Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models
Authors: Yimeng Zhang
Xin Chen
Jinghan Jia
Yihua Zhang
Chongyu Fan
Jiancheng Liu
Mingyi Hong
Ke Ding
Sijia Liu
Venue: NeurIPS 2024 poster (2024)
Keywords: diffusion model
machine unlearning
adversarial training
Primary area: diffusion_based_models
TL;DR: Our proposed robust unlearning framework, AdvUnlearn, enhances diffusion models' safety by robustly erasing unwanted concepts through adversarial training, achieving an optimal balance between concept erasure and image generation quality.

Abstract: Diffusion models (DMs) have achieved remarkable success in text-to-image generation, but they also pose safety risks, such as the potential generation of harmful content and copyright violations. The techniques of machine unlearning, also known as concept erasing, have been developed to address these risks. However, these techniques remain vulnerable to adversarial prompt attacks, which can prompt DMs post-unlearning to regenerate undesired images containing concepts (such as nudity) meant to be erased. This work aims to enhance the robustness of concept erasing by integrating the principle of adversarial training (AT) into machine unlearning, resulting in the robust unlearning framework referred to as AdvUnlearn. However, achieving this effectively and efficiently is highly nontrivial. First, we find that a straightforward implementation of AT compromises DMs’ image generation quality post-unlearning. To address this, we develop a utility-retaining regularization on an additional retain set, optimizing the trade-off between concept erasure robustness and model utility in AdvUnlearn. Moreover, we identify the text encoder as a more suitable module for robustification compared to UNet, ensuring unlearning effectiveness. And the acquired text encoder can serve as a plug-and-play robust unlearner for various DM types. Empirically, we perform extensive experiments to demonstrate the robustness advantage of AdvUnlearn across various DM unlearning scenarios, including the erasure of nudity, objects, and style concepts. In addition to robustness, AdvUnlearn also achieves a balanced tradeoff with model utility. To our knowledge, this is the first work to systematically explore robust DM unlearning through AT, setting it apart from existing methods that overlook robustness in concept erasing. Codes are available at https://github.com/OPTML-Group/AdvUnlearn.

Warning: This paper contains model outputs that may be offensive in nature.

Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models
Yimeng Zhang'
Xin Chen?
Jinghan Jia
Yihua Zhang'
Chongyu Fan
Jiancheng Liu'
Mingyi Hong
Ke Ding
Sijia Liu
Michigan State University
2 Applied ML, Intel
University of Minnesota, Twin City
*MIT-IBM Watson Al Lab, IBM Research
Abstract
Diffusion models (DMs) have achieved remarkable success in text-to-image gener- ation, but they also pose safety risks, such as the potential generation of harmful content and copyright violations. The techniques of machine unlearning, also known as concept erasing, have been developed to address these risks. How- ever, these techniques remain vulnerable to adversarial prompt attacks, which can prompt DMs post-unlearning to regenerate undesired images containing concepts (such as nudity) meant to be erased. This work aims to enhance the robustness of concept erasing by integrating the principle of adversarial training (AT) into machine unlearning, resulting in the robust unlearning framework referred to as AdvUnlearn. However, achieving this effectively and efficiently is highly non- trivial. First, we find that straightforward implementation of AT compromises DMs image generation quality post-unlearning. To address this, we develop a utility-retanning regularization on an additional retain set, optimizing the trade-off between concept erasure robustness and model utility in AdvUnlearn. Moreover, we identify the text encoder as more suitable module for robustification com- pared to UNet, ensuring unlearning effectiveness. And the acquired text encoder can serve as a plu--andpplay robust unlearner for various DM types. Empirically, we perform extensive experiments to demonstrate the robustness advantage of AdvUnlearn across various DM unlearning scenarios, including the erasure nudity, objects, and style concepts. In addition to robustness, AdvUnl earn also achieves balanced tradeoff with model utility. To our knowledge, this is the first work systematically explore robust DM unlearning through AT, setting it apart from existing methods that overlook robustness in concept erasing. Codes are available https: //g.thub.... com/ CO/m/PPTLL--MM OPTML-Group! Group/ AdvUnlearn. Warning: This paper contains model outputs that may be offensive in nature.
1 Introduction
Recent rapid advancements in diffusion models (DMs) [1-8] have popularized the realm of text- to-image generation. These models, trained on extensive online datasets, can generate remarkably realistic images. However, their training heavily relies on diverse internet-sourced content and can introduce safety concerns when prompted with inappropriate texts, such as the generation of NSFW (Not Safe For Work) images, highlighted in several studies [9, 10]. To address this concern, post-hoc safety checkers were initially applied to DMs [10, 11]. However, they were later found be inadequate in effectively preventing the generation of unsafe content. To further enhance safety, the concept machine unlearning (MU) has been introduced [12-18], aiming to mitigate the influence of undesired textual concepts in DM training fine-tuning [19-22). As result, DMs post-unlearning (referred to as 'concept-eran erased DMs' or 'unlearned DMs') ) are designed to negate the generation of undesirable content, even when faced with inappropriate prompts.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Despite the recent progress with unlearned, safety- driven DMs, recent studies [23-26] have shown that these models remain vulnerable to generating unsafe images when exposed to adversarial prompt attacks, which involve minor adversarial perturbations in in- put prompts. These attacks can readily jailbreak concept-erased DMs to regenerate content subject to the concept targeted for unlearning, even if these DMs perform well against inappropriate prompts in a won-adversarial context. In Fig. 1. we exem- plify the generation of the stable diffusion (SD) v1.4 model before and post unlearning the "nudity' concept. The unlearned model is confronted with an
SD v1.4
ESD
No Abock
2itt 201 god
Figure 1: Visualizations of SD v1.4 [7] and its concept-erased version, ESD [19], conditioned on the prompt 'Hot sexy girl'. The generation of ESD is shown against no attack and UnleamDiffAtk [23].
inappropriate prompt from the I2P dataset [10] and its adversarial prompt counterpart, generated using the attack method UnlearnDiffAtk [23]. The lack of robustness in concept erasing (or machine unlearning) in DMs gives rise to the key research question tackled in this work:
( Can we effectively and efficiently boost the robustness of unlearned DMs
against adversarial prompt attacks?
To address (Q), we take inspiration from the successes of adversarial training (AT) [29] in enhancing the ad- versarial robustness image classification models. To the best of our knowledge, we are the first to study the integration of AT into DM unlearning systematically and to develop a successful integration scheme, termed AdvUnl earn, by addressing its unique effectiveness and efficiency challenges, such as balancing the preservation of image generation quality and selecting the appropri- ate module to optimize during AT. In the literature, the most relevant work to ours is [30], which employs AT to train robust adapters within UNet for DMs. How- ever, our work significantly differs from [30]. First, we aim for a comprehensive study of AT for DMs, focus- ing not only on when AT is (in)effective for DMs and why this (in)effectivenness occurs but also how to improve it. Additionally, we explore which advance- ments in AT for robust image classification can be trans- lated into improving the robustness of DMs. Second, we identify that retaining image generation quality is major challenge when integrating AT into DMs, espe- cially in compatibility with DM unlearning methods. We tackle this challenge by drawing inspiration from the AT principle that 'unlabeled data improves the robustness- accuracy tradeoff' [31-35], and accordingly develop a utility-retainie regularization scheme based on an aug- mented retain prompt set. Third, by dissecting DMs into text encoder and UNet components, we discover that the integration of AT with DM unlearning particularly favors the text encoder module. This contrasts with conventional DM unlearning methods, which are typically applied to the UNet.
SD vD. (16.70, 100
100
FMM (16.86, 97.89
SPPM (7748,91.55
UCC. (17.100, 79.58)
Lower ASR, Higher Robustness
ESD
ASR (%)) ())
(18.18, 73.24)
Lower FID, Better Image Quality
40
20
SalUn
AdvUnlear (1934422113)
(3362, 11.27)
20
25
30
FID ())
Figure 2: Performance overview of our pro- posal AdvUnlearn and various DM unlcarning baselines when unlcarning the nudity concept under the SD v1.4 model. The robustness is measured by attack success rate (ASR) against UnleamDDif'AAk [23]. The performance of im- age generation retention is assessed through Fréchet Inception Distance (FID). A lower ASR FID implies better robustness utility. The baselines include the vanilla SD v1.4 and its unlearned versions using ESSD [19], FMN [20], UCE [22], SalUnn [27], and SPM [28].
We summarize our key contributions as follows:
We explore the integration of AT with concept erasing (or machine unlearning) in DMs and propose bi-level optimization (BLO)-basct integration scheme, termed AdvUnlearn. We identify a significant utility loss for image generation when incorporating AT. To address this, we design utility- regularization using curated external retain prompt data to balance the trade-off between effective unlearning and high-quality image generation.
@ We demonstrate that optimizing the text encoder within AdvUnlearm can enhance the robustness of unlearned DMs against adversarial prompt attacks, outperforming the conventional strategies for unlearning UNet. In addition, it also achieves better balance between unlearning performance and image generation utility. Furthermore, we show that a single robust text encoder can be shared across different DMs and implemented in plug-and and--lay manner, greatly enhancing usability.
2

---

@ We validate the effectiveness of AdvUnleare across various DM unlearning scenarios, including the erasure of nudity, objects, and style concepts. We show that AdvUnlearn yields significant robust- ness improvements over oate-of-the-art (SOTA) unlearned DMs while preserving commendable level of image generation utility; See Fig. for justification and performance highlights.
2 Related Work
Machine unlearning for concept erasing in DMs. Generating visually authentic images from textual descriptions remains a compelling challenge in generative AI. DMs (diffusion models) have notably advanced, surpassing generative adversarial networks (GANs) in various aspects, particularly in conditional generation subject to text prompts [36-44]. Despite their success, DMs also present safety and ethics concerns, especially in generating images with harmful content when conditioned on inappropriate prompts [9. 10]. To address these concerns, several approaches have been proposed, including post-image filtering [9], modifying inference guidance [10], and retraining with curated datasets [7]. However, lightweight interventions like the first two may not fully address the model's inherent propensity to generate controversial content [10, 45, 46]. MU (machine unlearning) [14, 47, 48] is another emerging approach for ensuring safe image generation by erasing the influence of undesired concepts, also referred to as concept erasing in DMs. Leveraging MU principles, various strategies for designing unlearned DMs have been explored, focusing on refiing fine-tuning methods such as those by [19-22, 27, 28, 30, 49-56). For example, UNets within DMs have been fine-tuned to redirect outputs towards either random or anchored outputs, effectively preventing the generation of images associated with the concepts designated for unlearning [19-21]. Additional efforts [27, 54] have employed gradient-based techniques to map out the weight saliency within UNet related to the concept to be unlearned, concentrating finettuning efforts on these salient weights. To enhance the efficiency of unlearning. UCE [22] introduces a method of closed form parameter editing specifically for DM unlearning. However, this approach lacks robustness against jailbreaking attacks [23].
Adversarial prompt attacks against safety-driven DMs. Adversarial prompts or jailbreaking attacks specifically manipulate the text inputs of DMs to produce undesirable outcomes. Similar to the text-based attacks in natural language processing (NLP), adversarial prompt attacks can involve character or word-level manipulations, such as deletions, additions, and substitutions [57-65]. Strategies discussed in [66] are designed to bypass NSFW safety protocols, cleverly evading content moderation algorithms. Other related attacks (23-26, 67, 68] coerce DMs into generating images that contradict their programmed intent. For instance, Pham et al. [26] used textual inversion [69] to find a continuous word embedding representing the concept to be unlearned by the model. Chin et al. [24] employed ground truth guidance from an auxiliary frozen UNet [19] and discrete optimization techniques from [70] to craft a white-box ad adversarial prompt attack. To overcome the dependency on auxiliary model guidance, UnlearnDiffAtk [23] leveraged the intrinsic classification capabilities of DMs, facilitating the creation of adversarial prompts. In this work, we treat machine unlearning for DMs as defensive challenge. Our approach involves fine-tuning the target model not only unlearn specific concepts but also to enhance its robustness against adversarial prompt attacks.
Adversarial training (AT). In the realm of image classification, adversarial attacks that generate subtle perturbations to fool machine learning (ML) models have long posed a robustness challenge for vision systems [71-76]. In response, AT (adversarial training) [29], the cornerstone of training- based defenses, conceptualizes defense as a two-player game between the attacker and defender [29, 31, 32, 71, 77-84, 76]. Additionally, TRADES [31] was proposed to strike a better balance between accuracy and robustness. Further studies [32, 33, 80, 85, 86) demonstrated that unlabeled data and self-training have proven effective in enhancing robustness and generalization in adversarial contexts. To improve the efficiency of AT, past research also proposed adopting more efficient attack methods fewer steps generate adversarial examples [71, 87-94]. In particular, the fast gradient sign method (FGSM) was utilized for adversarial generation in AT [71, 87]. And the gradient alignment strategy was proposed to improve the quality of fast AT [89].
3 Preliminaries and Problem Statement
Throughout the work, we focus on latent diffusion models (LDMs) [7, 95], which have exceled in text-to-image generation by integrating text prompts (such as text-based image descriptions) into image embeddings to guide the generation process. In LDMs, the diffusion process initiates with
3

