Boosting Alignment for Post-Unlearning Text-to-Image Generative Models
Authors: Myeongseob Ko
Henry Li
Zhun Wang
Jonathan Patsenker
Jiachen T. Wang
Qinbin Li
Ming Jin
Dawn Song
Ruoxi Jia
Venue: NeurIPS 2024 poster (2024)
Keywords: unlearning
diffusion models
stable diffusion
Primary area: diffusion_based_models

Abstract: Large-scale generative models have shown impressive image-generation capabilities, propelled by massive data. However, this often inadvertently leads to the generation of harmful or inappropriate content and raises copyright concerns. Driven by these concerns, machine unlearning has become crucial to effectively purge undesirable knowledge from models. While existing literature has studied various unlearning techniques, these often suffer from either poor unlearning quality or degradation in text-image alignment after unlearning, due to the competitive nature of these objectives. To address these challenges, we propose a framework that seeks an optimal model update at each unlearning iteration, ensuring monotonic improvement on both objectives. We further derive the characterization of such an update.
  In addition, we design procedures to strategically diversify the unlearning and remaining datasets to boost performance improvement. Our evaluation demonstrates that our method effectively removes target classes from recent diffusion-based generative models and concepts from stable diffusion models while maintaining close alignment with the models' original trained states, thus outperforming state-of-the-art baselines.

Boosting Alignment for Post-Unlearning Text-to-lmage Generative Models
Myeongseob Ko*
Henry Li Yale University henry .1 @yale. edu
Zhun Wang
Virginia Tech
University of California, Berkeley zhun. whun.wangdeerkeley edu
myeongseob@vt.co edu
Jonathan Patsenker
Jiachen T. Wang
Yale University
Princeton University
j jnathan pat.hamraapttteeeee@yyll. edu
tiantoowaggpriincttom.cc
Qinbin Li
Ming Jin
Dawn Song
University of California, Berkeley liginbin1998@mmai.ccc com
Virginia Tech
University of Californa,, Berkeley
inmingovt.edu
davnsong@berkeleyy edu
Ruoxi Jia Virginia Tech ruoxijia@vt.ed edu
Abstract
Large-scale generative models have shown impressive image-generation capabili- ties, propelled by massive data. However, this often inadvertently leads to the gen- eration of harmful or inappropriate content and raises copyright concerns. Driven by these concerns, machine unlearning has become crucial to effectively purge undesirable knowledge from models. While existing literature has studied various unlearning techniques, these often suffer from either poor unlearning quality or degradation in text-image alignment after unlearning, due to the competitive nature these objectives. To address these challenges, we propose a framework that seeks optimal model update at each unlearning iteration, ensuring monotonic improve- ment on both objectives. We further derive the characterization of such an update. In addition, design procedures to strategically diversify the unlearning and maining datasets to boost performance improvement. Our evaluation demonstrates that our method effectively removes target classes from recent diffusion-baas generative models and concepts from stable diffusion models while maintaining close alignment with the models' original trained states, thus outperforming state- of-the-art baselines. Our code will be made available at wuthtpp::/// thub. com/ relis-Jab/Restrricceeee..g Restrriceed.gradientt.. siveeettddiveitteeeeeeee www.rrriinttnllannnnnnmm.mm git
reds-lab
Introduction
Large-scale text-to-image generative models have recently gained considerable attention for their impressive image-generation capabilities. Despite being at the height of their popularity, these models, trained on vast amounts public data, inevitably face concerns related harmful content generation (Heng and Soh 2024 and copyright infringement (Zhang et al. 2023b Although
'Equal contributions
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Post -Unlearning
Concept
Condition
SD (Before)
Salun
ESD
RGD (Ours)
A anxious person standing at quiet beach as the sun rises.
Nudity
Alignment Score
0.352
0.305
0.329
0.350
A dog sitting in a field in the style of Monet.
Van Gogh
Alignment Score
0.348
0.280
0.330
0.352
Figure 1: Generated images using SalUn (Fan al. 2023 ESD [Gandikota al. 2023 and Ours
after unlearning given the condition. Each row indicates different unlearning tasks: nudity removal, and Van Gogh style removal. Generated images from approach and SD [Rombach et al. [022]
well-aligned with the prompt, whereas SalUn and ESD fail to generate semantically correct images given the condition. On average, across 100 different prompts, SalUn shows the lowest clip alignment scores (0.305 for nudity removal and 0.280 for Van Gogh style removal), followed by ESD (0.329 and 0.330, respectively). Our approach achieves scores of 0.350 and 0.352 for these tasks, closely matching the original SD scores of 0.352 and 0.348.
exact machine unlearning -ettaminng-etraiinnng the model by excluding target data is direct solution, its computational challenge has driven continued research on approximate machine unlearning.
To address this challenge, recent studies Fan et al. 2023 Gandikota et al., 2023 Heng and Soh 2024 have introduced approximate unlearning techniques aimed at boosting efficiency while preserving effectiveness. These approaches have successfully demonstrated the ability to remove target concepts while maintaining the model's general image generation capabilities, with generation quality assessed using the Fréchet Inception Distance. However, these studies generally overlook the impact of unlearning on image-text alignment, which pertains the semantic accuracy between generated images and their text descriptions [Lee et al. (2024). While pretrained generative models generally demonstrate high alignment scores, our study reveals a critical gap: state-of-the-aa unlearning techniques fall short in achieving comparable text-image alignment scores after unlearning, as illustrated in Figure This could lead to potentially problematic behaviors in real-world deployments, necessitating further investigation.
We attribute the failure of existing techniques to maintain text-image aligmment two primary factors. Firstly, the unlcarning objective often conflicts with the goal of maintaining low loss on the retained data, illustrating the competitive nature these two objectives. Traditionally, approaches to optimizing these objectives have simply aggregated the gradients from both; however, this method of updating the model typically advances one objective the expense of the other. Hence, while these approaches may successfully remove target concepts, they often compromise text-image alignment for retained concepts the process. Secondly, current methods employ simplistic approach to constructing dataset for loss minimization on retained concepts. For example, in Fan al. [2023), this dataset composed images generated from single prompt associated with the concept to be removed. This lack of diversity in the dataset might lead to overfitting, which in turn hampers the text-image alignment.
To address these issues, we propose a principled framework designed to optimally balance the objectives of unlearning the target data and maintaining performance on the remaining data each update iteration. Specifically, we introduce the concept of the restricted gradient, which allows for the optimization of both objectives while ensuring monotonic improvement in each objective. Furthermore, we have developed deliberate procedure to enhance data diversity, preventing the model from overfitting to the limited samples in the remaining dataset. the best of our knowledge, the strategic design of the forgetting target and remaining sets has not been extensively explored in the existing machine unlearning literature. our evaluation, we demonstrate the improvement in both forgetting quality and alignment on the remaining data, compared to baselines. For example,

---

evaluation in nudity removal demonstrates that our method effectively reduces the number of detected body parts to zero, compared 598 with the baseline stable diffusion (SD) [Rombach al. [022]. 48 with erased stable diffusion (ESD-u), and 3 with saliency map-based unlearning (SalUn) [Fan jt al, 2023]. Particularly, while achieving this effective erasing performance, our method reduces the alignment gap to SD by 1 1x compared to ESD-u and by 20x compared to SalUn on the retained test set.
Related Work
2.1 Machine Unlearning
Machine unlearning has primarily been propelled by the "Right to be Forgotten" (RTBF), which upholds the right of users request the deletion of their data. Given that large-scale models are often trained on web-scraped public data, this becomes critical consideration for model developers to avoid the need for retraining models with each individual request. addition to RTBF, recent concerns related to copyrights and harmful content generation further underscore the necessity and importance of in-depth research in machine unlearning. The principal challenge in this field lies in effectively erasing the target concept from pre-trained models while maintaining performance on other data. Recent studies have explored various approaches to unlearning, including the exact unlearning method [Bourtoule et al. [202T] and approximate methods such as using negative gradients. fine-tuning without the forget data, editing the entire parameter space of the model [Golatkar et al.
2020]. To encourage the targeted impact in the parameter space, [Golatkar al.) 2020 Foster ct al. 2024] proposed leveraging the Fisher information matrix, and [Fan et al.) [023] leveraged
gradient- based weight saliency map identify erucial neurons, thus minimizing the impact
remaining neurons. Furthermore, data-influeenee based debiasing and unlearning have also been
proposed [Chen et al. [0224] Bae et al.] 22023. Another line of work leverages mathematical tools in differential privacy [Guo et al. al.] 2019 Chien et al. 2024] to ensure that the model's 's behavior remains indistinguishable between the retrained and unlearned models.
2.2 Machine Unlearning in Diffusion Models
Recent advancements in text-conditioned generative models (Ho and Salimans 2022 Rombach et al. 2022), trained on extensive web-scraped datasets like LATON-5B [Schuhmann al. [0022]
have raised significant concerns about the generation of harmful content and copyright violations. A
series of studies have addressed the challenge of machine unlearning in diffusion models [Heng and
Soh 2024 Gandikota et al., [2023] Zhang et al.) 2023a| Fan et al. 2023]. One approach [Heng and Soh 2024 interprets machine unlearning as a continual learning problem. showing effective removal ts in classification tasks by employing Bayesian approaches to continual learning (Kirkpatrick
ct al. 2017 J. which enhance unlearning quality while maintaining model performance using generative reply Shiin et al.) 2017]. However, this approach falls short in removing concepts such as nudity compared other methods [Gandikota et al., 2023]. Another proposed method [Gandikota et al.. 2023] guides the pre-trained model toward a prior distribution for the targeted concept but struggles to preserve performance. The most recent work [Fan al., [0233 proposes selectively damaging neurons based on a saliency map and random labeling techniques, although this method tends to overlook the quality of the remaining set, focusing on improving the forgetting quality, which does not fully address the primary challenges in the machine unlearning community. Although [Bac et al.) 2023) presents a similar multi-task learning framework for variational autoencoders, their work does not show the optimality of their solution, and their experiments mainly focus on small-scale models, due to the computational expense associated with influence functions.
3 Our Approach
We study the efficacy of our approach in unlearning by removing target classes from class-conditional diffusion models or eliminating specific concepts from text-to-imapp models while maintaining their general generation capabilities. We will call the set of data points to removed as the forgetting datuset. To set up the notations, let D denote the training set and Dj C D be the forgetting dataset. We will use D, = D'D Dy to denote the remaining dataset. Our approach only assumes access to some representative points for D and D,.. As discussed later, depending on specific applications, these data
3

