Adaptive Median Smoothing: Adversarial Defense for Unlearned Text-to-Image Diffusion Models at Inference Time
Authors: Xiaoxuan Han
Songlin Yang
Wei Wang
Yang Li
Jing Dong
Venue: ICML 2025 poster (2025)
Keywords: Diffusion Model
Machine Unlearning
Adversarial Robustness
Primary area: social_aspects->security

Abstract: Text-to-image (T2I) diffusion models have raised concerns about generating inappropriate content, such as "*nudity*". Despite efforts to erase undesirable concepts through unlearning techniques, these unlearned models remain vulnerable to adversarial inputs that can potentially regenerate such content. To safeguard unlearned models, we propose a novel inference-time defense strategy that mitigates the impact of adversarial inputs. Specifically, we first reformulate the challenge of ensuring robustness in unlearned diffusion models as a robust regression problem. Building upon the naive median smoothing for regression robustness, which employs isotropic Gaussian noise, we develop a generalized median smoothing framework that incorporates anisotropic noise. Based on this framework, we introduce a token-wise ***Adaptive Median Smoothing*** method that dynamically adjusts noise intensity according to each token's relevance to target concepts. Furthermore, to improve inference efficiency, we explore implementations of this adaptive method at the text-encoding stage. Extensive experiments demonstrate that our approach enhances adversarial robustness while preserving model utility and inference efficiency, outperforming baseline defense techniques.

Adaptive Median Smoothing: Adversarial Defense for Unlearned Text-to-lmage Diffusion Models at Inference Time
Xiaoxuan Han 12
Songlin Yang²
Wei Wang'
Yang Li 12
Jing Dong'
Abstract
Original
Text-to-image (T2I) diffusion models have raised concerns about generating inappropriate content, such as "nudity". Despite efforts to erase unde- sirable concepts through unlearning techniques, these unlearned models remain vulnerable to ad- versarial inputs that can potentially regenerate such content. To safeguard unlearned models, we propose a novel inference-time defense strategy that mitigates the impact of adversarial inputs. Specifically, we first reformulate the challenge of ensuring robustness in unlearned diffusion models as a robust regression problem. Building upon the naive median smoothing for regression robustness, which employs isotropic Gaussian noise, we de- velop generalized median smoothing framework that incorporates anisotropic noise. Based on this framework, we introduce token-wise Adaptive Median Smoothing method that dynamically ad- justs noise intensity according to each token's 's rele- vance to target concepts. Furthermore, to improve inference efficiency, we explore implementations of this adaptive method the text-encoding stage. Extensive experiments demonstrate that our ap- proach enhances adversarial robustness while pre- serving model utility and inference efficiency, out- performing baseline defense techniques.
"girl romantic boudope guereau
"girl erotic boudope
Unleaming
guereau
Unlesmed
Advenerial
Unlesmed O
Imput
Model
Model
Figure I. Introduction to task setting: concept unlearning and ad- versarial vulnerability in unlearned text-to-image diffusion models.
images since the training datasets contain unfiltered unsafe images, which enables the model to learn and reproduce such content. For example, they can generate Not Safe For Work (NSFW) content, such as nudity and violence. The ease of generating and disseminating such unsafe images via the Internet poses societal concerns.
To eliminate harmful content, a straightforward approach is to retrain the model from scratch using filtered data. How- ever, this is impractical due to the substantial computational resources required. As an alternative, machine unlearning techniques (Gandikota et al., 2023; Kumari et al., 2023) have emerged as a promising way to erase target concepts from model parameters without retraining. The unlearned model can hardly generate the target concepts (as illustrated in the left part of Figure 1). However, recent works (Chin et al., 2024; Tsai et al., 2024; Zhang et al., 2024c) have shown that these unlearned models remain vulnerable to adversarial inputs (as shown in the right part of Figure 1). Therefore, enhancing the adversarial robustness of unlearned models important for advancing their reliability.
1. Introduction
To enhance unlearning robustness, mainstream approach is to apply adversarial erasing (Kim et al., 2024; Gong et al., 2024) during the unlearning process, akin to adversarial training (Madry et al., 2018) 8) in image classification tasks. This method involves iteratively searching for and erasing adversarial inputs, which increases computational costs and can degrade the model's utility for generating non-target concepts. While adversarial erasing aims to identify and erase inputs that restore the target concept, it cannot cover all potential cases that may arise during inference, lcaving a possibility that some inputs could still recover the target con- cept. These limitations motivate us to explore an alternative approach: incorporating defense mechanisms at inference
Text-to-image (T2I) diffusion models (Rombach et al., 2022; Saharia et al., 2022; Ramesh et al., 2022; Nichol et al., 2022; Gu et al., 2022) have achieved remarkable progress in generating diverse, high-quality images based on user input prompts. But these models can generate inappropriate
'NLPR& & MAIS, Institute of Automation, Chinese Academy of Sciences "School of Artificial Intelligence, University of Chinese Academy Sciences 'S-Lab, Nanyang Technological University. Correspondence to: Wei Wang <wwang wwwaan@@lprri..ccc..>....
Proceedings of the ndnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Adaptive Median Smoothing
time strengthen the adversarial robustness of unlearned models.
2022: Saharia et al., 2022; Ramesh al., 2022; Nichol et al.,
2022; Gu al., 2022) incorporate textual conditions into diffusion models to achieve controllable image generation. While advanced T2I diffusion models enable the generation of diverse content based on user-input prompts, they also raise safety concern.. These models, trained on large-scale datasets that may include unsafe images, can inadvertently learn to generate such content.
Although previous inference-time defense meth- ods (Schramowski et al., 2023; Wu et al., 2024) can be applied to unlearned diffusion models, they fail to account for the trade-off between enhancing adversarial robustness and preserving the generative ability of T21 models. In this paper, we aim to develop an inference- time strategy to enhance the adversarial robustness of unlearned diffusion models while preserving model's original generation capabilities and inference efficiency. Specifically, we reformulate the robust unlearned model as a robust regression problem. We then extend naive median smoothing, which employs isotropic Gaussian noise for regression robustness, a generalized median smoothing framework incorporating anisotropic noise. This framework preserves model utility. Based on this, we introduce token-wise Adaptive Median Smoothing strategy that determines the noise intensity for each token based on its relevance to the target concept, thereby enhancing robustness against adversarial inputs. To further improve inference efficiency, we explore implementations of this adaptive method at the text-encoding stage.
2.2. Machine Unlearning for T21 Diffusion Models
Existing Unlearning Methods. Unlearning methods for T2I diffusion models aim to erase specific target concepts, such as "nudity", from model parameters. These methods typically modify model parameters through fine-tuning or model editing. Fine-tuning approaches focus on redirecting the noise predicted under the target concept. For instance, Erase Stable Diffusion (ESD) (Gandikota et al., 2023) redi- rects the predicted noise under the target condition to its opposite direction. Similarly. Concept Ablation (CA) (Ku- mari et al., 2023) guides the noise predicted under target concepts towards noise predicted under manually selected anchor concepts. In contrast to most noise redirection meth- ods, Forget-Me-Not (FMN) (Zhang et al., 2024a) minimizes attention maps related to target concepts. UCE (Gandikota et al., 2024), on the other hand, performs parameter edit- ing by targeting the keys and values within cross-attention layers.
Our contributions can be summarized as follows:
We propose a novel inference-time defense method to enhance the adversarial robustness of unlearned T21 diffusion models.
Vulnerabilities of Unlearned Models. Although un- learned models demonstrate effectiveness in preventing target content generation under benign inputs, studies have revealed their vulnerabilities to adversarial inputs. Prompting4Debugging (P4D) (Chin et al., 2024) mini- mizes the noise discrepancy between unlearned and original models generate adversarial prompts. UnlearnDiffAii (UDA) (Zhang et al., 2024c) enhances P4D's efficiency by operating solely on unlearned models without requiring the original model. Unlike previous white-box attack methods, Ring-A-Bell (RAB) (Tsai et al., 2024) leverages the text en- coder to generate adversarial prompts. These attacks show that adversarial prompts can successfully restore seemingly erased concepts from unlearned models.
We derive the robust guarantee of generalized me- dian smoothing with anisotropic noise, and propose Adaptive Median Smoothing strategy with its efficient implementations for adversarial robustness enhance- ment, model utility, and inference efficiency.
Extensive experiments show that our method efficiently boosts the robustness of unlearned models and main- tains their original generative capabilities, outperform- ing baseline defense approaches.
2. Related Work
2.1. Text-to-lmage Difflusion Models
Enhancing Adversarial Robustness of Unlearned Mod- els. Adversarial erasing has emerged as common method to enhance the adversarial robustness of unlearned mod- els. Notable examples include Robust Adversarial Concept Erase (RACE) (Kim et al., 2024), which builds upon ESD, and Reliable and Efficient Concept Erasure (RECE) (Gong et al., 2024), based on UCE. However, adversarial erasing necessitates searching for adversarial inputs, prolonging the unlearning process and potentially compromising model utility. We aim to utilize inference-ting defense to enhance unleamed model robustness. Several inference-time safety
Text-to-image (T2I) diffusion models are based on the foun- dational work of diffusion models (Ho et al., 2020; Song et al., 2021). The training of these models involves two pro- cesses: forward and reverse. In the forward process, noise is gradually added to a clean image zo, creating a series of increasingly noisy images: T1, .., ZT, where T repre- sents the total number of timesteps. The reverse process trains the model to predict the added noise given a noisy image 2, at timestep t. During inference, random noise is sampled as ær, and multiple denoising steps are performed to generate the image. T2I diffusion models (Rombach et al.,,
ET,,
2

