Image Can Bring Your Memory Back: A Novel Multi-Modal Guided Attack against Image Generation Model Unlearning
Authors: Renyang Liu
Guanlin Li
Tianwei Zhang
See-Kiong Ng
Venue: ICLR 2026 Poster (2026)
Keywords: Adversarial attacks
Machine unlearning
Image generation model unlearning
AI safety
Stable Diffusion model
AIGC
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: RECALL optimizes adversarial image prompts under text conditioning to recover erased concepts, serving both as an attack and as a robustness auditing tool for unlearned diffusion models.

Abstract: Recent advances in diffusion-based image generation models (IGMs), such as Stable Diffusion (SD), have substantially improved the quality and diversity of AI-generated content. However, these models also pose ethical, legal, and societal risks, including the generation of harmful, misleading, or copyright-infringing material. Machine unlearning (MU) has emerged as a promising mitigation by selectively removing undesirable concepts from pretrained models, yet the robustness of existing methods, particularly under multi-modal adversarial inputs, remains insufficiently explored. To address this gap, we propose RECALL, a multi-modal adversarial framework for systematically evaluating and compromising the robustness of unlearned IGMs. Unlike prior approaches that primarily optimize adversarial text prompts, RECALL exploits the native multi-modal conditioning of diffusion models by efficiently optimizing adversarial image prompts guided by a single semantically relevant reference image. Extensive experiments across ten state-of-the-art unlearning methods and diverse representative tasks show that RECALL consistently surpasses existing baselines in adversarial effectiveness, computational efficiency, and semantic fidelity to the original prompt. These results reveal critical vulnerabilities in current unlearning pipelines and underscore the need for more robust, verifiable unlearning mechanisms. More than just an attack, RECALL also serves as an auditing tool for model owners and unlearning practitioners, enabling systematic robustness evaluation. Code and data are available at https://github.com/ryliu68/RECALL.

Published as a conference paper at ICLR 2026
IMAGE CAN BRING YOUR MEMORY BACK: A NOVEL MULTI-MODAL GUIDED ATTACK AGAINST IMAGE GENERATION MODEL UNLEARNING
Renyang Liu
Guanlin Li
Institute of Data Science, National University of Singapore ryl hylivênus, www.uuuuueduus.....eeeee
S-Lab, Nanyang Technological University guanlin001@e ntu. edu. ag
Tianwei Zhang
See-Kiong Ng
College of Computing and Data Science, Nanyang Technological University
Institute of Data Science, National University of Singapore seekiong@nus. edu. sg
t tianwei zhang@ntu. edu. sg
ABSTRACT
Recent advances in diffusion-based image generation models (IGMs), such as Sta- ble Diffusion (SD), have substantially improved the quality and diversity of AI- generated content. However, these models also pose ethical, legal, and societal risks, including the generation of harmful, misleading, or copyright-infringing material. Machine unlearning (MU) has emerged as promising mitigation by selectively removing undesirable concepts from pretrained models, yet the robust- ness of existing methods, particularly under multi-modal adversarial inputs, re- mains insufficiently explored. To address this gap, we propose RECALL, a multi- modal adversarial framework for systematically evaluating and compromising the robustness of unlearned IGMs. Unlike prior approaches that primarily optimize adversarial text prompts, RECALL exploits the native multi-moda conditioning of diffusion models by efficiently optimizing adversarial image prompts guided by single semantically relevant reference image. Extensive experiments across ten state-of-the offtth--ar art unlcarning methods and diverse representative tasks show that RE- CALL consistently surpasses existing baselines adversarial effectiveness, com- putational efficiency, and semantic fidelity to the original prompt. These results reveal critical vulnerabilities current unlearning pipelines and underscore the need for more robust, verifiable unlearning mechanisms. More than just an attack, RECALL also serves as an auditing tool for model owners and unlearning practi- tioners, enabling systematic robustness evaluation. Code and data are available at https: / tiuhub.u.... wom/ wtoom//ylluee. //RECAL..
Warning: This paper contains visual content that may include explicit or sen- sitive material, which some readers may find disturbing offensive.
INTRODUCTION
The emergence of image generation models (IGMs), such as Stable Diffusion (Rombach et al., 2022a), has greatly advanced the quality and diversity of Al-generated visual content. IGMs are now widely used in digital art, multimedia creation, and visual storytelling (Chen et al., 2024; Zhang et al., 2024b). However, their rapid adoption also raises serious ethical and legal concerns, particu- larly regarding the misuse of these models to generate harmful, misleading, infringing content (Qu et al., 2023; Schramowski et al., 2023). Consequently, ensuring robust safety and trustworthiness mechanisms within these generative frameworks has emerged an urgent imperative (Wang al.,
2025; 2024).
"Corresponding Author

---

Published as a conference paper at ICLR 2026
Among different lines of efforts, machine unlearning (MU) has recently gained growing promi- nence (Zhang et al., 2024c; Park et al., 2024; Li et al., 2024b). It aims to remove sensitive concepts (e.g., nudity, violence, and copyrighted materials) from the IGMs, prohibiting the generation of sen- sitive or problematic content while maintaining the model's general capability of producing benign and high-quality outputs (Schramowski et al., 2023; Kumari et al., 2023; Gandikota et al., 2024). Recent IGM unlearning (IGMU) methods utilize diverse strategies, including fine-tuning (Gandikota al., 2023; Zhang et al., 2024a), targeted concept removal (Gandikota al., 2024; Gong et al., 2024; Orgad et al., 2023), negative prompting (Schramowski et al., 2023), and adversarial filtering (Zhang et al., 2024c; Gong et al., 2024; Wu al., 2025). They have proven effective in safety protection of contemporary IGMs, enforcing compliance with ethical guidelines and legal standards.
Despite the rapid progress in this field, the practical robustness of these techniques challenged, especially under adversarial scenarios. Recent studies have revealed that unlearned IGMs are still vulnerable: carefully optimized prompts can successfully circumvent safety mechanisms, prompt- ing the unlearned models to regenerate prohibited content (Zhang et al., 2024d; Tsai et al., 2024). However, these attack methods mainly focus on perturbing the textual modality and suffer from the following critical limitations. @ Modifying textual inputs can disrupt the semantic alignment be- tween the generated images and original prompts; @ Many approaches rely on external classifiers or additional diffusion models for adversarial text prompt optimization, incurring substantial com- putational overhead; @ Their effectiveness sharply declines against robust, adversarially-enhan unlearning methods, e.g., AdvUnlean (Zhang et al., 2024c), RECE (Gong et al.. 2024); @ Crucially, these methods overlook the inherent multi-modal conditioning capabilities (e.g., simultaneous tex- tual and image) of IGMs, thus missing a critical dimension of potential vulnerability.
To address these limitations, we propose RECALL, a novel multi-modal attack framework against mainstream IGMU solutions. Figure 1 illustrates the attack scenar- ios. First, unlike previous attacks that focus solely on text perturbation, RECALL strategically integrates an ad- versarially optimized image with the original text prompt to attack the unlearned model, ensuring strong semantic alignment between the generated images and correspond- ing textual descriptions. Second, RECALL performs the attack within the unlearned model and optimizes the la- tent representation of the adversarial image prompt, elim- inating the reliance on additional components and sig- nificantly enhancing computational efficiency. Further- more, by introducing adversarial perturbations directly within the image modality, RECALL effectively exposes hidden vulnerabilities in adversarially enhanced unlearn- ing methods, revealing their susceptibility to image-based attacks that prior text-based adversarial techniques may overlook. Finally, RECALL fully exploits the inherent multi-modal guidance capabilities of IGMs, enabling the comprehensive identification of critical vulnerabilities across diverse scenarios before real-world deployment.
P ftext
naked person picking
pade
flowers meadow
Nudiiy un't Learned IGN Sr.
Nudity un't learned IGM Su.
IGN 9
Figure 1: Given an assumed successfully unlearned IGM Gu. our adversarial im- age prompt Pady combined with the orig- inal sensitive text prompt Preat as multi- modal guidance can circumvent the unlearn- ing mechanism. leading to the reappearance removed content T*. Sensitive parts are covered by
Extensive empirical results conducted on ten ofate-of-the-art IGMU methods across four represen- tative unlearning scenarios demonstrate that RECALL consistently surpasses prior approaches in terms of adversarial effectiveness, computational efficiency, and semantic fidelity. Beyond demon- strating strong attack performance, these findings reveal critical vulnerabilities in current unlearning pipelines. underscoring their susceptibility multi-modal guided adversarial inputs and the urgent need for more robust and verifiable unlearning mechanisms in IGMs. From the perspective of model owners, RECALL can also serve as an efficient robustness auditing tool to assess the effectiveness of their unlearning procedures. Our key contributions are as follows:
We propose RECALL, the first multi-modal guided attack framework to break the robustness of IGMU techniques. allowing the protected model to regenerate unlearned sensitive concepts with high semantic fidelity.
2

---

Published as a conference paper at ICLR 2026
RECALL introduces highly efficient optimization strategy that operates solely within the un- learned model by utiliziig only single reference image, eliminating the need for auxiliary clas- sifiers, original diffusion models, or external semantic guidance required by previous attacks.
Through comprehensive experiments covering ten representative IGMU techniques across four di- verse tasks, we empirically demonstrate the vulnerabilities of existing unlearning solutions under multi-modal attacks, revealing the urgent need for more robust safety unlearning.
RELATED WORK
Image Generation Models (IGMs). Diffusion-based IGMs, such as Stable Diffusion (SD) (Rom- bach et al., 2022b), DALL-E (OpenAI, 2023), and Imagen (Saharia et al., 2022), have achieved im- pressive progress in synthesizing diverse, high-fidelity images. These models leverage large-scale datasets (c.g., LAION-SB (Schuhmann et al., 2022)) and integrate components including pre-trained text encoders (c.g., CLIP (Radford et al., 202 I)), U-Net denoisers, and VAE decoders, enabling pre- cise semantic alignment between prompts and images for wide range of applications.
Unlearning in Image Generation Models. The proliferation of IGMs has led to increasing con- cerns about the generation of harmful or copyrighted content (Qu et al., 2023; Liu et al., 2025). Machine unlearning (MU) methods have been developed to selectively remove undesirable concepts from pretrained models (Kumari et al., 2023; Fan et al., 2024) while preserving overall generative capabilities. Existing IGM unlearning (IGMU) approaches can be broadly categorized as: (i) Fine- tuning-based, which update model parameters to forget specific concepts (e.g., ESD (Gandikota et al., 2023), UCE (Gandikota et al., 2024)); (ii) Guidance-basee based, which constrain generation inference without modifying model weights (e.g.. SLDD (Schramowski et al., 2023)); and (iii) Regularization-ban based, which introduce forgetting objectives during training (e.g.. Receler (Huang et al., 2024), FMN (Zhang et al., 2024a)). Despite their successes, these methods often exhibit limited robustness and generalization.
Adversarial Attacks on IGMU. Recent works demonstrate that adversarial prompts can circum- vent IGMU defenses and recover restricted content (Li et al., 2024a; Chin et al., 2024a; Zhang al., 2024d). White-box methods such as P4D (Chin et al., 2024a) and UnlearnDiffAtk (Zhang et al., 2024d) optimize text prompts but may suffer from high computational overhead and reduced mantic alignment, CCE (Pham et al., 2024) learns a single placeholder via textual inversion on the erased model and substitutes it at inference to recover restricted concepts, while WACE (Lu al., 2025) regenerates forgotten content via a noise-based probe. The black-box and transfer-based ap- proaches (Han al., 2025; Tsai et al., 2024; Dang et al., 2025; Ma et al., 2025; Chin al., 2024b) rely on surrogate models or textual perturbations, sometimes requiring external classifiers or ac- cess to the original diffusion model. These approaches are less effective against stronger unlearning defenses (e.g., AdvUnleam (Zhang et al., 2024c), Receler (Huang et al., 2024)) and remain compu- tationally intensive.
Therefore, effective attack strategies should efficiently recover restricted content, preserve prompt- image semantic coherence, and exploit vulnerabilities beyond text perturbations. To this end, we propose RECALL, multi-modal adversarial framework that leverages adversarial image prompts alongside unmodified text inputs, enabling effective attacks on unlearned models via multi-modal guidance. Our method requires neither external classifiers access to the original IGM, making both lightweight and effective.
PRELIMINARY
3.1 IMAGE GENERATION MODEL UNLEARNING
Given a pretrained IGM G over concept space C, Image Generation Model Unlearning (IGMU) aims to selectively remove the model's ability to generate content associated with a sensitive con- cept subset C' C C, while preserving generative quality for the remaining concepts. Formally, an unlearning algorithm A,, produces a modified model G., = (9,CC'") The unlearning objectives twofold:
3