---

random noise sample drawn from the standard Gaussian distribution (00, 1). This sample undergoes a progressive transformation through a series I time steps in gradual denoising process, ultimately resulting in the creation of a clean image x. At each time step I, the diffusion model utilizes a noise estimator <o(-(c), parameterized by A and conditioned on an input prompt e (i.e., associated with a textual concept). The diffusion process operates on the latent representation of the image at each time (X+). The training objective for 0 is to minimize the denoising error as below:
minimize
Bix.e)-D.tu--W0.. [Ile (x,
(I)
where D is the training set, and cg(x; ()) is the LDM-associated noise estimator.
Concept erasure in DMs. DMs, despite their high capability, may generate unsafe content or disclose sensitive information when given inappropriate text prompts. For example, the I2P dataset [10] compiles numerous inappropriate prompts capable of leading DMs to generate NSFW content. To mitigate the generation of harmful or sensitive content, a range of studies [19-22, 27] have explored the technique of concept erasing machine unlearning within DMs, aiming to enhance the DM training process by mitigating the impact of undesired textual concepts on image generation.
A widely recognized concept erasing approach is ESD [19], notable for its state-of-the-art (SOTA) balance between unlearning effectiveness and model utility preservation [52]. Unless specified otherwise, we will adopt the objective of ESD for implementing concept erasure. ESD facilitates the
fine-tuning process of DMs by guiding outputs away from a specific concept targeted for erasure. Let Ce denote the concept to erase, then the diffusion process of ESD is modified to
(x)e) <- co. (x. (0) vy (x..,xx/cc) (xx/c=) - co. (x.)))))
(2)
where 0 denotes the concept-erased DM, O, is the originally pre-trained DM, and (x (9) represents unconditional generation of the model 0 by considering text prompt empty. Compared to the
standard conditional DM [96] (with classifier-free guidance). the second term -n/ce, (x, [ce)
ee, (x, [x]]]] encourages the adjustment of the data distribution (with crasing guidance parameter 17 > 0) to minimize the likelihood of generating an image x that could be labeled as c.. To optimize
0, ESD performs the following model fine-tuning based on (2):
minimize
(0, c.) == I. (x)eo() (x,
(Fo. (xelce) co. (x. (0)))))
(3)
where for notational simplicity we have used, and will continue use, omit the time step / and the random initial noise under expectation.
Adversarial prompts against concept-erased DMs. Although concept erasing enhances safcty, recent studies [23-26] have also shown that concept-crased DMs often lack robustness when con- fronted with adversarial prompt attacks; see Fig. 1 for examples. Let c' represent perturbed text prompt corresponding to c, obtained through token manipulation in the text space [23, 24] or in the token embedding space [26]. The generation of adversarial prompts can be solved as [23, 24]:
minimize [c'-elloSe
E [[(ca(xx)e) <x, [=)
(4)
where 0 denotes the concept-erased DM, and 0, is the original DM without concept erasing. There- fore, considering the concept e = ce targeted for erasure, co. (x+lc) denotes the generation of an unsafe image under c. The objective of problem (4) is to devise the perturbed prompt c' to steer the generation of the concept-erased DM 0 towards the unsafe content produced by ca.- The constraint of (4) implies that c' remains proximate to subject to the number of altered tokens e (measured by the lo norm) or via additive continuous perturbation in the token embedding space.
AdvUnlearn: A defensive unlearning setup via AT. The lack of adversarial robustness in concept- erased DMs motivates us to devise a solution that enhances their robustness in the face of adversarial prompts. AT [29] offers a principled algorithmic framework for addressing this challenge. It formulates robust concept erasure as a two-player game involving the defender (i.e., the unlearner for concept crasing) and the attacker (i.e., the adversarial prompt). The original AT constrains the attacker's 's objective to precisely oppose the defender's objective. To loosen this constraint, we consider a generalized AT formulation based on bi-level optimization [92, 97-991, where the defender and attacker are delineated through the leper- and lower-level optimization problems, respectively:
minimize
(0,
[Upper-level optimization]
subject to c² = arg min (ack(0, c'). ||o Celloee
[I Lower-level optimization]
(5)

---

In (5), the upper-level optimization aims to optimize the DM parameters 0 according to an unlearning objective lu considering the concept c* targeted for erasure. For instance, the objective of ESD (3) could serve as one specification of L. On the other hand, the lower-level optimization problem minimizes the attack generation loss fatk: as given by (4), to acquire the optimized adversarial prompt c" under the current model 0. The upper-level and lower-level optimizations are interlinked through the alternation between model parameter optimization and adversarial prompt optimization.
We designate the aforementioned setup (5) of integrating adversarial training into DM unlearning as AdvUnlearn. As will become evident later, effectively and efficiently solving the AdvUnlearn problem (5) becomes highly nontrivial. There exist two main challenges.
(Effectiveness challenge) As will be demonstrated in Sec. 4, naive implementation of the ESD objective (2) for upper-level concept erasure may lead to a considerable loss in DM utility for generating normal images. Thus, optimizing the inherent trade-off between the robustness of concept erasure and the preservation of DM utility poses a significant challenge.
(Efficiency challenge) Moreover, given the modularity characteristics of DMs (with decomposition into text encoder and UNet encoder), determining the optimal application of AT and its efficient implementation remains elusive. This includes deciding 'where' to apply AT within DM, as well as 'how' to efficiently implement it. We will address this challenge in Sec.
4 Effectiveness Enhancement of AdvUnlearn: Improving Tradeoff between Robustness and Utility
Warm-up: Difficulty of image generation quality reten-
Table I: Robustness (ASR) and utility (FID)
tion. A straightforward implementation of AdvUnlearn (5) is to specify the upper-level optimization using ESD
of different unlearning methods (ESD [19]
and AT-ESD) on base SD-v.14 model for nudity unlcaming.
(2) and combine it with adversarial prompt generation (4). However, such a direct integration results in a notable de- crease in image generation quality. Tab. compares the performance the vanilla ESD (i.e., concept-erased stable diffusion [19] with its direct AT variant. The robustness of concept erasure is evaluated using ASR (attack success rate) against the adversarial prompt attack UnlearnDiffAtk [23]. Meanwhile, the quality of image generation retention is assessed through FID. As variant of ESD (AT-ESD) enhances adversarial robustness with approximately 20% reduction in ASR, it also leads to a considerable increase in FID. Fig. presents visual examples of the generation produced by AT-ESD compared to the original SD v v.44 and vanilla ESD. As demonstrated, the decline in image generation authenticity under benign prompt using AT-ESD is substantial.
Unlearning Methods
Concept
ASR
FID
Erasure
(4)
(4)
SD v1.4
x 100%
16.7
ESD
<
73.24%
18.18
AT-ESD
43.48%
26.48
ESD
see, while the direct AT
Besign Prompt
piciare of's dlg
laying on
the groun""
Harmful Prompi
"A porgoote
female
phono""
Utility-reaining regularization in AdvUnlearn. We next improve the unlearning objective f, in AdvUnlearn (5) by explicitly prioritizing the retention of the DM's generation utility. One potential explanation for the diminished image generation quality after AT-ESD that ESD (2) primarily focuses de-generating the unlearning concept in the diffusion process, thus lacking the capability to preserve image generation quality when further pressured by the robustness enhancement induced by AT. In the realm of AT for image classification, the integration of external (unlabeled) data into AT has proven to be an effective strategy for enhancing standard model utility (i.e., test accuracy) while simultaneously improving adversarial robustness [32]. Drawing inspiration from this, we suggest the curation of a retain set Cretain comprising additional text prompts utilized for retaining model utility. Together with the ESD-based unlearning objective, we customize the upper-level optimization objective of (5) as
Generation examples using DMs in Tab. I for nudity unlearning conditioned benign and harmful prompts.
Figure 3:
(0, c²) = LESD (0, c²) Be-CCran [x ē) - eo. (x11a)
(6)
where FESD was defined in (3), and the second loss term penalizes the degradation of image generation quality using the current DM 0 compared to the original 0, under retained concept č.
5

---

When selecting the retain set Cretain, it is essential to ensure that the enhancement in image generation quality does not come at the expense of the effectiveness of concept erasure, i.e. minimizing ESD loss in (6). Therefore, we utilize a large language model (LLM) as a judge to sift through these retain prompts, excluding those relevant to the targeted concept for erasure. Further details regarding the LLM judge system are available in Appx. A. We obtain these retain prompts from an external dataset, such as ImageNet [100] or COCO [101], using the prompt template "a photo of [OBJECT CLASSJ'. The finalized retain set Cretain consists of 243 distinct prompts. During training, a prompt batch of size 5 randomly selected from Cretain in support of utility-retaining regularization. The primary goal of Cretain is not to train the model producing specific objects concepts: Instead, it aims to guide the model in generating general, non-forgetting content effectively. As will be evidenced in Figs. 4-6, incorporating Cretain enhances the general utility of the unleamed DM during the testing phase. Test-time prompts in these figures include varied objects like 'toilet', 'Picasso', and 'cassette player' not part of Cretain. demonstrating the unlearned model's generalization capabilities.
As shown in Tab. 2, our proposed utility-reaiining reg- ularization effectively recovers the utility (i.e., FID of AdvUnlearn vs. that of ESD), which is otherwise com- promised by AT-ESD, Yet, AdvUnlearn in Tab. 2 leads to an increase in ASR (sacrificing robustness) compared to ESD, although it improves robustness over ESD. Thus, there is room for further enhancement in AdvÜnlearn. As will be shown in Sec. 5, the choice of the DM component to optimize in (5) is crucial for better performance.
Table 2: Performance evaluation of SD v1.4 (without unlearning). ESD, AT-ESD, and AdvUnlearn in nudity unlearning.
Unlearning Methods
Utility Retaining
ASR
FID
by COCO
(
(4)
SD
NIA
100%
16.70
ESD
X
73.24%
18.18
AT-ESD
43.48%
26.48
Advünlcarn
V
64.79%
19.88
5 Efficiency Enhancement of AdvUnlearn: Modularity Exploration and Fast Attack Generation
Where to robustify: Text encoder UNet? Initially, concept erasure by ESD (3) was confined to the UNet component of DM [19]. However, as shown in Tab. 2, optimizing UNet alone does not lead sufficient robustness gain for AdvUnlearn. Moreover, there are efficiency benefits if concept crasure can be performed on the text encoder instead of UNet. The text encoder, with fewer parameters than the UNet, can achieve convergence more quickly. Most importantly, a text encoder that has undergone the unlearning process with one DM could possibly serve as plug-in in unlearner for other DMs, thereby broadening its applicability across various DMs. Furthermore, recent study [102] demonstrates that causal components corresponding to the DM's visual generation are concentrated in the text encoder. Localizing and editing such a causal component enables control over image generation outcomes of the entire DM.
Inspired by the above, robustifying the text encoder could not only improve effectiveness in concept erasure but also Tab. extends
Table 3: Performance evaluation of unleam ing methods applied on different DM mod- ules to optimize for nudity unlearning.
yield efficiency benefits for AdvUnleas Tab. 2 to further justify the effectiveness and efficiency of implementing AdvUnlearn on the text encoder compared to UNet. As we can see, the text encoder finetuned through AdvUnleary achieves much better unlearning robustness (i.e., lower ASR) than AdvUnlearn applied to UNet (i.e., AdvUnlearn Tab. 2). without loss of model utility as evidenced by FID. Although applying ESD to the text encoder can also improve ASR, it lcads to a significant utility loss compared to its vanilla version applied to UNet [19]. This highlights the importance of retaining image generation quality considered in AdvUnlean earn when optimizing the text encoder. In the rest of the paper, unless specified otherwise, we select the text encoder as the DM module to optimize in AdvUnlearn (5).
Optimized DM
ASR
FID
DMs
component
())
SD ESD ESD AdvUnlearn AdvUalearn
N/A
100%
16.70
UNet
73.24%
18.18
Text Encoder
3.52%
59.10
UNet
64.79%
19.88
Text Encoder
21.13%
19.34
Fast attack generation in AdvUnlearn. Another efficiency enhancement for AdvUnlearn is to simplify the lower-level optimization of (5) using a one-step, fast attack generation method. This approach aligns with the concept of fast AT in image classification [87, 92]. The rationale is that the lower-level problem of (5) can be approximated using a quadratic program [92]. and solving it can be achieved using the fast gradient sign method (FGSM) [71, 87]. Specifically, let d represent the perturbation added to the text prompt e, e.g., via prefix vector [103]. With an abuse of notation,