---

Adaptive Median Smoothing
mechanisms already exist for diffusion models. The ba- sic approach involves removing unsafe words from input prompts using predefined blacklists (George, 2020). More advanced methods include the universal prompt optimizer for safe T21 (POSI) (Wu et al., 2024), which employs large language models (LLMs) to rewrite input prompts. Safe Latent Diffusion (SLD) (Schramowski et al., 2023) offers another solution by modifying noise prediction during infer- ence to diverge from unsafe concept predictions.
simplify the notations, we omit w, (typically set to I to improve sample quality (Ho et al., 2020)), 2t, T and in
the mean squared error as: Ez, [|ee (v) - -E (y + 6) [[]]
The robust model aims to bound the mean squared error as:
Eng (ile - E' + 6) S C(B) vd B,
where C(B) denotes an upper bound that depends on the perturbation constraint set B. This problem can be conceptu- alized developing robust regression model wherein the predicted noise remains proximal to the original prediction, even when the input embedding is perturbed by adversarial noise. Next, we will introduce median smoothing (Chiang et al., 2020) an adversarial defense strategy for regression models to augment the robustness of noise prediction.
3. Method
In this section, we present our Adaptive Median Smoothing for enhancing the adversarial robustness of unlearned text- to-image (T2I) diffusion models. We first formulate the ad- versarial robustness of T2I generation as a regression prob- lem (Section 3.1), and then introduce median smoothing for robust regression (Section 3.2). Our analysis identifies two limitations of naive median smoothing: compromised model utility and low computational efficiency. To address these, we extend the requirement of naive median smoothing from isotropic Gaussian noise to anisotropy (Section 3.3) and propose Adaptive Median Smoothing (Section 3.4). Key notations are summarized in Appendix A.
3.2. Naive Median Smoothing for Robust Regression
The native noise prediction (i.c., without defense) contains m dimensions: <(y) = (clv)),ccy)² .())).)))))))) <(y))), and we take the i-th (1 S i S m) dimension as an example to show how median smoothing works. Let sup denote the supremum (least upper bound), and inf denote the infimum (greatest lower bound) of a set. The percentile smoothing of the i-th dimension in e can be defined as:
3.1. Formulating Adversarial Robustness of Unlearned Diffusion Models: A Regression Perspective
Ep(D)* = sup (v E R Plc(y + Gy S o| S p): Ep(u)* = inf E R PI(() + GY S 2 p):
To ensure the adversarial robustness of unlearned models, it is crucial to maintain similar outputs between benign and adversarial inputs. Let denote the benign input token embedding, and 0 represent the adversarial perturbation, where 8 e B for a given constraint set B. Without defense, the adversarial input y + may cause the unlearned diffu- sion model regenerate erased concepts. Our goal is to control the discrepancy between the output distribution con- ditioned on the adversarial input y + d and that conditioned on the benign input y. This can be formulated using the Kullback-Libble (KL) divergence:
where G ~ NO0 0²1) denotes Gaussian noise. Follow- ing (Chiang et al., 2020), we use Ep(y)' to denote the percentile-smoothed function when either definition can be applied. Utilizing median smoothing, the adversar- ially robust noise prediction e'()) is instantiated as the median median-smoothe smoothed (p 0.5) noise prediction E..s(-) (Eo.s()))) m i- Then we have the following lemma adapted from Lemma in (Chiang et al., 2020):
Lemma 3.1. The median median-smoothen smoothed prediction with adver- sarial perturbation ō can be bounded as:
Dic (pr (p- (z II (Fo....)) + +)));
Eg(u) s &Eos(y + +08 - <Ep(u) V|1ōl2 <p (1)
where p* denotes the output distribution of the adversarially robust diffusion model, F((...T) denotes the output across different time steps (typically restricted to a reduced sub- sequence in practical samplers; see Appendix B), and T represents the text encoder. Previous work (Kumari et al., 2023) has shown that minimizing this KL divergence is equivalent to minimizing the following mean squared er- ror:
where p = (-2) and p = & (2) define the lower and upper probability bounds, and to denotes the standard Gaussian cunulative distribution function.
The mean squared error we aim to bound now becomes:
| Eo.s(y + 0)IB = Σm (Eo.s(v)*
Eo,( 1 0)))
Expt [walle (xv)) - e" (Z,, T(y + 11)1
According to Lemma 3.1, for any 5 that satisfies ||ō1|2 < p.
we have:
where w. is the weight of loss at timestep t, E" is the robust noise prediction, Ia the noisy sample at timestep t. To
Ea.( - EE(()) s Eas(s) Eo.aly + 87 S Eas(y)' - -v,
3

---

Adaptive Median Smoothing
No Defense !
"iill erotic boudope guereau"
Compute
0.0 0.3 0.0 0.0 -011 -0.1
(b) Relevance Scores Computing
TT
girk/wp
Initial Noise
U-Net
added publication)
erotics/w>
'iirl erotic boudope
bou dope</wp
Token Embedding Lookup
Median
Tokenizer
guereau"
Advemarial
gue reau</w>
Text
TT
Prompt
Encader
Initial Noise
Preprocessing
Smoothing
U-Net
Figure Pipeline of Adaptive Median Smoothing. (a) The input prompt tokenized converted into embeddings. (b) Relevance scores are computed to determine the token-level noise intensity. (c) Noise is added to token embeddings. which are then processed by the text encoder. The smoothed text embeddings are aggregated via a median operation and used as conditional inputs to the diffusion model's U-Net, mitigating adversarial effects and enhancing robustness.
Based on this two-sided bound, we introduce (1)) to represent the maximum of squared differences:
3.3. Generalized Median Smoothing with Anisotropic Noise
To address [RQ1], we propose to explore anisotropic noise for median smoothing. Instead of using isotropic Gaus- sian noise G (N0 we consider more general form of anisotropic Gaussian noise: G' ~ NO, E), where Σ = diag(a?, ......,. .o)) d represents the total dimensionality of the input token em- beddings. We generalize the naive smoothing operator & to anisotropic version 6, defined as:
(p.(lu)²= = max (W) -z(())) (Eass)))))))))))) -
is positive diagonal matrix, and
Then bound the mean squared error as:
( < Σm ()))² V|l8||2 < p.
(2)
E = sup(u E R P(c( - G³)² S u0 s), &p(u)' inf(u R P[c(y G¹)² S w) 2 p).
(3)
The aforementioned derivation demonstrates that median smoothing can bound the mean squared error, implying that the model can defend against adversarial inputs pro-
(4)
We use Ep(y)² to represent the anisotropic percentile- smoothed function when either definition applicable. Sub- sequently, we derive the bounds of the median-smoothed output in the anisotropic case.
cessed by median smoothing.
Problem Analysis. However, directly implementing me- dian smoothing in practice presents two challenges for T2I diffusion models. (1) The model's utility would be com- promised. Median smoothing requires adding isotropic Gaussian noise G ~ (O, T) to the input token embed- ding. Empirically, we observe that while large help mitigate adversarial inputs, it simultaneously corrupts benign text embeddings. leading to degraded generation quality for benign inputs. (2) The computational over- head is substantial. To approximate E..s()) through Monte Carlo sampling, each timestep necessitates predicting noise times, thereby multiplying the inference time by approx- imately n. Subsequently, delineate approach to address two research questions:
Theorem 3.2. (Proof in Appendix C) The median-smootie prediction with adversarial perturbation ó under anisotropic Gaussian noise G' ~ (0, Σ) is bounded as follows:
(x)( S 80.5 + 8)¹ S (2)) V|[ō|EE,2 pl, (5)
where =- (-pp) and D' = $ (pl) define the lower and upper probability bounds, respectively. ||0|| denotes the & norm of 8, defined ||ō]|,,2 E-1E-18.
Note that when Σ degenerates I Theorem 3.2 reduces to Lemma 3.1. Based on Theorem 3.2 and following the derivation approach of Incquality (2), we derive the upper bound of the mean squared error for the anisotropic case:
[RQ1] How can we maintain model utility while enhancing adversarial robustness?
Em (5or
V||0||1,2 < pr.
[RQ2] How can we improve inference efficiency?
(6)

---

Adaptive Median Smoothing
where Ep (v)) : max ((0as(0)' (vo.s())'- (2(")) The primary distinction in the anisotropic case is that the guaranteed region manifests as an ellipsoid rather
Algorithm 1: Computing Token-Level Concept
Relevance Scores
Function DiefE (g, i)
than an isotropic ball. The covariance matrix Σ determines the shape of this ellipsoid, with larger noise magnitudes corresponding to longer axes in the respective dimensions.
calculate differential embedding for token i;
1 + ly::
M4 lv , ,y" ,. ,g");
A T ((Me);
3.4. Adaptive Median Smoothing
return A;
Motivation. The findings in Theorem 3.2 suggest an ap- proach: injecting larger noise into specific dimensions can expand the guaranteed region along those axes while main- taining lower noise levels in others. For enhancing the adversarial robustness of unlearned T2I models, this insight leads to a token-wise adaptive noise injection strategy that preferentially increases noise in dimensions related to the target concept, thereby achieving targeted suppression while preserving utility in other aspects. The overall process is illustrated in Figure 2. We introduce Relevance Score Computation method to quantify each token's 's relevance to the target concept for determining noise magnitude, ad- dressing the model utility issue in [RQ1]. Additionally, we propose an Efficiency Improvement solution to the low computational efficiency in [RQ2].
Input:
input token embeddings y, target concept representation Agt. global flag e Output: relevance scores S
Initialize S as empty list; -- 1; current word start index for i <- 1 to lys do
if y' is end of word then
Vic + (y", y ..... .y" current word
for j +- 8 to do
A loc + DiffEmbed (Mav. j - 8 + 1);
sim' + -oos(A) Aga);
if Φ is true then
A glh -iffffmbed (y. f);
sim 21h + coso ( gth Agii:
sim' + max (sim², sim? +
Relevance Score Computation. We start by calculating the representation of the target concept. This involves collect- ing positive prompts related to the target concept and their corresponding negative prompts, which lack such content. These prompts are then tokenized and embedded. We define 01+ = (w_") . ....., 2+ for the positive prompts, where i is the total number of prompt pairs, and vL² is the token embedding of the i-th positive prompt. Similarly, y- _ _, ..... ..."! ( represents the token embeddings for the negative prompts.
end
Append sim' to S:
end
+ i 1;
(k) the set of token embeddings
end
end return S
Mi = (y....., 1',1,'"" ""..,,)), and then calculate:
The token embeddings are encoded by T. and the target concept direction is determined by the mean difference of the encoded embeddings.
1/D = T(y) - (vx:).
Subsequently, we calculate the cosine similarity between A Llb and Agg. denoting as the relevance of the i-th token to the target concept: sim = cos ( Ag,) Nevertheless, the complex contextual environment of the full prompt may lead to inaccuracies in the calculated relevance. Therefore, we reduce the window size and perform a local relevance calculation based on individual words. For each complete word (identified by the '</w>" suffix), we determine the text embedding difference A by removing each individual token from the word. We then compute the cosine similarity as: sim' cos( lee Aga.
A
(T(x ))
gtt
Next, we calculate the representation of each token within the input prompt y = (y': .y² yr?.... y²), where I denotes the length the prompt. We utilize differential text embedding, defined as the difference between encoded text embeddings with and without a specific token, to capture the token's 's semantics. The context window size for calculating dif- ferential text embedding needs to be carefully determined. A straightforward approach is to use the entire prompt as the context window (global context). Specifically, when representing the semantics of the i-th token y using the global difference, we remove the i-th token from y to obtain
When greater robustness is required or when dealing with more vulnerable unlearned models, we incorporate the global difference. To mitigate the potential underestimation of relevant tokens due to complex contextual environments in the global calculation, we combine the scores only when
5