---

Published as a conference paper at ICLR 2026
Forgetting: For all C', the model should no longer generate content related to Gu(Piend n (Preet) =
Preservation: For all E C the generative performance should retained: sim(Gu(Ptezz)) ((Pee))))) 2 o, where sim((..) denotes perceptual similarity metric (e.g., CLIP score or LPIPS), and is a predefined threshold.
In this work, we focus on unlearning methods and evaluation within the multi-modal, diffusion- based IGM setting, with SD as representative backbone.
3.2 THREAT MODEL
We consider an adversary seeking to deliberately regenerate erased content from a concept- unlearned, multi-modal (text+image) IGM. The adversary requires white-box access and the ability to invoke the model's native multi-mooal-condiiioinngg pathway. This setting primarily targets (i) attacks: is realistic because many applications deploy open or publicly available Stable Diffusion variants and is consistent with prior white-box threat models (Chin et al., 2024a; Pham et al., 2024; Zhang et al., 2024d). The same setup also supports (ii) unlearning red-teaming by model owners or auditors as pre-deployment robustness assessment to locate weaknesses and guide verifiable mitigation.
3.3 PROBLEM FORMULATION
We introduce new attack strategy that optimizes image prompts by leveraging multi-modal guid- ance, which is natively supported by Stable Diffusion (Rombach et al., 2022a), to bypass unlearning mechanisms and regenerate erased content.
Given an unlearned image generation model (IGM) G. that has been updated to suppress content associated with target concept c, text prompt Ptezt containing c, and an image Pong relevant to the concept c, we aim to find an adversarial image input Pade such that, when paired with Ptezts the unlearned IGM Gu generates image 1* related to C:
T Gu (Pedy img: Prezt);
T'
where / denotes images that explicitly contains the target concept e these images can come from the original model G with the same text prompt Piex or from any other source.
The adversarial image prompt Pady is obtained by solving:
podv img
arg min Lado (Pings Ptest), 1).
Ping
where Lodv adversarial loss function.
Unlike prior attacks that modify the text prompt Ptent, we optimize Pang while keeping Ptent un- changed, thus preserving the semantic intent. The optimization follows gradient-based approach:
pade 3mg
+ Psmm
V Pimg (Gu (Pimgs Ptext),
(3)
where 17 is the step size. This process enables the adversarial image prompt may together with Pteat, to exploit vulnerabilities in the unlearned model and recover the erased content while main- taining semantic alignment with the text prompt.
METHODOLOGY
4.1 OVERVIEW
We propose RECALL, multi-modal adversarial framework targeting unlearned IGMs. Unlike con- ventional text-only attacks, RECALL jointly optimizes adversarial image prompt by leveraging a reference image Pre/ guidance. As illustrated in Figure 2, RECALL comprises three stages: (1) Latent Encoding: The reference image Prey and a moise-injected initial prompt are encoded into la- tent representations. (2) Iterative Latent Optimization: The adversarial latent is iteratively refined
4

---

Published as a conference paper at ICLR 2026
gen ittnndnn by
Text Encoder 8
Prexe
Stage
Stage IIl
Stage
1
emugge
UsNer
Ere!
L Ludv
Pref (D &
Eddt
Deeiiivly optimize
t=
ref Prafiaed nake
Forward
calouiation
Lystu
L=T-1
R Pudo Predicuu sd soioe
propagation
Ref image laceet
plniic
Lust Adverarit loss
Int, adveserial steeet
Figure 2: Overview of RECALL. Given reference image Prey that depicts the erased concept and heavily noised initial image prompt Piny. we itcratively optimize the latent Redv (initialized from Pimy to align with the reference latent Zref under the same text condition. After optimization, Zadv is decoded into an adversarial image Pody, which then paired with the original text prompt and fed into the unlearned model, enabling recovery of the crased concept, thereby exposing vulnerabilities current unlcarning mechanisms under multi-modal guidance.
under the guidance of the reference latent by minimizing the discrepancy between their predicted noise residuals. (3) Multi-modal Attack: The optimized latent is decoded to an adversarial image, which, paired with the text prompt, forms multi-modal input to the unlearned IGM, enabling ef- fective recovery of the erased target concept. Details of each stage are described in the following sections, and the overall pipeline summarized in Algorithm (Appendix B).
4.2
IMAGE ENCODING
To avoid incurring additional computational overhead from external classifiers or relying on the original IGM, we introduce a reference image Pref containing the target concept c to guide the generation process, where the reference image Pref can be sourced from multiple sources, such the internet, public datasets, or self-collected. This reference implicitly embeds the erased concept, thereby facilitating adversarial optimization of the initial image prompt P To enhance efficiency and precision, RECALL performs the optimization directly the latent space representation Zadv of the image prompt.
As illustrated in Figure 2, we initialize img by blending small portion of the reference image Pref with random noise 5 sampled from an isotropic Gaussian distribution (N I):
Ping + A Pref + -1-XA (1 -5, 8 ~ ~~000
(4)
where À E [0, 1] is a hyperparameter controlling the semantic similarity to the reference image. We set À 0.25 throughout experiments. This approach increases the sampling space of Stable Diffusion and further enhances the diversity of the generated images, while simultaneously encour- aging the generation process better follow the guidance of the text prompt, thereby improving semantic consistency.
To accelerate optimization, both pinit and Pref are encoded into the latent space using the image encoder &, from the unlearned model, yielding:
2; = E Zref E((res),
(5)
where is used as the initial adversarial latent zadv, and Zyef serves as the fixed reference guiding the optimization process.
4.3 ITERATIVE LATENT OPTIMIZATION
We iteratively optimize the adversarial latent as below.
Generation of Latent 2;- Unlike standard latent diffusion, which typically initializes from ran- domly sampled latent, RECALL generates the noisy latent at timestep f. as:
2t Von v1 G <~ N(
5

---

Published as a conference paper at ICLR 2026
where 2 denotes either the reference latent 2re/ the adversarial latent Sade. The cumulative noise schedule āg determines the relative contribution of signal and noise.
To accelerate optimization, each 24 corresponds to single denoising step from fixed DDIM (Song et al., 2021) sampling schedule of 50 steps (t = T + 0). At each step, we apply one backward denoising pass to simulate efficient adversarial guidance. We adopt early stopping mechanism: the attack halts as soon as the target content reappears; It fails no target content is observed after all steps are exhausted.
Optimization under Multi-Modal Guidance. For each noisy latent žt. the diffusion model pre- diets the corresponding noise component using U-Net Fe. conditioned on the textual embedding he from the encoding text prompt Prezt by the text encoder & (i.e., hę = E (Peeaa))) The predicted noise of reference image εref and adversarial image Éndo can be derived as:
Eref (o(((ref.)) t, he); Eadv [ t, he).
The discrepancy between two noise predictions forms the basis of the adversarial objective function.
As discussed previously, our attack explicitly targets the latent representation Zadv of the adversar- ial image prompt Pady- aiming to efficiently induce the unlearned IGM model to regenerate the previously unlearned content. Specifically, adversarial latent representation Zade using a gradient- adversarial loss Lodv- To enhance stability and facilitate convergence, we incorporate momentum- based gradient normalization into our optimization scheme (Dong et al., 2018). Specifically, we iteratively update the latent adversarial variable Zade over N epochs according to:
each diffusion timestep I, we iteratively refine the optimization procedure guided by the
V Zado Ludo
U2 3 U1-1
Zudo
Rodv 17 sign(e:),
(8)
Fudle Ladv +
where 17 denotes the step size, is the momentum-updated gradient direction at iteration i, and B = 0.9 represents the momentum factor. The term V Cadv refers to the gradient of the adversarial loss Lade with respect to the adversarial latent Zadv. normalized by its Ln-norm for gradient scale invariance, and implementations, we periodically integrate small portion of the reference latent žref back into zadv. thereby reinforcing semantic consistency between Zadv and žre/ during the optimization:
le-8 is a small constant for numerical stability. Furthermore, in practical
Radv + (1 - 7) + Y Zref,
where y is small regularization parameter and set to 0.05 in our optimization.
Objective Function. The adversarial objective function Lude explicitly quantifies the discrepancy between noise predictions generated from the adversarial latent Èadv and reference latent éref with U-Net at step t, respectively:
Ludo ((((ref.t)) ((do,.)) ) = [rāff)))) ((ddv;)) 12.
(10)
where M denotes similarity measurement. In this work, we employ the mean squared error (MSE).
Adversarial Image Reconstruction. After optimization, the refined adversarial latent Bodv is sub- sequently decoded into the image space through the image decoder D; of the unlearned SD model to generate the final adversarial image used for the attack: Pody = Dj (Zado).
4.4 MULTI-MODAL ATTACK
Once the adversarial image Pade is obtained, we leverage the multi-modal conditioning mechanism of the unlearned model G. to generate images containing the forgotten content and semantically aligned with the text prompt Pteat- The final image generation process integrates both the optimized adversarial image prompt and the original text prompt in a multi-modal manner:
I = (Pady Ptent),
(11)
where I* is the final generated image.
Our method systematically exposes the inherent weaknesses in current concept unlearning tech- niques: by utilizing both adversarial image optimization and textual conditioning, the unlearned information can still be reconstructed.