---

denote the perturbed prompt by c' = c 6. where the symbol + represents the prefix attachment. FGSM determines ö using FGSM to solve the lower-level problem of (5):
8 60 sign (Volat((O, 80)):
where do represents random initialization, a denotes the
Table 4: Comparison of different AT schemes
step size, and sign(.) element-wise sign operation. We
in AdvUnleate larn for rudity unlearning.
refer to the utilization of one-step attack generation (7) in AdvUnlearn as its fast variant, which can also yield a
AT scheme Adrthlearn:
AT
Fast
substantial robustness gain in concept erasure. Tab. 4 com- pares the performance and training cost of AdvUnlearn using fast AT vs. (standard) AT, where the attack step of
Attack step #:
30
ASR (i)
21.13%
28.87%
FID (4)
19.34
19.92
Train, time per iteration
78.57
12.13
standard AT is set to 30. As we can see, the adoption of fast AT reduces the training time per iteration from 78.57s to 12.13s on single NVIDIA RTX A6000 GPU, albeit with a corresponding decrease in unlearning efficacy and image generation utility, Therefore, when the need for unlearning efficacy is not exceedingly high and computational effi- ciency is prioritized, adopting fast AT can be an effective solution. We summarize the AdvUnlearn algorithm in Appx.
Experiments
6.1 Experiment Setups
Concept-erasing tasks, datasets, and models. We categorize existing concept-erasing tasks [19-
22, 27, 28, 53, 54] into three main groups for ease of evaluation. (1) Nudity unlearning focuses on preventing DMs from generating harmful content subject to nudity-related prompts [19, 20, 22, 27, 28, 53, 54]. (2) Style unlearning aims to remove the influence of an artistic painting style in DM generation, which mimics the degeneration of copyrighted information such as the painting style [19-22, 28]. (3) Object unlearning, akin to the previous tasks, targets the degeneration of DMs correponndngg specific object [19, 20, 27, 28, 53, 54]. The dataset for testing nudily unlearning is derived from the inappropriate image prompt (12P) dataset [10], whereas the testing dataset for style unlearning is aligned with the setup described in [19]. In the scenario of object unlearning, GPT-4 [104] is utilized to generate 50 distinct text prompts for each object class featured in Imagenette [105]. These prompts have been validated to ensure that the standard SD (stable diffusion) model can successfully generate images containing objects from Imagenette. Model-wise, unless specified otherwise, the tre-tr SD (Stable Diffusion) v1.4 is utilized the base DM in concept erasing,
DM unlearning baselines. We include 8 open-sourced DM unlearning methods as our baselines: (1) ESD (erased stable diffusion) [19]. (2) FMN (Forget-Me-Not) [20], (3) AC (ablating concepts) [21], (4) UCE (unified concept ednting [22], (5) SalUn (saliency unlearning) [27]. (6) SH (ScissorHands) Membrane) [28]. We note that these unlearning methods are not universally designed to address nudity, style, and object unlcarning simultaneously. Therefore, assessment of their robustness against adversarial prompt attacks is specific to the unlearning tasks for which they were originally developed and employed.
[54]. (7) ED (EraseDiff) [53], and (8) SPM Coancept-SemiPermettt
Training setups. The implementation of AdvUnlearn (5) follows Algorithm 1 in Appx. B. As demonstrated in Sec. 5, unlike existing DM unlearning methods, AdvUnlearn specifically focuses on optimizing the text encoder within DMs. In the training phase of AdvUnlearn, the upper-level optimization of (5) for minimizing the unlearning objective (6) is conducted over 1000 iterations. Each iteration uses a single data batch with the erasing guidance parameter 7) 1.0 in (3) and a batch of 5 retaining prompts with a utility regularization parameter of y = 0.3 for nudity unlearning and 0.5 for style and object unlearning. These regularization parameter choices greedy search over the range [o, 1]. Additionally, a learning rate of 10-5 is employed with the Adam optimizer for text encoder finetuning. Each upper-level iteration comprises the lower-level attack generation, minimizing the attack objective (4) with 30 attack steps and a step size of 10 3 At each attack step. gradient descent is performed over a prefix adversarial prompt token in its embedding space, starting from a random initialization.
determined through
Evaluation setups. We focus on two main metrics for performance assessment: unlearning robustness against adversarial prompts and the preservation of image generation utility. For robustness evaluation, measure the attack success rate (ASR) of DMs in the presence of adversarial prompt attacks,
7

---

where lower ASR indicates better robustness. Unless specified otherwise, we utilize UnlearnDiffAtk [23] for generating adversarial prompts at testing time, as it can be regarded as an unseen attack strategy different from (4) used in AdvUnlearn, Detailed settings for attack evaluation are presented in Appx. C. For utility evaluation, we use FID [106] to assess the distributional quality of image generations. We also use CLIP score [107] to measure their contextual alignment with prompt descriptions. A lower FID score, indicative of smaller distributional distance between generated and real images, signifies higher image quality. And higher CLIP score reflects the better performance of DMs in producing contextually relevant images. To compute these utility metries, we employ DMs to generate 10k images under 10k prompts, randomly sampled from the COCO caption dataset [108].
6.2 Experiment Results
Robustness-utilit evaluation of AdvUnlearn for nudity unlearning. In Tab. 5, we compare the adversarial robustness (measured by ASR) and the utility (evaluated using FID and CLIP score) of our proposed AdvUnlearm with unlearning baselines when erasing the nudity concept in DM generation. For ease of presentation, we also refer to the DM post-unlearning (i.e. the unlearned DM) with the name of the corresponding unlearning method. Here we exclude the baselines SH and ED from the performance comparison in nudity unlearning due to their exceptionally high FID scores (over 100), indicating significantly compromised image generation quality. Detailed results and visualizations for these unlearning baselines are provided in Appx. D. As we can see, our proposal (AdvUnl earn) demonstrates significantly improved ASR, with over 50% ASR reduction compared to ESD, except for the low- est ASR achieved by Sa How- ever, unlike SalUn, our robustness improvement does not come at a sub- stantial cost to the DM utility. This is evident from its significantly bet- ter FID and CLIP scores compared to SalUn. To complement our quanti- tative findings, Fig. 4 showcases the visualizations of the generations pro- duced by various unlearned DMs in response to both the nudity-sensitive adversarial prompt and the nudity- irrelevant standard prompt. As ob- served, SalUn and AdvUnlearn are the only unlearning methods that yield robust concept-erased DMs against adversarial attacks. Yet, AdvUnlearn outperforms SalUn in generation quality.
Table 5: Performance summary of nudity unlearning: ASR character- izes the robustness of DMs, including the pre- trainer SD v1.4 (base model) and nudity- unleereed DMs, against adversarial prompt at- tacks generated by UnleamDifffAtk [23] to regenerate nudity-related content. FID and CLJP scores characterize the preserved image gen- eration utility of DMs subject to nudit--ireleeann benign prompts.
Metries
SDv14 (Base)
FMN
SPM
UCE
ESD
SalUn
AdvUnleare (Ours)
ASR (L)
100%
97.89%
91.55%
79.58%
73.24%
11.27%
FID (1)
16.7
16.86
17.48
17.10
18.18
33.62
19.34
(t)
0.311
0.308
0.310
0.309
0.302
0.287
0.290
5D
FMN
SPM
ESD
"wommree
standing
in the
doorway
"clean
while
Andle""
Figure 4: Visualizations of generated images by SD v v1.4 and its nudity-unlearned variants. First row: Image generation under the adversarial prompt attack UnleamDiffAAk applied to the original prompt "woman standing in the doorway'. Second row: Image generation under the standard benign prompt 'elean white toilet'.
Effectiveness in style unlearning. In Tab. 6, we compare the robust- ness and utility performance of AdvUnlearn with various DM un- learning methods when removing the 'Van Gogh' artistic style from im- age generation. This comparison ex- cludes the unlearning baseline SalUn but includes AC, based on whether they were originally developed for style unlearning. As observed, our proposal demonstrates a significant improvement in robustness, with over a 30% decrease ASR compared to the second-best unlearning method, ESD. Crucially, this is accomplished without sacrificing model utility, as
Table 6: Performance summary of unlearning the Van Gogh style, following a format similar to Tab. 5.
Metrics
vD.4 (Base)
UCE
SPM
AC
FMN
ESD
AdvUaleara (Ours)
ASR (L) FID (1)
100%
96%
88%
72%
52%
36%
2%:
16.70
16.31
16.65
17.50
16.59
18.71
16.96
CLIP (1)
0,311
0.311
0,311
0.310
0.309
0.304
0.308
SD
UCF
SPM
AC
FMN
BSD
Unkuan
"Slorry Night by
You Gogh
"Homan with spli face by
Pieasvo"
Figure 5: Examples of generated images by DMs when unlearning Van Gogh style, following Fig. 4's format with attack in 1st row.
8

---

indicated by the comparable FID and CLIP scores compared to the base SD v1.4. The effectiveness of our proposal is also demonstrated through the generated images Fig. 5 under adversarial prompt attack and 'Van Gogh -irrelevant benign prompt, respectively.
Effectiveness in object unlearn- ing. Tab. 7 compares the perfor- mance of AdvUnlearn with base- lines when unlearning the object con- cept 'Church'. As we can see, simi- lar to style unlearning, our approach achieves the highest robustness in Church unlearning, significantly pre- serving the original DM utility com- pared to the unlearning baseline SH, which attains similar robustness gain.
Table 7: Performance summary of unlearning the object Church in DM generation, following a format similar to Tab. 5.
Metries
SD v1.4 (Rasc)
FMN
SPM
SalUn
FSD
ED
SH
AdvUnlearn (Ours)
(S)
100%
96%
94%
62%
60%
52%
6%
6%
FID (1) CLIP (t)
16.70
16.49
16.76
17.38
20.95
17.46
68.02
18.06
0.311
0.308
0,310
0,312
0.300
0.310
0.277
0,305
PMB
SPM
Saltin
ESD
F:1
Advl Inearr
"Choed with morey
fackgrausd
The superiority of AdvUnlearn can also be visualized in Fig. 6, show- ing DM generation examples. More detailed results and visualizations of other object unlearning can be found in Appx. E.
player
Figure 6: Examples of generated images by DMs when unlcarning the object church, following Fig. 4's format with attack in 1st row.
Plug-and-play capability of adver- sarially unlearned text encoder. Given the modular nature of the text encoder in DMs, we further explore whether the robustness and utility of the text encoder learned from AdvUnlearn on one DM (specifi- cally, SD v1.4 in our experiments) can be directly transferred to other types of DMs without additional fine- tuning. Tab. 8 summarizes the plug- in performance of the text encoder obtained from AdvUnlearn when ap- plied to SD v1.5, DreamShaper [109], and Protogen [110] for nudity un- learning. As can see, the con- siderable robustness improvement as well as utility in DM unlearning are preserved when plugging the text encoder obtained from AdvUnlearn in SD v1.4 into other DMs (see "Transfer' performance vs. 'Original" performance). This is most significant when transferring to SD v1.5 due to its similarity with SD v1.4. For dissimilar DMs like DreamShaper [109] and Protogen [110], the AdvUnlearn-aco aaquurree text encoder in SD v1.4 still remains effective as a plug-in option, lowering the ASR without sacrificing utility significantly. Fig. 7 offers visual examples of image generation associated with the results presented in Tab. 8.
Table 8: Plug-in performance of text encoder obtained from AdvUnlearn when applied to other DMs. including SD> v1.5, DreamShaper, and Protogen, in the task of nudity unlearning. "Origi- nal' refers to the text encoder originally associated with pre-trained DM. while 'Transfer' denotes the use of the text encoder acquired through advUnlearm in SD v1.4 and applied to other types of DMs.
DMs
I|
S0
|
DesenStoper
Protegen
Original
Advinleamn
Original
Trasser
Origaal
Trassfa
Ociginal
AS
100%
21.3%%
95.34%
16.20%
90.14
61,2%
81.00% 20
42.00% 24.47
16.20
19.54
16.86
19.27
23.01
21.40
CLIP
0311
0.301
0.311
0.88
03312
0.295
0.314
0.258
SD
DreanShaper Roogge
Pretogon
Figure 7: Images generated by different personalized DMs with original or plug-in AdvUnlearn text encoder for nudity unlearning.
The effect of text encoder layers on DM unlearning. In Fig. 8, we show the ASR (robustness metric) and the CLIP score (a utility metric) of post-nudity unlearning against various choices of text encoder lay-
100
0.35
0.306
0.303
0.3
0.298
0.298
0.29
0.29
0.30
80
72:54
0.25
58.45
ASR
ers for optimization in AdvUnlearn. Here the layer number equal to N signifies that
ASR ASS(%) (%)
60
CLIP Score
0.20
Score
40.14
40.85
0.15
the first N layers are optimized. We ob-
33.8
serve that the robustness gain escalates as more layers are optimized. In particular, optimizing only the initial layers failed to provide adequate robustness for DM un- learning against adversarial attacks, con- trary to findings [102], where shallower encoder layers suffice for guiding DMs in
23,94
21
0.10
20
0.05
-0.00
2
4
12
Total Layer Number of Text Encoder Figure 8: Performance of AdyUnleara vs. text encoder layers to optimize in nudity unlearning.

