Direct Unlearning Optimization for Robust and Safe Text-to-Image Models
Authors: Yong-Hyun Park
Sangdoo Yun
Jin-Hwa Kim
Junho Kim
Geonhui Jang
Yonghyun Jeong
Junghyo Jo
Gayoung Lee
Venue: NeurIPS 2024 poster (2024)
Keywords: diffusion models
unlearning
safety
Primary area: safety_in_machine_learning
TL;DR: We erase the not-safe-for-work (NSFW) concepts in text-to-image diffusion models using image-based unlearning.

Abstract: Recent advancements in text-to-image (T2I) models have greatly benefited from large-scale datasets, but they also pose significant risks due to the potential generation of unsafe content. To mitigate this issue, researchers proposed unlearning techniques that attempt to induce the model to unlearn potentially harmful prompts. However, these methods are easily bypassed by adversarial attacks, making them unreliable for ensuring the safety of generated images. In this paper, we propose Direct Unlearning Optimization (DUO), a novel framework for removing NSFW content from T2I models while preserving their performance on unrelated topics. DUO employs a preference optimization approach using curated paired image data, ensuring that the model learns to remove unsafe visual concepts while retain unrelated features. Furthermore, we introduce an output-preserving regularization term to maintain the model's generative capabilities on safe content. Extensive experiments demonstrate that DUO can robustly defend against various state-of-the-art red teaming methods without significant performance degradation on unrelated topics, as measured by FID and CLIP scores. Our work contributes to the development of safer and more reliable T2I models, paving the way for their responsible deployment in both closed-source and open-source scenarios.

Direct Unlearning Optimization for Robust and Safe Text-to-lmage Models
Yong-Hyun Park" Sangdoo Yun Jin-Hwa Kim Junho Kim Geonhui Jang", Yonghyun Jeong", Junghyo Jo Gayoung Lee
Departmeett of Physics Education, Scoul National University 2 Schooo of Industrial and Management Engineering, Korea University
NAVER AI Lab
NAAERR Cloud
5 Korea Institute for Advanced Study (KIAS)
AA Institute of Seoul National University SNU AIIS
Abstract
Recent advancements in text-to-image (T2I) models have unlocked a wide range of applications but also present significant risks, particularly in their potential to gen- erate unsafe content. To mitigate this issue, researchers have developed unlearning techniques to remove the model's i ability to generate potentially harmful content. However, these methods are easily bypassed by adversarial attacks, making them unreliable for ensuring the safety of generated images. In this paper, we propose Direct Unlearning Optimization (DUO), novel framework for removing Not Safe For Work (NSFW) content from T2I models while preserving their performance on unrelated topics. DUO employs a preference optimization approach using curated paired image data, ensuring that the model learns to remove unsafe visual concepts while retaining unrelated features. Furthermore, we introduce an output- peetttrreeeennngg regularization term maintain the model's generative capabilities safe content. Extensive experiments demonstrate that DUO can robustly defend against various state-of-thh of-th--rtt red teaming methods without significant performance degradation on unrelated topics, as measured by FID and CLIP scores. Our work contributes to the development of safer and more reliable T2I models, paving the way for their responsible deployment in both closed-source and open-source scenarios.
CAUTION: This paper includes generaeede content that may contain offen- sive or distressing material.
Introduction
In recent years, text-to-image (T2I) models [22, 47, 45, 40, 8, 7] have experienced significant advancements thanks large-scale data and diffusion models. However, the large-scale web-crawled data such LAION [51] often include a significant amount of inappropriate and objectionable material, so T2I models trained on such data may pose potential risk of generating harmful content including Not Safe For Work (NSFW) content, copyright infringement, and violation of privacy [46, 4J. Filtering and curating such large-scale training data [55] is not feasible for large-scale datasets. At the production level, service providers usually block inappropriately generated images with an ad-hoc classifier [55], but the classifier can block normal images due to false positive detections and can be easily bypassed if the model weights are open-sourced.
Work done during an internship at NAVER Lab *Corresponding authors
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Text Space (CLIP)
Image Space
Safe prompls (e.g. "dressed", "clothed")
Image-based uniearming (Ours)
Safe
Natural unsafe prompts "nudly", "naked")
Prompt-based Unleamiing
Prompt-based unleaming
Adversarial prompls (e.g. " sn, soft embs)
Unsafe
Unsafe
ESD
ICE
SPN
Imege-based
Unleerning
Figure 1: Visualization of the advantages of image-based unlearning. Prompt-based unlearning can be easily circumvented with adversarial prompt attack. On the other hand, image-based unlearning robustly produces safe images regardless of the given prompt. We use for publication purposes.
To address the generation of unsafe content, there has been substantial amount of research focusing on directly fine-tuning diffusion models to forget unsafe concepts [12, 13, 26, 33, 17, 36, 63]. Recent work the field has focused mainly on prompt-based approaches to unlearning, which aim to induce models to behave as if they had received safe prompts when an unsafe prompt is given [12, 26, 33, 63, 36, 13]. These methods effectively censor NSFW image generation without degrading the image generation capability. However, recent studies [42, 56, 60] warn that by introducing slight perturbations to the unsafe prompts using adversarial prompts [56, 60] or embeddings[42)) it is possible to circumvent these censoring mechanisms and generate undesirable images (Figure 1).
Current unlearning methods are vulnerable to adversarial attacks because there are many synonyms or indirect expressions for NSFW concepts in text. For instance, even if the prompt "nudity" is removed, many related concepts like "naked," "erotic," or "sexual" may remain. Furthermore, it is infeasible to anticipate and eliminate all possible adversarial prompts beforehand. Moreover, unlearning methods that rely on text conditioning cause the model to behave as cannot comprehend the unsafe prompts, rather than removing the internal visual concepts within the model.
To fundamentally address limitations, is necessary guide the model guide the model to remove the image-related features that produce unsafe images. regardless of the prompt. One way to achieve this by directly unlearning the unsafe images instead of prompts. However, simply moving away from the target image leads to ambiguity regarding which concepts to forget and can cause forgetting of unrelated visual features. For instance, if we make the model unlearn the image in Figure 2-(a), it would lose the ability to generate not only nudity but also unrelated concepts like women or forests.
To mitigate this ambiguity, we reformulate the unlearning as a preference optimization problem. Preference optimization is a technique aimed training models to generate desirable outputs when provided with both positive and negative examples. Our main intuition is that, unlike when only an undesirable sample given, the presence of desirable sample helps the model resolve the ambiguity about what information should be retained from the undesirable sample. As shown in Figure 2-(b), thanks to the desirable image, the model can recognize that the forest and woman are not subjects that need to be erased.
In this paper, propose Direct Unlearning Optimization (DUO), method remove unsafe visual features directly from the model while maintaining generation quality for unrelated topics. Specifically, created paired data by using unsafe images and their counterparts, from which unsafe concepts were removed using SDEdit [34] (Section 3.2). Then, we employ Direct Preference Optimization (DPO) [44] make the model favor the latter group while encouraging to move away from the former group (Section 3.3). As shown in Figure 2-(b), preference optimization through the paired dataset explicitly specifies which features of given image should be forgotten. To further regularize the model not to unlearn for unrelated topics, we introduce
prppuutpreeerving regularization [37, 62, 6] that forces preserve the denoising capability of the model. We call our framework as Direct Unlearning Optimization (DUO). We demonstrate that our method can robustly defend against various state-of-the-an red teaming methods [56, 42) without significant performance degradation in unrelated topics, as measured by LPIPS [65], FID [19] and CLIP scores [43]. Additionally, through an ablation study, we validate the efficacy of output preservation regularization and visual feature unlearning.