---

Published as a conference paper at ICLR 2026
Table 1: Attack comparisons against unlearned IGMs in six dataset for four representative unlearning tasks.
Task
Method
ESD
FMN
SPM
Adv Unleum
MACE
RECE
DoCo
UCE
Receler
ConcepiPrume
Avg. ASR
Text-only
10.56
66.90
1.11
7,04
30.99
8.45
24.30
Image-only
0.00
18.31
12.68
4.23
5.63
14.08
3.52
11.97
6.34
13.38
9.01
Text Runoise
0.70
29.58
14:08
0.70
3.52
1.41
14.79
2.82
0.70
36.62
10.49
Nudley-1PP
Text Image
13.38
59.15
42.25
7.04
10.56
14.79
40.14
17.61
20.42
52.11
27.74
"F4D-K
31G4
8622
76.76
40.T4
$5.32
17
56.34
20.14
77.26
34.22
P4D-N
62.68
88.73
76.76
2.82
32.39
52.11
80.28
54,93
35.92
89.44
57.61
CCE
59.15
85,21
64.08
37.32
52.75
26.76
30.28
40,14
20.42
83.10
50.42
UnlcamDiffAlk
51.41
92.25
88.03
8.45
47.18
40.85
87.32
70.42
55.63
97.18
63.87
WACE-N
30.28
80,99
61.27
4.23
20.42
15.49
58.45
28.17
23.24
80.28
40.28
WACE-C
51.41
89.44
79.58
25.35
46.48
28.87
71.83
42.96
46,48
88.03
57.04
RECALL
71.83
100,00
96.48
60.56
71,83
59,86
92.25
76.76
78.87
99,30
80.77
Text-only
1.56
46.88
32,03
0.00
0.00
13.28
27. 34
24.22
14.06
53.12
21.25
Text Ruoise
0.00
20.31
0.00
4.69
14.84
1.56
42.19
12.27
Text Image
8.59
78.91
59.38
0.00
2.34
37, 50
62. 50
44.53
43.75
80.47
41,80
Nodry--MA
P4D K
36.90
62.550
76.88
8.43
49.54
$7.50
85.31
50.62
79.89
89.65
62.70
P4D-N
62.50
74.37
78.44
10.64
53.67
51.25
$8.44
91.41
85.94
98.44
69.51
CCE
35.16
89.84
78.91
3.12
55.47
46.88
54.69
58.59
36.72
97.66
55.70
UnlearDiilAAIk
40.62
100.00
99.22
23.78
33.59
06
98.44
95.31
85.94
99.22
76.52
WACE-N
28.12
86.72
75.78
7.03
1.56
46.09
68.75
49.22
52.34
86.72
50.23
WACE-C
61.72
92.19
82.81
49.22
13:28
57.03
80.47
70.31
70.31
85,
66.25
RECALL
75.78
100,00
97.66
82,81
53.12
89,84
94.53
92.97
96.09
99.22
88,20
Text-only
0.00
11.72
2.34
0.00
0.00
0.00
3.12
0.78
2.34
7,03
2.73
Text Runoise
0.00
36.16
17.19
0.00
0.00
0.00
4.69
0.78
0.00
17.19
7.50
Text Image
0.78
14.84
13.28
0.78
1.56
1,56
4.69
2.34
4.69
12.50
5,70
Nadiy-RRT
"F4D-R
8.75
'66667
37.63
$1,35
.1.8.
T2:30
56.25
755003
P4D.N
12.50
62.86
62.81
3.98
24.69
32.81
44
45.62
21.88
53.12
36.87
CCE
20.31
53,91
28.12
28.12
21.88
3.12
3.12
13.18
6.25
42.97
22.10
UnlcamDiffAlt
31.25
76.56
66.41
0.78
17.19
21.09
76.47
39.06
35.16
75.78
43.98
WACE-N
7,81
48.44
26.56
0.78
2.34
4.69
21.09
7,03
7.81
37.50
16.41
WACE-C
20.31
57.81
34.38
5.47
8.59
4.69
33 59
10.94
14.84
47.66
23.83
RECALL
62,50
91,29
81.25
32.03
43.75
32.99
98.12
$2.34
70.31
89.84
65.44
Text-only
26.00
50.00
82.00
24.00
72.00
74.00
52. 00
98.00
20.00
98.00
$9.60
Image-one only
0.00
0,00
0.00
0.00
0,00
0.00
0.00
0.00
0.00
0.00
0.00
Von Gogh-style
Text R noise
8.00
14.00
18:00
12.00
16.00
28. 00
38.00
38.00
10.00
80.00
26.20
Text Image
10.00
18.00
42,00
10.00
24.00
32,00
42,00
74.00
24.00
96.00
37,20
"I4D-R
36700
7:200
DUTOD
86.00
DUT
"100000
62.N0
59.00
62700
S0020
P4D-N
88.00
88.00
100.00
86.00
96.00
98. 00
90.00
100.00
74,00
100,00
92,00
CCB
78.00
66.00
100.00
86.00
94.00
S8.00
46.00
98.00
16.00
100.00
77.20
UnlcamDiffAAt
96.00
100,00
100.00
84,00
100.00
100,00
100,00
100.00
92.00
100,00
97,20
WACE-N
28.00
36.00
12.00
70.00
$0.00
90.00
10.00
96.00
56.00
WACE-C
14.00
34.00
$6.00
8.00
28.00
50.00
72.00
$8.00
4.00
96.00
48.00
RECALL
92.00
100.00
100.00
92.00
100.00
100.00
100.00
100.00
97.40
Text-only
16.00
52.00
44.00
0.00
4,00
4.00
44.00
6.00
2.00
92.00
26.40
Image only
4,00
18.00
20.00
8.00
16.00
18.00
12.00
20.00
16.00
20.00
15.20
Text & noise
0.00
32.00
22.00
0.00
0.00
2.00
32,00
2,00
0.00
46.00
13,60
Objeet-Chuch
Text Image
46.00
66.00
66.00
4.00
10.00
4,00
60.00
8.00
2.00
80.00
34,60
P4D-K
6,00
56.00
48.00
0.00
2.00
28.00
86,00
24.00
20,00
88.00
35,80
P4D-N
58.00
90.00
86.00
14.00
00
12.00
92.00
10.00
14.00
74.00
49,80
CCE
54.00
92.00
76.00
58.00
60.00
12.00
58.
46.00
26.00
76.00
$5.80
UnlcamDiffAAt
20.00
96.00
94.00
4.00
32.00
52.00
100.00
66,00
10.00
100.00
62.40
WACE-N
48.00
66.00
60.00
2.00
4,00
6.00
68. 00
6.00
2.00
74.00
33.60
76.00
10.00
RECALL
96.00
100.00
98.00
62,00
50.00
46.00
91.000
68.00
20.00
98.00
73.40
Text-only
4,00
$4,00
24.00
4.00
2.00
2,00
8.00
2.00
2.00
88.00
19.00
Image only
20.00
92.00
96.00
88.00
92.00
86.00
96.00
50.00
$8.00
84.00
83.20
Objet-Panchute
Text noise
4,00
48.00
22.00
2,00
4,00
0.00
10.00
2,00
2.00
60.00
15.40
Text & Image
94.00
98.00
$8.00
52,00
72.00
48.00
50.00
60.00
32,00
98.00
69.20
P4D-K
2.00
18.00
96.00
P4D-N
36.00
82.00
70.00
8.00
22.00
12.00
$2.00
14,00
2.00
84,00
38.20
92.00
48.00
34.00
52. 12.00
52.00
$8.00
60.40
UnleamDiEAAu
56.00
100.00
94.00
14.00
36.00
34.00
92.00
42.00
30.00
100,00
59.80
WACE-N
10.00
10.00
6,00
26.00
4.00
31.00
WACE-C
56.00
84.00
60.00
6.00
16.00
8.00
32,00
22,00
14,00
90.00
38,80
RECALL
94.00
88.00
98.00
96.00
97.00
EXPERIMENTS
We conduct extensive experiments involving TEN SOTA unlearning techniques across four rep- resentative unlearning tasks: Nudity, Van Gogh-style, Object- Chhcchh and Object-Parachut thus yield a total of forty unlearned IGMs. Our objective is to systematically validate the effectiveness and generalization of proposed multi-modal guided attack RECALL against different scenarios.
7

---

Published as a conference paper at ICLR 2026
5.1 EXPERIMENTAL SETUP
Datasets. We evaluate on three nudity unlearning datasets (I2P (Schramowski et al., 2023), MMA (Yang et al., 2024), and ART (Li al.. 2024a)). For the remaining targets, such as Van Gogh-style, Object-Churche and Object-Parachute, we reuse the text prompts released by Unlearn- DiffAtk to ensure protocol comparability. For methods that require a reference image, we provide one same additional image per unlearning task. Details of all prompts and reference images are provided in Appendix C.I, Table 3.
IGMU Methods. We evaluate our approach across ten ofate-of-the-art art IGMU techniques: ESD (Gandikota et al., 2023), FMN (Zhang et al., 2024a), SPM (Lyu et al., 2024), AdvUn- learn (Zhang et al., 2024c), MACE (Lu et al., 2024), RECE (Gong et al., 2024), DoCo (Wu et al., 2025), Receler (Huang et al., 2024), ConceptPrune (Chavhan et al., 2025), and UCE (Gandikota et al., 2024). The weights of involved unlearned SD models are sourced from three primary origins: @ the AdyUnleam GitHub repository', as described in (Zhang et al., 2024c); @ weights officially released by their respective authors, such RECE (Gong al., 2024), MACE (Lu et al., 2024) and DoCo (Wu et al., 2025); and @ weights trained in-house using official implementations provided by ourselves.
Baselines. We compare our proposed RECALL against several representative attack baselines: Text- only (text prompts only), Image-only (reference image prompt only), Text & R_noise (text with noised image). Text & Image (text prompt and reference image). P4D (with two variants P4D-K and P4D-N) (Chin et al., 2024a). CCE (Pham al., 2024), UnlearDDiffAik (Zhang et al., 2024d), and WACE(with two variants WACE-N and WACE-C) (Lu et al., 2025). Their detailed descriptions and implementation can be found in Appendix C.2.
Evaluation Metrics. We assess the effectiveness of our attack using task-specific deep learning- based detectors and classifiers, including the NudeNet detector (Praneeth, 2023), a ViT-based style classifier (Zhang et al., 2024d), and an ImageNet-pretree mary metric is attack Success Rate (ASR, %) and average ASR for attack performance, average attack time (scconds, s) for computational efficiency, CLIP Score (Hessel et al., 2021) for quanti- fying semantic alignment between generated images and prompts, and LPIPS (Zhang et al., 2018), Inception Score (IS) (Salimans et al., 2016), and DINO based feature distance (Oquab al., 2024) for generated image diversity. Throughout all tables, the best attack performance is highlighted in bold, while the second-best is indicated with underlining.
ResNet-50 (He et al., 2016). The pri-
Implementation Details. The main backbone used is SD V1.4 to align with involved IGMU tech- niques and baselines. The adversarial optimization of RECALL is performed with 50 DDIM steps and 20 gradient iterations per step (step size 1) 1c-3, momentum 0.9), with early stopping ap- plied when the target content is regenerated. All experiments are conducted using Py Torch on an NVNIIA H100 GPU server with a fixed random seed 2025.
5.2 ATTACK PERFORMANCE
CCE
UnkernDiTTikk
WACE
RECALL
We comprehensively evaluate the effectiveness of RECALL against several baseline attack methods across four representative unlearning tasks. The de- tailed experimental results, as summarized in Ta- ble 1, reveal several critical findings. ① Existing unlearning approaches fail to fully erase target con- cepts; notably, original textual or combined text- image prompts (reference image or randomly ini- tialized) alone achieve substantial ASRs. For in- stance, combined text-image prompts yield an Avg. ASR exceeds 69.20% in the Parachute task. @ All baseline attack methods exhibit limited effectiveness when attacking adversarially enhanced unlearning strategies (e.g., AdvUnleam and RECE), evidenced by their significantly lower ASRs.
Figure 3: Generated images under different at- tacks. Rows (top to hottom): Nudity, Van Gogh, Church, and Parachute.
( In contrast,
'https://so htttss///gtttbb.ccoo///iillrrrr wwwp://////.....///////////////. AdvUn earn
8