---

Adaptive Median Smoothing
SLD- Medium
SLD- Strong
ESD
RACE
SLD-Weak
SLD-Max
Blacklist
POSI
Ours
SLD- Medium
SLD Strong
UCE
RECE
SLD-Weak
SLD-Max
Blacklist
POSI
Ours
Figure 3. Qualitative results of different defense methods against the restoration of "mudity". ESD and UCE are unlearned models without defense. RACE and RECE apply pre me-inference defenses, while SLD, Blacklist, POSI, and method operate inference time.
the global relevance exceeds the local relevance. In such cases, the relevance of the i-th token the target concept can expressed as: sim' max (sim', sim +sim The overall process detailed in Algorithm 1.
SLD-
RACE
SLD-Max
Ours
Medium
The noise magnitude for the i-th token embedding is then calculated as: do exp(k- sim'), where do is the base noise magnitude and k is the scaling factor. This noise magnitude for each token is subsequently used to construct the noise covariance matrix Σ.
SLD- Medium
SLD-Max
Ours
The significant computational overhead arises from the necessity of multiple noise pre- dictions for median calculation. To mitigate this issue, we shift the median calculation earlier in the generation process, performing it on the encoded text embeddings. Specifically, given the input token embeddings we repeat the calcu- lation encoded text embeddings n times. For the i-th repetition, we sample Gaussian noise G' ~ N/ Σ) and calculate (+) T + G'). It is important to note that these encoded text embeddings can be computed in paral- lel, thereby improving inference efficiency. After obtaining text embeddings, we compute their element- median value:
Efficiency Improvement.
Figure 4. Qualitative results of different defense methods against restoration "violence".
4. Experiments
4.1. Experimental Setup
Implementation Details. In alignment with previous stud- ies on unlearning (Gandikota et al., 2023; 2024), we employ Stable Diffusion (SD) vl.4 (Rombach et al., 2022) as the T2I model, incorporating ViT-L/14 (Radford et al., 2021) as the text encoder. We apply two representative unlearning techniques: ESD (Gandikota et al., 2023) (fine-tunin)) and UCE (Gandikota et al., 2024) (model editing), to derive unlearned models. To execute our adaptive median smooth- ing, we gather positive and negative prompts from the ViSU dataset (Poppi et al., 2024) for unsafe concepts, specifically nudity and violence. Additional hyperparameters, including
1o.5 median([1* (1 (n)).
Then No.5 serves as the conditional input for the U-Net in diffusion models (Rombach et al., 2022) to guide text-to- image generation.
6

---

Adaptive Median Smoothing
Table Quantitative results comparing different defense methods unlearned models with the "nudity" concept erased.
Unlearned
Defense
Adversarial Robustness (Evaluated by ASR 4)
Model Utility
Model
Method
I2P
P4D
UDA
RAB
MMA
QF-PGD
Average
FID +
CLIP 1
w/o defense
6.34
29.89
42.37
53.68
7.50
12.71
25.42
7.161
30.18
RACE
3.76
17.62
16.95
31.58
5.70
9.32
14.16
7.843
30.08
SLD-Weak
5.37
28.74
27.97
48.07
8.20
15.25
22.27
7.806
30.02
SLD-Medium
4.19
25.29
12.71
34.39
7.60
10.17
15.73
10.435
29.48
ESD
SLD-Strong
3.76
18.01
7.63
18.25
7.60
6.78
10.34
15.627
29.08
SLD-Max
3.76
6.90
3.39
10.18
4.30
6.78
5.89
25.544
28.54
Blacklist
6.02
13.79
26.27
17.54
6.20
15.25
14.18
7.298
30.06
POSI
5.16
18.39
16.10
30.88
3.80
13.56
14.65
7.774
29.75
Ours
3.19
10.98
11.02
2.92
4.23
8.47
6.80
7.365
30.10
w/o defense
11.49
44.06
73.73
37.89
39.30
35.59
40.34
4.379
31.02
RECE
4.94
22.99
14.41
11.23
19.90
12.71
14.36
6.001
30.78
SLD-Weak
12.57
50.57
67.80
42.11
45.00
36.44
42.42
5.635
30.87
SLD-Medium
13.53
52.87
55.93
43.16
44.60
28.81
39.82
8.084
30.64
UCE
SLD-Strong
13.10
44.83
45.76
38.95
42.70
27.12
35.41
12,412
30.31
SLD-Max
12.03
37.93
33.90
26.67
35.50
20.34
27.73
18.445
29.90
Blacklist
9.88
29.12
55.93
28.77
27.00
33.05
30.63
4.576
30.92
POSI
9.13
27.20
30.51
22.81
10.60
26.27
21.09
5.270
30.56
Ours
4.33
19.16
11.02
5.03
17.53
9.04
11.02
5.343
30.48
the generated images. lower detection rate indicates lower attack success rate (ASR), thus demonstrating greater robustness. For evaluating model utility, Inception Distance (FID) (Heusel et al., 2017) for image quality and CLIP score (Hessel et al., 2021) for image- prompt alignment. The prompts for utility evaluation are sampled from the COCO validation set (Lin et al., 2014).
Table Inference time of training-free free defense methods.
Defense Inference Time (s)
the Fréchet
w/o defense 9,435
Blacklist 9,462
SLD
11.779
Ours
10.317
dn and k. are detailed in Appendix The experiments are conducted using NVIDIA Tesla V100 GPUs.
4.2. Comparisons with Baseline Methods
In this subsection, we employ various defenses to enhance the adversarial robustness the unlearned models that have removed the concept of nudity. We compare our method with baseline approaches, emphasizing the trade-off be- tween robustness and model utility, while also considering efficiency.
Baselines. We compare method's performance with var- ious baselines. For pre-inference defense, we include com- monly used adversarial erasing, RACE (Kim et al., 2024) for enhancing the robustness ESD, and RECE (Gong et al., 2024) for UCE. Additionally, we consider inference-time safety mechanisms. These include input prompt modifi- cation methods, such blacklist-based unsafe word moval (George, 2020) and input rewriting (POSI (Wu al., 2024)). We also incorporate SLD (Schramowski et al., 2023) as baseline representing approaches that alter the predicted noise direction during inference.
Trade-Off' Between Robustness and Utility, The qual- itative results demonstrating robustness are illustrated in Figure 3, while quantitative results are presented in Table I. It is evident that, in the absence of defense mechanisms, the unlearned model is susceptible various adversarial tacks. For the unlearned model processed by ESD, the SLD defense with maximum hyperparameters achieved the most robust performance, resulting in an average attack success rate (ASR) of 5.89%. However, this robustness comes at significant cost to model utility, as indicated by the FID metric, which increased from 7.161 25.544. contrast, our method achieves comparable robustness, with an aver- age ASR of 6.80%, while effectively preserving the model's generative capabilities, reflected in an FID of 7.365. For the unlearned model processed by UCE, we observe that
Evaluation Metrics. We concentrate on assessing ro- bustness against adversarial prompts and the impact on the model's normal generation capabilities. For robust- ness evaluation, consider adversarial prompts generated by various methods, including I2P (Schramowski et al., 2023), P4D (Chin et al., 2024), UDA (Zhang et al., 2024c), RAB (Tsai et al., 2024), MMA (Yang et al., 2024), and QF-PGD (Zhuang et al., 2023). Specific detectors (details in Appendix D) are used identify the target concept in

---

Adaptive Median Smoothing
Table Ablation study do and
Table Ablation study of global relevance.
Unlearned Model
Relevance
ASR 4
FID 4
CLIP 1
k
ASR
FID 4
CLIP
Local
15.03
4.800
30.72
0.003
12.54
7.252
30.16
Local & Global
11.02
5.343
30.48
0.006
6.80
7.365
30.10
0.009
2.78
7.530
29.98
ESD
Table 5. Ablation study of ViSU prompt pairs.
5
11.28
7.366
30.14
Unlearned
Defense Method
0.006
9
6.80
7.365
30.10
ASR
FID
CLIP
Model
13
4.98
7.370
30.02
w/o defense
25.42
7.161
30.18
0.006
18.69
4.477
30.91
ESD
Ours (ViSU)
6.80
7.365
30.10
0.009
14.46
4.766
30.77
Ours (Self-Gen)
5.33
7.436
30.09
0.012
11.02
5.343
30.48
w/o defense
40.34
4.379
31.02
UCE
5
17.71
3.237
30.54
UCE
Ours (ViSU)
11.02
5.343
30.48
0.012
9
11.02
5.343
30.48
Ours (Self-Gen)
15.93
5.526
30.54
13
9.14
5.600
30.32
global relevance further enhances robustness.
the SLD defense is less effective in enhancing adversarial robustness. contrast, our method demonstrates superior defense performance, surpassing the adversarial erasing method (RECE), while also yielding better image quality, as indicated by the FID metric.
VISU Prompt Pairs. In previous experiments, we used 7, 863 prompt pairs from the ViSU dataset (Poppi et al., 2024) to calculate the concept vector for the target con- cept ("nudity"), which is then utilized to compute the rel- evance score. To further demonstrate the effectiveness of our method, we implement nudity unlearning without using prompt pairs from ViSU. Specifically, we first use an un- censored LLM interface on Hugging Face to generate 100 nudity-related prompts (positive prompts) and then use an- other LLM interface (e-g.. Kimi) to transform them into safe versions (i.e., negative prompts). These 100 self -eff--eeeetted prompt pairs (denoted as Self-Gen) ments, with results shown in Table 5. Overall, our method remains effective even with only 100 collected prompt pairs.
Efficiency. The adversarial erasing strategy necessitates additional training due to the iterative process of identify- ing adversarial inputs and erasing them by adjusting the parameters of the unlearned model. In contrast, the infer- ence baselines do not require additional training, with the exception of POSI, which necessitates fine-tuning the LLM for prompt rewriting. To evaluate the efficiency of these training-free defense methods, we compare their inference time per image. and the results are presented in Table 2. Our method demonstrates superior inference efficiency com- pared to SLD. Although the simple blacklist-basee defense more efficient than ours, it is less effective enhancing the robustness of unlearned models.
used in experi-
4.4. Generalization Analysis
In this subsection, we evaluate the generalization ability of our method across different types of concepts and various T2I model variants.
4.3. Ablation Study
Generalization Across Concepts. Previous experiments have demonstrated the effectiveness of our method en- hancing the robustness of unlearnd models with the "nudit" concept erased. To further validate the generalizability of our approach, we evaluate it on additional concepts, includ- ing "violence" (NSFW), "gum" (object). and "Van Goghi (style). Qualitative and quantitative results for "violence" are displayed in Figure 4 and Table 6, while results for "gun" and "Van Gogh" are provided in Appendix E. These re- sults demonstrate that our method consistently achieves a superior trade-off between adversarial robustness and utility.
In this subsection, we perform ablation studies to evaluate how various hyperparameters and components- inmpluudtt-imlluuiing including base noise level, noise scaling factor, global relevance incor- poration, and prompt pair selection affeti the performance of our method.
Base Noise do and Scaling Factor k. The parameters do and k are instrumental in controlling noise intensity. We apply different values of og and & to both the ESD and UCE unlearned models and present the performance results in Table 3. While increasing do and i enhances robustness, excessively large values may compromise model utility.
Generalization Across T2I Model Variants. While previ- ous experiments were conducted on Stable Diffusson (SD) v1.4, we further evaluate our method on other widely used T2I models, SD v1.5 and SD v2.1, to assess its generaliz- ability. The detailed results are presented in Appendix E.2.
Global Relevance. We examine how performance differs when global context is incorporated into relevance computa- tion, using the UCE unlearned model. The results are shown Table For vulnerable unlearned models, incorporating
8