---

Nalood
trunt
Scoual
Homun
hadfey
Torss"
Unerlo Conape renoved
Unaif Image
Safe lange
Coneept be ranaved
(a) Unsafe images contain hoth unsafe concepts and unrelated concepts.
(b) Excluding unrelated concepts by utilizing both unsafe im- ages and their corresponding safe images.
Importance of using both unsafe and paired safe images to preserve model prior. We for publication purposes. Unsafe concept refers to what should be removed from the image (red), while unrelated concept refers to what should be retained in the image (green).
Figure 2:
2 Related work
Text-to-Image (T2I) models with safety mechanisms. The safety mechanisms designed to prevent undesirable behavior in T2I models can be classified into four categories: dataset filtering [55, 15], concept unlearning [12, 13, 26, 33, 17, 36, 63], in-generation guidance [50], and post-generation content screening [1, 3). These methods are orthogonal to each other and have different limitations. In this work, we focus concept unlearning and can combine with other techniques ensure more secure T2I generation.
Due to the advantage of not requiring training from scratch, finettunigg-based unlearning has been actively researched recently. Pioneering works like ESD [12] and CA [26] train the model to generate the same noise regardless of whether unsafe prompt is present not. SPM [33] trains one- dimensional adapters that regularize the model instead full model training. TIME [36]. UCE [13]
and MACE [31] update the prompt-dependent cross-attention weights with a closed-form equation. Forget-me-not [63] suppresses the attention map of cross-attention layers for unsafe prompts. SA [17] proposed unlearning method based continual learning, utilizing Elastic Weight Consolidation (EWC). These works rely on prompts during training, making them vulnerable to adversarial prompt attacks, as discussed later.
Meanwhile, SafeGen [29], as a concurrent work with ours, addresses similar concerns regarding adversarial prompts and utilizing image pairs remove unsafe features for training. They blurred unsafe images to guide the model using supervised learning, ensuring that unsafe images are generated in blurred form. In contrast to their work, utilize paired data generated with SDEdit [34] to enable the model to erase only unsafe concepts and employ preference optimization. Therefore, our method provide more selective guidance for the visual features that need to be removed, and avoid direct training on blurred images, which can potentially harm the generation capabilities.
Red- Teaming for T2I models. Red teaming is method for searching for vulnerabilities security systems. Extending this concept to machine learning, many red teaming techniques have been proposed to explore how robust a model's safety mechanism is. For text-to-Image (T2I) models, studies have shown that with safety mechanisms applied, it is still possible generate harmful images through prompt engineering [56, 42, 60, 9, 67, 16]. Ring-A-bell [56] and SneakyProme [60] generate adversarial prompts in black-box scenario without access to the diffusion model. They collect unsafe prompts and find prompts with similar embeddings through optimization. On the other hand, Concept Inversion [42] is method that can be used in white box scenario where access the gradient of the diffusion model is available. This method learns special token (c) through textual inversion [42] that contains information about unsafe images, and then uses it generate unsafe images. The goal of our research is to propose a safety mechanism that is robust against red teaming.
Preference optimization in T2I models. Direct Preference Optimization (DPO) [44] has been frequently used in language models as it enables preference-beee based model tuning without the need for reward models. DiffusionDPO [57] and D3PO [59] extend this approach diffusion models, ensuring that generated images better reflect user preferences. Diffusion-KTD [28] replaces DPO with Kahneman- Tahrssy Optimization (KTO) [11], eliminating the need for paired data. DCO [27] applies preference optimization to the personalization domain, ensuring that models preserve priors while
3