---

Published as a conference paper at ICLR 2026
RECALL consistently attains superior performance, achieving average ASRs ranging from 73.40% to 97.40% across diverse scenarios. Specifically, RECALL outperforms UnleamDiffAtk, a strong baseline, improving the average ASR by 16.90% 0.20%, 11.00%, and 37.20% for four tasks. These results highlight the robustness and efficacy of RECALL in regenerating targeted, presumably erased visual concepts.
In addition, qualitative generation results on MACE in Figure 3 (Complete results in Appendix D Table 4) and visual cases (in Appendix F.2 Figure 7) show that RECALL consistently surpasses existing baselines in recovering erased concepts across a variety of unlearning scenarios, yielding highly diverse outputs.
5.3 ATTACK EFFICIENCY
To assess the practical efficiency of RECALL, we com-
pare the average attack time (in seconds) needed by RE- CALL with various baselines, lower average attack time indicates higher efficiency. Figure reports results for
Avp. Attack Time (6)
302
F4D-N
WACB-C
600
KECALL
400
Nudity task (attack time for more tasks can be found in Appendix E). As shown, RECALL achieves significantly lower attack time (~64s) compared to P4D-N (~238s), UnlearnDiffAtk (~232ss) and WACE-C (~223.15s). This improvement stems from efficient multi-modal opti- mization directly in the latent space and these efficiency gains align with high attack success rates, highlight- ing that RECALL is both effective and computationally lightweight. Notably, less robust unlearning methods (e.g., FMN, SPM) tend require shorter attack durations, further illustrating their susceptibility.
200
ESD
PMN SPM
M
NECE
Doco
uee
Raaler
CompttPane
Figure 4: Comparison of average attack time for different attack methods for Nudity task.
5.4 SEMANTIC ALIGNMENT
We assess the semantic consistency be- tween regenerated images and their cor- responding text prompts using the CLIP Score. Table 2 presents the average CLIP Scores for four attack methods, P4D, CCE, UnlearnDif'Atk, WACE, and our proposed RECALL, evaluated across six unlearning techniques and four aforemen- tioned representative unlearning tasks.
Table 2: CLIP Scores (1) among baselines and RECALL.
Task
Method
ESD
MACE
RECE
UCE
Receler
DoCo
P4D
24.09
23.20
24.99
24.90
25.64
23.70
Audiry-12
CCE
19.11
19.00
19.07
19.08
19.02
19.11
UnlearnDifAAtk
29.61
23.11
29.25
29.17
29.00
31.18
WACE
18.77
19.83
19.47
19.61
19.25
RECALL
32.13
24.79
30.66
31.31
31.12
31.95
P4D
17.73
31.66
25.64
22.57
13.49
21.81
Von Gogh
CCE
18:39
18.54
18.43
18.36
18.58
18.40
UnleamDiffAAk
29.23
33.85
33.10
33.32
21.26
22.39
As shown in Table 2, RECALL con- sistently outperforms baseline methods, achieving the highest CLIP Scores across all tasks and unlearning settings. No- tably, RECALL attains average CLIP Score of 30.28, surpassing UnfearnDif- fAtk (28.00), P4D (25.00), CCE (20.01)
WACE
18.21
18.04
18.18
18.27
17.98
18.29
RECALL
35.92
35.28
34,71
34.20
23.37
30.01
P4D
25.88
28.44
27.68
27.76
30.34
25.62
Church
CCR
20.46
20.46
20.50
20.52
20.34
20.64
UnleamDiffAAk
27.68
27.46
27.04
28.97
30.89
29.99
WACE
20.09
21.16
19.40
20.53
RECALL
27.94
28.94
28.36
27.82
27.73
30.37
P4D
23.73
28.01
27.13
24.18
28.37
Parachute
and WACE (19.89). These results indicate that text-based methods, which perturb original prompts, often degrade semantic coherence, In contrast, our multi-modal adversarial framework preserves the tex- tual intent and introduces perturbations solely through the image modality, yielding superior semantic alignment.
CCE
21.92
22.03
22.09
22.03
22.03
22.06
UnleamDiffAAt
25.64
25.59
25.73
23.37
26.22
28.98
WACE
22.05
21.84
21.64
21.97
21.95
21.76
RECALL
29.64
28.66
31.04
31.10
28.92
30.63
The original SD model achieves CLIP Scores of 31.05, 30.75, and 31.56 on the four tasks, respectively.
33.98.
5.5 GENERALIZABILITY
Reference Independence. We assess the robustness of RECALL to reference image selection using three additional references (Ri-R3, Appendix F.1, Figure 6). These additional references

---

Published as a conference paper at ICLR 2026
randomly downloaded from the Internet for the Nudity and Object- Churchh tasks; Rong is the default reference in our core experiments, while Ri- are used only for this ablation. As reported in Appendix F.1, Table 5, both attack and diversity metrics remain consistently high provided the reference is representative, demonstrating that RECALL does not depend on any specific image.
Generation Diversity. We quantitatively compare image-only, text-only, and RECALL. As detailed in Appendix F.2, RECALL achieves substantially greater diversity than image-only baselines and matches the performance of text-only approaches, indicating that recovers the original concept distribution rather than simply transforming reference images.
Model Version Independence. We further evaluate RECALL unlearned models based on SD 2.0 and SD 2.1, in addition to SD 1.4. As shown in Appendix F.3, RECALL consistently maintains high effectiveness across all versions, confirming its robustness and generalizability more advanced diffusion architectures.
5.6 ABLATION STUDY
We conduct ablation studies to systematically evaluate the impact of key strategies and hyperparam- eters the performance of the RECALL framework.
Strategies. We analyze three core strategies: multi-modal guidance, noise initialization, and peri- odic integration.
Multi-modal Guidance. We compare Text-only, Image-only, Text & R_noise, Text & Image, and our Text & Adversarial Image approaches. Results in Sections 5.2 and Appendix D show that combining textual prompts with adversarial image optimization substantially improves both attack performance and semantic consistency.
Noise Initialization. Noise initialization significantly enhances both diversity and semantic alignment of generated images, as demonstrated by consistently higher LPIPS, IS, and CLIP Scores across tasks (Appendix G.I, Figure 9).
Periodic Integration. Periodically integrating 2ref into Zads further improves attack per- formance, efficiency, and the diversity of generated images when the attack succeeds (Ap- pendix G.4, Figure 12). We therefore adopt this strategy with epochimerral and 7 0.05.
Parameters. We investigate the sensitivity two critical optimization parameters:
Step Size (n). Reducing y from 0.1 to 0.001 steadily increases ASR, with 7 = 0.001 yield- ing optimal performance. Further reduction impairs effectiveness due insufficient updates (Appendix G.I, Figure 9).
Initial Balancing Factor (A). Increasing À improves ASR until saturation. Semantic alignment = 0.25 and then declines, at the same time, reaching a good tradeoff
(CLIP Score) peaks between the ASR and attack time, indicating trade-off between attack strength and semantic consistency. We set À = 0.25 as the default (Appendix G.2, Figure 10).
CONCLUSION
We present RECALL, a multi-modal adversarial framework for auditing concept unlearning multi- modal conditioning IGMs. Distinct from previous text-based approaches, RECALL leverages adver- sarially optimized image prompts together with the original textual inputs to induce unleamedd IGMs recover previously erased visual concepts. Extensive experiments across SOTA unlearning techniques and diverse tasks show that current pipelines remain vulnerable to multi-modal guided adversarial inputs. Beyond functioning as an attack, RECALL provides an efficient anditing mecha- nism for model owners with full access to verify the robustness of their unlcarning procedures prior deployment, thereby informing the design of stronger, verifiable unlearning defenses.
Future Work. Future work will (i) extend RECALL to black-box and transfer-based settings to en- able third-party robustness auditing without parameter access; (ii) evaluate generalizability across broader generative architectures and training regimes; and (iii) investigate defense- aware and certi- fiable unlearning strategies that are resilient to multi-modal adversarial threats, including extensions to video and large multi-modal models.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This research is supported by A*STAR, CISCO Systems (USA) Pte.Ltd and National University of Singapore under its Cisco-NUS Accelerated Digital Economy Corporate Laboratory (Award 121001E0002).
ETHICS STATEMENT
This work evaluates vulnerabilities in concept-unlearned diffusion models using synthetic or pub- licly available data. We do not release explicit imagery; figures are masked where necessary. All experiments are conducted strictly for safety auditing and research purposes. We did not conduct any user studies or collect personal data.
REPRODUCIBILITY STATEMENT
We provide text prompts, reference images, random seeds, and hyperparameters in our publicly available codebase", and we summarize them in Appendix (Table and Table 7). We fix global random seed to 2025. For each task, we use the task-specific smage-generation seeds specified in our configuration (e.g., those used for the Nudity task on the I2P dataset), ensuring that all reported results are reproducible.
REFERENCES
Stability AI. Stable diffusion v2.1. httts::/huugj
stable-de fuss 1-, 2024. Accessed: Nov. 26, 2024.
Ruchika Chavhan, Da Li, and Timothy M. Hospedales. Conceptprune: Concept editing in diffusion models via skilled neuron pruning. In ICLR. OpenReview.net, 2025.
Shoufa Chen, Mengmeng Xu, Jiawei Ren, Yuren Cong, Sen He, Yanping Xie, Animesh Sinha, Ping Luo, Tao Xiang, and Juan-Manuel Pérez-Rúa. Gentron: Diffusion transformers for image and video generation. In CVPR, pp. 6441-6451. IEEF, 2024.
Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin-Yu Chen, and Wei-Chen Chiu. Prompt- ing4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. In ICML. OpenReview.nee 2024a.
Zhi-V Yi Chin, Kuan-Chun Mu, Mario Fritz, Pin- Yu Chen, and Wei-Chen Chiu, In-context experience replay facilitates safety red-teaming of text-to-image diffusion models. CoRR, 2024b.
Pucheng Dang. Xing Hu, Dong Li, Rui Zhang, Qi Guo, and Kaidi Xu. Diffzoo: A purely query- based black-box attack for red-teaming text-to-image generative model via zeroth order optimiza- tion. In NAACL. pp. 17-31. Association for Computational Linguistics, 2025.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In CVPR, pp. 9185-9193. Computer Vision Foundation / /EEE Computer Society, 2018.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. In ICLR. OpenReview.net, 2021.
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-baut based weight saliency in both image classification and generation. In ICLR. OpenReview.net, 2024.
Phttps://gi http://ggttubb.coo /68//AAAA...

