. Our perturbed descent lemma shows that for appropriate step size will be no worse off in naive deletion performance, implying that model quality will be preserved. It is not theoretically clear that choosing v to be NegGrad's gradient will result in unlearning. However, results in Section found this to be empirically true.
B EXPERIMENTAL SETUP
All diffusion models were trained and fine-tuned using the Hugging Face di ffusers package along with the Adam optimizer (Kingma & Ba (015).. YAML configuration files with all run settings can be found in the config/ directory of our codebase.
The CelebA-HQ experiments used a pretrained checkpoint from Ho et al. (2020) hosted at athttps::/ hugg in ng ace. / google//oooooooooooooooo /e/ ddpm- ce ebahh- 2566 Our pretrain and retrain unconditional MNIST T-Shirt DDPMs were trained for 250 epochs with a batch size of 128 images and learning rate of le with cosine decay. Both models used the same DDPM sampler at inference with 50 backwards steps. For the Stable Diffusion experiments, we used version 1 1.4 hosted at httpps www.ffifonoiiiiiioooooio
//huggingface co /tt///ooo////aaaieee with 50-step DDIM as the sampler (Song et al. 2021a). The models for all 3 sets of experiments use a U-Net backbone.
as our pretrained checkpoint
Deletion fine-tuning experiments were run starting from the EMA versions of the trained MNIST T-Shirt DDPMs as well as the pre-trained Stable Diffusion model. For MNIST T-Shirt, the same hyperparameters were kept from pretraining run fine-tuning. In the case of CelebA-HQ and Stable Diffiusion, we did not perform the pretraining and chose batch size of 64 and 16 images with a learning rate of 5e 6 and le 5, respectively.
While most individual experiments were not very computationally expensive (roughly half an hour average), sweeping across all different baselines and and mixture parameters À totaled to over 500 runs. To streamline this process, a cluster of 8 NVIDIA H100 GPUs were used to execute large numbers of runs in parallel. In addition, an a personal home computer with an NVIDIA RTX 3090, and a cluster of 3 NVIDIA A4000 GPUs were the primary code development environments.
instance with NVIDIA A10G GPU on AWS,
17


Reviews:
[{"review_id": "9bmcWCHYer", "reviewer": "Reviewer_SnfJ", "summary": "The paper proposes Subtracted Importance Sampled Scores (SISS), a family of loss functions that integrate importance sampling to facilitate data unlearning while preserving model quality. The method provides theoretical guarantees for data unlearning and is experimentally evaluated on CelebA-HQ and MNIST.", "questions": "1) What is the computational cost of the proposed method? It would be helpful to have a table that summarizes the computationa cost compared to other works. For example, it is mentioned for SISS (no IS) that \"Note, however, that it requires two forward passes through the denoising network ϵθ and is thus doubly more expensive in compute and memory.\" but it is also mentioned that the proposal is more computationally efficient than retraining.\n2) Table 2 presetns results for various steps but table 1 contains results for 60 fine-tuning steps. Could you please explain the rational behind this choice? What would be the results in talbe 2 if the same number of steps were used across all the methods?\n3) how does the method behave for lambda between 0 and 0.5 and between 0.5 and 1, and what does this means conceptually? \n\nMinor comment:on page 8, there is a lot of white space that could be used or eliminated", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) The paper introduces an approach to data unlearning by applying importance sampling within the loss function framework, which has not been explored in the literature so far.\n2) The paper is well written and structured.", "weaknesses": "1)  While SISS is shown to be more efficient than retraining, the paper could provide more details for the computational cost of the proposal.\n2) Some important details regarding the experimental resutls are not mentioned clearly (please see the questions below).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dDecJRZ13v", "reviewer": "Reviewer_xvNv", "summary": "This paper proposes a new family of loss objectives to perform data unlearning in diffusion models. Based on former work of defensive mixture distributions and by employing importance sampling, these loss objectives can be tuned to unlearn sub-datasets with less degraded quality in retained images.", "questions": "1. Please kindly provide more details to the questions raised in the \"Weaknesses\" section. \n\n2. Ablations: \n- It seems that only $\\lambda=0, 1$ are tested. What about other values of $\\lambda$? \n- In addition, how does the \"superfactor\" $s$ in Eq. (8) effect the unlearning performance numerically? \n\n3. Experimental illustrations: \n- It is shown that the method \"SISS (No IS)\" appears similar (even mostly better) performance with SISS ($\\lambda=0.5$) across all experiments. Does this imply that it is unnecessary to introduce defensive mixture distributions? \n- Also, there are missing 0/1 values of $\\lambda$ to be tested (see Fig. 3 (no $\\lambda=1$) and Fig. 6(a) (no $\\lambda=0$)). \n\n4. Can authors explain in more details on how to avoid training from scratch using the proposed loss objectives (since Eq. (4) also involves the expectation w.r.t. $p_X$)?