---

(a) Original unsafe image
(b) Prompt substitution
(c) SDEdit method
Figure 3: Effectiveness of utilizing SDEdit for generating paired image data for unlearning. When unlearning unsafe images (a), we use safe images (b, c) to indicate which visual features should be retained. While prompt substitution (b) prevents the model from accurately determining what visual features to retain or forget, SDEdit (c) enables the model to identify which information from the undesirable sample should be kept or discarded. We use for publication purposes.
generating personal images. Our work the first to apply preference optimization to the unlearning problem and proposes task-specific data and regularization methods to fit unlearning task.
3 Method
In this section, we introduce our framework named Direct Unlearning Optimization (DUO) con- sisting of Direct Preference Optimization (DPO) with synthetic paired data and output-preserving regularization. After providing preliminary explanation of diffusion models, detail the process of generating paired images, which are necessary for successful preference optimization for con- cept unlearning. Next, we provide detailed explanation of applying direct preference optimization to the unlearning task using the generated paired images. Finally, we introduce srpputtpreeering regularization loss, novel strategy to maintain the prior distribution of the model.
3.1 Preliminary: Diffusion models
Diffusion models [52, 21, 53, 54, 32] are generative models that learn to generate images through an iterative denoising process. For image To. the diffusion process samples a noisy image z from ((x (2)) = (V vI - I) The magnitude of the added noise determined by the noise schedule dze, and it increases becomes larger. We train the model ca(-) to denoise the noisy image St va, + v1 o4e by predicting the added noise e.
LDsM ( (ore (ma) |||e co <=(x:))l
(1)
This is called the denoising score matching (DSM) loss. It encourages the model to estimate the gradient of the trg-rrbbabllity of the noisy data, i.e., cØ (2x) x log c).
Diffusion models can be conditioned on other modalities, such as text, to generate images that align with the given context [20, 35, 64]. this case, the model learns estimate e(0r, c) x V log p(rz), where e represents the conditioning information. This allows the model to generate images that are not only realistic but also semantically consistent with the provided text or other modalities.
3.2 Synthesizing paired image data to resolve ambiguity in image-based unlearning
As we mentioned in Section 1, even images with unsafe concepts contain numerous unrelated visual features that need to be preserved (c.g., photo-realism, background, and humans). Therefore, method needed to selectively remove only the visual features associated with the targeted unsafe concept. Intuitively, if we provide the model with images that have identical, unrelated visual features but differ in the targeted unsafe concept, the model can be guided to unlearn only the features related to the unsafe concept. Unfortunately, by replacing unsafe words with safe words in prompts often resulted in changes to the unrelated attributes of the images.
shown in Figure 3 (b), naively generating paired images
We solve this by creating image pairs using SDEdit [34], method for image translation. The process of creating image pairs with SDEdit is as follows. Given undesirable concept cT, c.g., naked,

---

first generate an unsafe image To using c Then, we add a certain amount of Gaussian noise to send it to z; Lastly. denoise T, to create paired safe image x with negative guidance for cT. If possible, we also use positive guidance for ct e.g., dressed, during the denoising process. Thanks to the characteristics of diffusion models, SDEdit allows us to generate images that have similar coarse features but either include or exclude the unsafe concept, ensuring that the concept unlearning process is focused on the specific elements we want to remove while preserving the rest of the image as shown in Figure (c).
Now, we want to make model not to generate visual features in unsafe image To while still can generate safe image onj We solve this as a preference optimization problem. In the next subsection, will discuss how consider generated paired dataset preference data and apply Direct Preference Optimization (DPO) to our unlearning problem.
3.3 Concept unlearning as a preference optimization problem
In subsection 3.2, ensure that the paired images only differed in the presence absence of unsafe concepts while keeping other attributes the same. Using them, we need to guide the model to remove only the visual features associated with unsafe concepts. We employed preference optimization method where the model is trained to move away from unsafe image zo and towards their corresponding safe images zt. Since the only difference between our dataset pairs zo and a5 the information related to the unsafe concept, the unrelated concepts remain unaffected.
Suppose we are given a paired dataset {-p To }. where a6 and Zg denote the retain and forget sample, respectively. The probability of preferring z over Ty can be modeled by the reward function r(z):
p(=0 > - = (r(att) r(5)))
where a is the sigmoid function. This model known as the Seadeey-Terry (BT) model [5]. The reward function can be learned using binary cross-entropy loss to maximize likelihood:
LET(r) Bad 2o ( rr(5)))
Given this reward function, preference optimization aims to fine-tune the model to maximize the reward. To prevent the model (o(x)) from excessively forgetting its existing capabilities, we use KL-constrained reward optimization as our objective:
max Exa [r())) - 3T (1a)))( po
where ps denotes the pretrained model distribution, and the hyperparameter 3 controls the extent to which the model diverges from the prior distribution. The above equation has a unique closed-form solution p [14, 25, 39, 41] (see Appendix D.I for detailed derivation):
Pg = (mo) exp(r(z))/3)/Z
where 2= = (x)) exp(r(x0)/3) is the partition function. By manipulating this equation, we can express the reward function in terms of the fine-tuned and pretrained model distributions:
(T() po (zo)
r(xu)= log
+ Bog Z
(6)
Plugging this into the BT loss equation, we obtain the DPO loss [44]:
pb(xt)
Blog p5( po po
LDPO -Egg Fo [log ( (ol
)
po(x))
Diffusion-DPO. There is challenge in directly applying the DPO loss function (7) to diffusion models. Specifically, po ) is not tractable as it requires marginalizing out all possible diffusion paths (æ1, ... , ..r)). Diffusion-DPO [57] elegantly addresses this issue using the evidence lower bound (ELBO). First, we define a reward function R(c, Du:2) that measures the reward over the entire diffusion trajectory, which yields r(zo) when marginalized across the trajectory:
r(0))= = Epo ( [((or])]
(8)
5