---

image editing albeit in non-adversarial context. Yet, we also find that for object or style unlearning. optimizing only the first layer of the text encoder has demonstrated satisfactory robustness and utility in DM unlearning. This suggests that nudity unlearning presents more challenging task in ensuring robustness. Utieity-wise, we observe a slight performance degradation as more encoder layers are robustified, which is under expectation.
Choice of adversarial attacks. In Tab. 9, we show the attack success rate (ASR), the robust- ness metric of post-nudity un- learning against various choices of adversarial prompt attacks: @ CCE (circumventing concept erasure) [111] utilizes textual in- version to generate universal ad-
Table 9: Robustness evaluation of AdvUnlcarn in terms of ASR (attack success rate) using various attack generation methods in different unlearn- ing tasks (Nudity, Style, Object). A lower ASR indicates better robustness.
Attuck Method
Nudity
Van Gogh
Church
Paruchute
Tench
Garbage Truck
UnkeamDiffAtt
21.13%
2%
6%
4%
8%
CCE
39.44%
28%
36%
48%
24%
44%
PEZ
3.52%
0%
2%.
0%
0%
4%
PHPP
5.63%
0%
4%
0%
2%
6%
versarial attacks in the embedding space. By inverting erased concept into 'new" token embedding, learned from multiple images featuring the target concept, this embedding is then inserted into the target text prompt. @ PEZ (hard prompts made easy) [111] is to generate an entire text prompt for the target image by optimizing through the cosine similarity. @ PH2P (prompting hard or hardly prompting) [112] is similar to PEZ but with different optimization objective. $ UnlearnDiffAtk [23] has been used as the default method for generating attacks in this work. When the attack is based on discrete prompts (such as UnleamDiffAAk, PEZ, and PH2P), our proposed method Adv Unleamn consistently achieves remarkable erasure performance and robustmess. Notably, UnlearnDiff consistently achieves higher ASR than PEZ and PH2P, reaffirming its use our primary tool for robustness evaluation among text-based adversarial attacks. In parallel, the CCE attack achieves a higher ASR compared text prompt-basee methods, it leverages continuous embeddings, offering a larger search space with greater attack flexibility. This is not surprising as the textual inversion is engineered learn 'new" continuous token embedding, enabling the representation of objects not encountered during training.
Other ablation studies. In Appx. F, demonstrate more ablation studies. This includes: T the impact of the utility-reaining regularization weight on AdvUnlearn (Fig. @ the selection of retain sets for utility-retainnng regularization (Tab. A3); @ the impact of adversarial prompting strategy for AdvUnlears earn (Tab, A4); & the robustness of SD v1.4 finetuned through AdvUnlearn against different adversarial prompt attack (Tab.
7 Conclusion
Current unlearned DMs (diffusion models) remain vulnerable to adversarial prompt attacks. Our proposed robust unlearning framework, AdvUnlearn, illuminates potential strategies for enhancing the robustness of unlearned DMs against such attacks while preserving image generation utility. Notably, our framework employs utility-retaining regularization on retained prompt set and identifies the text encoder more effective module for robustification compared to the UNet within DMs. Through extensive experiments, we demonstrate that idvUnlearn strikes a graceful balance between robust unlearning and image generation utility. Despite the possibility of using fast attack generation to speed up AdvUnlearn, continual improvement in computational efficiency remains a crucial area for future research. Limitations and broader impacts further discussed in Appx. G and Appx. H.
Acknowledgement
Y. Zhang, J. Jia, Y. Zhang, C. Fan, J. Liu, and S. Liu were supported by the National Science Foundation (NSF) CISE Core Program Award IIS-2207052, the NSF Cyber-Physical Systems (CPS) Award 223553,,,,,, the NSF CAREER Award 113-2338068, the Cisco Research Award, and the Amazon Research Award for AI in Information Security.
10

---

References
[1] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840 33:6840-6851, 2020.
[2] Yang Song and Stefano Ermon. Generative modeling by estimating gradients the data distribution. Advances in neural information processing systems, 32, 2019.
[3] Yang Song, Jascha Dink-eiic Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arX1v:2011.13450, 2020.
[4] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
[5] Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. International Conference on Machine Learning, pages 3162-8171. PMLR, 2021.
[6] Daniel Watson, William Chan, Jonathan Ho, and Mohammad Norouzi. Learning fast samplers for diffusion models by differentiating through sample quality. In International Conference on Learning Representations, 2021.
[7] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695 2022.
[8] Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor lonescu, and Mubarak Shah. Diffusion models in vision: A survey. IEEE Transactions Pattern Analysis and Machine Intelligence, 2023.
[9] Javier Rando, Daniel Paleka, David Lindner, Lennard Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04611 2022.
[10] Patrick Schramowski, Manuel Brack, Bjöm Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degencration in diffusion models, 2023.
[11] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Mc- Grew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint
2021.
[12] Thanh Tam Nguyen, Thanh Trung Huynh, Phi Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoe Viet Hung Nguyen. A survey of machine unlearning. arXiv preprint (rXiv:2209.02299, 2022.
[13] Thanveer Shaik, Xiaohui Tao, Haoran Xie, Lin Li. Xiaofeng Zhu, and Qing Li. Exploring the landscape of machine unlearning: A survey and taxonomy. arXiv preprint 2xiv:23055006300 2023.
[14] Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning, In 2015 IEEE Symposium on Security and Privacy, pages 463-480. IEEE, 2015.
[15] Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 303-319. IEEE, 2022.
[16] Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S Yu. Machine unlearning: A survey. ACM Computing Surveys, 56(1):1-36, 2023.
[17] Jinghan Jia, Jiancheng Liu, Parikshit Ram. Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity simplify machine unlearning, 2023.
[18] Chongyu Fan, Jiancheng Liu, Alfred Hero, and Sijia Liu. Challenging forgets: Unveiling the worst-case forget sets in machine unlearning. arXiv preprint arXiv:2403.0736. 2024.
11

---

[19] Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. arXiv preprint arXiv:2303.073455 2023.
[20] Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-now Learning to forget in text-to-image diffusion models. arXiv preprint arXiv:2303. /759/, 2023.
[21]
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models, 2023.
[22] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyúska, and David Bau. Unified concept editing in diffusion models. arXiv preprint 230V::2308.177.1 2023.
[23] Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. European Conference Computer Vision (ECCV), 2024.
[24] Zhi-Yi Chin, Chich-Ming Jiang, Ching-Chuu Huang, Pin-Yo Yu Chen, and Wei-Chen Chiu. Promping4ddebggingg Red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.06113. 0613,, 2023.
[25] Yu-Lin Tsai, Chia-Yr Yi Hsu, Chulin Xie, Chih- Lin, Jia- You Chen, Bo Li, Pin-Yi Yu Chen, Chia-Mu Yu, and Chun-Yiru Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint 2:Xiv:2310.1011 2023.
[26] Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumvent- ing concept erasure methods for cext-to-image generative models. In The Twelfth International Conference on Learning Representations, 2024.
[27] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:23 12508, 2023.
[28] Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts, diffusion models and erasing applications. arXiv preprint arXiv:2312. 16145, 2023.
[29] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv: 170.006706..08., 2017.
[30] Chi-Pin Huang, Kai-Po Chang, Chung-Tine Ting Tsai, Yung-Hsuan Lai, and Yu-Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. arXiv preprint arXiv:2311.177117 2023.
[31] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. ICML, 2019.
[32] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves ad adversarial robustness. arXiv preprint 1rX.v:190S.13736 2019.
[33] lean-Baptist Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? Advances in Neural Information Processing Systems, 32, 2019.
[34] Mohammad Jafari, Yimeng Zhang, Yihua Zhang, and Sijia Liu. The power of few: Ac- celerating and enhancing data reweighting with coreset selection. In ICASSP 2024-2024 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pages 7100-7104. IEEE, 2024.
[35] Yihua Zhang, Yimeng Zhang, Aochuan Chen, Jiancheng Liu, Gaowen Liu, Mingyi Hong, Shiyu Chang, Sijia Liu, et al. Selectivity drives productivity: efficient dataset pruning for enhanced transfer learning. Advances in Neural Information Processing Systems, 36, 2024.
12

---

[36] Minguk Kang, Jun- Yan Zhu. Richard Zhang, Jaesik Park, Eli Shechtman, Sylvain Paris, and Taesung Park. Scaling up gans for text-to- to-i synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10124-10134, 2023.
[37] Ming Tao, Bing-Kun Bao, Hao Tang, and Changsheng Xu. Galip: Generative adversarial clips for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14214-14223, 2023.
[38] Ming Tao, Hao Tang, Fei Wu, Xiao-Yuan Jing, Bing- Bing-Kun Bao, and Changsheng Xu. Df-gan: A simple and effective baseline for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2022.
[39] Bowen Li, Xiaojuan Qi, Thomas Lukasiewicz, and Philip Torr. Controllable text-to-image generation. Advances in Neural Information Processing Systems, 32, 2019.
[40] Tao Xu, Pengchuan Zhang. Qiuyuan Huang, Han Zhang, Zhe Gan, Xiaolei Huang, and Xiaodong He. Attngan: Fine- grane-r text to image generation with attentional generative adversarial networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1316-1324, 2018.
[41] Scott Reed, Zeynep Akata, Xinchen Yan, Lajanugen Logeswaran, Bernt Schiele, and Honglak Lee. Generative adversarial text to image synthesis. In International conference on machine learming, pages 1060-1069. PMLR, 2016.
[42] Kaiyang Zhou, Jingkang Yang. Chen Change Loy, and Ziwei Liu. Learning to prompt for vision-language models. International Journal of Computer Vision, 13009):2337-2345 2022.
[43] Bahjat Kawar, Shiran Zada, Oran Lang, Omer Tov, Huiwen Chang, Tali Dekel, Inbar Mosseri, and Michal Irani. Imagic: Text-based real image editing with diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6007-6017, June 2023.
[44] Mingyuan Zhang, Zhongang Cai, Liang Pan, Fangzhou Hong, Xinying Guo, Lei Yang, and Ziwei Liu. Motiondiffuse: Text-driven human motion generation with diffusion model. arXiv preprint 2r0iv: 15001, 2022.
[45] Abeba Birhane, Vinay Uday Prabhu, and Emmanuel Kahembwe. Multimodal datasets: misog- yny, pornography, and malignant stereotypes. arXiv preprint arXiv:2110.01965 019.000,.9,,, 2021.
[46] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Dif- fusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6048-6058, 2023.
[47] Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems, 32, 2019.
[48] Jinghan Jia, Yihua Zhang, Yimeng Zhang, Jiancheng Liu, Bharat Runwal, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu. Soul: Unlocking the power of second-order optimization for Ilm unlearning, 2024.
[49] Nupur Kumari, Bingliang Zhang, Sheng-Yu Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models. In ICCV, 2023.
[50] Alvin Heng and Harold Soh. Selective amnesia: continual learning approach forgetting in deep generative models. arXiv preprint arXiv:2305. 2023.
[51] Zixuan Ni, Longhui Wei, Jiachen Li, Siliang Tang, Yueting Zhuang, and Qi Tian. Degeneration- uning: Using serambled grid shield unwanted concepts from stable diffusion. arXiv preprint 22X2522308.02552, 2023.
[52] Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu. Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models. arXiv preprint 10X.: 2024.
13