---

points can be either directly sampled from Dj and D, or generated based on the high-level concept of D, to be removed. With slight abuse of notation, we will use D, and D, to also denote the actual representative samples used to operationalize our proposed approach. Furthermore, we denote the model parameter by 0. Let be a proper learning loss function. The loss of remaining data and that of forgeting data are represented by (0) == LEED, 1(0, 2) and f. (0) -> 1(0, 2). respectively. where À is weight adjusting the importance of forgetting loss relative to the remaining data loss. We term L, and Ly remaining loss and forgetting loss, respectively. We note that in the context of diffusion models, loss function I is defined as I Er, [ - 1= where Tt is a noisy version of z generated by adding Gaussian noise to the clean image xo ~ Paata (1) at time step & with noise scheduler, and eg( 1) is the model's s estimate of the added noise at time t [Xu et al., 2023, Ho et al.) 2020). For text-to-image generative models, the loss function I is specified as [ E, ,,,,,, []le
Eg(gt, t, tn))) n)]] where qu is an encoded latent qu {(ro) with encoder ε, and qt is noisy latent at time step f. The noise prediction 6o co I, v)) is conditioned on the timestep and a text 17.
Optimizing the Update. Similar to existing work Fan et al. 2023 our objective is to find an unlearned model with parameters Bu, starting from pre-traiees model with weights 0g. such that the model forgets the target concepts in Dy while maintaining its utility on the remaining dataset Dy. Formally, we aim to maximize the forget error on D,. represented by ()),), while minimizing the retain error on D, represented by (r)) This can be formulated as ming L. (0) + (0), where simple approach to
our approach applies iterative updates to achieve both goals simultancously. optimize this objective, often adopted by existing work, is to calculate the gradient (0) V (0) and use it to update the model parameters at each iteration. However, empirically, we observe that the two gradients usually conflict with each other, i.e., the decrease of one objective is at the cost of increasing the other; therefore, in practice, this approach yields a significant tradeoff between forgetting strength and model utility the remaining data. In this work, aim to present principled approach to designing the update direction at each iteration that more effectively handles the tradeoff' between forgetting strength and model utility on the remaining data. Our key idea is to identify a direction that achieves a monotonic decrease of both objectives.
To describe our algorithm, we briefly review the directional derivative.
Definition (Directional Derivative). The directional derivative (Spivak 2006] of a function at x in the direction of v is written as
lim f(x + lwv)
Dxf(x)=
h-00
h
This special form of the derivative has the useful property that its maximizer can be related to the gradient V (x), which we formally state below.
Theorem 2 (Directional derivative maximizer is the gradient). Let f be a function Then the maximum value of the directional derivative of at x is [Vf(x)) the E norm of its gradient. Moreover, the direction is the gradient itself, i.e.,
arg arg max D.f Vf(x).
(2)
In unlearning, we are specifically interested in the gradient of two losses, the forgetting loss L, and the remaining loss L,. Moreover, we seek gradient directions that simultancously improve on both. This motivates the restricted gradient, which we define below.
Definition 3 (Restricted gradient, local form for minimization). The negative restricted gradient of two losses Las Lgg is any direction v at f satisfying
min (Ca (0) s.t. (vL S 0. D.Ls(O) S 0.
Intuitively, with the restricted gradient we seek define the ideal direction for unlearning. We would like to optimize the joint loss L = L, + Ls subject to the condition that at every parameter update step, L, and Ly experience monotonic improvement. This is precisely the step prescribed by the negative restricted gradient. Since the learning rates used to fine-tune the parameters in the unlearning process are rypically quite small, we can approximate the updated loss at each iteration via a simple first-order Taylor expansion. In this case, the restricted gradient takes simple form.

---

Theorem 4 (Characterizing the restricted gradient under linear approximation). Given B. suppose that C, (0 + 6) (0) = V,, and ( + 6) (() 8 y. The restricted gradient can be writlen
arg min Dv(C, 67 6,
(3)
where
VL, VL, VLr, 8, VL,- Vhy VLr FL ||
(4)
||
when we have conflicting unconstrained gradient terms, i.e. VLy. VC, <0.
The theorem presented demonstrates that the restricted gradient is determined by aggregating the modifications from V VLy and C,, This modification process in- volves projecting VL, onto the normal vector of V,,, yielding 87. and similarly projecting VL, onto the normal vector VLy, resulting in 57. The optimal update, as derived in Theorem 4 is illustrated in Figure 2 Notably, when VL, and VL, have equal norms, the restricted gradient matches the direct summation of the two original gradients, namely. VC,- + V However, is more common for the norm of one gradient to dominate the other, in which case the restricted gradient provides a more balanced update compared to direct aggregation.
Vle
vl
8j
VL + VLr
87 87
87
VLr
VLy
(a) Direct aggregate
(b) Restricted gradient
Figure Visualization of the update. We show the up- date direction (gray) obtained by (a) directly summing up the two gradients and (b) our restricted gradient.
We wish to highlight intriguing link between the gradient aggregation mechanism presented in Theorem 4 and an existing method to address gradient confficts across different tasks in multi-task learning. This restricted gradient coincides exactly with the gradient surgery procedure introduced in Yu et al. (2020). While their original paper presented the procedure from an intuûtive perspective, work offers alternative viewpoint and rigorously characterizes the objective function that the gradient surgery procedure optimizes.
Remark 1.
Diversify D,.. Since D \ Dy is usually of enormous scale, it is infeasible incorporate all of them into the remaining dataset D, for running the optimization. In practice, one can only sample a subset of points from D,.. In our experiments, maintaining the model performance on the remaining dataset, as seen in Section 4.2 Therefore, we propose procedures for forming a diverse D,.. For models with finite set of class labels, such as diffusion models trained on CIFAR-10, we adopt a simple procedure of maintaining an equal number of samples for each class in D,.. Our ablation studies in Section 4.4 show that this is more effective in maintaining model performance on the remaining dataset than more sophisticated procedures, such as selecting the most similar examples to the forgetting samples. The intuitive reason is that reminding the model of as many fragments as possible related to the remaining set during each forgetting step is crucial. By doing so, it leads to finding a representative restricted descent direction, which helps the model to precisely erase the forget data while maintaining a state comparable to the original model. When the text input is unconstrained, such as in the stable diffusion model setting, strategically design diverse information, we propose the following procedure to generate D, based on the concept to be forgotten, denoted by c. Using large language model (LLM), we first generate diverse text prompts related to concept yielding prompt set V These prompts are then modified by removing all references to e, creating a parallel set ) By passing both V, and y through the target diffusion model, we obtain corresponding image sets X. and X. This process allows us to construct our final datasets: Dy = {(xx,)) y) x E Xx: y E Vv)) and D, = ((x,y) x E X, y E )).. Example prompts and detailed descriptions are provided in Appendix D
find that the diversity of D, plays an important role in
5

---

4 Experiment
In this study, we address the crucial challenge of preventing undesirable outputs in text-to-image generative models. We begin by examining class-we wise forgetting with CIFAR- 10 diffusion- based generative models, where we demonstrate our method's ability to selectively prevent the generation of specific class images (Section 4.2). We then explore the effectiveness of our approach in removing nudity and art styles (Section 4.3) to address real-world concerns of harmful content generation and
copyright infringement. We further study the impact of data diversity (Section 4.4) as well as the
sensitivity of our method to hyperparameter settings (Section 4.4)
4.1 Experiment Setup
For our CIFAR-I0 10 experiments, we leverage the EDM framework [Karras et al. 2022 which intro- duces some modeling improvements including a nonlinear sampling schedule, direct Xp-prediction, and second-order Heun solver, achieving the state-of-the-an FID on CIFAR-10. For stable diffusion, we utilize the pre-trained Stable Diffusion version 1.4, following prior works. Both implementations require two key hyperparameters: the weight À of the gradient descent direction relative to the ascent direction, and the loss truncation value a, which prevents unbounded loss maximization during unlearning. Detailed hyperparameter configurations are provided in Appendix C For dataset construction, we used all samples in each class for the CIFAR- 10 forgetting dataset and 800 samples for Stable Diffusion experiments. Considering the practical constraints of accessing complete datasets in real-world scenarios, we construct the remaining dataset D, by sampling 1 1% of data from each retained class, yielding total of 450 samples for CIFAR- 10 (50 from each of the 9 non-targe classes) and 800 samples for Stable Diffusion.
As our baselines for CIFAR-10 10 experiments, we consider Finetune Warnecke et al. 2021 gradient ascent and descent, referred to as GradDiff, and SalUn [Fan et al. 2023]. For concept removal, our baselines include the pretrained diffusion model SD [Rombach et al. 2022] erased stable diffusion ESD [Gandikota et al., 2023], and SalUn [Fan et al. 2023]. To fairly compare, We further consider the variants of ESD, depending on the unlearning task. We note that we do not consider the baseline by (Heng and Soh. [024] due to its demonstrated limited performance in nudity removal, compared to ESD. Our approach is referred to as RG when applied only with the restricted gradient, and RGD when data diversity is incorporated.
We evaluate our approach using multiple metrics to assess both forgetting ef- fectiveness and model util- ity. For CIFAR-10 exper- iments, we measure: 1) unlcarning accuracy (UA), calculated as 1-accuracy of the target class, 2) remain- ing accuracy (RA), which quantifies the accuracy on non-target classes, and 3) Fréchet Inception Distance (FID). We observed that standard CIFAR-10 classi- fiers demonstrate inherent bias when evaluating gen- erated samples from un- learned classes, predomi-
Table I: Quantitative evaluation of unlearning methods on CIFAR-10 diffusion-based generative models. Each method was evaluated by sequentially targeting each of the 10 CIFAR-10 classes for unlearning. For each target class, we measure unlearning accuracy (UA) specific to that class, remaining accuracy (RA) on the other 9 classes, and FID for generation quality. The reported values are averaged across all 10
class-specific unlearning experiments.
Class-wite Forgetting
Unlearning Method
UA+ 1
RA f
FID 1
Finetune SalUn GradDiff
0.21 10.126 126
0.791
4.252.10.482
0.512.0.173
0.434_1..05
14.40
1.000 10.000
0.734
14.09_12.a1
RG (Ours)
1.000 10.000
0.752
9.813 1.886
RGD (Ours)
1.000 10.000
0..71
6.539 10.994
nantly assigning these noise-like images to a particular class among the ten categories limitation arising from their training exclusively on clean class samples. We thus leveraged a CLIP-based zero-shot classifier, implementing text prompts "a photo of a class" for the original ten classes and adding "random noise" as an additional category, enabling a more reliable assessment of unlearning effectiveness. We generate 50K images for FID calculation. For concept removal in Stable Diffusion, we assess forgetting effectiveness using Nudenet [Bedapudi] 2019], which detects exposed body parts in generated images prompted by I2P (Schramowski et al. 2023 After filtering prompts with

---

non-zero nudity ratios, we obtain 853 evaluation prompts from an initial set of 4,703. To evalu- the retained performance, following (Lee al. 2024 we measure semantic correctness using CLIP (Cherti et al. 2023 alignment scores (AS) between prompts and their generated images. We evaluate model performance on both training prompts (mmii used during unlearning and separate set of held-out test prompts (Dr,test). These two distinct sets are constructed by carefully splitting semantic dimensions (c.g., activities, environments, moods). Detailed construction procedures for both sets are provided in Appendix D
4.2 Target Class Removal from Diffusson Models
We present the CIFAR-10 experiment results in Table 1 To fairly compare, we use the same remaining dataset for other baselines. Our finding first indicates that while Finetune achieves superior performance on retained data (highest RA and FID scores), it struggles to effectively unlearn target classes with this limited remaining dataset. Although increasing the number of fine-tuning iterations might improve unlearning accuracy through catastrophic forgetting, this approach would incur additional computational costs. Secondly, we observe that SalUn has low RA, compared to other baselines even with their comparable FID performance. We posit that random labeling introduces confusion in the feature space, negatively impacting the accurate generation of classes and resulting in degraded classification performance. Moreover, it might be challenging to expect the saliency map to select only the neurons related to specific classes or concepts, given the limitations of gradient ascent for computing the saliency map in diffusion models.
The Impact of Restricted Gradient and Data Diversity Our observations are follows. 1) RG outperforms Gradiff and Salun by decreasing FID and increasing RA while maintaining the best UA performance. 2) RGD shows improvements conjunction with the restricted gradient, further enhances performance in terms of RA and FID. We vary the hyperparameters and provide the results in section 4.4
RG, suggesting that data diversification, in
4.3 Target Concept Removal from Diffusion Models
Target concept removal has been a primary focus in diffusion model unlearning literature, driven by the need to mitigate undesirable content generation. While existing methods have shown potential for removing nudity or art styles, our study reveals that they often compromise model alignment after unlcarning.
Nudity Removal. We summarize our results in Figure and Table We observe that Salun tends generate samples that are overfit the remaining dataset. Although Salun shows promising performance in nudity removal-detectinn shown in -ithr this success comes at the cost of output diversity. In particular, SalUn often generates semantically similar images (e.g.. men, wall backgrounds) for both forgetting concepts (Figure and remaining data (Figure D]. Table quantitativelly validates this observation, revealing SalUn's lowest alignment scores post-unlcarning. These results suggest that SalUn's 's forgetting performance could stem from overfitting, This limitation may arise from two factors: the selected neurons potentially affecting both target and non-target concepts, and the limited diversity in their forget and remaining datasets. In the case of ESD, the resulting model often fails remove the nudity concept from unleamed models, as shown in Figure We also evaluate ESD-u and observe that the nudity removal performance between ESD and ESD-u are quite similar although it achieves better AS than SalUn. They suggest using "nudity" as prompt for unlearning, but it might be difficult to reflect the entire semantic space related to the concept of "nudity," given that we can describe nudity in many different ways using paraphrasing.
fewer exposed body parts compared to SD and ESD-u,
7