---

Using R(zorT), we can reformulate (4) for the diffusion paths 20:r:
max Poo [((er)) -5 [Po (Poor))) po (Forr)
Following a similar process as with the DPO objective, we can derive Diffusion-DPO objective to optimize (x
Pd (T(TTT) Pe (
Pä (o
LDiifiusionDDP -E "p po
[log (B. po(sjille (.p (o 1 | log
3 log
D] (10)
Pe (T(
By leveraging Jensen's inequality and the ELBO, this loss can be expressed as a combination of fully tractable denoising score matching losses (see Appendix D.2 for detailed derivation):
Ditfuusion DPO S - -R (att) )DD la yay -a(م; (=5)
||e (le-eah eg (xt 1)11 - ||e - Es( 1)12
(11)
log -8
(1|c cn (1 t) + ||e c
In Eq. (11), ||c c0 t)ll3 - -1--- (x t)ll operates gradient descent for the preferred sample,
while |c 6o (37 1) - ||c cs(xT 1) operates gradient ascent for the dispreferred sample.
3.4 Output-preserving regularization
Unfortunately, in preliminary experiments, we discovered that DPO's KL divergence regularization alone is insufficient for prior preservation. To mitigate this issue, we introduced the following novel regularization term to maintain the diffusion model's denoising capability:
Lprior | (
(12)
The above regularization maintains the output even when unlearning is performed, and the image completely noise, i.e., at 2y. The reason for limiting it to T is to prevent output preservation regularization from interfering with the removal of the knowledge about unsafe visual features contained in the image Tp.
Our final loss function, which incorporates the output preservation regularization, is as follows:
LDUO - -Ex mugaa (= 1.=0 ~g(n; |x ).o.
log (-8 ||e ca(x; 1)12 ||e - Ex (afxxx))))))) ,)11
))
(13)
(lle c0 t) + ||e cp(x) (ttccc( .0)13) A
Experiments
4.1 Experiments setup
Unlcarning setup. We use Stable Diffuson 1.4v (SD1.4v) with a LoRA [23, 48] rank of 32 with the Adam optimizer for fine-tuning. We observe that is difficult unlearn violence with a single LoRA, because it has various subcategories. To address this, we decompose it into four distinctive concepts: blood, suffering, gun, and horror. We apply DUO each concept and merge them use as violence unlcarning LoRA. We do not train the cross-attention layers to minimize the dependency on the text prompt for unlearning [12]. Our experiments are conducted on Stable Diffusion version 1.4 to compare with other baseline methods. We use ESD [12], UCE [13], SPM [33] as baselines for the concept unlearning category of the safety mechanism. For implementation details, please refer the Appendix.
Red teaming. For black box red teaming methods that not access model weights, we use Ring-A-Bell [56] and SneakyPrompt [60]. Ring-A-Bell uses genetic algorithm to find prompts that have similar embeddings to unsafe prompts defined by the attacker. We used 95 pre-trained prompts for nudity and 250 prompts for violence provided by the authors. SneakyPrompt slightly perturbs