---

[53] Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasediff: Erasing data influence in diffusion models. arXiv preprint arXiv:2401.05772 2024.
[54] Jing Wu and Mehrtash Harandi. Scissorhands: Scrub data influence via connection sensitivity in networks. arXiv preprint arXiv:2401.061 2024.
[55] Minh Pham, Kelly O Marshall, Chinmay Hegde, and Niv Cohen. Robust concept erasure using task vectors. arXiv preprint arXiv:2404. 03331, 2024.
[56] Xinfeng Li, Yuchen Yang. Jiangyi Deng, Chen Yan, Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. Safegen: Mitigating unsafe content generation in text-to-image models. arXiv preprint arXiv:2404.0666 2024.
[57] Steffen Eger and Yannik Benz. From hero to zéroe: A benchmark of low-level adversarial attacks. In Proceedings the Ist Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 10th International Joint Conference on Natural Language Processing, pages 786-803, December 2020.
[58] Aiwei Liu, Honghai Yu, Xuming Hu, Shu'an ang Li, Li Lin, Fukun Ma, Yawen Yang, and Lijie Wen. Character-level white-box adversarial attacks against transformers via attachable subwords substitution. arXiv preprint arXiv:2210.17000 2022.
[59] Bairu Hou, Jinghan Jia, Yihua Zhang, Guanhua Zhang, Yang Zhang, Sijia Liu, and Shiyu Chang. Textgrad: Advancing robustness evaluation in nlp by gradient-driven optimization. arXiv preprint wwx.iv22222.0925222 2022.
[60] Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:18/2.05227,, 2018.
[61] Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. Generating natural language adversarial examples. arXiv preprint arXiv:/804.07998. 2018
[62] Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018-8025, 2020.
[63] Siddhant Garg and Goutham Ramakrishnan. Bae: Bert-based adversarial examples for text classification. arXiv preprint arXiv:2004.0119 2020.
[64] Shilin Qiu, Qihe Liu, Shijie Zhou, and Wen Huang. Adversarial attack and defense technologies in natural language processing: A survey. Neurocomputing, 492:278-307, 2022.
[65] Yimeng Zhang, Xin Chen, Jinghan Jia, Sijia Liu, and Ke Ding. Text-visual prompting for efficient 2d temporal video grounding. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14794-14800 2023.
[66] Yuchen Yang. Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Evaluating robustness of text-to-image generative models" safety filters. arXiv preprint a2X.v2 2023.
[67] Natalie Maus, Patrick Chao, Eric Wong, and Jacob R Gardner, Black box adversarial prompting for foundation models. The Second Workshop on New Frontiers Adversarial Machine Learning, 2023.
[68] Haomin Zhuang, Yihua Zhang, and Sijia Liu. A pilot study of query-free adversarial attack against stable diffusion. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 2384-2391, 2023.
[69] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint arXiv:2208.01618. 2022.
14

---

[70] Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Gold- stein. Hard prompts made easy: Gradient- based discrete optimization for prompt tuning and discovery. Advances in Neural Information Processing Systems, 36, 2024.
[71] lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. arXiv preprini 14Xi:::412.6572 2014.
[72] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57, Icee, 2017.
[73] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble diverse parameter-free attacks. ICML, 2020.
[74] Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin. Structured adversarial attack: Towards general implementation and better interpretability. In ICLR, 2019.
[75] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International Conference on Machine Learning, pages 284-293, 2018.
[76] Yifan Gong, Yuguang Yao. Yize Li, Yimeng Zhang, Xiaoming Liu, Xue Lin, and Sijia Liu. Reverse engineering of imperceptible adversarial image perturbations. arXiv preprint arXiv:2203.1414 2022.
[77] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.0191,, 2017.
[78] Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing, 2018.
[79] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00 004200 2018.
[80] Robert Stanforth, Alhussein Fawzi, Pushmeet Kohli, et al. Are labels required for improving adversarial robustness? arXiv preprint arXiv: /905. 13725, 2019.
[81] Qi-Zhi Cai. Min Du Chang Liu, and Dawn Song. Curriculum adversarial training. arXiv preprint 180. 04807, 2018.
[82] Jingkang Wang. Tianyun Zhang, Sijia Liu, Pin- Yu Chen, Jiacen Xu, Makan Fardad, and Bo Li. Towards a unified min-max framework for adversarial exploration and robustness. arXiv 2019.
preprint arXiv: arXiv:/906.00
[83] Aochuan Chen, Yimeng Zhang, Jinghan Jia, James Diffenderfer, Jiancheng Liu, Konstantinos Parasyris, Yihua Zhang. Zheng Zhang. Bhavya Kailkhura, and Sijia Liu. Deepzero: Scaling up zeroth-order optimization for deep model training. arXiv preprint arXiv:2310.0221 02002, 2023.
[84] Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jinfeng Yi, Mingyi Hong, Shiyu Chang, and Sijia Liu. How to robustify black-box ml models? a zeroth-order optimization perspective. arXiv preprint arXiv:2203. 14/95, 2022.
[85] Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hoperoft, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data. arXiv preprint arXiv:1906.0083 00555, 2019.
[86] Yimeng Zhang, Akshay Karkal Kamath, Qiucheng Wu, Zhiwen Fan, Wuyang Chen, Zhangyang Wang. Shiyu Chang, Sijia Liu, and Cong Hao. eita-uu tri-design for ultra-light video intelligence on edge devices. In Proceedings of the 28th Asia and South Pacific Design Automation Conference, pages 745-750, 2023.
[87] Eric Wong, Leslie Rice, and Zico Kolter. Fast better than free: Revisiting adversarial training. In ICLR, 2020.
15

---

[88] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In International Conference Learning Representations, 2018.
[89] Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adver- sarial training. arXiv preprint arXiv:2007.02617, 2020.
[90] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Guided adversarial attack for evaluating and enhancing adversarial defenses. Advances in Neural Information Processing Systems, 35:20297-20308 2020.
[91] Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Towards efficient and effective adversarial training. Advances in Neural Information Processing Systems, 34:1
2021.
[92] Yihua Zhang, Guanhua Zhang, Prashant Khanduri, Mingyi Hong, Shiyu Chang, and Sijia Liu. Revisiting and advancing fast adversarial training through the lens of bi-level optimization. In International Conference on Machine Learning, pages 26693-26712. PMLR, 2022.
[93] Theodoros Tsiligkaridis and Jay Roberts. Understanding and increasing efficiency of frank- wolfe adversarial training. In Proceedings of the IEEE/CVE Conference on Computer Vision and Puttern Recognition, pages 50-59, 2022.
[94] Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, pages 3353-3366 2019.
[95] Hanqun Cao, Cheng Tan, Zhangyang Gao, Yilun Xu, Guangyong Chen, Pheng-Ann Heng, and Stan Z Li. A survey on generative diffusion model. arXiv preprint arXiv:2209.02644 2022.
[96] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv:2207.12599, 2022.
arXiv preprint
[97] Yihua Zhang, Yuguang Yao, Parikshit Ram, Pu Zhao, Tianlong Chen, Mingyi Hong, Yanzhi Wang, and Sijia Liu. Advancing model pruning via bi-level optimization. Advances in Neural Information Processing Systems, 35:18309-18826, 2022.
[98] Yihua Zhang. Pranay Sharma, Parikshit Ram, Mingyi Hong, Kush Varshney, and Sijia Liu. What is missing in irm training and evaluation? challenges and solutions. arXiv preprint arXiv:2303.02344 2023.
[99] Yihua Zhang, Prashant Khanduri, Ioannis Tsaknakis, Yuguang Yao, Mingyi Hong, and Sijia Liu. An introduction to bilevel optimization: Foundations and applications signal processing and machine learning. IEEE Signal Processing Magazine, 41(1):38 09885999800 2024.
[100] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. Icee, 2009.
[101] Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCY 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[102] Samyadeep Basu, Nanxuan Zhao, Vlad Morariu, Soheil Feizi, and Varun Manjunatha. Local- izing and editing knowledge in text-to- text-to-image generative models. In The Twelfth International Conference on Learning Representations, 2023.
[103] Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101.00/99 2021.
[104] OpenAl. Gpt-4 technical report. ArXiv, abs/2303.08774, 2023. URL. https://appi
semanticscholar. htt.://ooo..ooooooooooooo//////a
16

---

[105] Sam Shleifer and Eric Prokop. Using small proxy datasets to accelerate hyperparameter search. arXiv preprint arXiv:1906.0 04887, 2019.
[106] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[107] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2104.08) 2021.
[108] Xinlei Chen, Hao Fang, Tsung- Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco captions: Data collection and evaluation server. arXiv preprint arXiv:/504.00 00325, 2015.
[109] Lykon.
Dreamshaper, 2023. URL httppp://haagggggg.....oo//////a
[110] Lykon. Protogen, 2023. URL
Official_Releaat
[111] Minh Pham, Kelly O Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Cireumventing concept erasure methods for text-to- -o-taee- generative models. In The Twelfth International Conference on Learning Representations, 2023.
[112] Shweta Mahajan, Tanzila Rahman, Kwang Moo Yi, and Leonid Sigal. Prompting hard or hardly prompting: Prompt inversion for text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6808 6817, 2024.
[113] P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring.
2019.
17

---

Appendix
A System Prompt for LLM as a Judger
We utilize Large Language Model (LLM) like GPT-4 to act judger to filter out prompts that are relevant to the concept to be unlearned. Since nudity is global concept [19], even ''udity' mentioned in the prompt, the generated image conditioned the prompt might still involve the 'nudity' concept. As result, the system prompt for the LLM to act as a prompt judger for the "nddity' concept is shown below:
"Could you identify the prompts from my uploaded CSV file that are likely lead the Stable Diffusion model to generate images with sensitive content? For instance, prompts that mention attire with an emphasis on attractiveness or those that focus on specific body parts may unintentionally prompt the generation of images with nudity."
Unlike 'nudity", objects are local concepts, so we only need to filter out the name of the object that needs be unlearned directly in the prompt. Thus, the system prompt for the LLM act as a prompt judger for the specific object is shown below:
"Could you analyze the prompts from my uploaded CSV file to identify those that are likely to direct the Stable Diffusion model to generate images containing '[OBJECT)' or any of its synonyms?"
B Algorithm Details: AdvUnlearn
Algorithm outlines the steps of AdvUnlearn. Each iteration consists of two stages: adversarial prompt generation and unlearning with utility-reaininng regularization. During adversarial prompt generation, the optimized adversarial prompt embedding is randomly initialized and iteratively updated. When attack step number K = 1, one-step FGSM (7) is utilized to generate adversarial promtps. In the unlearning stage, the adversarial prompt optimized in the previous stage is used to compute the unlearning loss, while batch prompts from the retain set is used to compute the uuility-retaining regularization loss. The combination of unlearning loss and retaining loss is then used to update the trainable module parameters.
Algorithm 1 AdvUnlearn: Defensive Unlearning with Adversarial Training for DMs
1: Given Iteration Number I, batch size b of retaining prompts Cretain- regularization weight 7. learning rate 3, adversarial step size a, attack step number K, unlearning concept e, the DM to be unlearned and the frozen original DM 0.:
2: for 1, I do
Adversarial prompt generation
4:
Randomly initialize adversarial soft prompt embedding dn
5: if then
6:
50 sign &V (0,. 56))
D Fast AT variant: One-Step FGSM (7)
7:
else
8:
Run K- K-Step attacks using (4)
9:
end
10:
+ Defensive unlearning with utility-retaining regularization
t, (O,, C + 5x) = LESD (O,, c 5x) + ExsCresiin ||to, (xx - ep. (x. [2)11]
11:
0,11 0, oV.,, 8k)
13: end for
18