---

Prompt
Condition
SD
ESD
RGD (Duns)
Female gerizaia
RCD
GrodDiID
"p ghaai sportioe pack hyper mollose testred cclyy on phoiography"
Buftnets
150
"photto shat olled pry. mesollr gent with passng
Male brewst
12P
Body parts
hot handionne skantess 20 year run and
I2P
Male
"Arrllnnchtee raal perser pointing othen
Armpis
100
P/
brewst
"A dositunkeeed bare peower pointing deaettcculyy
200 250
images.
Figure 4: The nudity detection results by Nudenet, following prior works
Inpplig coaltip stoondight"
[Fan al. 2023] Gandikota et 2023). The Y-axis shows the exposed body part in the generated images, given the prompt, and the X-axis de- notes the number of images generated by each unlearning method and SD. We exclude bars from the plot the corresponding value is zero.
Figure 3: Generated images using SD, SalUn, ESD-u, and RGD (Ours). Each row indicates generated images with different prompts including nudity-related I2P prompts and samples from Dy. Each column shows the images generated by different unlearning methods.
Table 2: Nudity and artist removal: we calculate the clip alignment score (AS), following Lee et al. 2024 measure the model alignment the remaining set after unlearning. Cells highlighted in green indicate results from our method, while those in red indicate results from the pretrained model.
Nudity Removal
Artist Removal
AS (A)
D Dramin
D Dr
Dyamin
D
SD
0.357
0.352
0.349
0.348
ESD**
0.327 (0.030)
0.329 (0.023)
0.300 (0.049)
0.298 (0.050)
ESD-u"*
0.327 (0.03)
0.329 (0.023)
ESD-x"*
0.333 (0.016)
0.330 (0.018)
SalUn
0.305 (0.052)
0.312 (0.040)
0.279 (0.070)
0.280 (0.068)
GradDiffD (Oure)
0.342 (0.015)
0.348 (0.004)
0.334 (0.015)
0.333 (0.015)
RGD (0urs)
0.354 (0.003)
0.350 (0.002)
0.355 (-0.006)
0.352 (-0.004)
The values in parentheses. A, refer to the gap between the original SD unlearned model with each method.
ESD, ESD-u ESD-x refer training on full parameters, and cross-attention weights, respectively.
weights,
RGD outperforms state-of-the-an baselines in terms of forget quality (i.c., zero detection of exposed body part given I2P prompts described in Figure 4 and retain quality (i.e., high AS presented in Table()), effectively mitigating the trade-off off between the two tasks. To further validate the role of both the restricted gradient and diversification steps to nudity removal, we conduct a two-way ablation study. Removing the restricted grudient step from RGD yields GradDiffD, which incorporates dataset diversity into GradDiff, whereas removing the diversification step yields the previously introduced RGD's superior performance over both GradDif ffD (Table 7 and Figure Q and RG (Table 4 underscores the crucial importance of both steps in proposed unlearning algorithm.

---

Art Style Removal. Similar to nudity removal, the task of eliminating specific art styles presents significant challenge. In order evaluate whether the unlearning methods inadvertently impact other concepts and semantics beyond the targeted art style, prompt the model with other artists' styles (e.g., Monet, Picasso) while targeting to remove Vincent van Gogh's style. The results of generation examples are shown in Figure and Figure(5) and the average alignment scores are shown in Table 2 is observed that SalUn cannot follow the prompt to generate other artists' styles and shows significant drop in alignment scores (AS) compared with the pre-trained SD.
We also train ESD-X by modifying the cross-attention weights, which more suit- able for erasing artist styles than fall-parameter training (shown plain ESD without any suffix) as proposed in ESD work. Although ESD-x performs similarly to RG in terms of alignment scores, after manual inspection of the generated images, find ESD-x sometimes generates images ignoring the style instructions as presented in Figure while RG generates images with lower quality details like noisy backgrounds but adheres well to the style instructions. Consequently, after incorporating gradient surgery to prevent interference between retain and forgot targets, our RGD achieves better image quality and shows the best alignment score, almost equivalent to the performance of the pre-trained SD.
Concept
Condition
SD
Selun
DSDx
RGD (Ours)
A dog sitting in
Van Gogh
Geld in the style of
A cat playing with
Van Gogh
ball painted
Leonarclo da Vinci
Figure 5: Art style removal. Each row represents different prompts used to evaluate the alignment and each column indicates generated images from different unlearning methods.
4.4 Ablation
Ablation in Hyperparam- eters. We examine our method's sensitivity to two key parameters described in Sec- tion 4.1 the retained gradient weight and loss truncation threshold a. Figure[ppresents the variation over different values (y-axis) for given value (x-axis), measuring both remaining accuracy (RA) and generation quality (FID). Analysis reveals that RG consistently outperforms GradDiff in both metrics (i.e. achieving the lower FID, and higher comparable RA with low variation across different a), with RGD showing further improvements. RGD exhibits the lowest variance across different values and achieves the lowest FID and highest RA. RG's consistent improvements over GradDiff validate the restricted gradient approach, while RGD's superior performance underscores the importance of dataset diversity.
150
0.6
100
Method
GradDiff
50
RG
0.2
RGD
0.5
1.0 À
5.0
1.0
5.0
Figure 6: Performance analysis across different hyperparameter settings. Each box plot captures the variation over different a values for given À setting (A E (0.5, 5.0)), measuring both generation quality (FID, left) and remaining accuracy (RA, right). Lower FID indicates better generation quality, while higher RA indicates better model utility of non-target concepts.
Ablation in Diversity. We further investigate the impact of data diversity through controlled ex- periments. For CIFAR-10, we design two scenarios based on feature similarity analysis using CLIP embeddings: Case 1, where D, contains samples from only the two classes most semantically similar to the target class, and Case 2, with balanced sampling across all classes. This design stems from

---

Table 3: Comparison of UA, RA, and FID for diversity experiments in CIFAR- 10 diffusion models. In this context, Case represents a scenario where the remaining set lacks diversity (i.e., only includes samples from two closely related classes), while Case 2 includes equal samples from all classes. We note that we used the same remaining dataset size between both cases.
Unlearning Method
Case
Case
UA+
RA,
FID.
UA+
RA-
FID
UA
RA
FID
GradDiff
1,000#0
0.106+0.086
156.021=31.901
1,000=0
0.201=0.045
95.287+16.279
0.000
+0.095
-60.734
BG (Ours)
1.00040
0.20540.138
131.247446.049
1,00s0
0.463200059
47.79747.231
0.000
+0.258
-83.450
BGD (Ours)
1,00010
0.23920.071
94.259a28.217
1.00000
0.67520.019
10.45641.976
0.000
+0.436
-83.803
hypothesis that unlearning a target class may particularly affect semantically related classes, making their retention critical. We compute class similarities using cosine distance between CLIP feature vectors as described in Figure 7 Table 3 shows that limited diversity (Case 1) significantly impacts model performance, with FID increasing by 83.803 for RGD. This sensitivity to diversity extends to stable diffusion experiments, where we evaluate the impact of uniform dataset construction following SalUn's approach. As shown in Table RG with uniform datasets shows larger performance gap from SD (A = 0.032 in test alignment scores) compared to RGD (A 0.001). These consistent find- ings across both experimental settings underscore the important role of data diversity in maintaining model utility during unlearning.
5
Conclusion
This study advances the understanding of ma- chine unlearning in text-to-image generative models by introducing a principled approach to balance forgetting and remaining objectives. We show that the restricted gradient provides an op- timal update for handling conflicting gradients between these objectives, while strategic data diversification ensures further improvements model utilities. Our comprehensive evaluation demonstrates that our method effectively re- moves diverse target classes from CIFAR-10 10 diffusion models and concepts from stable diffu- sion models while maintaining close alignment with the models' original trained states, outper- forming state-of-the-ar basclines.
Table Comparison of alignment score (AS) be- tween RGD and RG. RG, in this table, indicates the case when we have uniform forgetting and remain- ing datasets but utilize the restricted gradient.
Nudity Removal
AS (A)*
D Dr.rain
D
SD
0.357
0.352
RG
|| 0.330 (0.027)
0.320 (0.032)
RGD
0.354 (0.003) 0.351 (0.001)
The values in parentheses, A, refer to the gap between the original SD and the unlearned model with each method.
5.1 Limitation and Broader Impacts
While our solution introduces computation- efficient retain set generation using LLMs, the strategic sampling of retain sets for stable diffusion models presents intriguing research directions. Specifically, investigating the effectiveness of different sampling strategies- as the impact of data proximity to target distribution and optimal mixing ratios between near and far samples-coue provide valuable insights for unlcarning in stable diffusion models. Although our restricted gradient approach successfully addresses gradient conflicts, developing robust unlearning methods that are less sensitive to hyperparameters remains an important challenge.
6 Acknowledgement
RJ and the ReDS lab acknowledge support through grants from the Amazon- Amazon-Virginia Tech Initiative for Efficient and Robust Machine Learning, and NSF CNS-2424127, and the Cisco Research Award. MJ acknowledges the support from NSF ECCS-2331775. IIS-2312794, and the Commonwealth Cyber Initiative. This research is also supported by Singapore National Research Foundation funding No. 053424, DARPA funding No. 112774-19499, and NSF IIS 2229876.
10

---

References
Scohui Bae, Seoyoon Kim, Hyemin Jung, and Woohyung Lim. Gradient surgery for one-shot unlearning on generative model. arXiv preprint arXiv:2307.04550 2023.
P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019.
Lucas Bourtoule, Varun Chandrasekaran, Christopher Choquette-Choo Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pages 141-159, IEEE, 2021.
Ruizhe Chen, Jianfei Yang, Huimin Xiong, Jianhong Bai, Tianxiang Hu, Jin Hao, Yang Feng, Joey Tianyi Zhou, Jian Wu, and Zuozhu Liu. Fast model debias with machine unlearning. Advances in Neural Information Processing Systems, 36, 2024.
Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-image learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pullern Recognition, pages 2818,889, 2023.
Eli Chien, Haoyu Wang, Ziang Chen, and Pan Li. Langevin unlearning: A new perspective of noisy gradient descent for machine unlearning. arXiv preprint arXiv:2401.10371. 2024.
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-bai baseee weight saliency in both image classification and generation. arXiv preprint arXiv: 23: 10. 12508, 2023.
Jack Foster, Stefan Schoepf, and Alexandra Brintrup. Fast machine unlearning without retraining through selective synaptic dampening. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 12043-12051, 2024.
Rohit Gandikota, Joanna Materzynska, Jaden from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2426 2426-2436, 2023.
and David Bau. Erasing concepts
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9304-9312, 2020.
Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint 1xXiv:9911.03000 2019.
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach forgetting in deep generative models. Advances in Neural Information Processing Systems, 36, 2024.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12590 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6$5 0-010 2020.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. In Proc. NeurIPS, 2022.
James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho. Agnieszka Trabska-Barwingh et al. Overcoming catastrophic forgetting in neural networks. Proceedings of the national academy of sciences, 114 (13):3521-3526, 2017.
Tony Lee, Michihiro Yasunaga, Chenlin Meng, Yifan Mai, Joon Sung Park, Agrim Gupta, Yunzhi Zhang, Deepak Narayanan, Hannah Teufel, Marco Bellagente, et al. Holistic evaluation of text-to-image models. Advances in Neural Information Processing Systems, 36, 2024.
11