---

1,300
0,975
0.9
6,9
0.850
0.0
0,925
DUG
0.6
0.5
0.5
Prior preservation (I-LPIPS)
Prior preservation (I-LPIPS)
Prior preservation (I-LPIPS)
(a) SneakyPrompt
(b) Ring-A-Bell
(c) Concept Inversion
Figure 4: Quantitative result on nudity. The defense success rate (DSR) refers to the proportion of desirable concepts are generated. Prior preservation represents 1 LPIPS between images generated by the prior model and the unlearned model. Results closer to the top right indicate better outcomes.
undesirable prompts that are blocked by the safety filter. e.g.. "A naked man riding a bike.", to bypass the safety filter, e.g.. "A grponypui man riding bike". We used 200 prompts trained by the authors on SD1. 14v for evaluating SneakyPrompt on nudity.
For white-box attacks that access model weights, we use Concept Inversion [42]. The concept inversion protocol is follows. First, malicious images are generated using prompts provided by the i2p benchmark [38]. For nude images, prompts in the sexual category are used, and for violence, prompts with a toxicity probability of 0.95 or higher are used. For the images obtained through this process, special token <c> is trained using textual inversion with model that has a safety mechanism applied. The trained special token is then used as prefix for the sexual/toxic prompts from the i2p benchmark.
Evaluation. To evaluate whether we have defended against red teaming, we use external models. If these models determine that the image does not contain the unsafe concept, we consider the defense successful and report this ratio as the defense success rate. To classify whether images contain nudity, we use the NudeNet detector [2]. Following Tsai et al. [56], if the detector detects one of the following labels in the image: "FEMALE BREAST EXPOSED, FEMALE GENITALIA EXPOSED, ANUS EXPOSED, MALE GENITALIA EXPOSED", we consider the image to contain nudity.
To classify whether images contain violence, we used GPT-4o, state-of-the-art multimodal LLM [58, 61, 1]. We use the user prompt, "Does the dataset contain data that, if viewed directly, might be offensive, insulting, threatening, might otherwise
anxiety? Please answer yes no." [49]
along with the image. If the model's response is "yes", we determine that it contains violence, while "no" indicated unlearning success. neither token is present, we regenerate the model output.
To evaluate model performance unrelated to the unlearned concept, we measure the FID [19] and CLIP scores [18] using MS COCO 30k validation dataset [30]. These metries provide insights into the capabilities of unlearned models. Additionally, we report the LPIPS [65] between the images from the original 1D1.4v model and those from the unlearned model using identical noises. This quantifies how the unlearned model's distribution differs from the original.
4.2 Red teaming results
Unlearning is task to satisfy the tra between unlearning performance and prior preservation simultaneously. We plot the Pareto curve by adjusting the magnitude of KI. regularization. Specifically, each point in the figures corresponds to 3 E {100, 250, 500, 1000, 2000).
Nudity. Figure 4 shows the quantitative results for nudity detection. Our method maintains model performance comparable the current state-of-the-ar SPM terms of prior preservation while achieving a defense success rate (DSR) of nearly 90% against all red teaming methods. A notable characteristic of the Pareto curve is the sharp bend where the increase unlearning performance diminishes, and the model rapidly loses its prior knowledge. Based on this observation, we recommend choosing B 500 and B = 250 for defending against black-box and white-box teaming methods, respectively.
7

---

$01.4v
ESD
UCB
SPM
Our
SD14
UCE
SPM
(a) Ring-A- Bong-A-Bell Bell
(b) Concept Inversion
Figure 5: Qualitative result on nudity. We used 500 for Ring-A and 250 for Concept Inversion. We use for publication purposes.
SIN
Nudit
gr
Nudity
Figure 6: Quanlitative result on prior preservation. The top row shows the original model, while the bottom row displays the results generated using prompts from the MS COCO validation 30k dataset after removing nudity. The same column uses the same initial noise and the same prompt.
Table FID and CLIP score (CS) for nudity.
Table FID and CLIP score (CS) for violence.
Method
FID (4)
CS (t)
Method
FID (L)
CS (t)
SD (1.4v)
13.52
30.95
SD (1.4v)
13.52
30.95
ESD
14.07
30.00
ESD
16.87
29.44
UCE
13.95
30.89
UCE
14.04
30.74
SPM
14.05
30.84
SPM
13.53
30.93
DUO (8 500)
13.65
19.88
DUO (8 = 1000)
13.37
30.78
DUO (8 250)
13.59
30.84
DUO (3 500)
18.28
30.18
Figure 5 presents the qualitative results from Ring-A-Bo A-Bell and concept inversion attacks. While previous comptt-bsedd unlearning methods are easily circumvented with red teaming, our method demonstrates robust defense against these attacks. This result highlights the effectiveness of our image-based based unlearning approach, which is independent of the prompt and robust against prompt- based red teaming. Interestingly, in the case of concept inversion, completely corrupted images generated, unlike in the King-A-Bell attack. Through experimentation, we observed that it is challenging to robustly block textual inversion unless the generated result deviates significantly from the data manifold. This suggests that to defend against white box red teaming, which leverages gradient information, the internal features of the model must be completely removed rather than merely bypassed. Analyzing the different mechanisms of black-box and white-box red teaming presents an interesting direction for future research.
In Table 1, we report the FID and CLIP scores for MS COCO 30k. These scores indicate how well the unlearned model preserves its ability to generate images for unrelated prompts. Unlike the other methods, DUO does not modify text embeddings or prompt-dependent weights; instead, it removes visual features directly from the model, making prior preservation quite challenging. Nonetheless, regarding FID and CLIP scores, DUO shows performance comparable to other unlearning methods. Thus, for nudity, DUO is robust against prompt-base adversarial attacks while also preserving the original model's generation capabilities for unrelated concepts. Figure 6 qualitatively confirms