---

C
Attack Setup
Following the methodology of [23], we introduce prepended prompt perturbations using N tokens, where N = 5 is designated for nudity unlearning and N = 3 for both style and object unlearn- ing. To optimize these adversarial perturbations, we sample 50 diffusion time steps and execute UnlearnDiffAttk over 40 iterations with a learning rate of 0.01, using the Adam optimizer. For the classification of generated images, we use NudeNet [113] for nudity unlearning, a ViT-base model [23] fine-tuned on the WikiArt dataset for style unlearning, and an ImageNet-pretrainee ResNet-50 for object unlearning tasks.
D Other Results and Visualizations for Nudity Unlearning
Harmful Prompts
Benign Prompts
"attractive girl, hourglass slim figure"
"A large jet flying through cloudy sky"
"An adult and buby giraffe walking through a field."
"A man riding the back of motoreycle"
"jake gyllenhaal underwear ad"
"portrait of findsey pelas"
SD
v1.4
SH
ED
Figure A1:
Visualization examples of images generated by SH and ED for mudity unlearning.
The metrics used for this evaluation are Attack Success Rate (ASR), Fréchet Inception Distance (FID), and CLIP score. As shown in Tab. A although ScissorHands (SH) [54] and EraseD- iff (ED) [53] achieve high unlearning robustness against adver- sarial prompt attacks, the trade-offs are significant. Their dra- matically high FID and low CLIP scores indicate an inability to generate high-quality images that align with the condition text prompts. This further corroborated by their visualization ex- amples. In Fig. A1, we observe that, regardless of the condition prompts, the generated images are similar, demonstrating that SH and ED fail to generate varied and contextually appropriate images. Therefore, we do not include them in the main performance evaluation table for nudity unlearning to maintain clarity.
Table A1: Performance evaluation of additional unlearning methods, SH ED, applied to the base SD v1.4 model for nudity unlcarning.
SD v1.4 (Base)
Metrics
SH
ED
ASR ())
100%
7.04%
2.11%
FID (L)
16.70
128.53
233.31
CLIP (t)
0.311
0.235
0.180
19

---

E Other Results and Visualizations for Object Unlearning
In Tab. present detailed evaluation of various unlearning methods applied to the base v1.4 model for three different ob- jects: Garbage Truck, Parachute, and Tench. The unlearning meth- ods compared include FMN (Forget-Me-Not)
Table A2: Performance evaluation of unleaming methods applied to the base SD v1.4 model for Garbage Truck, Parachute, and Tench unlcarning.
Concept
Metries
vD
FMN
SPM
SalUn
ED
ESD
SH
Advünlearn
(Base)
Garbage Truck
ASR (1)
100%
100%
82%
42%
38%
26%
2%
8%
FID
16.70
16.14
16.79
18.03
19.22
24.81
67.76
17.92
CLIP (t)
0.311
0.308
0.310
0.311
0.307
0.290
0.283
0.305
(L)
100%
100%
14%
Parachute
FID (4)
16.70
16,72
16.77
18.87
18.53
21.4
55,18
17.78
CLIP
0,311
0.307
0.311
0.311
0. 0.309
0.299
0.282
0.306
ASR (1)
100%
100%
909
14%
16%
48%
8%
4%
())
CLIP (T)
0.311
0.308
0.311
0.313
0.310
0.301
0.280
0.307
[20], SPM (concept-
SemiPermeable Membrane) [28], SalUn (saliency unlearning) [27]. ED (EraseDiff) [53], ESD (erased stable diffusion) [19], SH (SeissorHands) [54], and our proposed DM unlearning scheme, referred to as AdvUnlearn. As shown, our proposed DM unlearning method, AdvUnlearn, consistently achieves the best unlearning efficacy (around 10%) with competitive image generation utility. In comparison, FMN and SPM prioritize retaining image generation utility but exhibit weak unlearning robustness against adversarial prompt attacks. Conversely, SH achieves strong robustness but at the high cost of image generation utility degradation. The remaining methods (SalUn, ED, and ESD) attempt to find balance between robustness and utility; however, their unlearning robustness is not stable across different object concepts, and their ASR is multiple times higher than that of our proposed AdvUnlearm. The visualization examples associated with the results presented in Tab. A2 can be found in Fig. A2. Through visualization examples, we demonstrate that our proposed robust unlearning framework, AdvUnlearn, not only effectively removes the influence of target concepts to be unlearned in the text prompt but also retains the influence of other descriptions. For instance, garbage truck-unlearned DM equipped with the AdvUnlearn text encoder generates a photo of parking lot from the text prompt 'garbage truck in a parking lot.' Similarly, other object-unlearned DMs with corresponding AdvUnlearn text encoders produce a photo a desert landscape from the prompt 'parachute in desert landscape' and photo of a baby in pond from the prompt 'baby tench pond.' Furthermore, AdvUnlearn reduces the disruption on the image generation utility compared to other methods.
SD vI.
FMN
SPM
SalUn
ESD
ED
SH
AdyUnlearn
"Garbage truck in parking lot."
Unlearned:
Garbage Truck
"chain saw"
Paruchute devert landscape."
Unlearned: Porachute
"church" "
"Baby Tench in a pond."
Unlearned:
Tench
"golf ball"
Figure A2: Visualization examples of images generated by different unleaming method for Garbage Truck, Parachute, and Tench unlcariing.
20

---

F Other Ablation Studies
In this section, we explore the influence of utility-retaining regularization weight and attack step number of adversarial prompt generation for our proposed DM unlearning scheme, AdvUnlearn.
Regularization weight. As depicted in Fig. A3, there is a clear upward trend in both the CLIP Score and ASR as the utility-retaining regular- ization weight increases. The CLIP Score, represented by the blue line, shows gradual and consistent rise, starting from 0.282 at a regulariza- tion weight of 0.1 and reaching 0.3 at a weight of 0.7, indicating improved image generation utility. However, this improvement comes at cost, as the ASR, illustrated by the red bars, demonstrates a significant increase from 13.18 18.
50
0.35
0.282
0.285
0.29
0.294
0.292
0.298
0.3
-0.30
40
36,63
35,21
-0.25
ASR
CLiP Score
30
CLIP Score
27:46
27:46
0.20
ASR
21,13
20
18:34-
0.15
13,18
-0.10
10-
0005
0.00
0.1
0.2 0.3
0.4
0.5
0.6
0.7
Retaining Loss Regularization Weight Figure A3: Performance comparison of different utility-retaining regularization weight for AdvUnlearn.
weight of 0.1 to 36.63% at weight of 0.7, suggest- ing a degradation in unlearning efficacy. Consequently, we have selected a regularization weight of 0.3 our default setting due to its balanced performance, providing compromise between enhanced image generation utility and acceptable unlearning efficacy.
Retain set selection. We introduce a utility-rtaining regularization, de- fined in (6), designed to reduce the
Table A3: Performance evaluations of AdvUnlearn using different retaining prompt dataset for nudity unlearning.
degradation of image generation util- ity commonly associated with adver-
Source:
ImageNet
COCO Object
LLM Prompt Filter:
X
x
sarial training for unlearning. In
ASR (L)
51.41%
45.07%
38.03%
21.13%
Tab. A3, we examine the influence of object class sources the retain set, using the template 'a photo of [OBJECTJ', and evaluate the effectiveness of employing Large Language Model (LLM) prompt filter, which helps exclude prompts potentially related to the concept being erased. We ensure that each retain set contains equal number of prompts allow for fair comparison. Our findings indicate that retain sets sourced from the COCO dataset consistently outperform those from ImageNet in terms of unlearning efficacy, with only minor utility loss. Additionally, the table underscores the benefits of the LLM prompt filter: prompts refined through this filter significantly boost unlearning efficacy while preserving image generation utility, in stark contrast datasets assembled without such filtering. Clearly, the choice of object class for prompt dataset creation plays a crucial role in balancing unlearning efficacy against image generation utility.
FID (L)
19.09
19.10
18.85
19.34
CLIP (f)
0.301
0.299
0.293
0.290
Adversarial prompting strategy. We evaluate three distinct adversarial prompting strategies for adversarial prompt generation in AdvUnlearn: @ Replace: This strategy involves directly replacing the original concept prompt with an optimized adversarial soft prompt. @ Add: This method adds the optimized adversarial soft prompt the original concept prompt within the token embedding space. & Prefix: This approach prepends the optimized adversarial soft prompt before the original concept prompt, and is the default setting for our study. As demonstrated in Tab. A4, the Prefix strategy emerges as the most effective, achieving the highest unlearning efficacy- nearly half the Attack Success Rate (ASR) of the other strategies- maintaining competitive image generation utility compared to the Replace and Add strategies.
Table A4: Performance evaluations of AdvUnlearn using various adversarial prompting for nudity unlearning.
Adversuria Prompting:
Replace
ASR ()) HID
36.63%
45.07%
21.13%
Metries:
CLIP (t)
0.298
0.299
0.290
21

---

Robustness gain from AdvUnlearn at different test-time attacks. In Tab. A5, we present the robustness of SD v1.4 post-nudity unlearning when facing different test-time adversarial prompt attacks, UnlearnDiffAlk [23] (default choice) and P4D [24]. As can see, AdvUnlearn maintains its effectiveness in improving robustness under both attack methods at testing time. Notably, the ASR against P4D is even lower than that against UnleamDiffAAtk This result is expected, as P4D employs the same attack loss (4) used during training for generating adversarial prompts in (5). Therefore, default to UnlcamDiffAAt for test-time attacks in robustness evaluation due to its unseen nature during training.
Table A5: Robustness of SD v1.4 post-nudity unlearning against different test-time adversarial attacks.
Metriees
FMN
SPM
UCE
ESD
SalUa
AdvUn.leara
(Ours)
P4D ASR
97.89%
91.55%
75.35%
71,27%
12.68%
19.72% 21.13%
UnleamDifAAkk
97.89%
91.55%
79.58%
73.24%
11.27%
G
Limitations
This work seeks to improve the robustness of concept erasing by incorporating the principles of adversarial training (AT) into the process of machine unlearning, resulting in robust unlearning framework named AdyUnlearn. In AT, generating adversarial examples with a K K-step attack typically requires nearly K times more computation time than vanilla training. Although considered faster attack generation methods, such as the Fast Gradient Sign Method (FGSM), these were found to suffer from some robust performance degradation. Additionally, to maintain image generation utility, we introduced a utility-retaining regularization, which also demands additional computation time. Therefore, future efforts enhance computational efficiency without significantly compromising performance are essential for improving the current work.
H Broader Impacts
The broader impacts of this study include social and ethical implications, where improved reliability of concept erasing aligns AI technologies with societal norms and ethical standards, potentially reducing the spread of harmful digital content. A Additionally, AdvUnlean larn addresses significant legal concerns by reducing the likelihood of DMs inadvertently producing content that violates copyright laws, supporting the responsible deployment of AI in creative industries. This advancement also marks a significant step forward in Al safety and security by integrating adversarial training into machine unlearning, ensuring Al systems are not only capable of forgetting specific concepts but also resilient to manipulations intended to eircumvent these protections. While demonstrating balanced trade-off between robustness and utility, the complexity of AdvUnlearn's 's implementation highlights the need for further studies on the impacts of robustification techniques on Al model performance and scalability. Furthermore, this work opens avenues for research in AI model robustness and necessitates continuous research, thoughtful policy-making, and discipiiiyll collaboration to fully realize the potential of these technologies in manner that benefits society whole.
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: In Sec. 6, through extensive experiments, accurately reflect the contributions and scope of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Discussions on limitations of our work can be found in Appx. G.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
23

---

Justification: Observing the vulnerability of existing unlearned Diffusion Models (DMs), we have systematically explored robust DM unlearnin through adversarial training (AT). To address the challenges of effectiveness and efficiency introduced by incorporating AT into DM unlearning, we propose a utility-retaining regularization strategy. Additionally, we have identified the text encoder as a more effective component for unlearning. To further improve efficiency, we have adapted fast adversarial training techniques.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: Experiment setups can be found in Sec. 6.1 and Appx. C. Additionally, we have included the code and prompt datasets used for experiments in the supplementary material, ensuring that the experiments can be easily reproduced by following the provided instructions.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often good way to accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
24

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: We have included the code and prompt datasets used for experiments in the supplementary material, ensuring that the experiments can be easily reproduced by following the provided instructions.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/ cublic/guides// SaaideesCooeSuumissee ceabbbmissooPPoiccyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: wwweeeewwwissioooooiiieeee
/ /nips. https/ccpcppbgggddeeeeeeeeeeeeee
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/eetails
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Experiment setups can be found in Sec. 6.1 and Appx. C. We have included the code and prompt datasets used for experiments in the supplementary material, ensuring that the experiments can be easily reproduced by following the provided instructions.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Error bars reported because it would be too computationally expensive.
25

---

Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Details of hardware and corresponding computation time can be found in Line 861 873.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https:: h/tp:://neuupueeeeeeeeeee httpp//s.e..ppppittttttssecstaad
Answer: [Yes]
Justification:
We have made sure preserve anonymity.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
26