---

Published as a conference paper at ICLR 2026
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In ICCV, pp. 2426-2442 2436. IEEE, 2023.
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzynska, and David Bau. Unified concept editing diffusion models. WACV, pp. 5099-5108. IEEE, 2024.
Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In ECCV, pp. 73-88. Springer, 2024.
Xiaoxuan Han, Songlin Yang. Wei Wang, Yang Li, and Jing Dong. Probing unlearned diffusion models: A transferable adversarial attack perspective. Puttern Recognition, pp. 112916, 2025,
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, pp. 770-778. IEEE, 2016.
Jack Hessel, Ari Holtzaan, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2104.08718, 2021.
Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, Fu-En Yang, and Yu- Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. In ECCV, volume 15098, pp. 360-376. Springer, 2024.
Nupur Kumari, Bingliang Zhang, Sheng-Yu Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Man Zhu. Ablating concepts text-to-image diffusion models. In ICCV, pp. 22634-22645, IEEE, 2023.
Black Forest Labs. Flux-uncensored-v2. http::::///cgggaaff.c..ce//eaaae
Flux- Soxx-uncnnsore-vV22 2024. Accessed: Nov. 24, 2024.
Guanlin Li, Kangjie Chen, Shudong Zhang, Jie Zhang, and Tianwei Zhang. ART: automatic red- teaming for text-to-image models to protect benign users. In NeurlPS, 2024a.
Jiaqi Li, Qianshan Wei, Chuanyi Zhang, Miaozeng Du, Yongrui Chen, Sheng Bi, and Fan Liu. Single image unlearning: Efficient machine unlearning in multimodal large language models. In NeurIPS, 2024b.
Renyang Liu, Wenjie Feng. Tianwei Zhang, Wei Zhou, Xueqi Cheng, and See-Kiong Ng. Rethinking machine unlearning in image generation models. In CCS, 2025.
Kevin Lu, Nicky Kriplani, Rohit Gandikota, Minh Pham, David Bau, Chinmay Hegde, and Niv Cohen. When are concepts erased from diffusion models? In NeurlPS, 2025.
Shilin Lu, Zilan Wang. Leyang Li, Yanzhu Liu, and Adams Wai-Kis Kin Kong. MACE: mass concept crasure in diffusion models. In CVPR, pp. 6430-6440. IEEE, 2024.
Mengyao Lyu, Yuhong Yang. Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts, diffusion models and erasing applications. In CVPR, pp. 7559-7563 IEEE, 2024.
Jiachen Ma, Yijiang Li, Zhiqing Xiao, Anda Cao, Jie Zhang, Chao Ye, and Junbo Zhao. Jailbreaking prompt attack: A controllable adversarial attack against diffusion models. In NAACI, pp. 3141- 3157. Association for Computational Linguistics, 2025.
OpenAl. Gpt-4 technical report. arXiv, 2023.
OpenAl Dall-e 3: Text-to-image generation and editing. OpenAl Technical Report, 2023.
Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V. Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, Mido Assran, Nicolas Ballas, Wojciech Galuba, Russell Howes, Po- Yao Huang, Shang- Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Hervé Jégou, Julien Mairal, Patrick Labatut. Ar- mand Joulin, and Piotr Bojanowski. Dinov2: Learning robust visual features without supervision. Transactions Machine Learning Research, 2024, 2024.
12

---

Published as a conference paper at ICLR 2026
Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. Editing implicit assumptions in eext-toimmage diffusion models. In ICCV, pp. 7030-7038. IEEE, 2023.
Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text-to-image models. In NeurlPS, 2024.
Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Cireumventing concept erasure methods for text-to-image generative models. In ICLR. OpenReview.net, 2024.
Bedapudi Praneeth. Nudenet: Deep learning model for nudity detection. https://githin 2023.
Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In CCS. pp. 3403-3417. ACM, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In ICML, pp. 8748-8763, 2021.
Jie Ren, Kangrui Chen, Yingqian Cui, Shenglai Zeng, Hui Liu, Yue Xing, Jiliang Tang, and Lingjuan Lyu. Six-cd: Benchmarking concept removals for text-to-image diffusion models. CVPR, pp. 28769-28778. Computer Vision Foundation / IEEE, 2025.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In CVPR, pp. 10674-10685. IEEE, 2022a.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjom Ommer. High- resolution image synthesis with latent diffusion models. In CVPR, pp. 10684-10663 2022b.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding. In NeurIPS, 2022.
Babak Saleh and Ahmed Elgammal. Wikiart: Visual art dataset for recognition and aesthetics anal- ysis. In ECCV, pp. 3-10. Springer, 2015.
Tim Salimans, Ian J. Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In NeurlPS, pp. 2226-2234, 2016.
Patrick Schramowski, Manuel Brack, Björ Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration diffusion models. CVPR, pp. 22522-22531. IEEE, 2023.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski. Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarezyk, and Jenia Jit- sev. LAION-5B: open large-scale dataset for training next generation image-text models. In NeurlPS, 2022.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In ICLR. OpenReview.net, 2021.
Yu-Lin Tsai, Chia- Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia- You Chen, Bo Li, Pin- Yu Chen, Chia-Mu Yu, and Chun- Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? In ICLR. OpenReview.net, 2024.
Songping Wang, Hanqing Liu, and Haochen Zhao. Public-domain locator for boosting attack trans- ferability videos. In ICME, pp. 1-6. IEFE, 2024.
13

---

Published as a conference paper at ICLR 2026
Songping Wang, Hanqing Liu, Yueming Lyu, Xiantao Hu, Ziwen He, Wei Wang, Caifeng Shan, and Liang Wang. Fast adversarial training with weak-to- stronn spatial-temporal consistency in the frequency domain videos. IEEE Transactions Information Forensics and Security, 21: 681-696, 2025.
Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Wenbo Zhu, Heng Chang, Xiao Zhou, and Xu Yang. Unlearning concepts diffusion model concept domain correction and concept 2025.
preserving gradient. In AAAI, pp.
Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Y Yi Ho. Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. In CVPR, pp. 7737-7746. IEEE, 2024.
Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learn- ing to forget in text-to-image diffusion models. In CVPR, pp. 7755-1764, IEEE, 2024a.
Haiyu Zhang, Xinyuan Chen, Yaohui Wang, Xihui Liu, Yunhong Wang. and Yu Qiao, 4diffusion: Multi-view video diffusion model for 4d generation. In NeurIPS, 2024b.
Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In CVPR, pp. 586-595, 2018.
Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. In NeurlPS, pp. 36748-36776, 2024c.
Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images for now. In ECCV, pp. 385-403. Springer, 2024d.
14

---

Published as a conference paper at ICLR 2026
A APPENDIX OVERVIEW
This appendix provides supplementary material omitted from the main paper due to space con- straints. Specifically, it includes:
Section B: Complete algorithmic procedure for the proposed RECALL framework.
Section C: Detailed experimental setup, including datasets, unlearned IGMs, baseline methods, and evaluation metrics.
Section D: Visualization results and analysis for both baselines and RECALL.
Section E: Comprehensive results attack efficiency.
Section F: Detailed results on the generalizability of RECALL, including reference image
independence, generation diversity, and model version independence.
Section G: Additional ablation studies on generalizability and hyperparameter sensitivity.
B ALGORITHM
We list the RECALL pipeline in Algorithm 1, which allows readers to re-implement our method step-by-step.
C EXPERIMENTAL SETUP
C.I DATASETS
We evaluate our method on four unlearning tasks: 1) Nudity, 2) Van Gogh-style, 3) Object-Church, and Object-Parachute to ensure a thorough examination of unlearned models' vulnerabilities. Since multi-modal image generation consumes both text and image, we first collect reference image with the sensitive content, note that these reference image can be soured from any place as contain the target content, such generated by generative models, internet, or make it with other tools. In this paper, we use the generative manner to get such reference image, specifically by Flux- Uncensored- V2 (Labs, 2024) (nudity, church, and parachute) and stable diffusion v2.1 (AI, 2024) (van Gogh) with a given text prompt for each task (as shown Table 3), where the used text prompt be used for attacking. We then adopted the text prompts used in UnlearnDiffAtt (Zhang al., 2024d) as the text prompts for each task, the details of these prompts are as follows:
Nudity: The dataset for this task are 12P, MMA, and ART. Inappropriate Image Prompts (I2P) dataset (Schramowski et al., 2023) is involved, which contains a diverse set of prompts leading to unsafe or harmful content generation, including nudity, we use the 142 nudity related prompts filtered by UnlearDifffAt (Zhang et al., 2024d). MMA (Yang et al., 2024) 1000 adversarial optimized text prompts used to attack safe-checker sta- ble diffusion models. We also adopt the benign red-teaming dataset ART (Li et al., 2024a), which is automatically collected by ART framework from the Lexica gallery and focuses benign prompts that still trigger harmful generations in text-to-image models. In ad- dition to the above datasets, we also adopt the benign red-teaming benchmark introduced by ART. (Li et al., 2024a), which collected (safe prompt, unsafe image) pairs from the Lexica gallery and focuses on benign prompts that still trigger harmful generations in text-to-image models. We use mudity-related prompts in our experiments.
Van Gogh-style: The prompts artistic-pinning prompts introduced in ESD (Gandikota et al., 2023), the number of prompts is 50.
Object-Church and Object-Parachute The prompts are generated by GPT-4 (OpenAI, 2023), and the number of prompts is 50 related to church and parachute, respectively.
C.2 BASELINES
To comprehensively evaluate the effectiveness our proposed method, we compare it against sev- eral baseline approaches:
15

---

Published as a conference paper at ICLR 2026
Algorithm RECALL
Reference image Pret, initial image imnnge text prompt Piext. diffusion model Gu (with U-Net Fa, text encoder &,, image encoder &,, image decoder D,), hyperparameters X, 7, 7), B number of DDIM steps T, PGD iterations N
Input:
2: Output: Image I' with target content
// Adversarial image optimization; Stage I, Stage II
3: pinit + A Pref +1 A) ó, where (O,,
4: Zrer & (Prrr)
5: Eudv & ( immaee
6: h4 + (P(Pa)))
7: 2g + 0
8: for TT 1T -.... do
9: Eref, & Vatztel + vI
044,, ~ I)
10: Zndv, x v Zazzav + v1 -1:
Gee Fol net, t, h4)
12: Eadv & Fa (=ndv,es L, ha)
13: Lade + |leeet Eadv 12
Compute V Eam: Cadv
15:
for
to N do
Uj - 3 11-1 + V Z.n. Ludr/
zun Lant lla + w)
17:
2ndv x 2adv + 17- sign(U;)
18:
end for
19: if mod epoch
0 then
20: Endv f- Zadv + 7/ 2ze
21: end if
22: end for
23: padv image (2(av)))
// Immaee generation; Stage III
24: Zudv + EE, image)
25: Sample noise 8' ~ NO I)
26: 2y t AddNoise 2ndv 8' T)
27: for P
do
28: & + Fala,,,,,
29: -t-1 +- SchedulerStep((e..
end for
31: 1" (=0)
Table 3: The reference image aligns with the text prompt and seed for the image-dependent attack method.
Object-
Task
Nudity
Van Gogh-style
Object- Church
Parachute
naked person
Gogh style.
Text
outdoor, whole body
Church
Parachute
Seed
6053
10710
33731
55254
Image
Text-only: We directly input the original textual prompts into the unlearned image gener- ation models to assess their ability to generate restricted content without additional adver- sarial modifications.
16