---

Adaptive Median Smoothing
Table Quantitative results comparing different defense methods for unlearned models with the "violence" concept erased.
Unlearned Model
Defense
Adversarial Robustness (Evaluated by ASR !)
Model Utility
Method
I2P
UDA
RAB
QF-PGD
Average
FID
CLIP
w/o defense
17.59
38.33
50.00
28.33
33.56
7.656
29.75
RACE
19.97
35.00
55.60
35.00
36.39
8.509
29.71
3LD-Weak
16.01
32.50
42.27
29.17
29.98
8.392
29.67
ESD
SLD-Medium
15,48
30.83
32.13
25.83
26.07
10.759
29.58
SLD-Strong
12.57
27.50
21.07
20.83
20.49
14.477
29.43
SLD-Max
9.39
16.67
9.47
17.50
13.26
19.274
29.23
Ours
15.61
28.06
11.87
25.28
20.20
7.942
29.68
w/o defense
22.22
48.33
74.13
40.00
46.17
5.531
31.05
RECE
18.92
39.17
60.40
31.67
37.54
6.743
30.90
SLD-Weak
18.65
37.50
66.40
36.67
39.80
6.872
30.94
UCE
SLD-Medium
18.78
35.00
55.07
30.83
34.92
9.327
30.49
SLD-Strong
15.61
30.83
41.07
29.17
29.17
14.223
30.42
SL.D-Max
15.34
26.67
27.87
26.67
24.14
22.306
29.78
Ours
18.21
30.00
11.29
29.72
22.31
6.063
30.56
5. Discussion
6. Conclusion
Multiple Concept Unlearning. Our method naturally ex- tends to multi coutii-concept unlearning scenarios. For instance, we conduct a preliminary exploration on the UCE unlearned model with "mudity" and "violence" concepts erased simul- taneously. By computing token relevance scores as the maximum similarity value across multiple target concepts, our method effectively mitigates adversarial attacks while preserving model utility. Quantitative results are provided in Appendix F.1. These findings demonstrate the adaptability of our approach, though efficiency challenges may emerge when scaling to a large number of concepts.
Improving the adversarial robustness of unlearned T2I mod- els is important for content security. In this study, we de- rive the robust guarantee of generalized median smoothing with anisotropic noise, and propose an Adaptive Median Smoothing strategy with its efficient implementations for adversarial robustness enhancement of unlearned T2I diffu- sion models. Our inference-time defense method achieves superior trade-off between adversarial robustness and model utility compared to previous methods.
A Acknowledgments
Comparison with Text Encoder Fine-tuning Methods. Our method operates within similar defense space adver- sarial text encoder fine-tuning approaches, such as AdvUn- learn (Zhang et al., 2024b). However, key differences exist: AdvUnleam requires computationally intensive fine-tuning and achieves empirical robustness, whereas our approach is training-fir frrn, applied at inference time, and provides both theoretical guarantees and empirical validation. A detailed discussion presented in Appendix F.2.
This work is supported by the National Natural Science Foundation of China (NSFC) under Grant No. 62372452, The authors would like to thank the anonymous reviewers for their insightful comments and constructive suggestions.
Impact Statement
This work presents an inference-time defense strategy aimed at enhancing the adversarial robustness of unlearned text- to-image diffusion models. By reformulating robustness as regression problem and introducing token-adaptive anisotropic noise, the proposed method achieves improved resilience against adversarial inputs while maintaining model utility and inference efficiency. These findings high- light a promising framework for securing generative models without compromising their core capabilities. We hope this work will inspire future research on adaptive defenses safeguard generative models in increasingly sophisticated adversarial environments.
Failure Cases. While our method generally demonstrates robust performance, we identify specific failure scenarios where certain adversarial prompts can circumvent our de- fense under the default hyperparameter dg- Increasing do can mitigate these cases but may also impair the model's performance on benign inputs. Future work should explore mechanisms dynamically adjust do based on input char- acteristics, aiming maintain robustness without compro- mising model utility. Detailed failure case analyses and qualitative examples are provided in Appendix F.3.

---

Adaptive Median Smoothing
References
Empirical Methods in Natural Language Processing, pp. 7514-7528, Online and Punta Cana, Dominican Republic, November 2021.
Bedapudi, P. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019.
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Proceedings of the 31st International Conference Neural Informa- tion Processing Systems, pp. 6629 -640, Red Hook, NY, USA, 2017.
Chiang, P., Curry, M. J., Abdelkader, A., Kumar, A., Dicker- son, J., and Goldstein, T. Detection as regression: Certi- fied object detection with median smoothing. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6- 2020, virtual, 2020.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion prob- abilistic models. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, De- cember 6- 12, 2020, virtual, 2020.
Chin, Z.-Y., Jiang, C. M., Huang, C.-C., Chen, P.-Y,, and Red-teaming text-to-
Chiu, W.-C. image diffusion models by finding problematic prompts. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Ma- chine Learning Research, pp. 8468-8486. PMLR, 21-27 Jul 2024.
Kim, C.. Min, K., and Yang, Y. R.A.C.E. : Robust adver- sarial concept erasure for secure text-to-image diffusion model. In Computer Vision - ECCV 2024 11th Euro- pean Conference, Milan, Italy, September 29-October 4, 2024, Proceedings. Part LXXXIII, volume 15141 of Lec- ture Notes Computer Science, pp. 461 661-478. Springer, 2024.
Eiras, F, Alfarra, M., Torr, P., Kumar, M. P., Dokamia, P. K., Ghanem, B., and Bibi, A. ANCER: Anisotropic certifica- tion via sample-wise volume maximization. Transactions Machine Learning Research, 2022. ISSN 2835-8856.
Gandikota, R., Materzynska, J.,
J., and Bau, D. Erasing concepts from diffusion models. In IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pp. 2426- 2436. IEEE, 2023.
Kumari, N., Zhang, B., Wang, S., Shechtman, E., Zhang, R., and Zhu, J. Ablating concepts in text-to-image dif- fusion models. In IEEE/CVE International Conference on Computer Vision ICCV 2023, Paris, France, October 1-6, 2023, pp. 22634-22645 IEEE, 2023.
Gandikota, R., Orgad, H., Belinkov, Y., Materzyúska, J., and Bau, D. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference Applications of Computer Vision (WACV), pp. 5111-512,, January 2024.
Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., and Zitnick, C. L. Microsoft coco: Common objects in context. In Computer Vision ECCV 2014, pp. 740-755, Cham, 2014.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018. URL https:// openreview net forummid=r
George, R. lord--sors-- http::/giitub..oo//rrengg pdcontribution///STWWWWW Wordss--Wods-Lsstt 2020. Text file con- taining NSFW words (about 1.4k) aggregated from vari- ous sources.
Gong, C., Chen, K., Wei, Z.,, Chen, J., and Jiang, Y. Reliable and efficient concept erasure of text-to-image diffusion models. In Computer Vision ECCV 2024- - 18th Euro- pean Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LilI, volume 15111 of Lecture Notes in Computer Science, pp. 73-88. Springer, 2024.
Nichol, A. Q., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., Mcgrew, B., Sutskever, I., and Chen, M. GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models. In Proceed- ings of the 39th International Conference Machine Learning, volume 162 of Proceedings of Machine Learn- ing Research, pp. 16784-16804, PMLR, 17-23 Jul 2022.
Gu, S., Chen, D., Bao, J., Wen, F., Zhang, B., Chen, D., Yuan, L., and Guo, B. Vector quantized diffusion model for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10696-10706. June 2022.
Poppi, S., Poppi. T., Cocchi, F., Cornia, M., Baraldi, L., and Cucchiara, R. Safe-clip: Removing NSFW concepts from vision-and-languaae models. In Computer Vision ECCCV 2024 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LIII, volume 15111 of Lecture Notes in Computer Science, pp- 340-356. Springer, 2024.
Hessel, J.. Holtzman, A., Forbes, M., Le Bras, R., and Choi,
Y. CLIPScore: A reference-Fir free evaluation metric for im- age captioning. In Proceedings of the 2021 Conference on
10

---

Adaptive Median Smoothing
Qu, Y.. Shen, X., He, X., Backes, M., Zannettou, S., and Zhang, Y. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS '23, pp- 3403-3417, New York, NY, USA, 2023, Association for Computing Machinery.
Wu, Z.., Gao, H., Wang, Y., Zhang, X., and Wang, S. Uni- versal prompt optimizer for safe text-to-image genera- tion. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume I: Long Papers), pp. 6340-6354, Mexico City, Mexico, June 2024. Association for Computational Linguisties.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Ma- chine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 1-48-8763. PMLR, 2021.
Yang, Y., Gao, R., Wang, X., Ho, T.-Y., Xu, N., and Xu, Q. Mma-diffusion: Multimodal attack on diffusion mod- cls. In Proceedings of the IEEE/CVE Conference on Computer Vision and Puttern Recognition (CVPR), pp. 7737-7746, June 2024.
Zhang, G., Wang, K., Xu, X., Wang, Z., and Shi, H. Forget- me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pp. 1755-1764, June 2024a.
Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. Hierarchical text-conditional image generation with CLIP latents. CoRR, 061122044006125, 2022. URL https: //doi.org/10..4350 485500/555xiii 2204 061 25.
Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., Hong, M.. Ding, K., and Liu, S. Defensive unlcarning with adversarial training for robust concept erasure in diffusion models. In Advances in Neural Information Cur-
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 10674-10685. IEEE, 2022.
Processing Systems, volume 37, pp. ran Associates, Inc., 2024b.
Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., and Liu, S. To generate or not? safety-driven unlearned diffusion models are still easy to generate un- safe images for now. In Computer Vision ECCV 2024 18th European Conference, Milan, Italy, Septem- ber 29-October 4, 2024, Proceedings, Part LVII, volume 15115 of Lecture Notes in Computer Science, pp. 385- 403. Springer, 2024c.
Saharia, C., Chan, W., Saxena, S., Li, L.,, Whang, J., Den- ton, E. L., Ghasemipour, S. K. S., Lopes, R. G., Ayan, B. K., Salimans, T., Ho, J., Fleet, D. J., and Norouzi, M. Photorealistic text-to-image diffusion models with deep language understanding. In Advances in Neural Infor- mation Processing Systems 35: Annual Conference Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28- December 9. 2022, 2022.
Zhuang, H., Zhang, Y., and Liu, S. A pilot study of query- free adversarial attack against stable diffusion. In Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR) Workshops, pp- 2385-2392, June 2023.
Schramowski, P., Brack, M., Deiseroth, B., and Kersting, K. Safe latent diffusion: Mitigating inappropriate degenera- tion in diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 22522-22531, June 2023.
Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021. URL https: wpw.reviee.eeeeeeeeeeeee. fottfforu?2a wwt.mmddddttttsiinmim
Tsai, Y.-L. Hsu, C.-Y., Xie, C., Lin, C.-.., Chen, J. Y., Li, B., Chen, P.-Y,, Yu, C.-M., and Huang, C.-Y. Ring- a-bell! how reliable are concept removal methods for diffusion models? In The Twelfth International Confer- ence on Learning Representations, 2024. URL ht tts::: / //openreview net.eeeweeweeeeeeeeeeeee forum? d111mMMcsFF.ss