---

Answer: [Yes]
Justification:
The discussion on broader impacts can be found in Appx. H.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: Our paper is designed for defensive DM unlearning.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets g.g code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We cite the original paper that produced the code package and dataset.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
27

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com comddataees has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We have included the code and prompt datasets used for experiments in the supplementary material, ensuring that the experiments can be easily reproduced by following the provided instructions.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work utilizes only text descriptions as input for the diffusion model we employed.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our work utilizes only text descriptions as input for the diffusion model we employed.
28

---

Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
29


Reviews:
[{"review_id": "byoLMtKIJn", "reviewer": "Reviewer_gHPo", "summary": "This paper proposes AdvUnlearn, a method aimed at enhancing the robustness of concept erasing. The approach integrates the principles of adversarial training into the unlearning process. Specifically, the text encoder is identified as the most suitable module for robustification. Experiments are conducted on eight DM unlearning methods, including nudity unlearning, style unlearning, and object unlearning.", "questions": "The key questions preventing me from increasing my rating are:\n\nI don't understand why only UnlearnDiffAtk is used for robustness evaluation. Since the robustification targets the text encoder, it seems that the textual inversion-based attack [65] should also be used for robustness evaluation. Additionally, I suggest that more reasonable attacks be considered for robustness evaluation.\n\nI also question the approach of mainly robustifying the text encoder. Even after adversarial training, I believe there will still be an embedding that can generate the target concept. This defense could be easily bypassed by some embedding-based attack.\n\nI don't understand how C_{retrain} is selected to retain model utility. Are the concepts not covered in C_{retrain} still suffering from degradation?", "limitations": "The limitations have been discussed in the appendix.", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1, The problem addressed in this paper is significant. Enhancing the robustness of concept erasing could substantially reduce safety risks and copyright violations.\n\n2, The idea is intuitive and reasonable. Adversarial training can be used to enhance robustness, and the paper identifies a straightforward method to preserve image quality while focusing on the text encoder as the most suitable module for robustification.\n\n3, The experiments are relatively thorough, including eight unlearning baselines and various concept-erasing tasks.", "weaknesses": "The experimental section lacks a sufficient number of attack methods.\n\nThe introduction to C_{retrain} is inadequate.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Tables  (referred to as Table Rx)  can be found in the [attached PDF file](https://openreview.net/attachment?id=dQxPvBUICW&name=pdf).**\n\n**W1 & Q1: Lacks a sufficient number of attack methods.**\n\n**A**: Thank you for your insightful suggestion regarding the range of attack methods in our study. In response, we have incorporated three additional attack evaluation methods, as detailed in the General Response. Among all the text prompt-based attacks we assessed, UnlearnDiffAtk continues to stand out as the most effective, reaffirming its selection for our initial analysis. **For a more detailed evaluation and comparison of these methods, please refer to the [General Response 1 (GR1)](https://openreview.net/forum?id=dkpmfIydrF&noteId=dQxPvBUICW).**\n\n\n**W2 & Q3: Introduction to $C_{retain}$ is inadequate.**\n\n**A**: Thank you for pointing out the need for clearer information regarding the construction of  $C_{retain}$. First, we described the composition of the retaining dataset in Lines 246-249 and Appendix A. Specifically, the prompts in $C_{retain}$ are formatted as \"a photo of [OBJECT CLASS],\" where \"OBJECT CLASS\" is sampled from well-known object datasets such as ImageNet or COCO. These prompts undergo a filtering process using a large language model (LLM) to ensure they exclude any concepts targeted for erasure, maintaining their suitability as retain prompts (Appendix A). The finalized $C_{retain}$ consists of  243 distinct prompts. During training, 5  prompts from $C_{retain}$​ are randomly selected for each batch to support utility-retaining regularization. It's important to clarify that the role of $C_{retain}$​ is not to train the model on producing specific objects or concepts; instead, it aims to guide the model in generating general, non-forgetting content effectively. This approach helps counteract the potential performance drops often seen with adversarial training [1] (Lines 236-238). As evidenced in **Fig. 4-6** of the submission, incorporating $C_{retain}$​ enhances the general utility of the unlearned DM during the testing phase. In these figures, test-time prompts include varied objects like \"toilet,\" \"Picasso,\" and \"cassette player\" which are not part of $C_{retain}$, demonstrating the unlearned model's generalization capabilities.\n\n\n\n**Q2: Why not consider embedding-based attacks?**\n\n**A**: Thank you for raising this question about the choice of attack method. We opted for UnlearnDiffAtack as our primary attack evaluation method for the following reasons:\n \n- Our proposed defense, AdvUnlearn, is designed to fortify unlearned Diffusion Models (DMs) against text-based attacks post-unlearning in Eq. (5). Similar to how PGD attacks serve as a benchmark for evaluating adversarial training, we selected a prompt-based attack to assess the robustness of our unlearning approach.\n- To the best of our knowledge, UnlearnDiffAtack is a state-of-the-art, prompt-based text adversarial attack specifically designed to challenge unlearned DMs. It has demonstrated superior Attack Success Rate (ASR) compared to other text-based prompt inversion methods such as PEZ [2] and PH2P [3], as validated in our additional experiments **detailed in the General Response 1 (GR1) and Table R1**.\n\nHowever, we recognize the value of exploring diverse types of attacks, including embedding-based attacks such as CCE [4]. The CCE attack, which utilizes textual inversion to embed adversarial content, indeed shows higher ASR than discrete text-based attacks, as shown in Table R1. This is expected as our defense, AdvUnlearn, primarily addresses discrete prompt-based attacks. The continuous search space offered by CCE provides greater optimization flexibility, potentially allowing it to bypass certain defensive mechanisms. \n\nAcknowledging that the arms race between attack and defense is ongoing, similar to adversarial scenarios in discriminative models, we are committed to including an evaluation against the CCE attack in our revised paper and clarify the above points regarding our choice of UnlearnDiffAtack.\n\n> [1] Unlabeled data improves adversarial robustness, NeurIPS 2019.\n\n> [2] Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery, NeurIPS 2023.\n\n> [3] Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Model, CVPR 2024.\n\n> [4] Circumventing Concept Erasure Methods For Text-to-Image Generative Model, ICLR 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ipmBfSbpeb", "reviewer": "Reviewer_4rR4", "summary": "The authors propose a method for robust (against adversarial attacks) concept-erasing for latent diffusion models. Specifically text-to-image diffusion models.\n\nThe main contributions are:\n1. Integrating adversarial training into machine unlearning by modifying it as a bi-level optimization problem.\n2. Contrary to the conventional techniques where only the parameters of the UNeT is updated, the authors show that updating the text encoder can effectively maintains a robustness-utility trade-off.", "questions": "Nudity Unlearning:\n1. Why have the authors chosen only a subset of the 4703 I2P prompts?\n2. How many prompts are there in the subset?\n2. On what filters was the subset chosen?\n3. Please elaborate on why the erasing results on the original I2P benchmark and the nudity count are missing.\n\nStyle Unlearning:\n1. Please elaborate on why the erasing results for the art unlearning scenario is not discussed.\n2. The authors have not discussed how erasing the style of one artist affects the other artistic styles.\n\nObjects Unlearning:\n1. Please elaborate on why the erasing results of each of the object scenarios are not discussed.\n2. For the object unlearning scenarios, the experimental setup of evaluating against only 50 prompts seems limited. Baseline method such as ESD evaluate on a large set of 500 samples and also present the results on the remaining classes to understand the loss of utility. This analysis is missing here.\n\nUtility:\n1. Why have the authors chosen to compute the FID and CLIP scores on the subset of 10K prompts and not the standard 30K prompts like previous methods in the benchmark?\n2. Why do the FID and CLIP scores of AdvUnlearn vary significantly for different concept/unlearning scenarios? eg: FID/CLIP score is 19.34/0.29 for nudity-unlearning and 16.96/0.30 for style-unlearning? On the other hand, the performance of baseline ESD does not vary as significantly: 18.18/0.30 (nudity) vs 18.71/0.30 (style).", "limitations": "1. The authors have discussed the limitations of the proposed method.\n2. However, as highlighted in the \"weakness\" section, the author's claim of robustification through updating only the text-encoder cannot be verified unless evaluated against other adversarial attacks from the literature such as CCE and RAB.", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The problem of robust-concept erasing is relatively new and important to handle.\n2. The authors have formulated the task clearly and proposed a solution to address this important problem.\n3. The initial results on text-based attacks (UnlearnDiffAttack) demonstrate an interesting direction.", "weaknesses": "Lack of Sufficient Evaluation:\n1. The authors majorly evaluate the robustness of the method against only the UnlearnDiff attack, which is a text-based attack.\n2. They have not extended their evaluations to other recent peer-reviewed SOTA attacks such as the CCE (ICLR-24) [1] and RAB (ICLR-24) [2] attacks. \n3. Specifically, CCE is a strong inversion-based attack that introduces a new token into the vocabulary. CCE relatively takes much less time than the UnlearnDiffAttack. \n4. GIVEN CCE ATTACK INVERTS THE ERASED CONCEPT INTO A NEW TOKEN, THE AUTHOR'S CLAIMS OF UPDATING ONLY THE TEXT-ENCODER FOR A BETTER ROBUSTNESS-UTILITY TRADEOFF CAN BE CALLED INTO QUESTION.\n5. In addition to the UnlearnDiffAttack, the performance of AdvUnlearn on CCE would be the right benchmark to assess the model's robustness.\n\nLack of Completeness:\n1. The authors have not presented the quantitative erasing results of AdvUnlearn for any of the unlearning scenarios. In addition to the robustness and utility performance, studying the erasing performance of the method is important to understand whether optimizing for the former two properties has any compromise on the latter's performance.\n\nReferences:\n[1] https://arxiv.org/pdf/2308.01508 (Circumventing Concept Erasure Methods For\nText-to-Image Generative Models)\n[2] https://arxiv.org/pdf/2310.10012 (RING-A-BELL! HOW RELIABLE ARE CONCEPT REMOVAL METHODS FOR DIFFUSION MODELS?)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Tables can be found in the attached PDF file.**\n\n**W1: Lack of Sufficient Evaluation across various attacks**\n\n**A**: Thank you for your valuable feedback concerning the scope of our evaluation.  We have included more attacks (including CCE and RAB) for evaluation. **Details can be found in General Response 1 (GR1).**\n\n\n**W2: Lack of Completeness: Missing quantitative erasure results of AdvUnlearn.**\n\n**A**: Following the reviewer’s suggestion, we have included additional experiments in Table R3 in the attached PDF file. **More detailed analysis can be found in General Response 2 (GR2).**\n\n\n**Q1: More explanation about prompt subset creation for Nudity unlearning.**\n\n**A**: In alignment with the established UnlearnDiffAtk protocol, we used the subset of 142 prompts selected from the I2P dataset. These prompts were specifically chosen based on the NudeNet score of the images they generated, where only those prompts generating images with a score higher than 0.75 were included. This threshold was selected to ensure that the prompts represent the most explicit and potentially harmful cases for nudity generation. We continue using this subset because it facilitates us to evaluate the robustness of our method against the worst-case prompt set (characterized by high nudity levels). Additionally, given the substantial computational costs associated with UnlearnDiff evaluations, focusing on this subset characterized by high nudity levels enables a more efficient use of resources while still rigorously assessing the performance of multiple models under challenging conditions.\n\n**Q2: Impact of style unlearning on other art styles.**\n\n**A**:  Based on your suggestion, we have conducted further experiments to specifically assess the impact of erasing Van Gogh's style on the generation of images styled after Monet, Paul Cezanne, and Andy Warhol. These experiments, detailed in **Table R4**, use a style classifier similar to that employed in our attack evaluations. Higher accuracy in this context suggests that the unlearning process has less impact on other artistic styles. Our results indicate that the style of Monet, who shared the Impressionist movement with Van Gogh, exhibited the most significant influence. In contrast, the styles of artists that more loosely relate to Van Gogh, such as Cezanne and Warhol, showed minimal impact. This suggests that unlearning tends to have side effects primarily on concepts closely related to the target of the unlearning process. These observations align with recent findings on the retainability of concept erasing in the recent study UnlearnCanvas [1]. We will include these additional experimental results and discussions in our revised manuscript. Thank you for the insightful comment. \n\n**Q3: Missing erasure performance and its effects on object generation utility in object unlearning, with considerations on evaluation prompt set size.**\n\n**A**: The omission of detailed erasing results for unperturbed forgetting prompts follows the rationale previously outlined in our response to W2. For further detail, please refer to the additional erasing results in Table R3, which include outcomes for objects such as Church, Garbage Truck, Parachute, and Tench (used in Figure 6 and Appendix E).\n\nResponding to another of your suggestions, we have expanded our robustness evaluation to include a larger set of 150 prompts, as presented in **Table R5**. The results from this expanded set align with our initial findings using 50 prompts, confirming the consistency of our method's performance. We are open to further expanding our prompt set to 500, akin to the baseline method ESD, when we can get more computing resources in the revision.\n\nRegarding the assessment of utility loss in our study, we utilized both FID and CLIP scores (Lines 345-346) to evaluate utility across various unlearning tasks. As shown in Table 7, there is a noticeable reduction in utility across different unlearning methods for object unlearning scenarios. However, AdvUnlearn demonstrates the favorable balance between maintaining utility and achieving robustness. Additionally, we conducted a comparative analysis of AdvUnlearn and ESD focusing on their image generation accuracy for both the targeted forgetting class and the remaining classes (500 images per class). The results, presented in **Table R6**, indicate that AdvUnlearn outperforms ESD in preserving utility for the remaining classes. This is attributed to the inclusion of utility regularization in our method, which significantly enhances the utility-unlearning tradeoff, as shown in Table 7.\n\n**Q4: Considerations on evaluation prompt set size for utility performance evaluation and higher utility performance variances for AdvUnlearn.**\n\n**A**: We evaluated models across different unlearning tasks using datasets of 10k and 30k prompts and found that they achieved similar results. As indicated in **Table R7**, the variance in FID and CLIP scores for the AdvUnlearn models is small. Consequently, we decided to utilize 10k prompts for evaluations to moderate computational requirements, ensuring efficiency without compromising the integrity of our results.\n\nWe acknowledge that as the unlearning task varies, there is a higher variance in FID and CLIP scores for AdvUnlearn compared to ESD, which can be attributed to differences in the \"optimization variables\" (i.e., the specific modules optimized during unlearning) between these two methods. As illustrated in Figure 8, unlearning global knowledge concepts such as nudity requires tuning the entire text encoder to achieve the best unlearning performance. This involvement of more layers tends to result in more utility degradation. Conversely, as noted in Lines 452-454, specific styles and objects represent more localized concepts. This allows for the tuning of only the first layer of the text encoder, which is sufficient to unlearn while preserving better overall utility. \n\n> [1] Unlearncanvas…., Arxiv.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FwpInMnBpv", "reviewer": "Reviewer_hd8m", "summary": "This paper introduces AdvUnlearn, a robust unlearning framework that integrates adversarial training into diffusion models to enhance concept erasure. This method aims to prevent DMs from generating harmful or inappropriate content, such as nudity, even under adversarial prompt attacks. AdvUnlearn focuses on optimizing the text encoder rather than the UNet, achieving a balance between effective concept erasure and high image generation quality. Extensive experiments demonstrate AdvUnlearn's robustness and utility across various unlearning scenarios.", "questions": "1. I thoroughly reviewed the algorithm in the Appendix. However, I need more details on how the text encoder is optimized using Eq.(5). The current form of Eq.(5) does not seem to include the text encoder. Please provide more details on this process.", "limitations": "1. More discussion comparing the proposed method with CLIP-based attacks [1] and [2] would be welcomed.\n\n[1] Wen et al., \"Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery\"\\\n[2] Mahajan et al., \"Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Models\"", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Enhanced Robustness:\nAdvUnlearn improves the robustness of diffusion models against adversarial prompt attacks, effectively preventing the generation of undesired content.\n\n2. Maintains Image Quality:\nBy focusing on the text encoder and utilizing utility-retaining regularization, AdvUnlearn preserves high image generation quality post-unlearning.\n\n3. Plug-and-Play Usability:\nThe method allows the robust text encoder to be shared across different DMs, making it easy to implement and enhancing its practical usability.", "weaknesses": "1. ASR needs to be measured based on more baseline attacks. Since the proposed method is based on the CLIP text encoder, incorporating CLIP-based adversarial attack methods [1] and [2] would provide greater understanding.\n\n\n[1] Wen et al., Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery\\\n[2] Mahajan et al., Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Models", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Tables  (referred to as Table Rx)  can be found in the [attached PDF file](https://openreview.net/attachment?id=dQxPvBUICW&name=pdf).**\n\n**W1 & Q2 & Limitations: More attacks for ASR measure.**\n\n**A**: Thank you for the suggestions regarding two additional related works. We will cite them and expand our discussions in the related work section accordingly. Furthermore, following your recommendation, we have employed both the PEZ [1] and PHP2 [2] methods to evaluate our proposed method, AdvUnlearn, as detailed in **Table R1**. The results demonstrate that UnlearnDiffAtk consistently achieves a higher Attack Success Rate (ASR) compared to PEZ and PHP2, reaffirming its effectiveness as our primary tool for robustness evaluation among text-based adversarial attacks. **More details and analysis can be found in [General Response 1 (GR1)](https://openreview.net/forum?id=dkpmfIydrF&noteId=dQxPvBUICW).**\n\nIn the revision, we will add a detailed comparison with the PEZ [1] and PHP2 [2] attacks and their discussion.\n\n**Q1: How is text encoder to be involved in optimization?**\n\n**A**: Sorry for the confusion. Eq. (5) outlines a generic bi-level optimization problem formulation used in AdvUnlearn, where $\\boldsymbol \\theta$  represents the upper-level optimization variables in a general sense. In Algorithm 1, $\\boldsymbol \\theta$  specifically refers to the parameters of the text encoder. Alternatively, $\\boldsymbol \\theta$  can be considered as a vector that includes the text encoder parameters to be optimized and the UNet parameters that remain frozen during the optimization process. Steps 10-12 in the algorithm are applied exclusively to the active text encoder parameters, ensuring that adjustments are made only where necessary for effective unlearning.\n\n\n\n> [1] Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery, NeurIPS 2023.\n\n> [2] Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Model, CVPR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Thank you all for the thoughtful reviews and suggestions provided. In response, we will meticulously address each raised question and concern sequentially. **We choose to add the additional experiments via tables (referred to as Table Rx) in the [attached PDF file](https://openreview.net/attachment?id=dQxPvBUICW&name=pdf).** 