---

0.6
Defense
0.4
DUO
0.4
UCE
SPM
0.0
0.2
0.4
06
0.8
1.0
0.0
0.2
0.6
0.8
1.0
Prior preservation (I-LPIPS)
Prior preservation (I-LPIPS)
(a) Ring-A-Bell
(b) Concept Inversion
Figure 7: Quantitative result on violence. The defense success rate (DSR) refers to the proportion of desirable concepts generated. Prior preservation represents LPIPS between images generated by the prior model and the unlearned model. Results closer to the top right indicate better outcomes.
SDL
DCE
(a) Ring-A- B-elll
(b) Concept Inversion
Figure 8: Qualitative result violence. We used 500 for Ring-A-bell and / 1000 for Concept Inversion. We use blurring for publication purposes.
that the generation results do not significantly differ between the prior model and the model after unlearning.
Violence. Figure 7 demonstrates the red teaming result on violence. Like nudity, DUO shows remarkable robustness against attacks while maintaining the same prior preservation score. We observe that the defense success rate values are generally not completely blocked compared to nudity, believe this is due to the fact that violence a more abstract and complex concept compared to nudity, making unlearning more difficult. Figure show qualitative results. We present the outcomes using 3 500 for ring-a-bell and 1000 for concept inversion. Table 2 shows the FID and CLIP scores for MS COCO 30k. Similar to the nudity concept removal experiment, our method maintains comparable prior preservation performance to existing methods. Unlike the nudity experiment, the violence concept removal experiment, we observe that the trade-off between prior preservation and defense success rate varies more steeply with the parameter B3
1.0
4.3 Ablation study
success rate
0.8
Output preservation regularization. We study the effect of output preservation regularization. As shown in Figure 9, lambda significantly enhances prior preservation performance at similar level of DSR. This effect is more dramatic in the small regime. Without Lprior. the COCO generation result is severely degraded to the point of being unrecognizable. On the other hand, the unlearning result using Lurior still produces plausible images at the same J3. This demonstrates that output preservation regularization is effective in unlearning, where only the desired concept is removed. To assess the effectiveness of choosing the DPO method, we conducted an ablation study to evaluate the impact of KI. divergence regularization. Please refer to Appendix A for ablation study for KI. divergence regularization.
0.5
Prior preservation
Figure 9: Ablation study on output preserving regularization (Ring- A-Bell). Output preserving regu- larization helps preserve the prior without significantly reducing the defense success rate.

---

Conclusion and limitation
We addressed the vulnerability of existing unlearning T2I methods prompt-based adversarial attacks. To eliminate dependency on prompts, we conducted image-based unlearning and solved it using preference optimization methods. To address the challenge of prior preservation, we curated the dataset using SDEdit and proposed additional output- preservation regularization methods. As result, our method remained robust against adversarial prompt attacks while maintaining image generation capabilities for unrelated concepts. Since our method involves unlearning visual features, unrelated concepts that share excessively similar visual features may be influenced by unlearning. We anticipate that this issue could be addressed by curating paired datasets that include similar concepts, but we leave this as future work.
Impact statement While our method is designed to improve the safety of text-to- text-to-Image models, it could potentially be misused by malicious actors. For example, attackers might attempt to manipulate the unlearning process to create more harmful content. Therefore, in an open-source scenario, our method should applied to the model before releasing the model weights. Additionally, our method may still be vuinerable to new adversarial attacks. Therefore, it is necessary to compensate our method with other safety mechanisms such as dataset filtering or safety checkers.
References
[1] J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida,
J. Altenschmidt, S. Altman, S. Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
[2] P. Bedapudi. Nudenet: lightweight nudity detection. httppp///ggthbb..cmmmdattteeee NudeNet/, 2019.
[3] Betker, G. Goh, L. Jing, T. Brooks, J. Wang. L. Li, L. Ouyang, J. Zhuang, J. Lee, Y. Guo, et al. Improving image generation with better captions. Computer Science. htlps://cdn. openai. com/papers/dall---3 pdf. 2(3):8, 2023.
[4] A. Birhane, S. Han, V. Boddeti, S. Luccioni, et al. Into the laion's den: Investigating hate in multimodal datasets. Advances in Neural Information Processing Systems, 36, 2024.
[5] R. A. Bradley and M. E. Terry. Rank analysis of incomplete block designs: I. the method of paired comparisons. Biometrika, 39(3/4):324-345, 1952.
[6] Chen and D. Yang. Unlearn what you want to forget: Efficient unlearning for llms. arXiv 2023.
preprint 2rXiv:2310.20113
[7] J. Chen, J. Yu, C. Ge, L. Yao, E. Xie, Y. Wu, Z. Wang, J. Kwok, P. Luo, H. Lu, et al. Pixart-alpha: Fast training of diffusion transformer for photorealistic text-to-image synthesis. arXiv preprint arXiv:2310.00426 2023.
[8] J. Chen, C. Ge, E. Xie, Y. Wu, L. Yao, X. Ren, Z. Wang, P. Luo, H. Lu, and Z. Li. Pixart-sigma: Weak-to-strong training of diffusion transformer for 4k text-to-image generation. arXiv preprint arXiv:2403.0 04692, 2024.
[9] Z.-Y. Chin, C.-M. Jiang, C.-C. Huang, P.-Y. Chen, and W.-C. Chiu. Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.0m 06135, 2023.
[10] P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning, 2024.
[11] K. Ethayarajh, W. Xu, N. Muennighoff, D. Jurafsky, and D. Kiela. Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.0 0060000116.... 2024.
[12] R. Gandikota, J. Materzynska, Fiotto- Kauffa, and D. Bau. Erasing concepts from diffusion models. In Proceedings of the IEEF/CVF International Conference on Computer Vision (ICCV), pages 1426-2436, October 2023.
[13] R. Gandikota, H. Orgad, Y. Belinkov, J. Materzyúska, and D. Bau. Unified concept editing in diffusion models. In Proceedings of the IEFF/CVE Winter Conference on Applications of Computer Vision, pages 5111-5120, 2024.
10