---

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 9748-8763. PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pages 10684-10695, 2022.
Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting, Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 22522-22531, 2023.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35:25278-25222 25294,, 2022.
Hanul Shin, Jung Kwon Lee, Jachong Kim, and Jiwon Kim. Continual learning with deep generative replay, Advances in neural information processing systems, 30, 2017.
Michael Spivak. Calculus. Cambridge University Press, 2006.
Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. arXiv preprint arXiv:2 /177, 2021.
Yanwu Xu, Mingming Gong, Shaoan Xie, Wei Wei, Matthias Grundmann, Tingbo Hou, et al. Semi-implicit denoising diffusion models (siddms). arXiv preprint arXiv:2306. 12511, 2023.
Tianhe Yu, Saurabh Kumar, Abhishek Gupta, Sergey Levine, Karol Hausman, and Chelsea Finn. Gradient surgery for multi-task learning. Advances in Neural Information Processing Systems, 33: 5824-5836, 2020.
Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. arXiv preprint arXiv:2303.1759/ 2023a.
Yang Zhang, Teoh Tze Tzun, Lim Wei Hern, Haonan Wang, and Kenji Kawaguchi. On copyright risks of text-to-image diffusion models. arXiv preprint arXiv:2311. 122000, 2023b.
12

---

Appendices
A Proof of Theorem 4
14
A.1 Lemma and Proofs
14
B Preliminaries
16
B.1 Denoising Diffusion Probabilistic Models
16
B.2 Latent Diffusion Models
16
C Implementation Details
16
C.1 Class Conditional Diffusion Models
16
C.2 Stable Diffusion Models
16
D Dataset Diversification Details
17
D.1 Nudity Removal
17
D.2 Artist Removal
18
Additional Results
18
E.1
Generalization Different Pretrained Models
18
E.2 Impact of Different Sizes in Dy and D,
19
E.3 Class-wise Feature Similarity
19
E.4
Qualitative Results
20
13

---

A Proof of Theorem
To prove this theorem, establish the following lemma. We notate the l norm || throughout. Lemma 5 (Projected gradients obtain optimal solution to a constrained objective). Let ()( and C, (0) be K -LLisschitz smooth negative forget and retain losses under the la norm respectively, Then, the update 07 = v TV2,
VL, V,, is the minimizer of
arg min L + +.)) s.t. 2,(0) 2 C,
(5)
||6
VLy.Ve. V y is the minimizer of
in terms ō.. Similarly, 8 = VL, 1V2
arg min L0 + 6,) s.1. ( 2 L, 0 + 6,), ||,|| =n
(6)
in terms of 8j. for value n < R when have conflicting unconstrained gradient terms, i.e. VL, VC, < O.
Proof of Lemma 5 due to the Lipschitz condition on Ly. C,.. Therefore, we have,
For 8r, dy. both of norm 7), we have good approximation by the Taylor expansion
(0 + 5,) - (0) ~ 6, VC, C, 5ÿ) L)(0) 6, VL
1, + 6,) - (,) = 6, VL,
(0 5y) (0) = by VC,
We re-express the two objectives as,
arg min 85 VLf og VL, <0 |
arg min 8p VC,, s.t. 8, VL, < ||
(8)
By the method of Langrangian multipliers, for each objective we create slack variables Ay, A., and obtain the unconstrained objectives,
arg min ōy V 2gō5 VL, arg min by (VL, + ,,V
|
[
arg min 5, VL, + X, VL, arg min 8, (VL, + X,,z) ||6.1|=1
1|5.1|=n
We first observe since both are now linear objective, that the minima is trivially observed when 07 (VVL, + VL,), and 87 x (VL, + A, VLy). For the rest of this proof, without loss of generality, suppose is scaled such that we hold the previous proportionality statements as equalities.
We invoke KKT sufficiency conditions to both confirm if these minima exist, and obtain solutions the slack variables. In the case conflicting gradients, since VL, VL, < O, the minimizers of the unconstrained objectives in Equations 7 are not satisfied within the constraints. Therefore, 'y and X, do not vanish, and are maximizers of their respective objectives. Taking the gradients in respect to the slack variables and setting to O, have
Vxy (6) (VC,+ Vx, (0) (VC, VL,)) x, (0) 67) -VL, 8 =
- (87- -VL, 87 -0
We can solve this in a way that satisfies the objective by requiring d be orthogonal to VLy, and 0j to be orthogonal to V C. In this case, have X5 VV, and X |V2, the optima. IVC.112
vc,.Ve.
We verify that these are maximizers by computing the second derivatives, which are constants at - 122 and 2 1 respectively. Both are strictly negative, confirming the second order sufficient condition for maximizer.
Therefore it is precisely the restricted gradient steps, 87
VC,
VL.vE. [V.
VL, and 6 VL,
VL,.VC. VLy, which solve the optimization problems in Equations 6 respectively.
IV2,
14

---

We take the Taylor expansions in respect to v of 2, and C, around 6. We have mutatis mutandis for some I.,
Proof of Theorem 4
1 + lv) (V2,))
It follows that, for v, w, such that VL,(0) -0
Cj + hv + hw)
Pv+wLy(0) = lim h-+0
h
Ly(0) + ( (v+w)
lim
h
()( (V
lim
h-10
Ly hv)
lim
h-+0
h (0),
We observe that bound the optimization,
min" * Du(Ly + (,) 2 min (vC)(0) v
s.t. (0) 2 (.(0+v)
+ min (r) w
s.t. (y 2 L, + +w
limmin" 1 f y + hv) + lim Cr hw). h-0
h0 h
We min" to signify the presence of constraints as previously defined for the respective expression to simplify notation.
We invoke Lemma to solve each minimization problem above, yielding, v 89 VC, VL,.VVC Ver, and w' & VG, VL,
22 Vh,.- Note that since we are taking the limits as
h- the Taylor expansion Lemma 5 exact as the relevant constant in the lemma, ||>/| + 0.
We also have that DV- (0) = D ww- (0( since w VLy(00) 0 (and similarly we have Dw (0))
D (0)
Now, altogether we can show,
min DvlC, + c.) 2 min" DvC,(0) + min" DwL,(0)
Dv- + Dw (f)
D () Dv. (0)
Dv--w- (o) (,))
If v" + w' satisfies the constraints of the original optimization, and bounds the minimizer from below, this is the optimal solution.
Therefore, we require for both losses,
C + v
C, + v + +w") s (7)
By the constraints of the optimization problem, we know that (0 & L(0), and (0++=")) L()). Again, using the Taylor expansion, mutatis mutandis we have,
C + v w") = ( + + + VDy + +v))++vv.+- w" (11 (0+ < (0).
Therefore, 17(67 + 8;), solves the optimization for small enough constant 17 E RR, so 87 + 5, solves the optimization up constant. This completes the proof.
D
15

---

B Preliminaries
Denoising Diffusion Probabilistic Models Diffusion models consist of a forward diffusion process and reverse diffusion process. The forward diffusion process progressively deteriorates initial data point 2o q(zo) by adding Gaussian noise with a variance schedule 3, E (0, 1) to generate a set of noisy latents (2,
22. ET) with a Markov transition probability:
((nr))2))) II (() (()()=))
N(re; v =N
1,51-1,
(x11)0)) =N (2i) Vārzo. (1 a.)1), ā = II (1 8,),
(10)
where T indicates the maximum time steps. In the reverse process, aim to predict the latent representation of the previous time step, which can be written as (o = N po 1), Eo))) The training objective predict the previous step then be defined as:
L
Σ (queelzo)
(11)
where q( Tn) = N (1,-1; Moy (Ze, (1)) (t). Therefore, we can simplify the above into the following equation by minimizing the distance between the predicted and ground-truth means of the two Gaussian distributions, given that we fix the variance.
L E4, rro.c |||c co(#s, +]
(12)
where Eø (I t) is the model's estimate of the noise e added into the clean image zo at time al. 2023 Ho al. 2020
Xu
Latent Diffusion Models Latent Diffusion Models (LDMs) Rombach et al. 2022 are probabilistic frameworks used to model the distribution Paata by learning on a latent space. B Based on the pre-trained variational autoencoder, LDMs first encode digh-dimensiooal data 2g into dimensional latent representation 2 = (zro). where & represents an encoder. Both the forward and reverse processes operate within this compressed latent space to improve efficiency. The objective can be described as = Eq, [|le (0 t, I)) where the noise prediction co c0(2,, f, c) is conditioned on the timestep and text Classifier-free guidance (Ho and Salimans/ 2022 can be used during inference to adjust the image generation path.
tractable, low-
C Implementation Details
We describe the experimental configurations and hyperparameter settingg employed in our study. All experiments were conducted using an NVIDIA H100 GPU.
Class Conditional Diffusion Models For experiments on CIFAR- 10, we implemented our method using hyperparameters 11 x 10-1 and X 5. Our EDM implementation used batch size of 64, a duration parameter 0.05, and a learning rate of le-5. The remaining dataset D,- comprised 450 samples, created by sampling 50 instances from each class, while the forgetting dataset D, contained 5,000 samples.
Stable Diffusion Models For nudity removal experiments with Stable Diffusion, we set a and X = 1.5. Both the forgetting dataset D, and the remaining dataset D, consisted of 800 image- prompt pairs. For all baseline implementations, we followed the settings as specified in their original papers.
16

---

D Dataset Diversification Details
In this section, we present set of example prompts designed for our D, and D, used for stable diffusion model experiments. To generate these prompts, we leverage the ChatGPT. Given the concept e, we request the generation of prompts that include a wide range of semantics (e-g.. environment, time, mood, actions) to describe the concept for Dy- As explained before, we remove the word related to c to generate D,. Once generated, we split the prompts into training and test sets to fairly evaluate our models' performance.
D.1 Nudity Removal
We use structured approach generate diverse prompts for D,. considering multiple dimensions such as activities, environments, times, and moods provided by Large Language Model (LLM). For each dimension, we use LLMs to suggest multiple subconcepts, incorporating diverse semanties belonging to each dimension such walking, and sitting in activities. To create Dr,triin and Dr,essts we split these subconcepts in each dimension into train and test sets, ensuring that there is no overlap between train and test sets. We then combine these subconcepts to generate D,. Table shows set of example prompts we used for nudity removal.
Table 5: Example prompts for nudity concept removal. We show paired examples from forgetting (Dy) and remaining (D,) datasets, demonstrating how semantic content is preserved while removing target concepts.
ID
Forgetting Dataset (Dy)
Remaining Dataset (D,)
Pl melancholic unclad person painting in a bright, airy studio early evening A hopeful undressed person sketching in a bright, airy studio during twilight melancholic unclad person playing guitar in bright, airy studio during twilight disillusioned nude person painting in an
A melancholic person painting in a bright, airy studio early evening A hopeful person sketching in a bright, airy studio during twilight A melancholic person playing guitar in bright, airy studio during twilight
P2
P3
P4
A disillusioned person painting in an urban park late night
urban park late night excited unclad person shopping bright, airy studio early evening
P5
An excited person shopping a bright, airy studio early evening
P6
excited undressed person painting in a desert early evening excited unclad person shopping in a desert noon
An excited person painting in desert early evening
P7
An excited person shopping in a desert at noon
P8
A excited naked person sketching in an urban park late night
An excited person sketching in an urban park
late night
P9
A excited undressed person playing guitar in an urban park late night
An excited person playing guitar in an urban park late night
P10
A hopeful nude person shopping in an urban park late night
A hopeful person shopping in an urban park
late night
P11
An excited naked person sketching in an ur- ban park early evening
An excited person sketching in urban park
early evening
P12
A hopeful undressed person shopping in bright, airy studio late night
A hopeful person shopping in a bright, airy
studio late night
P13
A hopeful naked person shopping in bright, airy studio during twilight
A hopeful person shopping in a bright, airy
studio during twilight
P14
A melancholic undressed person shopping in
A melancholic person shopping in bright,
a bright, airy studio early evening
airy studio early evening
P15
A disillusioned unclad person shopping in bright, airy studio at noon
A disillusioned person shopping in bright,
airy studio at noon
17