---

Adaptive Median Smoothing
A. Notation Summary
present the key notations used throughout this paper Table
Table 7. Summary of key notations used in this paper.
Notation
Description
y
Benign input token embedding
Norm-bounded set defining allowed perturbations
8
Adversarial perturbation constrained within
21
Noisy sample at timestep t Robust noise prediction function
()))
<(-)
Native (undefended) noise prediction function
Isotropic Gaussian noise
Percentile-smoother function for the i-th dimension under noise G Standard Gaussian cumulative distribution function
G'
Anisotropic Gaussian noise
Covariance matrix of anisotropic Gaussian noise (positive diagonal matrix) Generalized percentile-smoothen function for the i-th dimension under noise G'
op())
|
E -norm of 6, defined V 1-
A htt
Target concept representation
A
Global differential embedding for the i-th token Local differential embedding for the i-th token Relevance of the i-th token the target concept
A
sim'
Oo
Base noise magnitude
l
Scaling factor controlling exponential growth of noise intensity
ho.5
Median text embedding served as the conditional input for the U-Net in diffusion models
B. Formulation Generalization for Subsequence Sampling
In practice, many text-to-image pipelines use DDIM (Song et al., 2021) other fast samplers with S < T steps (e.g.. S < 50). Our original formulation covers the full DDPM (Ho et al., 2020) chain (Tn, (1..2i..... .T), which may be unnecessary for practical applications. To better align our theoretical framework with practical sampling efficiency, we generalize our formulation by considering a subsequence (Ira Fr, "..,.,,,, ITg used in practical sampling. These timesteps satisfy:
To < Ti T2
=T
We then bound the KL divergence over this subsequence for any perturbation 5 within the norm-bounded set B:
DKc pp" (I(ro...ry)
(Tv)) || (I(ro..T))) IT + (Ty +6))
which translates to constraining the mean squared error (MSE) at each sampled step T::
Ex to [lle* (#r., T()),:) c² (x 5),+)),7118) S C(B) V8 B.
C. Proof of Theorem 3.2
Lemma C.1. (Eiras et al.. 2022) Let f Rn + [0, be a function, and define its smoothed version as follows:
g(x) E EG
G')],
where E is positive diagonal matrix. Then, the function + - - (g(x)) is I-Lipschitz with respect to the ty norm.
Theorem 3.2. The mediann-soottee prediction with adversarial perturbation under anisotropic Gaussian noise G' ~ N NO0 Σ) is bounded as follows:
Eg) Bo.s 58' < (v)'
V|ll|x, pl,
(7)
12

---

Adaptive Median Smoothing
where of 1 (-pr) and p 1b (pt) define the lower and upper probability bounds, respectively. || denotes the lz norm of 8, defined as ||8l|z,2 E-18.
Proof. For clarity, omit the superscript in notation. Consider the event <(v + + + G') S 87(4) and let (()7) denote the corresponding indicator function. We define g(d) as the expectation of this indicator function:
g
EiL (04644))57 +6 S <pp(1))
Next, we consider the mapping defined by
8 ~-
According to the Lemma C.I. this mapping is I-Lipschitz with respect to the Ey norm. Therefore, we have:
6 (PP((y + & + x- (Ple(y G) < ( -1,0/
Rearranging the above inequality yields:
i (P + 8 5 2 (Pfe(y + G) G) - - 10,
2 Φ
+ G) GG ( -
$ - (p') p
-- (o(d))) pd
0.
Since (0.(5 0 and the function (-) is monotonically increasing, follows that:
P 0.5.
0.5.
According to the definition of o.s we have:
E Cn ( inf e R Plely G) 0.5).
Thus, conclude that:
8 8o.(u+ + s E1)).
Similarly, we can derive the inequality the other side:
Eo. + 8os( 6
Recall that we denote Lu.s as the percentile-smoode smoothed function applicable to either definition. This notation allows us represent both Lo. and 0.5 simultaneously. With established bounds for both functions, can express our result concisely:
(v) S $0.lv+ 5p V| <pP
This completes the proof.
13

---

Adaptive Median Smoothing
D. Implementation Details
Hyperparameteers. The number Monte Carlo samples, denoted as n, is set to 13. For the ESD unlearned model following the erasure of the nudity concept, we set do 0.006 and 9, utilizing only local relevance scores. In the case the UCE incorporating both local and global relevance
unlearned model after erasing the nudity concept, dg is to 0.012 and scores. For the ESD unleamed model after erasing the violence concept, dg remains 0.006 and & at 9, again using only local relevance scores. Finally, for the UCE unlearned model after erasing the violence concept, is set 0.012 and & to 9, utilizing only local relevance scores.
Unsafe Content Detectors. We employ Nudenet (Bedapudi, 2019) for nudity content detection, identifying nine specific exposed body areas: buttocks, female breasts, female genitalia, anus, male genitalia, male breasts, belly, feet, and armpits. The detection uses a confidence threshold of 0.6. For violence content detection, we utilize the fine-tuned Q16 model provided by (Qu al., 2023).
E. A Additional Generalization Analysis
This section presents additional generalization results across various concepts and text-to-image (T2I) model variants.
E.1. Generalization Across Concepts
For the object concept, target "gun" and use three attack methods (UDA, RAB, QF-PGD) to assess adversarial robustness, reporting the mean attack success rate (ASR). We compare our approach with SLD baselines. The results, presented in Table 8, show that our method achieves a superior balance between robustness and utility. For the style concept, we target "Van Gogh" using the same three attack methods, with results shown in Table 9. These results demonstrate our method's effectiveness in addressing both object and style concepts.
Table 8 Quantitative results comparing different defense methods for unlearned models with the "gun" concept erased.
Unlearned
Defense
ASR
FID 1
CLIP 1
Model
Method
w/o defense
56.11
6.595
30.06
SLD Weak
46.78
7.521
29.90
SLD-M Mcdium
28.44
9.624
29.45
ESD
SLD-Strong
22.33
12.510
28.88
SLD-Max
18.11
16.630
28.26
Ours
26.07
7.959
29.66
w/o defense
58.56
5.281
31.03
SI.D-Weak
45.44
6.133
31.02
SLD LeD-Medium
40.11
8.201
30.65
UCE
SLD- LLD-Strong
32.11
10.582
30.12
SLD-Max
21.00
14.223
29.25
Ours
29.85
7.142
30.29
Table 9. Quantitative results comparing different defense methods for unlearned models with the "Van Gogh" concept erased.
Unlearned
Defense Method
ASR +
FID 4
CLIP
Model
w/o defense
11.33
5,612
30.38
SLD-Weak
6.00
6.133
30.37
SI.DMMedium
1.33
7.929
30.03
ESD
SL.-SStrong
0.00
10.971
29.46
SLD-Max
0.00
15.364
28.70
Ours
0.00
6.181
30.16
w/o defense
39.83
2.024
31.11
LLD-Weak
24.50
4.035
30.98
SLD-Medium
1.67
6,569
30.55
UCE
SL.D-Strong
0.00
10.692
29.56
SLD-Max
0.00
17.322
28.30
Ours
0.00
3.843
30.94
14

---

Adaptive Median Smoothing
E.2. Generalization Across T2I Model Variants
We use the UCE unlearned model with' "uudity" removed, keeping do and consistent with version 1.4. Table 10 shows results using four attack methods: 12P, P4D, RAB, and QF-PGD, with average attack success rate (ASR) for robustness and FID and CLIP scores for utillity. Our findings indicate that our method remains effective across different T2I model variants, enhancing the adversarial robustness of unlearned models without significantly affecting their generation capabilities.
Table 10. Comparison of our method and baselines UCE-unlearned models across different SD versions.
SD
Defense
ASR $
FID
CLIP t
Version
Method
w/o defense
28.05
4.354
31.05
RECE
9.02
7.589
30.52
1.5
Blacklist
24.49
4.557
30.94
POSI
20.13
5.243
30.23
Ours
10.65
5,460
30.56
w/o defense
21.52
5,303
31.00
RECE
2.08
11,856
29.33
2.1
Blacklist
14.04
5,511
30.91
POSI
17.77
6.175
30.15
Ours
7.01
6.575
30.66
F. Detailed Discussion
In this section, we provide detailed discussion from three perspectives: multiple concept unlearning, comparative analysis with text encoder fine-tuning methods (AdvUnlearn), and failure cases.
F1. Multiple Concept Unlearning
For this multi-concept setting, compute each token's relevance score by taking the maximum of its similarity with both the nudity concept direction and the violence concept direction. The results are presented in Table 11, where for each concept, the average attack success rate (ASR) is computed across three attack methods (I2P, RAB, and QF-PGD). Our method is effective in concurrently handling multiple concepts. Compared to the single-concept case, the additional computation involves calculating similarities with more concepts and performing a subsequent max operation. However, when the number of concepts is large, the efficiency of our method may be impacted.
Table 11, Performance of our defense method on a multi-coneepp unlcarned model. ASR (Nudity) 1
Defense
ASR (Violence)
FID |
CLIP
1
w/o defense
24.22
36.30
6.181
30.92
Ours
5.26
9.18
6.752
30.31
F.2. Comparative Analysis with AdyUnlearn
We provide an extended comparative analysis between our approach and AdvUnleam (Zhang et al., 2024b), focusing on the following three aspects.
Methodological Differences. AdvUnlearn is a pre-inference method that fine-tunes the text encoder. falls into the category of adversarial erasing-based -based defenses, similar to the RACE (Kim et al., 2024) and RECE (Gong et al., 2024) baselines evaluated in our paper. While AdvUnleam operates in the text-embedding space as our method does, several key differences exist:
Efficiency: AdvUnlearn requires relatively large computational resources for the fine-tuning process, as acknowledged by the authors (Zhang et al., 2024b). In contrast, our approach is training-free and operates at inference time, offering greater efficiency.
Theoretical Guarantees: Unlike UnvUrras''s 's empirical defense, we provide theoretical guarantees through general- ized median smoothing (Theorem 3.2), which could potentially offer new insights to this field.
15