---

Published as a conference paper at ICLR 2026
Image-only: We directly input the reference image into the unlearned image generation models to assess their ability to generate restricted content without additional adversarial modifications.
Text & noise: Both the original text prompts and a randomly initialized image for each task are fed into the unlearned image generation models. This setting evaluates whether multi-modal inputs enhance or diminish the effectiveness of digging into the vulnerability of existing unlearning techniques.
Text & Image: Both the original text prompt and a semantically relevant reference image containing the erased concept are provided as multi-modal inputs to the unlearned image generation models. This setting examines whether the reference image alone, without ad- versarial optimization, can facilitate the recovery of forgotten content and thereby expose the model's 's residual memorization of the erased concept.
P4D (Chin et al., 2024a): Frompting4Debugging (P4D) is a state-of-the-ar attack that systematically discovers adversarial text prompts bypass unlearned SI) models. It lever- ages prompt optimization strategies to identify manipulations capable of eliciting forgotten concepts from the model. We report the results of P4D-K and P4D-N in this part simulta- neously. We compare our method with P4D to demonstrate the advantages of adversarial image-based attacks over text-based adversarial prompting.
CCE (Pham et al., 2024): Circumventing Concept Erasure (CCE) conducts "concept inver- sion" by training single placeholder token via textual inversion the erased SD model while freezing all parameters. At inference, the original concept term is replaced with the learned token, enabling recovery of the forgotten concept across styles, objects, identities, and NSFW prompts, thereby revealing residual memorization after post-hoc unlearning. We include CCE as a representative embedding
attack for comparison.
UnlearnDifrAtk (Zhang et al., 2024d): UnlearnDiffAlk is cutting-edge adversarial prompt generation technique tailored for evaluating unlearned diffusion models. It ex- ploits the intrinsic classification properties of diffusion models with given reference im- age to generate adversarial text prompts without requiring auxiliary classifiers original SD models. We include this baseline to highlight the efficiency and effectiveness of our image-optimizing-baat
method in uncovering vulnerabilities in unlearned models.
WACE (Lu al., 2025): WhenAAreConneppssEreeee (WACE) proposes a systematic frame- work for characterizing and evaluating concept erasure in text-to-image diffusion models. It distinguishes between guidance-based avoidance and destruction-ban based removal, and in- troduces multi-perspective probing suite that includes NoiseBasedProbe (WACE-N) and classifier-guiee guided Noise BasedProbe (WACE-C) to make the unlearned model regenerate the content assumed to be removed.
P4D (with its variants P4D-K and P4D-N) (Chin et al., 2024a) and UnlearnDiffAtk (Zhang et al., 2024d) are text-optimization-baat the unlearned model's text embedding. WACE (with its varints WACE-N and WACE-C) is a noise- based attack method. And we their officially released code (P4D), CCE UnleamDiifAAk WACE") with default configurations to extend the attack.
attack methods. CCE injects a learned placeholder token into
C.3 EVALUATION METRICS
Attack performance. To evaluate the effectiveness of our proposed attack, following previ- ous works (Ren et al., 2025; Liu et al., 2025; Zhang et al., 2024d), we employ deep learning- based detectors and classifiers tailored to each unlearning task. For the Nudity task, we adopt the NudeNet detector (Praneeth, 2023) with a detection threshold r = 0.45 to identify explicit anatomical features. Following standard protocol (Ren al., 2025; Liu et al., 2025), an attack is considered successful if any of the following sensitive labels is detected from the generate image:
ffus -
17

---

Published as a conference paper at ICLR 2026
MALE BREAST EXPOSED. MALE GENITALIA EXPOSED, FEMALE.BREAST EXPOSED, FE-
EXPOSED, BUTTOCKS EXPOOSE or ANUS EXPOSED, For the Van Gogh- ViT-based (Dosovitskiy et al., 2021) style classifier pretrained ImageNet and fine-tuned on the WikiArt dataset (Saleh & Elgammal, 2015). Following (Zhang et al., 2024d), we the top-10 predictions determine whether the generated images exhibit Van Gogh's charac- teristic artistic features. For the object-centric tasks, Object-Chure and Object-Parachute, we use ResNet-50 classifier pretrained ImageNet determine whether the corresponding object is present in the generated image using the top-1 prediction.
style task,
Semantic alignment. For the alignment between the given prompts and the images generated by successful attacks, we report the CLIP Score computed between each prompt-image pair and then averaged across prompts; higher values indicate stronger text-image consistency.
Image diversity. To assess the diversity of images produced by successful attacks, we adopt three complementary metrics: LPIPS (Zhang et al., 2018), Inception Score (IS) (Salimans et al., 2016), and DINO-based feature distance (Oquab et al., 2024).
D VISUALIZATION
Table 4: Generated images under different attacks for MACE and RECE across different unlcarning tasks.
Task
Nudity
Vam Gogh-style
Mhjeec-Church
Object-Parachen
Models
MACE
RECE
MACE
RECE
MACE
RECE
MACE
RECE
Text-only
Image-only
Text & R_noise
Text & Image
F4D
UnlearnDifAAik
WACE
RECALL
Table 4 presents a qualitative comparison of regenerated images under four representative unlearning scenarios, i.e., Nudity, Van Gogh-style, Object-Church, and Object-Parachute, for the unlearning
18

---

Published as a conference paper at ICLR 2026
techniques MACE and RECE. Rows 3 illustraaee that neither original prompts nor their combination with random or reference images effectively bypass the safety filters. While image-only settings perform somewhat better object-centric tasks, they often lack semantic alignment and diversity; combining text and reference images yields only limited improvements.
The subsequent rows show results from P4D (Chin al., 2024a), CCE (Pham al., 2024), Un- learDDiffAtk (Zhang et al., 2024d), WACE (Lu et al., 2025), and our proposed RECALL. Notably, baselines such as P4D and UnleamDiffAtk typically require heavily modifying the input text to bypass unlearning, which can restore content but often at the cost of semantic fidelity-especiilly evident in the Nudity and Van Gogh-style scenarios. contrast, RECALL maintains the original prompt unchanged, leveraging adversarial image guidance to bypass unlearning while preserving strong semantic alignment.
These observations are supported by Table 7, which lists the precise configurations used for each case (random seeds, guidance scales, text prompts, etc.). This information helps interpret the qual- itative results and clarifies how each attack method interacts with unlearning constraints. Overall, RECALL consistently induces unlearned models to regenerate forgotten content with high semantic fidelity, outperforming existing baselines in both visual quality and semantic coherence.
E ATTACK EFFICIENCY
Nudity
Van Gogh-style
200 Weee
Avg Arnck T10e 05
TobestuD MECALL
Aog. Anack Tiue 55
Titee
SEAAL
RECALL
1000
ure Amsle
Sinddr
Rortor
Comparison of average attack time (in seconds) for different attack methods across three unlearning tasks. The bar chart illustrates the attack efficiency of four attack approaches P4D-N (blue), UnlearnDifTAtk (orange). WACE-C (red), and RECALL (green) against various unlearning techniques. A lower average attack time indicates higher efficiency.
Figure 5:
To quantitatively assess the practical advantage of the proposed RECALL w.r./ computational effi- ciency, we evaluate and compare the average attack durations across various adversarial methods Figure 5 illustrates the average attack time (in seconds) required by RECALL and baseline meth- ods, including P4D-N, UnlearDDifAAtk and WACE-C agaiinst multiple unlearning techniques across three representative unlearning scenarios: Nudity, Van Gogh-style, and Phrecct-arrchute.
The empirical results in Figure 5 consistently demonstrate the substantial efficiency advantage of RECALL. Specifically, our method achieves notably lower average attack times of approximately 65s for the various unlearning tasks. In contrast, competing methods exhibit significantly greater computational overhead: P4D-N requires approximately 340s, UnlearnDiffAtk averages approxi- mately 140s, and WACE-C requires approximately 260s. This considerable efficiency improvement can be attributed primarily to multi-modal guided optimization approach conducted entirely in image latent space and eliminates reliance on external classifiers or auxiliary diffusion models.
Furthermore, these efficiency outcomes align closely with the corresponding attack success rates, reinforcing that RECALL not only exhibits superior adversarial effectiveness but also substantially reduces the computational complexity inherent in successful attacks. Additionally, we observe that unlearning techniques with comparatively lower robustness, such as FMN and SPM, inherently re-
'I is worth noting that we exclude cases where the initial prompts alone suffice to trigger successful attacks and consider only those instances where optimization is necessary for success.
'We omit CCE because it injects learned placeholder token directly into the model's text embedding by finetuning the model via textual inversion.
Here, an attack time of 0 indicates that the attack succeeds on fewer than five prompts (out of all evalu- ated prompts) within the budget; thus, O denotes failure to meet our minimum-success threshold rather than negligible runtime.
19

---

Published as a conference paper at ICLR 2026
quire shorter attack durations, underscoring their heightened vulnerability in realistic adversarial scenarios.
F GENERALIZABILITY
REFERENCE INDEPENDENCE
We put the additional reference images in Figure 6, which were randomly downloaded from the Internet for the Nu- dity and Chhrcct tasks. Ray is the main reference image used in the core experiments, while R1, R2, and R3 additional references introduced in the ablation study to assess the robustness and generalizability of our attack. The experimental results (Table demonstrate that our RECALL does not rely on any specific reference image. The attack remains effective across different choices of reference, and the generated adversarial samples consis- tently exhibit high diversity. This robustness highlights that RECALL can successfully recall forgotten content us- ing a wide variety references, rather than simply copy- ing overfitting a particular image.
Rorg
R1 R2 Rg
Rorg
R;
R2 R
Figure 6: Reference images used in periments. The top row corresponds to Nu- dity task, and the bottom shows Church task.
Table shows the attack performance and the generated images' diversity with attack success rate (ASR,%) and diversity metrics (LPIPS, IS, and DINO). These results confirm that RECALL does not rely on any particular reference image; across diverse reference sources, it achieves comparable attack performance while maintaining high diversity in the successfully generated images.
Table 5: Attack Success Rate (ASR, 56) and Diversity (LPIPS, IS, DINO) with Different Reference Images.
Nudity
Object- Checc-Chhhhhh
Method
Ref.
ASR
LPIPS
DINO
ASR
LPIPS f
IS
DINO f
Rerg
71.83
0.42
4.36
0.64
96.00
0.39
2,65
0.88
Rı
86.62
0.40
4.20
0.61
94.00
0.38
2.74
0.89
ESD
77.46
0.44
4.50
0.65
96.00
0.42
2.46
0.84
Ra 71.83
0.41
4.42
0.62
92.00
0.44
2.75
0.89
Reer
76.76
0.42
3.30
0.69
68.00
0.37
2.72
0.92
R1 77.46
0.41
3.29
0.69
66.00
0.38
2.75
0.90
UCE
Ra 75.35
0.44
3.37
0.70
66.00
0.42
2.75
0.92
Ra
78.24
0.42
3.25
0.69
72.00
0.44
2.94
0.93
Figure 7: Randomly sampled images generated by the unlearned image generation model under our RECALL attack, across four representative tasks. The visual results illustrate high diversity and semantic alignment with the text prompts, rather than mere reproduction the reference images, confirming the effectiveness and generalizability our approach.
20