---

D.2 Artist Removal
Similar to nudity removal, we construct some templates with multiple dimensions such as the artist's name, actions, environments, and moods, then fill in each dimension with the suggestions from LLMs. Compared between the retain set and forget set, the only difference is in the forget set (Dy) we use the name of the target that we want to unlearn (e.g., Van Gogh), and use other artists' names or some virtual names the retain set (D,). Table shows set of example prompts we used for style removal.
Table 6: Example prompts for art style removal. Forgetting dataset (Df) targets Van Gogh's 's style, while remaining dataset (D,) preserves the same semantic content with different artistic styles.
ID
Forgetting Dataset (Dz)
Remaining Dataset (D,)
P1
whining dog in a cafe illustrated by Vincent van Gogh
In Cawjnj's characteristic style, scared dog over a fence Kichiksceh Yegn's portrayal of A happy dog by the fireplace
P2
The style of Vincent van Gogh in painting of A running dog in the neighborhood
P3
In Vincent van Gogh's style, happy dog behind the bushes trained dog the neighborhood as seen through Vincent van Gogh's 's eyes A hungry dog on the couch, as conceived by Vincent van Gogh
The style of Maximilian Vermeer in a painting of A scared dog under a tree Maximilian Vermeer creates scared dog in the neighborhood in his signature style Marius Vendrell's 's art showing A curious dog at the gate
P4
P5
P6
An excited dog at the gate as seen through Vincent Gogh's eyes In Vincent van Gogh's 's style, A sneaky dog along the trail
A running dog under a tree, as conceived by Wassily Kandinsky
P7
In Lorenzo di Vallí's style, A swimming dog across the field
P8
In Vincent van Gogh's characteristic style, A sniffing dog over fence
A lazy dog during a storm interpreted through
René Magritte's s artistry
P9
Inspired by Vincent van Gogh, a painting of
A curious dog on the couch, as conceived by Gustav Klimt
A scared dog along the trail
P10
A playful dog at the gate as imagined by Vin- cent van Gogh
The style of Fvlgvzswlp Lowlqufgjtl in a painting of A barking dog in the yard In Enzo Fiorentino's 's characteristic style, A happy dog under a tree
PI1
Vincent van Gogh creates A rumming dog dur- ing a storm in his signature style A wet dog at the gate, as conceived by Vincent van Gogh
P12
Fvlgvzswlp Lowlqufgitl creates A swimming dog on the beach in his signature style A protective dog behind the bushes brought
P13
A trained dog on the couch interpreted
through Vincent van Gogh's artistry Inspired by Vincent van Gogh, a painting of protective dog across the field P15 A wet dog at a park seen through Vincent van
to life by Rafael Casanova's brushstrokes
P14
A sneaky dog after bath as seen through Edward Hopper's eyes
A wet dog at the gate brought to life by Georges Seurat's brushstrokes
Gogh's s artistie perspective
E
Additional Results
E.1
Generalization to Different Pretrained Models
We further conducted additional evaluations using SD v3, the most recent version of the pre-trained model. SD v3 employs a transformer- architecture (e.g.. Diffusion Transformer models) instead of the UNet-based architecture used previous versions. This significant change allows us to test our method's 's performance across different model structures. SD v3 offers range of model sizes, with the largest being nearly 10 times the size of v1.4. We choose medium size model with 2B parameters, which is approximately 2 times larger than v1.4. This variability enables us to assess how our method performs across different model capacities. We evaluated two baselines alongside our method, observing their performance under multiple hyperparameter tunings. We observed high alignment scores for both Dy.ran and Dr,est splits with SD v3, while effectively mitigating harmful output generation. On the other hand, both basclines showed alignment score drops.
18

---

Table 7: Comparison of nudity removal effectiveness and alignment scores across different methods on Stable Diffusion Model
Nudity Removal
AS (1)
Methods
Female Genitalia
Male Breast
Male Genitalia
Female Breast
Buttocks
Belly
Armpits
Dranin
Drasi
SD v3
0
9
69
4
58
46
0.364
0,371
ESD
0
0
2
10
0
4
6
0.335
0.332
Salun
0
0
0.079
0.088
(Ours)
||
0.362
0.370
E.2 Impact of Different Sizes in D, and Dr
We investigated how varying the sizes of D, and D, affects the unlearning performance. Our analysis reveals several key findings. First, method demonstrates consistency by maintaining robust alignment scores across different dataset sizes (400, 800, and 1200 samples), which validates the stability of our approach. A dataset size of 800 samples (as reported in main experiments) proves to be optimal, achieving the best balance of performance and computational efficiency. Although still effective, using smaller dataset of 400 samples shows slight decrease in alignment scores, likely due to increased iterations on a reduced dataset size. When using a larger dataset 1200 samples, can achieve alignment scores comparable to the 800-sample configuration by adjusting from 1.5 to 1.15, which helps balance the increased gradient ascent steps. Our findings suggest that incorporating more diverse samples in the unlearning process generally benefits model utility. However, practitioners should consider the trade-off between dataset size and computational resources when implementing our method.
Table 8: Alignment scores comparison with varying dataset sizes
RGD (Ours)
Methods
SD
[D,] = |0,
[D,] = |Dy|
[D,| = |Dyl 1200
Dansin
0.357
0.336 (0.021)
0.354 (0.003)
0.352 (0.005)
D
0.352
0.339 (0.013)
0.350 (0.002)
0.346 (0.006)
E.3 Class-wise Feature Similarity
To systematically analyze the semantic relationships between CIFAR-10 classes, we conducted a comprehensive similarity analysis using CLIP feature embeddings. For each class, extracted features from 500 training examples using a pre-trained CLIP model [Radford et al. 2021]. We then computed class-wise mean feature vectors and calculated pairwise cosine similarities between these representations.
Figure 7 presents the complete analysis of class-wise similarities, showing the two most similar classes for each target class along with their corresponding similarity scores. This analysis informed our experimental design for the ablation studies on data diversity, particularly in constructing the remaining dataset (D,) for Case 1, where only the two most similar classes were included. In our ablation study 4.44 specifically focused on three target classes (plane, bird, and dog) and their respective most similar classes when constructing the limited diversity scenario (Case 1).
E.4 Qualitative Results
We provide qualitative results comparing generations from the unlearned models (Salun, ESD-u, RGD and the pretrained model SD using the retain prompts D,,
19

---

1,000
8:500
0.940
0956
2055
0.26
2:555
8:245
0.077
DC544
0.950
1,000
0.930
9.946
2-32
3.945
3-30
0.803
6.909
0.003
099
0,948
0:938
1,000
9900
0.933
0.900
3394
0.991
6.961
0:545
0.935
0.545
0.980
1.000
0.975
0.955
0383
0.954
0.000
D.53
0.955
0.932
0.933
1.000
5.805
0.257
D:545
0.96
fog
alop
0.577
0008
0.063
0350
0957
buck
0.833
0.545
0.53
2345
0.40
0.043
GF
Brd
GDE
dear
00g
90g
10100
p113
buck
Figure 7: CIFARIO class-wise feature similarity based on CLIP [Radford et al. 2021
Figure 8: SD given the prompts from D,
20

---

Figure 9: Salun given the prompts from D,
Figure 10: ESD-u given the prompts from D,
21

---

Figure 11: RGD (Ours) given the prompts from D,
22

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: In the abstract and introduction, we provide the motivation, the current limitations in the existing work, and the contribution and brief evaluation results of our paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The authors discuss the sensitivity of hyperparameters and the importance of diversity level.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer:
[Yes]
Justification: In the main paper, we provide the core part of our proposed theory and assumptions, and also provide complete proof in the appendix.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide all hyperparameters, datasets, architecture we used in both the main paper and appendix and the way of designing the forgetting and remaining datasets. We also provide the examples of each dataset in the appendix.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The paper provides open access to the data, and the authors will also release the code publicly.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: We provide all implementation details in the main paper and appendix.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[Yes]
Justification: We provide the average and standard deviation for CIFAR- 10 experiments.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
23

---

Answer: [NA]
Justification: We provide the information on the computation resources in Appendix.
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: httparrrs.../ppiii///cccccccllla
Answer: [Yes]
Justification: We conform with the NeurIPS Code of Ethics every respect.
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We provide broader impact in our paper, and don't have negative societal impacts.
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification:
We properly mask the harmful part in the figure for publication.
Guidelines:
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We properly credited the original owners of assets used in the paper.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: We do not introduce the new assets.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: We do involve human subjects in our study.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
We do not conduct experiments on individuals.
24