---

[14] D. Go. T. Korbak, G. Kruszewski, J. Rozen, N. Ryu, and M. Dymetman. Aligning language models with preferences through f-divergence minimization. arXiv preprint wrXiv22302.8225. 2023.
[15] A. Gokaslan, A. F. Cooper, J. Collins, L. Seguin, A. Jacobson, M. Patel, J. Frankle, C. Stephen- son, and V. Kuleshov. Commoncanvas: An open diffusion model trained with creative-commons images, arXiv preprint arXiv:2310.16822
2023.
[16] X. Han, S. Yang, W. Wang, Y. Li, and J. Dong. Probing unlearned diffusion models: A
transferable adversarial attack perspective. arXiv preprint arXiv:2404. /9382, 2024.
[17] A. Heng and H. Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. Advances in Neural Information Processing Systems, 36, 2024.
[18] Hessel, A. Holtzman, M. Forbes, L.. Bras, and Y. Choi. CLIPScore: a reference-free
evaluation metric for image captioning. In EMNLP, 2021.
[19] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[20] J. Ho and T. Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207. 12598, 2022.
[21] J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-6851, 2020.
[22] Ho, W. Chan, C. Saharia, J. Whang, R. Gao, A. Gritsenko, P. Kingma, B. Poole, M. Norouzi, D. J. Fleet, et al. Imagen video: High definition video generation with diffusion models. arXiv preprint arXiv:22 10.02303, 2022.
[23] E. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, and W. Chen. Lora: Low-rank adaptation of large language models. arXiv preprint
09685, 2021.
[24] D. Kingma, T. Salimans, B. Poole, and J. Ho. Variational diffusion models. Advances in neural 11216666211000 2021.
information processing systems,
[25] T. Korbak, H. Elsahar, G. Kruszewski, and M. Dymetman. On reinforcement learning and distribution matching for fine-tuning language models with no catastrophic forgetting. Advances in Neural Information Processing Systems, 35: 15:16003-16220, 2022.
[26] N. Kumari, B. Zhang, S.-Y. Wang, E. Shechtman, R. Zhang, and J.-Y. Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691-22702, 2023.
[27] K. Lee, S. Kwak, K. Sohn, and J. Shin. Direct consistency optimization for compositional text-to-image personalization. arXiv preprint arXiv:2402. 12004, 2024.
[28] S. Li, K. Kallidromitis, A. Gokul, Y. Kato, and K. Kozuka. Aligning diffusion models by optimizing human utility. arXiv preprint WrXiv:2404.04445 2024.
[29] X. Li, Y. Yang, J. Deng, C. Yan, Y. Chen, X. Ji, and W. Xu. Safegen: Mitigating unsafe content generation in text-to-image models. arXiv preprint TrXiv:2404.06666 2024.
[30] T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick. Microsoft coco: Common objects in context. In Computer ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[31] Lu, Z. Wang, L. Li, Y. Liu, and A. W.-K. Kong. Mace: Mass concept erasure in diffusion mod- els. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6430-6440, 2024.
[32] C. Luo. Understanding diffusion models: A unified perspective. arXiv preprint arXiv:2208. / 1970,, 2022.
[33] M. Lyu, Y. Yang. H. Hong. H. Chen, X. Jin, Y. He. H. Xue, J. Han, and G. Ding. One- dimensional adapter to rule them all: Concepts, diffusion models and erasing applications. arXiv preprins arXiv:2312. 13.41455. 2023.
[34] C. Meng. Song, Song, Wu, J.-Y. Zhu, and S. Ermon. Sdedit: Image synthesis and editing with stochastic differential equations. arXiv preprint arXiv:2108.01073 2021.
11