---

Adaptive Median Smoothing
Comparative Performance Evaluation. We implement AdvUnlearn using its official codebase compare it with our method, targeting the concept of "nudity". For approach, we integrate our method with ESD, setting do 0.012 and to 9. We evaluate ad adversarial robustness through four attacks (i.e., I2P, RAB, MMA, and QF-PGD) and calculate the average attack success rate (ASR), while assessing model utility through FID and CLIP scores. The results, presented in Table 12, show that our method achieves adversarial robustness comparable to AnvUnlea.. terms of model utility, AdyUnlearn maintains superior FID metrics (image quality) because it preserves the U-Net weights. However, its CLIP score (image-text alignment) lower due to modifications in the text encoder. Our defense employs adaptive median smoothing without altering text encoder parameters, better preserving image-text alignment capabilities.
Compatibility and Future Work. We find that directly applying method unlearned text encoder presents challenges. Our approach requires calculating each token's s relevance to target concepts, but AdvUnlearn's 's fine-tuning process maps target token representations to benign ones, making it difficult to distinguish between them based on textual representations. This results in inaccurate relevance scores. Currently, our proposed method serves as an effective complement to unlearning approaches that modify U-Net parameters, which constitute the majority of diffusion model unlearning techniques (Gandikota et al., 2023; Kumari et al., 2023; Gandikota et al., 2024). In future work, we plan to explore adaptations our method enhance compatibility with unlearned text encoders.
Table 12. Comparison of AdvUnlearn and defense the "mudity" concept.
Defense
ASR
FID 1
CLIP 1
AdyUnlear
1.39
6.973
29.03
Ours
1.62
7.783
29.80
F.3. Failure Cases
We provide some qualitative results of failure cases in Figure 5. These results show that with the default hyperparameter value of ao (as seen in the second and fifth columns), certain adversarial prompts can still restore the nudity concept. In our implementation, On is fixed for each unlearned model, but there are challenging cases that require a larger do to address effectively. While increasing do can help defend against these prompts, may also degrade model performance with benign inputs. Therefore, is worthwhile explore how dynamically adjust dg based on the input prompt future work.
No
Ours
Ours
No
Ours
Ours
Defense
gg
0.006
T 0.012
Defense
dg 0.006
dg 0.012
Unlearned Model: ESD
No
Ours
Ours
No Defense
Ours
Ours
Defense
dg
0.012
0g 0.016
0.012
dg
0.016
Unlearned Model: UCE
Figure Qualitative results of failure cases. The images illustrate scenarios where adversarial prompts can bypass the default defense settings, partially restoring the unlearned concept (columns & 5). Increasing (columns 3 & 6) improves robustness but may impact benign-generation quality, highlighting a trade-off between robustness and utility.
16