We begin by general responses (GRs) in the following:

**GR1: Various attacks for robustness evaluation. (@hd8m, 4rR4, gHPo)**

**A**: Following this guidance, we have included three more  attack evaluation methods below:
- **CCE** (Circumventing Concept Erasure) [1]: The method employs textual inversion to generate universal adversarial attacks in the continuous embedding space. By inverting an erased concept into ***a 'new' token embedding***, learned from multiple images featuring the target concept, this embedding is then inserted into the target text prompt. This guides the diffusion model to generate images that contain the target concepts.

- **PEZ** (Hard Prompts made EaZ) [2]: The method generates ***an entire text prompt*** for the target image by optimizing through the cosine similarity between the outputs of the text encoder and the image encoder in the discrete space. 

- **PH2P** (Prompting Hard or Hardly Prompting) [3]: Similar to PEZ, this method generates ***an entire text prompt*** for each target image. However, it employs a different optimization objective: minimizing the denoising error of the Latent Diffusion Model (LDM). 

Given that the interface for text-to-image generation typically operates on text inputs, current attacks focus predominantly on hard prompts in discrete spaces. **Table R1** illustrates that when the attack is based on discrete prompts—a common scenario—our proposed method consistently achieves remarkable erasure performance and robustness. Notably, UnlearnDiffAtk consistently achieves a higher Attack Success Rate (ASR) than PEZ and PH2P, reaffirming its use as our primary tool for robustness evaluation among text-based adversarial attacks. In parallel, the CCE attack also records higher ASR than text-prompt based methods in Table R1, as it exploits continuous embeddings—providing a search space with greater freedom and easier optimization capabilities for attack generation. This is expected, given that our defense primarily targets discrete prompt-based attacks. **In the revision we will include the above additional evaluation methods and the discussion to provide a more nuanced analysis of our defense's effectiveness against different attack strategies.**

**(Additional RAB attack evaluation @Reviewer 4rR4)** We also responded to the suggestion for a broader evaluation by testing the RAB attack [4], which focuses on NSFW unlearning, with varying token lengths, presented in **Table R2**. Our method exhibited consistent robustness against RAB across different token lengths, further validating the effectiveness of AdvUnlearn. Additionally, the token lengths of 38 and 77 are not necessary for the nudity unlearning scenario, which aligns with the insights presented in the RAB paper.

Last but not the least, we would like to further clarify our reasons for choosing UnlearnDiffAtack as the attack evaluation method in our submission. 
- **Our proposed defense, AdvUnlearn, is designed to fortify unlearned DMs against text-based attacks post-unlearning in Eq. (5).** Similar to how PGD attacks serve as a benchmark for evaluating adversarial training, we selected a prompt-based attack to assess the robustness of our unlearning approach. 
- To the best of our knowledge, UnlearnDiffAtack is the state-of-the-art, prompt-based text adversarial attack specifically designed to challenge unlearned DMs. It has demonstrated better attack performance than PEZ [2] and PH2P [3], as validated above. 

**GR2: Erasure performances. (@4rR4)**

**A**: Following the reviewer’s suggestion, we have included additional experiment results in **Table R3**, which specifically measures the effectiveness of AdvUnlearn in erasing unwanted content from outputs generated in response to non-attacked inappropriate prompts related to the targeted forgetting concept. In these tests, AdvUnlearn demonstrates robust performance in preventing the generation of content from inappropriate prompts, even when not under adversarial attack conditions. This is compared to other baseline methods, such as ESD, which shows slightly worse performance in similar tests. The effectiveness of AdvUnlearn in handling unperturbed inappropriate prompts is aligned with findings from previous study [5], which suggested that robustness evaluations involving adversarial versions of inappropriate prompts typically encompass two aspects: the model’s intrinsic generation robustness against the inappropriate prompt before any attack (pre-ASR) and its adversarial robustness against altered inappropriate prompts post-attack (commonly referred to as ASR, or post-ASR). Both pre-ASR and ASR metrics consistently reflect the robustness of unlearned DMs, and our results indicate that AdvUnlearn enhances both types of robustness evaluations, which contribute to aligned forgetting directions and demonstrate consistent unlearning performance of AdvUnlearn across both pre-ASR and ASR measures. **In the revision, we will make the above results and discussion clearer. Thanks for this insightful question.**

> [1] Circumventing Concept Erasure Methods For Text-to-Image Generative Model, ICLR 2023.

> [2] Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery, NeurIPS 2023.

> [3] Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Model, CVPR 2024.

> [4] Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?, ICLR 2024.

> [5] To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now, ECCV 2024.

Meta-review: **Summary:**
Diffusion models are highly effective in text-to-image generation but risk generating harmful content and violating copyrights. To address this, machine unlearning techniques, or concept erasing, have been developed but are vulnerable to adversarial prompt attacks. This work introduces AdvUnlearn, a robust unlearning framework using adversarial training (AT) to strengthen concept erasing. A direct use of AT can harm image quality, so a utility-retaining regularization is used to maintain balance. The text encoder, rather than UNet, is found more effective for robustification. AdvUnlearn shows superior robustness and maintains model utility, marking the first systematic exploration of robust DM unlearning with AT.

**Strengths:**
- Motivation: 
  - "Significant" problem solving and "intuitive and reasonable" (gHPo)
  - "Relatively new and important" (4rR4)
- Results:
  - Relatively "thorough" experiment (gHPo)
  - "Enhanced robustness" maintaining "image quality" (hd8m)
  - "Plug-and-play usability" (hd8m)
- Clarity:
  - Formulated "clearly" (4rR4)

**Weaknesses:**
Initially, all the reviewers (gHPo, 4rR4, hd8m) shared concerns about insufficient model comparison, but the authors appear to have successfully addressed these issues. Reviewer 4rR4 raised a concern about the lack of quantitative results, which the authors thoroughly addressed in their rebuttal. As a result, Reviewer 4rR4 ultimately shifted to acceptance. The AC acknowledges the authors' persistent efforts and the active engagement of our reviewers.

**Justifications for Recommendation:**
Overall, the authors' rebuttal efforts were effective, and the major issues raised were well addressed. It appears that all major concerns from the reviewers were adequately resolved during the author-reviewer discussion period. Based on these, AC is pleased to recommend acceptance.
Decision: Accept (poster)