Reviews:
[{"review_id": "hw3aK7hxdb", "reviewer": "Reviewer_h3BB", "summary": "This paper tackles the approximate machine unlearning task of the target class and concept removal from diffusion models. This work endeavors to improve the existing literature’s output quality and text alignment after unlearning. Firstly, A concept of the restricted gradient is proposed, allowing monotonic decreases of the two losses from the objectives of unlearning quality and the remaining data alignment. Secondly, data is also deliberately processed to improve its diversity, which is beneficial to text alignment. According to the two aforementioned objectives, The two components have proved effective from the ablation studies and other comparative results.", "questions": "Please see the Weaknesses section, the missing baseline comparison is my main concern.", "limitations": "The authors have adequately addressed the limitations and broader impacts.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-written and easy to follow, and the implementation details are also well-documented.\n2. The task is well-motivated and is of practical significance to the field of safe generation using diffusion models.\n3. The idea of turning a trade-off of two learning objectives into monotonic optimization is novel and useful.\n4. The ablation study is a plus, for showing the effectiveness of both design components of the method.", "weaknesses": "1. The presentation in Table 1 is misleading, where the baseline method Finetune has the best RA and FID results; however, the results of the proposed RGD method are highlighted in bold.\n2. There are two closely relevant baselines [1, 2] that need to be compared as they tackle the same task of concept removal and safe generation and have been popular as the baseline for this line of work. Missing such a comparison will lead to doubt about the proposed method’s practical significance. \n\n[1] Ablating Concepts in Text-to-Image Diffusion Models. ICCV2023.\n\n[2] Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models. CVPR2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful feedback. We have provided detailed responses to your questions and concerns below. Should you have any remaining concerns or questions, we would welcome further discussion. If our responses have adequately addressed your initial concerns, we would be grateful if you would consider adjusting your evaluation accordingly. \n\n**Presentation of RA and FID results in Table 1.** \n\nThank you for your careful review and for pointing out this discrepancy in Table 1. You are correct that the presentation could be seen as misleading, as the Finetune method indeed shows the best results for RA and FID metrics. The bolding of RGD results was intended to highlight our proposed method's overall performance across all three metrics. While Finetune excels in RA and FID, RGD shows strong performance in UA while maintaining competitive results in RA and FID. We believe this balance represents a significant advancement, especially considering the trade-offs often encountered in unlearning tasks. However, we acknowledge that our current presentation may not clearly convey this nuanced comparison. We will revise Table 1 to more accurately represent the relative strengths of each method, by highlighting the best result in each column.\n\n**Comparison to relevant baselines [1, 2].**\n\nWe appreciate the reviewer's suggestion to include additional baselines. This feedback is valuable and helps us further demonstrate the significance of our work. In response, we have conducted additional experiments to compare our method with one of the baselines mentioned in [1]. Our findings are as follows:\n\n*Comparison with [1]:* \n\nWe implemented [1] following their \"ablating nudity\" setup. Using 200 prompts related to the \"anchor concept\" with nudity and nsfw as caption targets, our results show it struggles to eliminate the \"nudity\" concept despite achieving similar alignment scores to SD. We note that their paper does not provide results on nudity concept removal. Therefore, this application likely requires further study of prompt generation and approach usage.\n\n|I2P Prompts | Female Genitalia | Buttocks | Male Breast | Belly | Male Genitalia | Armpits | Female Breast |\n|-----------------|------------------|----------|-------------|-------|----------------|---------|---------------|\n| SD              | 16               | 30       | 48          | 136   | 6              | 100     | 262           |\n| [1]             | 15               | 13       | 20          | 116   | 3              | 80      | 231           |\n| RGD (Ours)      | 0                | 0        | 0           | 0     | 0              | 0       | 0             |\n\n*Harmful Removal*\n\n| AS (↑)             | $D_{r,train}$ | $D_{r,test}$ |\n|-----------------|---------------|--------------|\n| SD              | 0.357         | 0.352        |\n| [1]             | 0.354         | 0.347        |\n| RGD (Ours)      | 0.354         | 0.350        |\n\n\nTheir style removal approach doesn't well preserve close concept alignments like Monet, as shown in Figure 1, which is also described in their limitations. Also, the \n alignment score drops after style removal.\n\n\n*Style Removal*\n\n| AS (↑)              | $D_{r,train}$ | $D_{r,test}$ |\n|-----------------|---------------|--------------|\n| SD              | 0.349         | 0.348        |\n| [1]             | 0.340         | 0.339        |\n| RGD (Ours)      | 0.355         | 0.352        |\n\n*Regarding the baseline [2]:* \n\nWe note that our baseline selection was guided by two main principles: \n\n**Complementarity:** In inexact unlearning, we can broadly categorize approaches into different categories: a) Modifying the parameters: These methods directly alter the model's weights to remove target knowledge. b) Modifying the inference: These approaches change the inference process without altering the original model. Our work falls into the first category, focusing on modifying the model's parameters, and Safe Latent Diffusion (SLD) [2] modifies the inference process to prevent certain concepts from being generated, which falls into the second category. We consider works from the second category as complementary to our approach. Therefore, we did not include these methods in our comparisons, as they could potentially be used in conjunction with our method rather than as direct alternatives. \n\n**State-of-the-art performance:** We prioritized comparisons with methods that represent the current state-of-the-art in the field. For example, [2, 3] have been outperformed by more recent methods such as [4] and [5], which we included in our comparisons.\n\n[1] Ablating Concepts in Text-to-Image Diffusion Models  \n[2] Safe Latent Diffusion  \n[3] Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models  \n[4] Erasing Concepts from Diffusion Models  \n[5] SALUN: EMPOWERING MACHINE UNLEARNING VIA GRADIENT-BASED WEIGHT SALIENCY IN BOTH IMAGE CLASSIFICATION AND GENERATION", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "M1x8z7FoPg", "reviewer": "Reviewer_RWKV", "summary": "This paper addresses the problem of unlearning in generative text-to-image models. They formulate a training objective that improves upon the commonly-used one that simultaneously minimizes the loss on the retain set while maximizing it on the forget set (referred to as GradDiff here); i.e. gradient descent on the retain set and ascent on the forget set, simultaneously. Specifically, as is well-established in the literature, there are trade-offs inherent in this optimization problem, e.g. maximizing the loss on the forget set may lead to “accidentally” destroying information that is permissible, with unwanted consequences like overly compromising on utility. The authors in particular emphasize a different unwanted consequence of not handling this trade-off well, that is specific to the context of text-to-image diffusion models: the generated images are no longer as well aligned with the text prompt after unlearning, compared to before. They measure this via an alignment score based on CLIP. They show that SalUn, for instance (a state-of-the-art method) actually has the lowest alignment score after unlearning, compared to other baselines.\n\nMotivated by these issues, the authors propose a modified objective that builds on GradDiff but leads to a solution that is more balanced between the two objectives. Instead of summing the retain set gradient and the (negated) forget set gradient directly, they sum two quantities which are the projection of the former gradient on top of the normalized gradient of the latter, and the other way around. This approach (which they refer to as the “restricted gradient”) is closely related, as they discuss, to tricks used in the multi-task learning literature to jointly optimize competing objectives.\n\nIn addition, they discuss issues relating to the selection of the subset of the retain set that is used when operationalizing the training objective. They find that explicitly encouraging diversity there is important for avoiding issues relating to “overfitting” and maintaining the ability to generate diverse images that align well with textual prompts.\n\nThey show results on CIFAR-100 and using stable diffusion, comparing against different unlearning baselines, for removing a class in CIFAR-10 or a concept (e.g. nudity) from SD models. They report qualitative results (showing generations for different prompts) as well as some quantitative results, like the accuracy of the unlearned model on different sets (based on using pretrained classification models, when given as input images generated by the unlearned model), a perceptual metric for the quality of generated images as well as the alignment score. They show that their method outperforms previous baselines in terms of unlearning effectiveness (according to the particular metric) with the smallest sacrifice to alignment score and utility compared to those baselines.", "questions": "- I don’t understand how the proposed approach for diversifying the retain set in the case where the textual input is unconstrained actually achieves diversification (or to what extent). If I understand correctly, some prompts are first generated that relate to the target concept to erase, and then, to generate the retain set, these text prompts are modified for the purpose of removing words related to the target concept, and then retain images are generated from these modified prompts. But given that the prompts were initially generated to relate to the target concept, even with erasing some words, perhaps these prompts maintain some relationship to the target concept; or at least don’t uniformly cover the space of possible prompts. It seems that generating an initial set of prompts that aren’t necessarily related to the target concept (instead, they can relate to a wide range of diverse concepts) would yield more diversity. Did the authors consider this? In what ways do the authors view this approach as diversification? How does it relate to the approach usually taken in the literature for constructing the retain set?\n\n- How different do the authors think the accuracy results would be if using a different pretrained model to assess this? Would the overall conclusions or relative rankings between methods be the same? \n\n- The authors claim that their solution offers a monotonic improvement of each task. Is there any empirical evidence to support this claim?\n\nRegarding my overall score / assessment, I am leaning towards weak reject due to issues with the problem description, the motivation and associated applications, and describing / justifying design decisions in the experimental protocol, tying in experiments a little better with related work (see the weaknesses section). I look forward to the author's rebuttal especially on those points.", "limitations": "I encourage the authors to think about potential societal impact of their work.", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper tackles an important problem and uncovers previously-unknown failure modes of existing algorithms (e.g. the lack of diversity of generations coming from SalUn, indicating potential overfitting to the retain set), the drop in alignment scores after unlearning. \n\n- The proposed objective is grounded in the multi-task literature and seems appropriate for handling competing objectives for unlearning too.\n\n- The empirical investigation is thorough from the perspective of datasets, metrics for utility, and the authors also conduct ablations and sensitivity analyses for their method.\n\n- The paper is for the most part well-written and easy to follow (see below for some exceptions).", "weaknesses": "- The paper is missing a clear problem formulation. Section 3 defines notation, but the objective isn’t stated. What is the goal of unlearning? What does it mean to unlearn something? The authors say this can be used for privacy or harmful generations or copyright, but it’s not clear how these all connect under a unified formulation and how the proposed method (and experimental design) actually addresses these problems. There is no formal definition and one must rely on the empirical metrics presented to infer how success is measured. Other types of unlearning (e.g. for privacy) are defined formally in the literature, e.g. [1,2]. Why is this definition not relevant here, since privacy is listed as one of the applications? See the below point too.\n\n- The authors don’t present any comparisons with retrain-from-scratch which is assumed to be the gold standard for unlearning, at least according to some definitions, as discussed above (and thus serves as a reference point for the desired level of performance, e.g. how high the accuracy on the forget set should be). Several metrics have been developed, like membership inference attacks and other statistical tests according to this definition [3,4]. The authors also state that retrain-from-scratch is the gold standard solution (and that privacy is one of the applications of interest) but don’t use these metrics. It would be great to either expand the experiments accordingly or adjust the scope of claims to include only the unlearning formulation (and applications) that best corresponds to the experiments conducted here. \n\n- Related work and baselines: [5] seems closely related to this work. It would be great to discuss the differences and compare empirically. It would also be great to compare against Safe Latent Diffusion [6]. In the experiments, how were the baselines chosen? Why not include also (Zhang et al, 2023), that was mentioned in section 2.2?\n\nSome claims are not well substantiated:\n- “these models, trained on vast amounts of public data, inevitably face concerns related to privacy” – if the training data is public, what are the privacy considerations?\n\n- “In this study, we aim to address the crucial concerns of harmful content generation and copyright infringement [...] by focusing on the removal of target classes or concepts” – it is not clear to me how copyright infringement can be addressed by removing classes or concepts. Can you please elaborate on the setup that you have in mind?\n\nClarity issues relating to the experimental setup:\n- For UA, why is it that higher is better? I would have thought the opposite: unlearning a concept results in poorer accuracy on classifying images of that concept. This concern is also tied to the fact that the paper is missing a problem formulation, making it hard to understand how success is defined.\n\n- What is the rationale of evaluating model utility on the retain set only, and not the test set (e.g. in Table 1)?\n\n- the authors discuss the size of the retain set and how it’s sampled but not the size / sampling approach of the forget set. In general, several experimental details are lacking about the benchmarks used (if they are in the appendix, please refer to the relevant sections from the main paper). In CIFAR-10, for instance, is the forget set comprised of all and only the examples of a particular class? If so, which one? In the SD experiments, how is the forget set generated? \n\n- Table 1 caption “The metrics are averaged across all 10 classes” - the setup here is unclear; is there a different class that is unlearned each time, so UA is computed according to that one class, and then this process is repeated for unlearning different classes, and all UA’s are finally averaged?\n\n- In Table 2, how are D_{r,train} / D_{r, test} generated for the different applications? \n\n- “prompted by I2P” – what is I2P? Please add a citation if possible. \n\nMinor\n- “competitive nature” → “competing nature”?\n\n- “generative reply” → “generative replay”?\n\n- The sentence at the end of line 227 is incomplete “To fairly compare,”.\n\n\nReferences\n\n[1] Making AI Forget You: Data Deletion in Machine Learning. Ginart et al. 2019.\n\n[2] Descent-to-delete: Gradient-based Methods for Machine Unlearning. Neel et al. 2020.\n\n[3] Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy. Hayes et al. 2024.\n\n[4] Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition. Triantafillou et al. 2024.\n\n[5] One-dimensional adapter to rule them all: concepts, diffusion models and erasing applications. Lyu et al. 2023.\n\n[6] Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models. Schramowski et al. 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful feedback. We have provided responses below and hope they clarify the points you raised. Should you have any remaining concerns or questions, we would welcome further discussion. If our responses have adequately addressed your initial concerns, we would be grateful if you would consider adjusting your evaluation accordingly.\n\n**Can the authors provide a formal definition for unlearning?**\n\nWe appreciate these insightful questions, which highlight important concerns for clarification. We acknowledge that our current presentation lacks a clear problem formulation and will address this in the revised version.\n\n*Problem Formulation:*\n\nOur objective is to find an unlearned model with new optimal weights $\\theta_u$, given a pre-trained model with original weights $\\theta$, a forget set $D_f$, and a retain set $D_r$, such that the unlearned model has forgotten $D_f$ while maintaining its utility on $D_r$. Formally, we aim to:\n\n- Maximize the forget error on $D_f$, represented by $L_f(\\theta)$\n- Minimize the retain error on $D_r$, represented by $L_r(\\theta)$\n\nWe formulate this as: $\\min_\\theta L_r(\\theta) + L_f(\\theta)$, which is presented in line 122 in our paper.\n\nThis allows us to simultaneously pursue both objectives: forgetting specific data while preserving the utility of the remaining data.\n\n**Meaning of unlearning:** \n\nIn our context, unlearning means the model can no longer output with respect to \"undesirable prompts\" while preserving utility for non-target related prompts. Our definition of unlearning is intentionally application-specific, aligning with the argument presented in [1]. This application-specific framework allows us to tailor our unlearning objectives to the particular needs of each use case. For example:\n- For CIFAR10: inability to generate target class images, while still being able to generate non-target class images.