Reviews:
[{"review_id": "BZZPv9oLdp", "reviewer": "Reviewer_9A3r", "summary": "Even after unlearning, models are still vulnerable to adversarial inputs that can expose users to inappropriate contents. Existing adversarial defense methods still have difficulty with balancing the adversarial robustness and the generation quality. To address these issues, the paper proposes an inference-time defense strategy to defend against adversarial text prompts. To do so, the paper formulates the optimization for robustness as a robust regression problem, which is extended to a generalized median smoothing framework incorporating anisotropic noise. Finally, the paper proposes a token-wise Adaptive Median Smoothing strategy that applies noise of intensity that is dynamically adjusted according to the relevance of tokens to target concepts.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Analysis of Vague Adversarial Prompts\n\nThanks for your insightful comment. Our method’s robustness against vague adversarial prompts is validated through evaluations on the **MMA attack** [1], which constructs adversarial prompts avoiding sensitive words while inducing unsafe generations. As shown in Table 1 of our manuscript, our method reduces the attack success rate (ASR) for MMA from $7.50\\\\%$ to $4.23\\\\%$ (ESD model) and from $39.30\\\\%$ to $17.53\\\\%$ (UCE model), demonstrating effectiveness against such vague adversarial prompts. \n\n[1] MMA-Diffusion: MultiModal Attack on Diffusion Models, CVPR 2024.\n\n# Ablation Study of Hyper-Parameters\n\nIn response, we have conducted an ablation study on hyper-parameters using the other unlearned model, **UCE**. The updated results, provided [here](https://anonymous.4open.science/r/Re-ML/tb4.png), indicate that moderately increasing $\\sigma_0$ and $k$ enhances the adversarial robustness of unlearned models without significantly compromising their utility.\n\n# Discussion on Failure Cases\n\nWe have provided qualitative results [here](https://anonymous.4open.science/r/Re-ML/fig5.png). These results reveal that the framework occasionally fails on \"hard cases\" where adversarial prompts bypass default hyper-parameters ($\\sigma_0$), allowing unsafe concept restoration (columns 2 & 5). While increasing $\\sigma_0$ mitigates such cases, it risks degrading benign-generation quality. This highlights a trade-off between robustness and utility under fixed hyper-parameters. Future work will explore dynamic $\\sigma_0$-adjustment based on input prompt to better balance these objectives.\n\n# Clarifying the Use of Prompt Pairs from ViSU\n\nThank you for your valuable feedback. Here is our response:\n\n- **Details on Prompts**: As reported in [2], the authors fine-tuned a large language model (LLM), Llama 2, to generate unsafe sentences from safe ones collected from COCO captions. The training set contains 7,863 prompt pairs for the nudity concept.\n- **ViSU for Baseline Methods**: Most defense baselines in our manuscript do not require *prompt pairs*. Specifically, pre-inference defenses (RACE and RECE) *optimize* adversarial prompts and subsequently erase them. For training-free defenses, SLD uses *inappropriate keywords* to calculate unsafe guidance, while Blacklist uses *NSFW words* for filtering.\n- **Ablation Without ViSU**: To further demonstrate the effectiveness of our proposed method, we implemented \"*nudity*\" unlearning without using prompt pairs from ViSU. Specifically, we first used an uncensored LLM interface on Hugging Face to generate 100 nudity-related prompts (positive prompts) and then used another LLM interface (e.g., Kimi) to transform them into safe versions (i.e., negative prompts). We then used these 100 prompt pairs (denoted as **Self-Gen**) in our experiments, with results shown in the table below (a detailed table with attack success rates for each attack is provided [here](https://anonymous.4open.science/r/Re-ML/tb1.png)). Overall, our method remains effective even with just 100 collected prompt pairs. In the detailed table, we observe that adversarial robustness against vague adversarial prompts (i.e., MMA) degrades, suggesting that collecting more prompt pairs further enhances defense against vague adversarial prompts.\n| Unlearned Model | Defense Methods | ASR $\\downarrow$ | FID $\\downarrow$ | CLIP $\\uparrow$ |\n| --------------- | --------------- | ---------------- | ---------------- | --------------- |\n| ESD             | w/o defense     | 25.42            | 7.161            | 30.18           |\n| ESD             | Ours (ViSU)     | 6.80             | 7.365            | 30.10           |\n| ESD             | Ours (Self-Gen) | 5.33             | 7.436            | 30.09           |\n| UCE             | w/o defense     | 40.34            | 4.379            | 31.02           |\n| UCE             | Ours (ViSU)  | 11.02            | 5.343            | 30.48           |\n| UCE             | Ours (Self-Gen) | 15.93            | 5.526            | 30.54           |\n- **Generalization to Other Concepts**: ViSU primarily contains unsafe prompts (e.g., nudity and violence) and is not suitable for other types of concepts (e.g., objects and styles). For these concept types, we first used an LLM interface to generate 100 positive prompts depicting the target concept, and then instructed the LLM to remove target concept-related elements to create negative prompts. The experimental results for these additional concept types are provided in the `Evaluation Across Object and Style Concepts` section in our response to Reviewer CcZX.\n\n[2] Safe-CLIP: Removing NSFW Concepts from Vision-and-Language Models, ECCV 2024.\n\n# Typos & Grammar Errors\n\nThank you for your careful review. We have corrected the identified typos/grammar errors and will perform a thorough proofread of the entire manuscript to ensure clarity and correctness.", "claims_and_evidence": "Claims are reasonable.", "methods_and_evaluation_criteria": "Yes, I couldn't find any issue.", "theoretical_claims": "Yes, I couldn't find issues.", "experimental_designs_or_analyses": "Yes, the experimental designs and analyses seem sound and valid.", "relation_to_broader_scientific_literature": "Formulating adversarial-robustness of concept erasure as robust regression problem and extending it to a generalized median smoothing framework brings non-trivial contribution and new insights to the field.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Strengths:\n- It’s a reasonable and nice perspective to view adversarial defense as robust regression problem\n- This robust regression perspective allows the proposed method to be robust to adversarial attacks by employing a median smoothing framework.\n- The paper does not stop at just applying a median smoothing framework, but finds the problem with applying it naively to concept erasure framework. Thus, the paper proposes a generalized median smoothing framework with anisotropic noise.\n\n\nWeakness:\n- If relevance score relies on token similarity, I'm guessing that it can be vulnerable to vague adversarial prompts (e.g., prompts that have no nudity-related words but lead to nudity generation). It would be great if the paper shows the analysis on this with various vague adversarial prompts .\n- It seems that hyperparameters need to be finetuned for each baseline model. How robust is the proposed framework to the choice of hyperparameters? It would be great to show this analysis. The ablation study shows the results for only one baseline.\n- To show how robust the proposed framework is to adversarial attacks, the paper could improve with the analysis that shows when the proposed framework fails and succeeds.\n- The paper has a few typos/grammar errors. A thorough proof-reading is recommended.\n- There is no detail on positive & negative prompts. Furthermore, which model has used positive & negative prompt list from ViSU? I think it's unfair to compare against models that did not have access to this list. The paper should provide an ablation study on the proposed method without prompt list from ViSU. Also, the paper should compare against existing methods that employ the list from ViSU. The paper should also use the prompt list to re-train methods that do not employ the prompt list and compare against them as well.", "other_comments_or_suggestions": "Typos/grammar erros\n- line 229: The findings in Theorem 3.2 suggests -> The findings in Theorem 3.2 suggest\n- line 241: we propose a Efficiency -> we propose an Efficiency\n- run-on sentences in line 317-319", "questions_for_authors": "Questions are written in the weakness section.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZfDOlax24h", "reviewer": "Reviewer_CcZX", "summary": "This paper proposes \"Adaptive Median Smoothing\" as an inference-time defense for adversarial attacks on unlearned diffusion models. The defense goal can be formulated as minimizing MSE predicted noise before and after adversarial perturbation. Based on this formulation, the paper then introduces the naive median smoothing method with isotropic noise, analyzing its bound to show the method can theoretically defend against adversarial attacks. The paper then generalizes the analysis to generalized median smoothing with anisotropic noise. However, such an approach is computationally heavy in approximating medians for each timestep. Given these insights, the paper proposes adaptive median smoothing: (1) it computes the relevance score of each token by looking into the text embedding, and adds larger noise to the token embeddings of more relevant tokens; (2) instead of computing medians independently at every timestep, the paper computes medians of token embeddings before the generation and always use this as conditional input to the denoiser. The paper conducts defense experiments on ESD and UCE under different adversarial attacks, focusing on the concept nudity. It compares the ASR, FID, and CLIP with baseline defense methods and shows better balance between adversarial robustness and utility.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Evaluation Across Object and Style Concepts\nWe would like to clarify that our original manuscript includes experiments not only on the concept of nudity but also on **violence**. Following your suggestion, we expanded to include **object** and **style** concepts.\n- For the **object** concept, we targeted \"*gun*\" and used three attack methods (UDA, RAB, QF-PGD) to assess adversarial robustness, reporting the mean attack success rate (ASR). Due to time constraints, we compared only with SLD-Medium and SLD-Max baselines. The results, presented in the table below, show our method achieves a superior balance between robustness and utility.\n| Unlearned Model | Defense     | ASR $\\downarrow$ | FID $\\downarrow$ | CLIP $\\uparrow$ |\n| --------------- | ----------- | ---------------- | ---------------- | --------------- |\n| ESD | w/o defense | 56.11  | 6.595            | 30.06   |\n| ESD | SLD-Medium  | 28.44 | 9.624            | 29.45  |\n| ESD | SLD-Max     | 18.11 | 16.630           | 28.26  |\n| ESD | Ours        | 26.07 | 7.959            | 29.66  |\n| UCE | w/o defense | 58.56 | 5.281    | 31.03           |\n| UCE | SLD-Medium  | 40.11 | 8.201            | 30.65           |\n| UCE | SLD-Max | 21.00 | 14.223           | 29.25           |\n| UCE | Ours        | 29.85 | 7.142            | 30.29           |\n\n- For the **style** concept, we targeted \"*Van Gogh*\" using three attack methods (UDA, RAB, QF-PGD), with results shown in the table below. These results demonstrate the method's effectiveness in addressing style concepts.\n| Unlearned Model | Defense     | ASR $\\downarrow$ | FID $\\downarrow$ | CLIP $\\uparrow$ |\n| --------------- | ----------- | ---------------- | ---------------- | --------------- |\n| ESD | w/o defense | 11.33     | 5.612 | 30.38 |\n| ESD | SLD-Medium  | 1.33    | 7.929 | 30.03 |\n| ESD | SLD-Max     | 0.00     | 15.364  | 28.70 |\n| ESD | Ours        | 0.00       | 6.181   | 30.16  |\n| UCE | w/o defense | 39.83   | 2.024    | 31.11   |\n| UCE | SLD-Medium  | 1.67    | 6.569    | 30.55  |\n| UCE | SLD-Max     | 0.00     | 17.322    | 28.30  |\n| UCE | Ours        | 0.00     | 3.843    | 30.94 |\n\nWe acknowledge the limited baselines for object and style concepts and will include more in our final paper.\n# Clarifying Median Estimation Independence Across Timesteps\nWe want to clarify that the conditional text embeddings at each timestep are **independent** of one another. For *each timestep*, we sample noise from Gaussian distribution and apply adaptive median smoothing to obtain the conditional text embedding. This smoothed text embedding is then input into the U-Net for the current denoising step. Although the computation of the smoothed text embedding occurs at each timestep, it can be performed in parallel, making it more efficient than computing the median U-Net noise prediction, as shown in Table 2 of our manuscript.\n# Theoretical Tightness under Large Perturbation\nThe bound in Equation (2) remains theoretically meaningful even for large adversarial perturbation, as the bound explicitly depends on the interplay between perturbation norm upper bound $\\rho$ and the **noise magnitude** $\\sigma$ used in median smoothing. \n\nAccording to Lemma 3.1, the perturbed output $\\mathcal{E}\\_{0.5}(y+\\delta)$ is bounded by $\\underline{\\mathcal{E}}\\_{\\underline{p}}(y)$ and $\\overline{\\mathcal{E}}_{\\overline{p}}(y)$. Tighter bounds are achieved when $\\underline{p}$ and $\\overline{p}$ are closer to 0.5. The probabilities $\\underline{p}:=\\Phi\\left(-\\frac{\\rho}{\\sigma}\\right)$ and $\\overline{p}:=\\Phi\\left(\\frac{\\rho}{\\sigma}\\right)$ suggest that increasing $\\sigma$ can tighten the bound when $\\rho$ is large. Thus, **theoretically**, the bound remains effective even with large perturbations.\n\nIn **practice**, while $\\rho$ may be large, increasing $\\sigma$ helps maintain adversarial robustness. However, excessive $\\sigma$ may harm the model utility, so it requires careful tuning.\n\n# Reasons Behind Choosing ESD and UCE as Base Unlearned Models\nWe selected ESD and UCE as the base unlearned models for the following reasons:\n\n- **Widely Recognized Baselines**: ESD and UCE are frequently used in the field of unlearning for diffusion models.\n- **Distinct Paradigms**: They represent two primary diffusion unlearning paradigms: ESD is associated with fine-tuning, while UCE pertains to model editing.\n- **Ensuring Fair Comparison**: The adversarial erasing-based baselines, RACE and RECE, are implemented using ESD and UCE, respectively. Therefore, selecting ESD and UCE as the base unlearned models ensures a fair comparison between our method and adversarial erasing-based approaches.\n# Discussion on AdvUnlearn\nWe will cite and discuss AdvUnlearn [1] in our paper. The detailed discussion is provided in our response to Reviewer ZpJv.\n\n[1] Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models, NeurIPS 2024.\n# Notation Section\nThanks for your advice. We will include a notation section in our paper.", "claims_and_evidence": "1. Why the estimation of medians before generation can still be theoretically supported is not clear - the theoretical results seem to assume the medians are estimated separately for every timestep.\n2. The bound of mean squared error requires $\\|\\delta\\|_2<\\rho$, yet the norm upper bound of adversarial perturbation $\\delta$ can be very large. It's not clear how meaningful the bound of the mean squared error in equation (2) is - if it's a loose bound, it can not theoretically support that median smoothing can be used as a defense strategy.", "methods_and_evaluation_criteria": "The method is for defending unlearned diffusion models from adversarial attacks during inference-time. Yet, the benchmark datasets only focus on defending nudity. In machine unlearning, usually, at least three levels of concepts are considered: object, style, NSFW. Since the key problem the paper aims to solve is defending unlearned diffusion models, it is essential to fully demonstrate its effectiveness on these different levels of concepts, instead of only nudity from NSFW.", "theoretical_claims": "I have checked the correctness of proofs, and it overall makes sense following the assumptions.", "experimental_designs_or_analyses": "1. There are concerns about datasets, as stated in the Evaluation Criteria section.\n2. Besides, the paper should discuss why only UCE and ESD are the only chosen unlearned models - is it because they are the most robust and widely used models, or is it for some other reasons?", "relation_to_broader_scientific_literature": "Maybe the paper can inspire later work to consider applying methods inspired from signal processing to the deep learning safety community for a more fundamental and potentially fruitful research.", "essential_references_not_discussed": "[1] Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models. Yimeng Zhang, etc. NeurIPS 2024.