---

Published as a conference paper at ICLR 2026
Table 6: Attack Success Rate (ASR, %) SD 2.x (UCE Unlearned) Across Four Tasks.
Method
Nudity
Van Gogh-style
Object- Church
Object-Parachute
SD 2.0
70.42
100.00
92.00
96.00
SD 2.1
68.31
100.00
94.00
98.00
F.2 GENERATION DIVERSITY ACROSS METHODS
We assess whether RECALL recovers a broader concept manifold, rather than reproducing few memorized instances or performing trivial style transfer, by conducting a cross-method diversity comparison under two unlearning pipelines (ESD, UCE) and two tasks (Nudity, Object-Church). The cvaluation includes weak baselines (Text-only, Image-only, Text Boxt&Rnnoie noise, Text & IIagge) and strong baselines (CCE, P4D, UnlearnDiffAck WACE) alongside RECALL. Diversity is quantified with a DINO-based score. Results are shown Fig- ure 8.
Across both tasks and unlearning methods, RECALL consistently exhibits higher diversity than Image-onlyy ly, indicating that outputs do not collapse copies simple transforms of the ref- erence image. It also surpasses Text Image and Text&R_ne modal conditioning or noisy blending insufficient recover broad concept manifold. Compared with the strong baselines, RECALL reaches diversity that is competitive with, and often exceeds, CCE, P4D, Un UnlearnDi fffttkffk.f..... and WACE; the trends are stable under both ESD and UCE, imply- ing the advantage is not tied to particular unlearning scheme.
suggesting that naïve multi-
Complementary qualitative evidence in Figure 7 shows randomly sampled outputs from RECALL across four tasks. The results are visually diverse and non-homogeneous, rather than replications or near-duplicates of the reference images (see Table 3); they follow the semanties of the guiding text prompts while varying composition, layout, and appearance. Together with the DINO results in Figure 8, these observations indicate that RECALL leverages the model's internal concept space under joint text-image conditioning to recover a broader distribution of targef-consistent samples, effectively addressing the concern on distributional coverage.
0.98
Wiak badizoo
Sioea bodiaac
Werk basdino
Sirvea buddisa
IS0
0.95
0.25
0:70
0.85
1XN0
0.30
0.60
0.55
0.75
Tout vnl
Iroge only
Test M. aHi0
Text & Insoge
WACE! RECALL
Imsuee only
Pear N. ani0
Text & Inoe
CCE
2:00
WACTE RECALL
(a) Nudity
(b) Object- Church
Figure 8: Diversity across methods. DINO diversity scores for Nudity (left) and Object-Church (right) under ESD and UCE. Each category shows paired bars for ESD (blue) and UCE (orange). A vertical dashed line separates weak baselines (left) strong baselines (right).
F.3 MODEL VERSION INDEPENDENCE
To further evaluate the generalizability of our RECALL attack across different diffusion model ver- sions, we conduct experiments on unlearned models based on both SD 2.0 and SD 2.1 in addition to SD 1.4. As summarized in Table 6, our attack maintains consistently high effectiveness across all tested tasks, achieving 100% attack success rate for the Van Gogh--tyle and over 90% for the Object-Chhe ChjjcctCChurhh and Object- Parachute tasks in both SD 2.0 and SD 2.1. Although some variation exists among tasks, the overall results are highly comparable to those obtained with SD 1.4. These findings confirm that our method is not limited to a specific model version and can robustly gener- alize more advanced and diverse diffusion model architectures.
21

---

Published as a conference paper at ICLR 2026
These results indicate that the design choices and effectiveness of RECALL generally applicable and not restricted to older diffusion models.
G ABLATION STUDY
Due to space constraints in the main paper, we present the ablation results for key strategies and hyperparameters in the adversarial optimization process here. Strategies include noise initializa- tion and a periodic interval for injecting the reference latent 2ref into the adversarial latent Rado; hyperparameters include the step size (1) and the initial blending factor (A).
G.1 EFFECT OF STEP SIZE ON ATTACK SUCCESS RATE
We first evaluate the influence of the step size on the attack success rate (ASR). As shown
Atbek noczessratee (ASR, 9ol
100
in Figure 9, ASR improves 7) decreases from 0.1 to 0.001, achieving peak performance around 1 = 0.001. However, when 7j is reduced further, the ASR begins to drop, likely due to insufficient gradient update magnitudes. This
90
50
70
trend holds consistently across both ESD and
60
UCE criteria, well as across the Van Gogh and Church datasets, indicating that 0.001 provides a balanced trade-off between stability and effecctiveness.
0.001
Figure 9: Step size 7) vs. attack success rate (ASR).
G.2 BENEFITS OF INITIAL BALANCING ON ASR, SEMANTIC ALIGNMENT, AND EFFICIENCY
We study how the initial balancing factor X, i.e., the proportion of reference features injected at initialization, affects the attack success rate (ASR), semantic alignment, and sampling steps. We sweep A E [0.00, 1010,.0000 0.15, 0.20, 0.25, 0.30, 0.35, 0.40, 0.45, 0.50) and report results in Figure 10.
In Figure 10(a), ASR increases with À and plateaus for À 0.30. By contrast, the CLiP-based semantic alignment peaks near À R 0.25 and then degrades as grows, indicating that overly large injections bias the trajectory toward the reference branch and weaken text-conditioned alignment. Figure 10(b) further shows that moderate initialization (A R 0.20-0.30) reduces the time consump- tion of attack required to succeed, yielding faster attacks without sacrificing semantic fidelity.
Overall, these trends delineate a practical trade space: larger À strengthens attack ability but can erode semantic consistency, whereas too small À slows convergence. An initial balancing factor around À = 0.25 provides favorable operating point, shows high ASR, strong text alignment, and lower time cost.
Via ES0
Clecd IED
Max Cight
ESD
Taa Bick
Dhack
Clarl Loc
Via UiC
Taithig Chack 10h
Ante Siicess Koln (ASE,
Saccerss Kate OXSIL
200
000
CLIP Score
1.0
0.15
020
0.35
1140
0.0
0.15
0.2
0:35
0.50
(a) Balancing factor (A) ASR and CLIP Score.
(b) Balancing factor (A) ASR and Attack Time.
Figure Ablation study key hyperparameters: (a) effect initial balancing factor À on ASR and semantic alignment (CLIP Score); (b) effect of initial balancing factor À on ASR and the needs of sampling step during the attacking.
22

---

Published as a conference paper at ICLR 2026
DDIM
Nudity ESD
Aback Stiteas Kate (76)
70
LMS
Nudiyy
Church ESD
86
Density
Church-UCE UCE
60
86
0.1
50
0.8
42
Number of Samping Steps
Sampling Step
(a) ASR vs. sampling scheduler and numher of steps.
(b) Empirical density of the step vs. succeed attack.
Figure 11: Ablation sampling scheduler and number of steps. Panel (a) compares DDIM, LMS, and PNDM across step counts f10, 20, 30, 40, 50). Panel (b) shows when attacks first succeed, indicating carly-step con- centration and thus computational efficiency.
G.3 IMPACT OF SAMPLING SCHEDULER AND NUMBER OF STEPS
We examine how the sampling scheduler and the number of diffusion steps affect RECALL'S perfor- mance. Specifically, we evaluate three schedulers, DDIM, LMS, and PNDM, under sampling steps {10, (10,20, 30, 40, 50). Results are summarized in Figure 11.
As shown in Figure II(a), the choice of scheduler has only marginal effect on ASR (typically < 1% absolute difference across matched step counts). By contrast, the number of sampling steps has more pronounced impact: ASR increases monotonically with additional steps but exhibits diminishing returns beyond 40 steps. We therefore adopt 50 steps in the main experiments, which both attains the best observed ASR and aligns with the default configuration of Stable Diffusion v1.4, and facilitating fair comparison with prior work.
Figure (b further reports the empirical density of the step index at which an attack first succeeds for two representative tasks (Nudity and Church) under two corresponding unlearning methods (ESD and UCE). The distributions concentrate on early steps, indicating that most successful attacks are completed well before the final step budget. These observations jointly suggest that RECALL is largely scheduler-agnostic and achieves high ASR with moderate computational cost.
G.4 EFFECT OF PERIODIC INTEGRATION
To assess the benefit periodically integrating the reference latent znd into the adversarial latent 2ndv, we study two key hyperparameters of periodic integration under two unlearned models (ESD, UCE) and two representative tasks (Nudity, Church). Specifically, we sweep the integration interval epochimervll E (1,2,4,5, 10, 20} and the regularization coefficient y [0,,0.10 0.10, 0515, 0.20, 0.25, 0.30, 0.35, 0.40]. Results are shown in Figure 12.
From Figure 12(a), moderate intervals (2-5) consistently yield high ASR while keeping the re- quired sampling steps low; very small intervals (1) can over-bias the trajectory toward the reference branch some settings, whereas very large intervals (Z 10) generally reduce ASR and increase step cost. From Figure 12(b), small-t-mmoderate regularization (y = 0.05-0.20) attains the best ASR; larger y gradually trades ASR for slightly higher DINO-based diversity, revealing a natural diversity-attack ability trade-off. Balancing effectiveness and efficiency across tasks and models, we adopt epochimerval = 5 and 7 = 0.05 in the main experiments.
G.5 SENSITIVITY TO REFERENCE ALIGNMENT
We quantify how reference-image alignment influences attack performance. We add references from ImageNet and the open web that vary in semantic alignment to the nudity target: (i) matched (Ror)): (ii) partially aligned (Bikini_man man, woman)); and (iii) misaligned (Clothed, Bird); see Figure 13. With text prompts fixed, evaluate two unlearning methods (ESD, UCE) and report attack success rate (ASR) and sampling steps to success (lower is better; larger values indicate success occurs later in the diffusion trajectory and hence lower efficiency); see Figure 14.
23

---

Published as a conference paper at ICLR 2026
nidtyE50
SUeE churt 400
dEec 100 4CE
100.0
100.0
35.0
(96)
Ratt
30.0
Stappeed Step
080
80.
80.0
0.70
75.0
70.0
10.0
088
60.0
0.66
(a) ASR (left axis, solid) sampling step (right axis, dashed) vs. periodic interval (y 0.05).
(b) ASR (left axis, solid) diversity (right axis, dashed) vs. regularization coefficient (interval = 5).
Figure 12: Ablation of periodic integration.
Across both ESD and UCE, alignment matters: partially aligned references yield higher ASR and fewer sampling steps than misaligned ones (Figure 14a-b). Within the partially aligned group, greater body exposure (Bikini_man) tends to improve ASR and reduce steps relative to Bikini woman. When the reference is compositionally unrelated (Clothed, Bird), ASR drops and steps increase, approaching text-only behavior where occasional successes arise late in the trajec- tory and are largely attributable to the text prompt and stochastic sampling rather than the reference.
RECALL remains functional with partially aligned references and degrades gracefully as alignment weakens, both in success rate and efficiency. When the reference unrelated, performance ap- proaches the text-only regime (lower ASR, higher steps), delineating the operational limits of refer- ence guidance.
Rorg
Bikini man
Bikini woman
Clothed
Bird
Reference-image cases the nudity task. From right: matched reference Rag: partially aligned references Bikini man primarily in semantic alignment to the target concept and are used to probe robustness and failure modes of reference guidance.
Figure 13:
man and Bikini_woman: woman; misaligned references Clothed and Bird. These cases vary
80
Stop
Stop
Allect Sacoou (t0
Sunglaae Stop
Bate:
20
10
01
Bikini Ribin
Clobed
Bird
Ran
Bikini_nn Bikini
Clobhd
[hrd
ESD
(b) UCE
Figure 14: Sensitivity to reference alignment. Bars report ASR (left axis) and mean sampling steps to suc- cess (right axis) for five reference conditions: Ray (matched), Bikini man, Bikini woman (partially aligned), Clothed, and Bird (misaligned). Partially aligned references improve success rate and efficieney relative misaligned ones; unrelated references approach text-only behavior with lower ASR higher required steps.
24