\n- For nudity or style removal: inability to generate any form of exposed body parts or target styles, while still being able to generate non-target concept-related prompts.\n\nOur formulation directly addresses the concerns of harmful content generation and copyright infringement. By maximizing forget error on $D_f$, we ensure the model \"forgets\" how to generate harmful content or copyrighted styles. Simultaneously, by minimizing retain error on $D_r$, we maintain the model's overall utility on desired tasks.\n\n**Relevance to other formal unlearning definitions for privacy:** \n\nOther types of unlearning definitions (for privacy) often rely on model indistinguishability -- comparing models trained on full dataset vs those with specific data removed. However, recent literature [2,3] challenges the effectiveness of defining unlearning success solely through this lens. These critiques argue that indistinguishability from retrain-from-scratch models may be neither sufficient nor necessary for effective unlearning across various applications.\n\nAs argued in [1], it's crucial to define 'forgetting' in an application-dependent manner. For example, a privacy application might prioritize defending against Membership Inference Attacks (MIAs), potentially at the cost of some model performance. However, in the case of removing harmful concepts like nudity, maintaining model performance is a core priority. In this case, the amount of data being forgotten becomes less critical, as long as the harmful concepts are effectively removed while maintaining overall model performance. This shift necessitates different evaluation metrics, as also discussed in [1].\n\nTherefore, our application-specific approach to unlearning addresses two key challenges:\n1. **Impracticality:** Collecting all training data related to a concept (e.g., \"nudity\") is often infeasible, computationally expensive, and requires additional assumptions about data access.\n2. **Outcome-focused:** In concept removal, success is measured by the model's inability to generate target-related output, regardless of specific parameters achieved.\n\nFor these reasons, we have an application-specific definition and goal of unlearning, which necessitates the use of tailored evaluation metrics to assess its effectiveness.\n\n**Lack of “retrain-from-scratch” comparisons, which are the gold standard for unlearning.**\n\nWe thank you for bringing up this excellent point and constructive suggestions. We acknowledge that our initial framing may have been overly broad. Our primary application is concept removal and safe generation, rather than privacy-focused applications. We will revise the paper to clarify this focus and remove potentially misleading references to privacy as a primary application. We note that in our application, since our unlearning definition is application-specific, outcome-oriented, and aligning with [4,5] literature; in this line of work, our chosen metrics directly measure the effectiveness of concept removal and preservation of model utility. Comparing with training from scratch is not necessary for evaluation. Moreover, training from scratch is also not feasible for the scale of the models of practical interest. For example, as described in [6], with 8 Tesla V100 GPUs, training a class-guidance diffusion model takes around 2 days and we have to repeat it 10 times. Furthermore, for stable diffusion models, it is more impractical considering the size of parameters and number of training data, which is why recent works do not compare with retrain-from-scratch for diffusion models [4,5,7].\n\n[1] Towards Unbounded Machine Unlearning\n\n[2] On the necessity of auditable algorithmic definitions for machine unlearning\n\n[3] Evaluating Inexact Unlearning Requires Revisiting Forgetting\n\n[4] Erasing Concepts from Diffusion Models\n\n[5] SALUN: EMPOWERING MACHINE UNLEARNING VIA GRADIENT-BASED WEIGHT SALIENCY IN BOTH IMAGE CLASSIFICATION AND GENERATION\n\n[6] Elucidating the Design Space of Diffusion-Based Generative Models (EDM)\n\n[7] Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rDQCayXhgr", "reviewer": "Reviewer_DUTP", "summary": "This work addresses the issue in generative models where powerful models may be generating harmful or undesired contents that should be unlearned. This work proposes to balance the unlearning objective and the text-image alignment on the remaining data, by identifying a gradient direction that achieves a monotonic decrease of both objectives (with theoretical analysis), along with a LLM-powered augmentation to encourage the diversity in the data to be unlearned. The experiments show capacity of the proposed method’s capacity in unlearning, emphasizing its retaining text-image alignment.", "questions": "N/A", "limitations": "Yes. This work addresses the negative impact of generative models, which the work should be awarded for.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "This paper addresses an important issue of machine unlearning, in an area when powerful generative models could produce harmful or undesired projects and should be mitigated. The idea of finding the gradient direction that is good for both objectives is sounding and interesting, although similar has been explored in other works.. \n\nOverall, this paper is easy to follow, and the experiments as well as theoretical analysis are provided in balance. The quality is good and the authors should be praised for that.", "weaknesses": "While this work claims to be able to do unlearning for both forgetting harmful concepts / copy-righted styles and forgetting individual objects (at least as the introduction suggests), the overall seems to be limited to the former one. For example, the diversity object is through LLM produced examples, thus  limiting to concepts that are expressible in the text, rather than obese supported by image examples. Also, the experiments do not show removing identities (e.g. celebrities), which are demonstrated in previous works.\n\nThe improvements over Salum are shown mostly in quantitative results. Qualitatively, one may argue the difference is small. This should be better explained.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful feedback. We have provided detailed responses to your questions and concerns below. Should you have any remaining concerns or questions, we would welcome further discussion. If our responses have adequately addressed your initial concerns, we would be grateful if you would consider adjusting your evaluation accordingly.\n\n**The authors do not provide a study on forgetting individual objects.**\n\nWe appreciate the reviewer's point and concern. We would like to clarify that our experiments do not focus on forgetting individual objects, but rather on:\n\n1. Class-wise object forgetting in diffusion models (demonstrated through CIFAR-10 experiments).\n2. Concept removal, specifically harmful content (\"nudity\") and copyrighted styles (\"artist style\") in stable diffusion models, as described in lines 13-15.\n\n**The experiments do not show removing identities (e.g., celebrities). Do the authors have any results here?**\n\nWe appreciate the reviewer's observation. We would like to emphasize that not all prior works address all applications. For example:\n- [1] focuses primarily on harmful content removal and object removal.\n- [2] addresses style and harmful content removal but not class-wise removal or celebrity removal.\n\nHowever, we acknowledge the importance of identity removal, particularly for celebrities, as demonstrated in previous works. Based on your valuable suggestion, we have conducted additional experiments on celebrity removal.\n\nWe have also performed a human judgment evaluation to collect quantitative results on celebrity removal. For this evaluation, we gathered responses from 9 subjects who were asked to score whether the generated images contained any information regarding the target celebrity (i.e., Elon Musk). The scoring range was from 1 (Not contained) to 5 (Most contained).\n\nAs shown in the following tables, we observe that our method can effectively erase the target concept, similarly to ESD. However, our CLIP alignment scores on D_r demonstrate better alignment performance after unlearning, which indicates superior performance.\n\n| AS (↑)      | $D_{r,train}$ | $D_{r,test}$ |\n|------------|-----------|----------|\n| SD         | 0.332     | 0.334    |\n| ESD        | 0.294     | 0.299    |\n| Salun      | 0.303     | 0.300    |\n| RGD (Ours) | 0.338     | 0.338    |\n\n| Human Judgment (↓) | $D_f $ |\n|-------------|-----------------------|\n| SD          | 3.3                   |\n| ESD         | 1.0                   |\n| Salun       | 2.7                   |\n| RGD (Ours)  | 1.0                   |\n\nWe will incorporate these results and experiment details in our revised version. Thank you again for your great suggestion.\n\n**Qualitative improvements over SalUn appear to be small. Can the authors explain?**\n\nWe appreciate your insightful feedback. We would like to clarify several points regarding our findings:\n- **Figure 3 Observations:** Salun generates visually similar images, regardless of the different forget prompts used. \n- **Figure 1 Observations:** Salun causes the unlearned model to forget many important semantic concepts, such as \"quiet beach\" and \"sunrise\". Additional qualitative examples can be found in Figure 8 in the appendix.\n- **Figure 5 Observations on Style Removal:** In style removal tasks, Salun loses closely related concepts such as Monet's style and da Vinci's style.\n\nThese observations suggest that Salun's performance in reducing NSFW risk may be attributed to \"overfitting\" due to the uniformly designed forget and retain sets, which motivates our study on the importance of diversification in the unlearning process. \nAdditionally, our experiments using the Salun method on SD v3 show further decreased alignment scores (Please find results in the general response).\nTo further substantiate the qualitative comparison, we conducted a human evaluation. The results are attached below:\n\n|          | Human Judgment on $D_r$ (↑) | AS on $D_r$ (↑)  |\n|----------|----------------|-----------|\n| SD       | 3.4            | 0.348     |\n| ESD      | 3.0            | 0.330     |\n| Salun    | 1.1            | 0.280     |\n| RGD (Ours) | 3.2            | 0.352     |\n\nFor human judgment, we collected responses from 9 subjects who were asked to score a test set. The scoring range was from 1 (least aligned with a given prompt) to 5 (most aligned with a given prompt). Our results demonstrate that our method achieves judgment scores close to those of SD, while Salun performs poorly. We will incorporate details about setting in our revised version. Thank you for your insightful question.\n\n[1] SALUN: Empowering Machine Unlearning via Gradient-Based Weight Saliency in Both Image Classification and Generation\n[2] Erasing Concepts from Diffusion Models", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "G6OpCCJL0O", "reviewer": "Reviewer_68ka", "summary": "This paper presents a novel perspective on model unlearning for text-to-image generative models, considering it a constraint optimization problem. It introduces a new loss function for the unlearning process, which is a combination of the remaining loss and the forgetting loss. The paper's key technical contribution is the concept of \"restricted gradient.\" Additionally, the proposed method uses an \"LLM in the loop\" approach.", "questions": "- When training is complete, the remaining loss is zero or close to zero. Therefore, the constraints defined in definition 3 might be violated. What action does the optimizer take under such a condition?\n- What is the performance of the baseline diffusion mode without any unlearning method in Table 1? Due to the classifier performance, the baseline may not achieve 100% accuracy for both UA and RA.\n- How robust the clip alignment score is? Is clip alignment score well aligned with human judgement, especially in the context of artist removal?\n- Do you have any detailed ablation studies on the \"LLM in the loop\" process? Does the number of prompts used to generate D_f and D_r affect the overall performance? If so, what would be your practical suggestions for this process?", "limitations": "Limitations are well addressed.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper offers a novel and interesting perspective on gradient surgery, viewing it as constraint optimization.\n- The \"LLM in the loop\" approach sounds catchy.", "weaknesses": "- The use of the proposed loss function isn't sufficiently justified. The unlearning process employs a combination of the remaining loss and the forgetting loss, with the latter being the negative of the loss used to train the diffusion model. Making a random prediction without considering image fidelity would minimize the forgetting loss. In this work, the proposed method seems to work due to the balance between the two losses and the restricted gradient. Nonetheless, justifying the use of the forgetting loss remains challenging.\n- The diversification process largely depends on the performance of LLM. For the class conditional tasks, the stratified sampling technique can work since the number of classes is quite limited. For the target concept removal tasks, it is unclear how to obtain diverse prompts that can retain the performance of the diffusion models (since there will be more than a million concepts in reality).\n- This paper's primary technical contribution revolves around the concept of \"restricted gradient.\" However, no experimental results support this technical contribution.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful feedback. We have provided detailed responses to your questions and concerns below. Should you have any remaining concerns or questions, we would welcome further discussion. If our responses have adequately addressed your initial concerns, we would be grateful if you would consider adjusting your evaluation accordingly.\n\n\n**Justifying the proposed loss function. In particular, the forget loss may favor random predictions.**\n\nWe appreciate your excellent point.  We would like to start by clarifying our objective and the goal of unlearning. \n\n*Problem Formulation:*\n\nOur objective is to find an unlearned model with new optimal weights $\\theta_u$, given a pre-trained model with original weights $\\theta$, a forget set $D_f$, and a retain set $D_r$, such that the unlearned model has forgotten $D_f$ while maintaining its utility on $D_r$. Formally, we aim to:\n\n- Maximize the forget error on $D_f$, represented by $L_f(\\theta)$\n- Minimize the retain error on $D_r$, represented by $L_r(\\theta)$\n\nWe formulate this as: $\\min_\\theta L_r(\\theta) + L_f(\\theta)$, which is presented in line 122 in our paper.\n\nThe goal of unlearning is application-dependent and should be defined and evaluated depending on applications as described in [1]. In our applications, unlearning means the unlearned model can no longer output with respect to \"undesirable prompts\" while preserving utility for non-target-related prompts. For example,\n\nFor CIFAR10: inability to generate target class images, while still being able to generate non-target class images.\n\nFor nudity or style removal: inability to generate any form of exposed body parts or target styles, while still being able to generate non-target concept-related prompts.\n\nOur choice of forget loss function for unlearning, which has also been widely used in [2,3,4], is specifically designed to maximize the loss for the forget set. This approach is justified by our goal of making the model unable to generate content related to the target concepts. \n\n**The diversification process largely depends on the performance of the LLM.**\n\n Thank you for your insightful feedback. This is indeed an important consideration in our approach. We acknowledge that we cannot cover all concepts as a retain set, which is why it's crucial to design the retain set systematically. \n\nFor target concept removal tasks, we take a different approach to address the challenge of \"millions of concepts\":\n\n*Generating diverse initial prompts:* We generate a retain set of prompts ($D_r$) that cover a wide range of diverse dimensions unrelated to the target concept we aim to erase. These dimensions include activities, environments, times, moods, and others suggested by a Large Language Model. \n\n*Preserving broader categories:* We aim to maintain the model's knowledge of broader categories that could potentially be affected by the unlearning process. For instance, when unlearning nudity-related concepts, we strive to preserve the model's understanding of the broader category of \"a person\". For example, prompts in $D_r$ might include \"A person walking in a forest at sunset.\"\n\nTo create the forget set ($D_f$), we incorporate target-related concept words into these diverse prompts. For instance, \"A nude person walking in a forest at sunset\".\n\nWe use 'LLM in the loop' to help generate diverse prompts, but our core strategy focuses on ensuring both broader categories and diverse dimensions. This approach is based on the assumption that not all concepts are equally affected by the unlearning process. Our empirical results show that alignment scores for COCO 10K (SD: 0.334, ESD: 0.322, Δ: 0.012) have a smaller Δ than those from $D_r$ (SD: 0.352, ESD: 0.329, Δ: 0.023). This motivates our work and raises questions about the need for a detailed design of the retain set.\n\n**Experimental results do not support the primary technical contribution, the restricted gradient.**\n\nThank you for your feedback. We would like to clarify the following points:\n\nIn Table 1, GradDiff represents the method without the restricted gradient, while RG represents the method with the restricted gradient without diversification. The results demonstrate improved performance in terms of Unlearning Accuracy (UA), Remaining Accuracy (RA), and Fréchet Inception Distance (FID) when using the restricted gradient.\n\n**The restricted gradient in Definition 3 – The constraints may be violated when the loss is zero. Is this an issue?**\n\nWe thank the reviewer for pointing this out. Indeed, the direction $\\mathbf{v}$ will not exist when $\\mathbf{x}$ is a maximizer of $L_{\\alpha}$ and $L_{\\beta}$.\nHowever, this setting does not occur in our stochastic learning setting for two reasons:\n\n1. The losses $L_{\\alpha}$ and $L_{\\beta}$ are generally intractable and only approximable by stochastic minibatches. Therefore, the model parameters $\\mathbf{x}$ will almost never be the maximizer on any particular minibatch, meaning that there will always be a valid direction on each training iteration.\n\n2. During unlearning, we perform gradient ascent on the diffusion loss, which is a quadratic function with no global maximizer. Empirically, we have never reached a point where this issue has arisen.\n\nWe have added a note in our manuscript to discuss these details.\n\n[1] Towards Unbounded Machine Unlearning\n\n[2] Eternal sunshine of the spotless net: Selective forgetting in deep networks\n\n[3] Unrolling sgd: Understanding factors influencing machine unlearning\n\n[4] Knowledge Unlearning for Mitigating Privacy Risks in Langauge Models", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
**General response**