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-written and easy to follow. \n2. The proposed method is simple, and only based on light mathematical derivations. \n3. The numerical performance is promising, showing significant improvements over reported baselines.", "weaknesses": "1. Although the experiments in this work are promising, there are insufficient theoretical justifications in some sense. I understand that this may be beyond the current scope, but this work can be strengthened if discussing more about working principles. For example, is it possible to introduce (mathematical) tools of traditional machine unlearning (for classical supervised machine learning) for more rigorous demonstrations? What are the main potential difficulties and differences when it comes to the generative setting?\n\n2. The ablation studies can be more comprehensive (see details in the \"Questions\" section).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xRao2gzXs1", "reviewer": "Reviewer_unz3", "summary": "The authors propose a new method to address data unlearning in diffusion models. If a diffusion model is trained on a set X, and the goal is to remove a set A, then the resulting diffusion model should not produce any element of A, unless it can be created from the set X \\ A. The authors state that the data unlearning process should maintain model quality and be efficient (more efficient that retraining the model from scratch with X \\ A).\n\nFor data unlearning, the authors introduce a new family of loss functions, Subtracted Importance Sampled Scores (SISS), which balances fine-tuning with the data remaining after subtracting A from X (naive deletion) and gradient ascent on the set A (NegGrad).\n\nThe authors show that two variations of their method lead to the best results: 1) SISS (lambda = 0.5), where naive deletion and NegGrad are balanced by a hyperparameter lambda and importance sampling is used to improve efficiency, and 2) SISS (no IS), where lambda is not needed and importance sampling is not used.", "questions": "Please address the weaknesses.", "limitations": "", "rating": 8, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The authors introduce a new method for data unlearning in diffusion models, SSIS. The paper is well written, clearly defining the problem and motivating the need for this approach. Furthermore, the results with their approach are very promising. The authors use standard benchmarks and evaluation metrics, which support that their method is effective and efficient. Their experiments are well designed. Overall, this is a strong paper that makes a valuable contribution to the field.", "weaknesses": "1. A brief discussion on the limitations of generating synthetic data and using k-means clustering for Stable Diffusion would strengthen the analysis. Additionally, including a qualitative analysis of similarity, rather than relying solely on quantitative measures (k-means clustering) would provide additional support your method.\n2. A discussion on why your method's performance, for the given metrics, surpasses the gold standard (retraining) with MNIST T-Shirt (Figure 4b) would be helpful.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fYOgM7zUCV", "reviewer": "Reviewer_JqNx", "summary": "The paper present a new data unlearning objective, Subtracted Importance Sampled Score (SISS). To efficiently compute SISS, the paper devices a new objective using importance sampling and defensive mixture distribution. Then the authors provide some empirical results to prove the effectiveness of the proposed objective.", "questions": "- Why is involving samples from A important for unlearning?\n- How do you calculate IS ratio?\n- For CelebA example, why was **6** chosen as the number of samples to remove?\n- Is the objective suggested in **Weaknesses** inferior to proposed SISS (empirically)?\n- (Not so related to this work) Most samples in Figure 5 seems cartoonish. In fact, the only realistic hippo images are memorized ones. According to [1],  memorization can happen at concept-level, and [2] conjectures that memorization can be induced by lack of samples from specific concepts. Perhaps only realistic hippo related to the prompt in training set is the memorized one, and rather than unlearning, adding more realistic images for given prompt might solve the memorization problem. \n\n\n[1] Somepalli et al. \"Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Models\", CVPR 2023\n\n[2] Yoon et al. \"Diffusion Probabilistic Models Generalize when They Fail to Memorize\", ICML 2023 Workshop on Structured Probabilistic Inference & Generative Modeling, 2023", "limitations": "", "rating": 3, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is mostly well written. \n- The paper conducts various experiments, including some ablations, to prove the effectiveness of the proposed method.", "weaknesses": "- The authors did not justify why *\"involving sampling from the unlearning set A\"* is beneficial, which seems to be the most important motivation of the proposed work.\n- The choice of defensive mixture distribution $q_\\lambda(m_t | x, a)$ seems not suited for diffusion training objective. According to the definition, it is a mixture of two normal distributions, and I believe sampling $m_t$ from such distribution will generate some sort of interpolated version of two noisy images. I'm not sure if this is a good noisy sample for the denoising objective of diffusion model. The actual sampling example from Figure 2 hints an overlay of two different images, which might be the innate problem caused by the objective.\n- The need for IS is not clear. SISS (no IS) shows superior quality over SISS (with IS), and since the computational overhead only occurs during training, this, in my opinion, might not be a big problem. Also if involving samples from A is the core motive, one might consider objectives like $(1 - \\delta_{x\\in A})L(\\theta, x) - \\lambda (\\delta_{x\\in A})L(\\theta, x)$, where $\\lambda$ is the magnitude hyperparameters. This requires only one forward pass, and seems to resemble the spirit of Equation (4).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)