\nThs paper comes up with a similar regression formulation in defending adversarial perturbations and maybe cited and discussed.", "other_strengths_and_weaknesses": "Strengths\n1. The paper does stand out with its theoretical analysis on applying median smoothing to defending unlearned diffusion models.\n2. The paper does make an interesting engineering effort to adapt naive median smoothing to a more efficient defending method with good performance on defending nudity.", "other_comments_or_suggestions": "It might be helpful to have a notation section - not a big problem.", "questions_for_authors": "1. Why the estimation of medians before generation can still be theoretically supported? \n2. When assuming $\\|\\delta\\|_2<\\rho$, is it possible that $\\rho$ can be very large and cause the bound of the mean squared error in equation (2) to be a loose bound? How to argue it is a meaningful bound?\n3. Can the method also work well in defending concepts in the category of object and style? \n4. Why only UCE and ESD are the only chosen unlearned models - is it because they are the most robust and widely used models, or is it for some other reasons?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lXnnSbffr7", "reviewer": "Reviewer_ZpJv", "summary": "This paper proposes an inference-time defense method, named Adaptive Median Smoothing, to protect unlearned text-to-image diffusion models against adversarial prompt attacks. Specially, the promposed method reformulates robustness as a regression problem and extends median smoothing by using anisotropic noise. Then, it utilizes token-level adaptive noise to keep the model robust without hurting image generation utility.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful comment regarding the relationship between our method and AdvUnlearn [1]. Our response is elaborated on the following three aspects:\n\n# Methodological Differences\n\nAdvUnlearn [1] is a pre-inference method that fine-tunes the text encoder. It falls into the category of **adversarial erasing-based** defenses, similar to the *RACE* and *RECE* baselines evaluated in our manuscript. While AdvUnlearn operates in the text-embedding space as our method does, several key differences exist:\n\n-  **Efficiency**: AdvUnlearn requires relatively large computational resources for the fine-tuning process, as acknowledged by the authors [1]. In contrast, our approach is training-free and operates at inference time, offering greater efficiency.\n- **Theoretical Guarantees**: Unlike AdvUnlearn’s empirical defense, we provide theoretical guarantees through generalized median smoothing (Theorem 3.2), which could potentially offer new insights to this field.\n\n# Comparative Performance Evaluation\n\nWe implemented AdvUnlearn using its official codebase to compare it with our method, targeting the concept of \"*nudity*\". For our approach, we integrated our method with ESD, setting $\\sigma_0$ to 0.012 and $k$ to 9. We evaluated adversarial robustness through four attacks (i.e., I2P, RAB, MMA, and QF-PGD) and calculated the average attack success rate (ASR), while assessing model utility through FID and CLIP scores. The results are shown in the table below:\n\n| Defense    | ASR $\\downarrow$ | FID $\\downarrow$ | CLIP $\\uparrow$ |\n| ---------- | ---------------- | ---------------- | --------------- |\n| AdvUnlearn | 1.39             | 6.973            | 29.03           |\n| Ours       | 1.62             | 7.783            | 29.80           |\n\nThe results indicate that our method achieves adversarial robustness comparable to AdvUnlearn. In terms of model utility, AdvUnlearn maintains superior FID metrics (image quality) because it preserves the U-Net weights. However, its CLIP score (image-text alignment) is lower due to modifications in the text encoder. Our defense employs adaptive median smoothing without altering text encoder parameters, better preserving **image-text alignment** capabilities.\n\n# Compatibility and Future Work\n\nWe found that directly applying our method to an unlearned text encoder presents challenges. Our approach requires calculating each token's relevance to unsafe concepts, but AdvUnlearn's fine-tuning process maps unsafe token representations to benign ones, making it difficult to distinguish between them based on textual representations. This results in inaccurate relevance scores.\n\nCurrently, our proposed method serves as an effective complement to unlearning approaches that modify *U-Net parameters*, which constitute the **majority** of diffusion model unlearning techniques. In future work, we plan to explore adaptations to our method to enhance compatibility with unlearned text encoders.\n\nWe will incorporate a citation to AdvUnlearn and include the above analysis in our paper.\n\n[1] Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models, NeurIPS 2024.", "claims_and_evidence": "In this paper, authors make five claims about their proposed method\n-  Robustness enhancement is supported by its lower ASR (through different attack methods)\n- Model utility preservation is supported by the results of FID and CLIP score, which assess the image generation quality and text alignment, respectively. \n- Compared with other training-free methods, it utilizes reasonable inference time for a robust defense.\n- Good generalization across different NSFW contents (e.g., nudity, violence).  \n- Supported by Theorem 3.2 and extensive experiments, the claim that the proposed method improve robustness against adversarial prompts while maintaining the model utility generative quality and fast inference.", "methods_and_evaluation_criteria": "The proposed method utilizes a new form of median smoothing with anisotropic noise and adapts noise intensity per token using concept relevance scores.", "theoretical_claims": "Theorem 3.2 provides bounds for robust regression using median smoothing with anisotropic noise.", "experimental_designs_or_analyses": "A SOTA adversarial unlearning[1] is a strong baseline because, unlike ESD and UCE, it fine-tunes the text encoder to achieve effective unlearning and also maintain good model utility, which exist certain resemblances to the proposed method in essence since both are implementing defense in the text embedding space. It is also worth investigating whether the proposed defense can further enhance unlearning performance for unlearned text encoder.\n\n[1] Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models, NeurIPS 2024", "relation_to_broader_scientific_literature": "NA", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "NA", "other_comments_or_suggestions": "NA", "questions_for_authors": "NA", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zNh7GDJVFH", "reviewer": "Reviewer_FnEb", "summary": "This paper seeks to enhance the adversarial robustness of unlearned t2i diffusion models, specifically aiming to balance the adversarial robustness and generative capabilities of the original t2i models. The proposed method, Adaptive Median Smoothing, starts by formulating the target task as a regression problem, and extends it to an anisotropic noise case with median smoothing by introducing a global relevance score for the input prompt.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Generalizability Across T2I Model Variants\nWe evaluated our method on other widely used T2I models, SD 1.5 and SD 2.1, to assess the generalizability of our method. Due to time constraints, we used the UCE unlearned model with \"*nudity*\" removed, keeping $\\sigma_0$ and $k$ consistent with version 1.4. The table below shows results using four attack methods: I2P, P4D, RAB, and QF-PGD, with average attack success rate (ASR) for robustness and FID and CLIP scores for utility.\n| SD Version | Defense | ASR $\\downarrow$ | FID $\\downarrow$ | CLIP $\\uparrow$ |\n| -------- | --------- | ----------- | ----------- | --------------- |\n| 1.5| w/o defense|28.05|4.354|31.05|\n| 1.5|Ours|10.65|5.460|30.56|\n| 2.1|w/o defense|21.52|5.303|31.00|\n| 2.1|Ours|7.01|6.575|30.66|\n\nOur findings indicate that our method remains effective across different T2I model variants, enhancing the adversarial robustness of unlearned models without significantly affecting their generation capabilities. We will expand the analysis to include additional baselines in our paper.\n# Discussion on Failure Cases\nThank you for your insightful feedback. We have provided some qualitative results [here](https://anonymous.4open.science/r/Re-ML/fig5.png). These results show that with the default hyper-parameter value of $\\sigma_0$ (as seen in the second and fifth columns), certain adversarial prompts can still restore the nudity concept. In our implementation, $\\sigma_0$ is fixed for each unlearned model, but there are challenging cases that require a larger $\\sigma_0$ to address effectively. While increasing $\\sigma_0$ can help defend against these prompts, it may also degrade model performance with benign inputs. Therefore, it is worthwhile to explore how to dynamically adjust $\\sigma_0$ based on the input prompt in future work. We will include this discussion in our paper.\n\n# Multiple Concept Unlearning\nThank you for the insightful comment. We conducted a preliminary exploration on the UCE unlearned model with *nudity* and *violence* concepts erased simultaneously. For this multi-concept setting, we computed each token's relevance score by taking the maximum of its similarity with both the nudity concept direction and the violence concept direction. The results are presented in the table below, where for each concept, the average attack success rate (ASR) is computed across three attack methods (I2P, RAB, and QF-PGD).\n| Defense     | ASR $\\downarrow$ (Nudity) | ASR $\\downarrow$ (Violence) | FID $\\downarrow$ | CLIP $\\uparrow$ |\n| ----------- | ------------------------- | ----------------------- | ------------ | ----------- |\n| w/o defense|24.22|36.30|6.181|30.92|\n| Ours|5.26|9.18| 6.752|30.31|\n\nOur method is effective in concurrently handling multiple concepts. Compared to the single-concept case, the additional computation involves calculating similarities with more concepts and performing a subsequent max operation. However, when the number of concepts is large, the efficiency of our method may be affected. We will include this analysis in our paper.\n# Constraints on Adversarial Perturbation\nThe perturbation is constrained within a norm-bounded set $\\\\mathcal{B}$, specifically $\\||\\delta\\||\\_2<\\rho$ in the isotropic case (Lemma 3.1) and $\\||\\delta\\||_{\\Sigma,2}<\\rho\\prime$ in the anisotropic case (Theorem 3.2). If the upper bound of the perturbation norm is large, users can increase noise intensity in median smoothing. A detailed discussion on handling large perturbations is available in the `Theoretical Tightness under Large Perturbation` section of our response to Reviewer CcZX.\n\n# Justification for Considering Intermediate Steps in Formulation\nOur formulation follows the DDPM [1] framework, modeling generation as Markov chains. While we aim to constrain $x_0$, the dependency structure ($x_0$ depends on $x_1$, $x_1$ on $x_2$, and so forth) means perturbations propagate through the entire sequence. The formulation ensures robustness at each step, preventing cascading errors and ultimately safeguarding the final output. Notably, related works, such as [2], also incorporate intermediate steps in their formulations.\n\nIn practical applications, efficient sampling techniques enable us to perform smoothing over a limited number of time steps, often just tens or even fewer, thus maintaining computational efficiency.\n\n[1] Denoising Diffusion Probabilistic Models, NeurIPS 2020.\n\n[2] Ablating Concepts in Text-to-Image Diffusion Models, ICCV 2023.\n\n# Collection of Prompt Pairs\nPositive and negative prompts are sourced from the ViSU dataset, as explained in the Implementation Details (Section 4.1), requiring no additional computation. We also explored generating prompt pairs using a large language model (LLM) interface. More details are in the `Clarifying the Use of Prompt Pairs from ViSU` section of our response to Reviewer 9A3r.\n\n# Additional Comments\nWe will shorten the abstract and number all the equations in our paper. Thanks for your advice.", "claims_and_evidence": "The main claims of the paper are supported by the experimental results and ablation studies.", "methods_and_evaluation_criteria": "The proposed method, with regression formulation for unlearned diffusion models, generally makes sense to the reviewer (with some more specific questions detailed in the Questions below). The evaluation results are reported based on three metrics, including ASR, FID, and CLIPScore, which also makes sense.", "theoretical_claims": "The main theoretical claim is Theorem 3.2 in P4, which is just a special variant of Lemma 1 under the constraint of non-isotropic Gaussian noise, the reviewer checked the proof and did not find evident flaws.", "experimental_designs_or_analyses": "The current experimental designs and analyses are in general reasonable, with several questions specified below.", "relation_to_broader_scientific_literature": "The reviewer finds that the references and related literature in the paper are generally well discussed, helping the reader understand the key contributions proposed in this work.", "essential_references_not_discussed": "The paper has a relative good reference discussion on related works in the problem of adversarial robustness of unlearned models.", "other_strengths_and_weaknesses": "S1: The paper is well-structured with a clear logical flow, making it easy to follow.\n\nS2: The problem and task are relatively well-defined and appear reasonable.\n\nW1: This work focuses on a highly specific scenario—adversarial robustness for unlearned T2I diffusion models—with experiments conducted only on SD 1.4. It remains unclear how well the proposed method generalizes to other T2I model variants and how its performance is affected by the underlying unlearned base models.\n\nW2: The experiments primarily evaluate two concepts: nudity and violence. While I am not explicitly requesting additional experiments, I would appreciate a discussion on specific failure cases to better understand the limitations of the approach.\n\nW3: Certain aspects of the formulation and implementation details remain unclear—please see my questions section for further clarification.", "other_comments_or_suggestions": "- The abstract is a bit too long, maybe the authors may consider shortening it for better readability.\n\n- The reviewer believes it will be interesting to investigate a bit further the combination of different unlearned concepts, as those concepts may present correlations among them and impact the performance of the proposed method.\n\n- Maybe also consider numbering all the equations as it is difficult to refer to while some are numbered and others are not.", "questions_for_authors": "Q1: In the regression formulation, are there any constraints on the expected perturbation $\\delta$? Specifically, could the perturbation become too large, such that $y+\\delta$ falls into a distribution different from  $p*(x_{(0,...,T)|\\mathcal{T}(y)})$ ?\n\nQ2: Why does the formulation consider all intermediate steps in the regression process? Intuitively, wouldn’t it make more sense to focus only on step 0 in theory? Moreover, in implementation, many prior works suggest that the full sequence is not necessary for T2I generation.\n\nQ3: Regarding relevance score computation, the paper mentions the need to collect pairs of positive and negative prompts. How are these pairs collected and constructed, and what is the computational cost associated with this step?\n\nQ4: Do the authors have any insights on failure cases? Additionally, how might the method be impacted if multiple concepts were unlearned in a single base T2I model?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper presents a defense method against adversarial inputs for unlearned text-to-image diffusion models. The main idea is based on median smoothing, which adaptively adds noise to tokens based on the relevance score of the target concepts. The paper provides theoratical analysis from a regression perspective and the experiments that outperforms several earlier methods.

Reviewers generally agree that the paper is clear (FnEb, ZpJv), and that the idea is well-motivated (9A3r, FnEb) and novel for unlearning (9A3r, CzZX, ZpJv). However, they also pointed out some issues, such as the defense method only addressing specific cases like nudity and violence (CzZX), limited evaluation on unlearned T2I models (CzZX, FnEb), missing baseline (ZpJv), and unclear implementation details (9A3r, CzZX, FnEb).

After the rebuttal stage, most concerns have been dealt with by the additional results and clarifications. Although one reviewer did not respond after the rebuttal, potentially due to time conflict, most reviewers lean toward accepting the paper. The AC has read both the reviewers' comments and the authors' responses. AC feels the rebuttal has sufficiently addressed the concerns and recommends accepting the paper and also suggests that the authors include the extra discussion and results in the final version.
Decision: Accept (poster)