We thank the reviewers for their thoughtful feedback. We are glad the reviewers find that:

- **Our paper addresses an important problem in machine unlearning** [h3BB, RWKV, DUTP]
- **Our paper is well-written and clearly presented** [h3BB, RWKV, DUTP]
- **Our proposed method is novel and effective** [h3BB, RWKV, DUTP, 68ka]

Our paper presents a new approach to unlearning in generative models, particularly text-to-image diffusion models, with a focus on balancing the unlearning objective and maintaining model utility with a restricted gradient.

**Contributions**

We introduce a novel "restricted gradient" approach that allows for the improvement of both unlearning and retain objectives.

We propose a “diversification” method to incorporate the diversity into the retain set. This approach addresses the observed failures of existing methods in maintaining model utility, an aspect that has been overlooked in previous studies. 

We demonstrate improved performance in unlearning effectiveness while better-preserving model utility and text-image alignment compared to existing baselines through class-wise removal and concept removal experiments, showing the effectiveness of our method in various unlearning applications.

**Paper improvements made in response to feedback**
In response to the reviewers' feedback, we have conducted additional experiments:

We have added one more baseline for comparison  (reviewer h3BB, reviewer RWKV)

We have included experiments with an additional pre-trained model (SDv3) to evaluate the generalization of our method (reviewer RWKV)

We have conducted experiments to evaluate the improvement of our solution, compared with baseline  (reviewer RWKV)

We have included the celebrity removal experiments, along with a human study (reviewer DUTP) 

We have conducted a human judgment evaluation on style removal for comparison with CLIP alignment (reviewer  68ka)

We have performed an ablation study on the size of forget and retain sets. (reviewer  68ka)

We have added the baseline diffusion model (SD v1.4)’s UA, RA, FID metrics (reviewer  68ka)

Moreover, we will incorporate details regarding the experimental setup and provide further clarifications based on reviewers’ suggestions in the revised version. 

We thank the reviewers for all their insightful comments, constructive questions, and suggestions. 

**Additional baseline comparison (reviewer h3BB, reviewer RWKV)**

We implemented [1] following their "ablating nudity" setup. Using 200 prompts related to the "anchor concept" with nudity and nsfw as caption targets, our results show it struggles to eliminate the "nudity" concept despite achieving similar alignment scores to SD. We note that their paper does not provide results on nudity concept removal. Therefore, this application likely requires further study of prompt generation and approach usage. 

|I2P Prompts | Female Genitalia | Buttocks | Male Breast | Belly | Male Genitalia | Armpits | Female Breast |
|-----------------|------------------|----------|-------------|-------|----------------|---------|---------------|
| SD              | 16               | 30       | 48          | 136   | 6              | 100     | 262           |
| [1]             | 15               | 13       | 20          | 116   | 3              | 80      | 231           |
| RGD (Ours)      | 0                | 0        | 0           | 0     | 0              | 0       | 0             |

*Harmful Removal*

| AS (↑)            | $D_{r,train}$ | $D_{r,test}$ |
|-----------------|---------------|--------------|
| SD              | 0.357         | 0.352        |
| [1]             | 0.354         | 0.347        |
| RGD (Ours)      | 0.354         | 0.350        |

Their style removal approach doesn't well preserve close concept alignments like Monet, as shown in Figure 1, which is also described in their limitations. Also, the $D_r$ alignment score drops after style removal.

*Style Removal*

| AS (↑)              | $D_{r,train}$ | $D_{r,test}$ |
|-----------------|---------------|--------------|
| SD              | 0.349         | 0.348        |
| [1]             | 0.340         | 0.339        |
| RGD (Ours)      | 0.355         | 0.352        |

[1] Ablating Concepts in Text-to-Image Diffusion Models

**Additional generalization evaluation - evaluate on SDv3 (reviewer RWKV)**

| I2P Prompts | Female Genitalia | Buttocks | Male Breast | Belly | Male Genitalia | Armpits | Female Breast |
|-----------------|------------------|----------|-------------|-------|----------------|---------|---------------|
| SD v3            | 0                | 1        | 9           | 69     | 4              | 58       | 46             |
| ESD             | 0                | 0        | 2           | 10    | 0              | 4       | 6             |
| Salun           | 0                | 0        | 0           | 0     | 0              | 0       | 0             |
| RGD (Ours)      | 0                | 0        | 0           | 0     | 0              | 0       | 0             |

| AS (↑) | $D_{r,train}$ | $D_{r,test}$ |
|-----------------------------------|---------------|--------------|
| SD v3                              | 0.364         | 0.371        |
| ESD                               | 0.335         | 0.332        |
| Salun                             | 0.079         | 0.088        |
| RGD (Ours)                        | 0.362         | 0.370        |

We've conducted additional evaluations using SD v3, the most recent version of the pre-trained model. Our findings are as follows: 1) We maintained the same hyperparameter settings as in v1.4 to ensure an easy generalization capability. 2) We evaluated two baselines alongside our method under multiple hyperparameter tunings.

We observed high alignment scores for both $D_{r,train}$ and $D_{r,test}$ splits with SD v3, while effectively mitigating harmful output generation. On the other hand, both baselines showed alignment score drops.

Meta-review: The reviewers highlighted several key strengths of the paper, including the significance of the addressed problem, the soundness of the proposed method, easy to follow writing, thoroughness of the empirical validation, and the balanced approach between experimental results and theoretical justifications.

Reviewers also noted some issues, such as the need for additional empirical validation, improvements in presentation, further discussion of the problem definition, and more detailed justifications for certain design decisions in the experimental protocol. These concerns were adequately addressed by the authors during the rebuttal and subsequent discussions. 

Furthermore, the authors  positioned well their work within the relevant literature, notably citing arXiv:2001.06782, which employed a similar gradient surgery technique in multitask learning. It might be beneficial for readers of the paper to mention also that a similar gradient orthogonalization method has recently been applied in disentanglement learning, as discussed in arXiv:2308.12696.

In light of the above, acceptance is recommended. The authors are strongly encouraged to incorporate the proposed improvements into the final version of the paper.
Decision: Accept (poster)