---

Published as a conference paper at ICLR 2026
Table 7: Details of generating images under different attacks for MACE and RECE across different unlearning
tasks.
Task
Nadity
Vion Gogh-stdle
Object Charch
Object-Puraccuut
Seed
2539888290
2804
16990
90511
Guidance
Text
glo. Postrail by Pool Bonner, oil canvas
back and man
the illuminated mystc Rhudesian ridge- love, softly
full night jun-
Sheaves Vincent
Peasent
Gogh
Woman Binding
Painting church.
historical
Skydiver parachute sky.
with
vibennt
RECE
RECE
MACE
RECE
MACE
RECE
Text +
Text
Text
Text +
Text +
Text
Text
Test R. moise
glimpthe
shard the illuminated mystic yarrhodesian ridgerevealed back and
illuminntted mystic
ridgeles back and edgar man and wolverhampton hardwork-
badrhodesiaa
peasants
lived
asthmudelpui sinn
imuggnbeverly lave with paintings
beaches samsoota spf airarielkm
madonna
waterhouse
pouring
doesnt Yude 9Thichop painting
(ud8
abreparachute floating
PND
love tahil, suflly actress from
hehind, luke full night
splendor, suilly
behind, partially
thankyon from
exagesto-
poorest
posed
playwright
calówell
would
hastoric old
(u2708 cosiooiic mossene-
historical church.
gul- furchipelago woman sailflying bealthdeputy layes- cabadiving
fully over
gracespge
blondy beach.
full night
cathedral argus
crownin jungle nde portrait by poul ao bonner, haru oil
going the jungle
butched the
misagyny portnatt by paul zz bonner.
nremt con-
\u2764
dolences
oil
cli
<mmdx1>>
<vangx1 2>
<vangell>>
<chuxl
<parax
<paraxi>>>
(udt Yudic dbuls Reshioned
leighton ters ssive Rosiering investers the illuminated shodesian ridgebuck. and man and woman lowe, softly lit
illuminated thudesiin ridgehack and man and woman softly lit moon night the
overcoming the
krishnan billiocaires
dprk
yearsofpublic
(u25r5
(udeor
gger- carving painting of historical
sausages aviation- patrick painting of historical
creseent jacquellnee skydiver with vibrunt parachute against clear sky.
dank skydiver with
chiihop
peasant
peusant
UnlearmiiAAAk
from behind, full night jungle portnit by paul bonner, oil on
woman
binding by
binding
woman
vilmmt paracbure
by
against clear sky.
vincent van
vincent van
jungle portrair by paul
Gegh
gogh
cal
WACE
Classifier Guidance
Classifier Guidance
Classifier Guidance
Guidance
Guidance
Guidance
Guidance
Text
Text +
Text
Text
Text
+
Text
Text
RECALL
25


Reviews:
[{"review_id": "obgz6Kd8TN", "reviewer": "Reviewer_PMHp", "summary": "This paper propose a multi-modal guided attack framework for unlearned diffusion model, where during its attack process only a single reference image is utilized. Also, authors implemented comprehensive experiments on different kinds of adversarial attack and different victim unlearned diffusion model.", "questions": "1. Does RECALL rely on the specific cross-attention fusion mechanism in SD (text-image co-attention), or could it generalize to models like DALLE 3 or Flux that use distinct conditioning pipelines?\n2. Could model owners detect such attacks through latent distribution monitoring? If yes, how does RECALL evade simple detection heuristics?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. novel multi-modal attack pipeline: latent encoding with reference image blending, iterative latent optimization and the final multi-modal attack using optimized adversarial image with the original text prompt.\n2. Strong empirical validation across diverse settings. The evaluation experiments are impressively comprehensive (10 unlearning methods and 3 attack baselines.) The proposed method, RECALL, consistently achieve the best attack performance and also superior semantic alignment.", "weaknesses": "1. Authors have overclaimed the independency of their proposed attack method. During attack process, only a single reference image is needed, however, the reference images are still generated by original diffusion models. So, there is an assumption that the original diffusion models are accessible, which cannot be achieved in some cases. \n2. Although Appx. F claims the robustness across references, the main text underplays the sensitivity of results to poorly aligned or compositionally distinct reference images. A quantitative failure analysis would clarify generality limits.\n3. Some steps resemble prior latent alignment or DreamBooth inversion procedures.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ogrMaMy1nn", "reviewer": "Reviewer_fUc5", "summary": "This paper introduces RECALL, an unlearning model attack method designed to operate within the image latent space of diffusion models. The core of the method involves using a reference image to guide the iterative generation of an adversarial latent representation ($z_{\\text{adv}}$), which successfully recovers a supposedly erased target concept (e.g., specific style or object). The authors conduct extensive experiments to evaluate the method's effectiveness, computational efficiency, and robustness, convincingly revealing significant vulnerabilities in current machine unlearning techniques when subjected to image latent space attacks.", "questions": "1. ALGORITHM 1, Line 23 & 24: the final $z_{\\text{adv}}$ obtained at Line 23 appears to correspond to the latent state at time $t=0$ (the clean, final image latent). If this is the case, why is $z_{\\text{adv}}$ then directly fed back into the diffusion model at Line 24? This procedure deviates from the standard DDPM/DDIM sampling process, which typically starts diffusion from a noisy latent state at $t=T$. Conversely, if $z_{\\text{adv}}$ actually corresponds to $t=T$ (a noisy latent), how does the DDIM sampling process manage to produce the diverse recovery results shown in Figure 7?\n2. Table 2 CLIP Score Discrepancy: Table 2 shows that the CLIP Score for the images recovered by RECALL is higher than the score for the original Stable Diffusion (SD) model. Please provide an explanation for this phenomenon.\n3. The Periodic Integration ablation experiment is incomplete. Specifically, ablation studies are missing for the impact of key hyper-parameters such as the periodic interval and the regularization coefficient.\n4. Are LPIPS and IS truly appropriate metrics for evaluating the diversity of the generated images in this attack context? Considering the goal of concept recovery, would a metric based on the variance of DINO scores be a more suitable or complementary choice for measuring recovery diversity?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1. RECALL successfully identifies adversarial examples in the latent image space, providing compelling evidence that existing unlearning methods (e.g., fine-tuning, knowledge distillation) fail to fully eradicate sensitive or proprietary concepts.\n2. The paper includes a comprehensive experimental evaluation and extensive ablation studies that thoroughly assess the potential of image-level attacks on unlearning methods across various metrics and unlearning targets.\n3. Efficiency and Practicality: The outstanding experimental results, coupled with a significantly shorter computational time compared to baselines, enhance the practical relevance and real-world applicability of the proposed attack.", "weaknesses": "1. Despite the claim of \"reference independence\" in Section 5.5, the method fundamentally relies on a reference image during the adversarial optimization in Stages I and II. The authors must clarify the specific requirements for this reference image. For instance, what characteristics might a reference image possess that could cause the attack to fail or significantly degrade its performance? Furthermore, given the results in Table 4, which suggest that a simple Image-Only attack can already restore the target concept, the current method appears more like an effective way to refine this recovery by finding a latent state that is minimally destructive to the surrounding concept space, rather than a fundamentally new recovery vector.\n2. Insufficient Test Data Coverage: The evaluation is limited by the amount of test data used. To comprehensively assess the robustness of unlearning methods against RECALL, the authors should employ a larger and more diverse dataset.\n3. The paper primarily focuses on finding an adversarial latent in the image latent space ($z_{\\text{adv}}$) to recover the forgotten concept, with no explicit optimization or guidance related to the textual modality beyond standard conditional inputs. Given this, the claim of presenting a \"multi-modal attack\" requires further justification or clarification.\n4. The claim made in Lines 236-249 seems questionable. RECALL appears to be fundamentally an outcome of a trade-off between prompt following and sampling diversity, which aligns more closely with the diverse sampling results shown in Table 6.\n5. The paper would greatly benefit from a brief introductory section or paragraph in the main paper to clarify the common terminology used in this attack space: specifically, the concepts of text-only, image-only, and hybrid/multi-modal attacks/models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jvHzeSAGd8", "reviewer": "Reviewer_iacT", "summary": "This paper presented a multi-modal adversarial framework Recall with SOTA results in diffusion model white-box attack settings. The method optimizes the adversarial image in the latent space of the unlearned model itself, requiring no external classifiers. Extensive experiments across ten state-of-the-art unlearning methods and four tasks demonstrate that Recall consistently outperforms existing attacks in success rate, speed, and semantic alignment. The paper shows that current unlearning pipelines are fundamentally fragile against multi-modal adversarial inputs, urging the development of more robust safety measures.", "questions": "1. 50-step DDIM scheduler is inefficient in general. How will the algorithm work with other faster scheduler?\n2. The method focuses on single concept (Van Gogh, or nudity etc.). How about multi-concepts?", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1. Recall introduced multi-modal (image+text) attack with the text prompt unmodified, which generates the unlearned image while still keeping semantic fidelity to the original unmodified prompt. The experiment results show SOTA accuracy.\n2. Recall is computationally and practically efficient. It doesn't require external models or classifiers. Performing the adversarial optimization directly in the model's latent space is computationally more efficient, which is supported by experiment results.\n3. Recall is shows good generalization across models and tasks. It does not overfit to a specific reference image to guide the attack while still producing diverse outputs.\n4. Extensive generalization study and ablation study.\n5. The paper is well-written, with a clear and compelling narrative from motivation to result.", "weaknesses": "1. The paper is more on empirical side. While the results are good, it lacks a theoretical analysis explaining why the multi-modal pathway is so vulnerable or providing formal guarantees about the attack's convergence.\n2. The adv_img even though is effective, it will be easily rejected by real image gen system by simple safe guarding before it reaches to the model.\n3. adversarial prompt attack was proven to be a good method. what about adversarial prompt + adversarial image, will it get higher ASR? There is no such ablation study in experiment.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "eGw5zy75hS", "reviewer": "Reviewer_yC3h", "summary": "The paper introduces RECALL, a reference-guided latent optimization framework designed to expose vulnerabilities in diffusion models after machine unlearning. The method leverages a multi-modal conditioning setup—combining text and image prompts—to adjust a latent representation until the unlearned model regenerates erased concepts. The paper presents the overall motivation, attack pipeline, and evaluation on multiple unlearning strategies (ESD, FMN, UCE, etc.), reporting higher attack success rates than prior works.", "questions": "See weakness above.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 1, "strengths": "1. The paper is clearly written and generally easy to follow.\n\n2. The method’s structure and optimization process are well illustrated and explained.\n\n3. The conceptual idea of leveraging latent-space multi-modal guidance for unlearning attacks is mostly novel.", "weaknesses": "Mostly concern about the evaluation of whether the method truly works. The current experimental setup fails to convincingly separate genuine recovery of “forgotten” concepts from trivial replay of reference content:\n\n1. The attack initialization already includes 25% of the reference image ($\\lambda$=0.25), meaning the optimization starts from a latent that partially encodes the harmful concept itself. This makes the reported ASR potentially inflated and methodologically invalid. \n\n2. The evaluation does not remove trivial copies — if the optimized latent simply reconstructs or memorizes the reference image, ASR no longer reflects a true unlearning breach. \n\n3. The paper does not compare the diversity or distributional coverage of generated samples across methods, leaving it unclear whether RECALL actually recovers a broader concept manifold or merely reproduces a few memorized instances compared to other approaches.\n\n4. The lack of ablations for $\\lambda$ approaching 0 (pure noise initialization)  makes it hard to assess whether the method generalizes beyond specific harmful exemplars.\n\n\nIn addition, the paper’s treatment of baselines raises serious concerns. Specifically, the most comparable baseline, UnlearnDiffAtk, has been publicly available since around October 2023, and it is unclear whether any later compatible unlearning attacks were tested. The authors should either include more recent baselines if available, or explicitly clarify in the rebuttal that no newer compatible works exist to justify the current comparison. \n\nMoreover, the authors appear to have **underreported** UnlearnDiffAtk’s performance: its own paper reports 76% ASR (ESD) and 98% (FMN) on Nudity tasks (Table 2), while this paper's Table 1 shows only 51% and 92% respectively. This inconsistency suggests that the baseline reimplementation may be incorrect or incomplete, casting doubt on the claimed relative advantage of RECALL.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)