---

[35] A. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. McGrew, I. Sutskever, and M. Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprini arXiv:2112, 10741, 2021.
[36] H. Orgad, B. Kawar, and Y. Belinkov. Editing implicit assumptions in text-to-image diffusion models. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 7053-7061 2023.
[37] G. Ortiz-Jimenez, A. Favero, and Frossard. Task arithmetic in the tangent space: Improved editing of pre-trained models. Advances in Neural Information Processing Systems, 36, 2024.
[38] S. Patrick and B. Manuel. In-context policy iteration (i2p). https://githuu com/
m1 r-reeeerrchiipp 2024. Accessed: 2024-05-23.
[39] X. B. Peng, A. Kumar, G. Zhang, and S. Levine. Advantage-weighted regression: Simple and scalable off-policy reinforcement learning. arXiv preprint arXiv:1910.00117 2019.
[40] Pernias, D. Rampas, M. L.. Richter, C. Pal, and M. Aubreville. Würstchen: An efficient archi- tecture for large-scale text-to-image diffusion models. In The Twelfth International Conference on Learning Representations, 2023.
[41] J. Peters and S. Schaal. Reinforcement learning by seward-weighted regression for operational space control. In Proceedings of the 24th international conference on Machine learning, pages 745-750, 2007.
[42] M. Pham, K. O. Marshall, N. Cohen, G. Mittal, and C. Hegde. Circumventing concept erasure methods for text-to-image generative models. The Twelfth International Conference on Learning Representations, 2023.
[43] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pages 8748-8766 PMLR, 2021.
[44] R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, Ermon, and C. Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36, 2024.
[45] A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprini arXiv:2204.061 2022.
[46] Rando, D. Paleka, D. Lindner, L. Heim, and F. Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint 2tti::22200061100 2022.
[47] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[48] S. Ryu. Low-rank adaptation for fast texl-to-image diffusion fine-tuning, https://githin com/ com/clonan httcc//ooooooooo/////ooo /oora 2022.
[49] P. Schramowski, C. Tauchmann, and K. Kersting, Can machines help answering question 16 datasheets, and in turn reflecting on inappropriate content? In Proceedings of the 2022 ACM Conference Fairness, Accountability, and Transparency, pages 1361,1361,,10 2022.
[50] Schramowski, M. Brack, B. Deiseroth, and K. Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2023.
[51] C. Schuhmann, R. Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35: 25278-201 25594, 2022.
[52] Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning, pages
PMLR, 2015.
[53] Song, C. Meng, and S. Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020.
12

---

[54] Y. Song, J. Bohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arX1v:2011.13456. 2020.
[55] Stability-AI. Stable diffusion version 2.
stablediffusion, 2023.
[56] Y.-L. Tsai, C.-Y. Hsu, C. Xie, C.-H. Lin, J.-Y. Chen, B. Li, P.-Y. Chen, C.-M. Yu, and C.-Y. Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint 2.KV:2330.11011:. 2023.
[57] B. Wallace, M. Dang. R. Rafailov, L. Zhou, A. Lou, S. Purushwalkam, S. Ermon, C. Xiong, Joty, and N. Naik, Diffusion model alignment using direct preference optimization. arXiv preprint arXiv:23 129088, 2023.
[58] т. Wu, G. Yang, Z. Li, K. Zhang, Z. Liu, L. Guibas, D. Lin, and G. Wetzstein. Gpt-4v (ision) is a numan-aligned evaluator for text-to-3d generation. arXiv preprint S0t1:22401004092, 2024.
[59] K. Yang. J. Tao, J. Lyu, C. Ge, J. Chen, Q. Li, W. Shen, X. Zhu, and X. Li. Using human feedback to fine-tune diffusion models without any reward model. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024.
[60] Y. Yang, B. Hui, H. Yuan, N. Gong, and Y. Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE Symposium on Security and Privacy (SP), pages 123-123. IEEE Computer Society, 2024.
[61] Z. Yang, L. Li, K. Lin, J. Wang, C.-C. Lin, Z. Liu, and L. Wang. The dawn of Imms: Preliminary explorations with gpt-4v (ision). arXiv preprint arXiv:2309. 00200997742.. 17421, 9():11 2023. [62] Y. Yao, X. Xu, and Y. Liu. Large language model unlearning. arXiv preprint arXiv:23 10683, 2023.
[63] E. Zhang, K. Wang. X. Xu, Z. Wang, and H. Shi. mortet-me-not: Learning to forget in text-to- image diffusion models. arXiv preprint 17X1, 2023.
[64] L. Zhang, A. Rao, and M. Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836-3847, 2023.
[65] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018.
[66] R. Zhang, L. Lin, Y. Bai, and S. Mei. Negative preference optimization: From catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05860 2024.
[67] Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu. To generate or not? safety-driven unlearned diffusion models are still easy generate unsafe images... for now. arXiv preprint arXiv:2310. 11868, 2023.
[68] Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now, In European Conference on Computer Vision, pages 385-403 Springer, 2025.
13

---

Target cunaggi
Retazz octsup
P-
300
2000
Figure 10: Ablation study on KL divergence regularization.
A
Ablation study
KL-constrained optimization. In this section, we study the effect of KL-constrained optimization. When 3 - 0, the sigmoid function can be approximated as a linear function, then DUO approaches naïve combination of gradient ascent for preferred samples and gradient descent for de-preferred samples [66]. As shown Figure 10, when - O, the images are somewhat degraded, and the generation results for unrelated concepts also change.
The number of synthesized image pairs Figure 11 demonstrates how varying the number of synthesized image pairs affects the Pareto curve on the Ring-A- Bell nudity benchmark. The figure clearly shows that when the number of pairs is less than 64, there is noticeable improvement in the Defense Success Rate. However, increasing the number beyond 64 pairs does not yield significant changes the Pareto curve. This analysis suggests that 64 pairs provide good balance between performance and computational efficiency for our method.
1.0
Defonse success rate
0.8
0.6
DUO (1024)
DUO (256)
DuO (16)
0.2
DUO (4)
0.75
0.80
0.85
0.90
0.95
Prior preservation (I-LPIPS)
Reproducibility We have conducted experiments us- ing different random seeds (1 to 4) demonstrate the our results. Figure 13
Figure 11: Ablation study on the number of synthesized image pairs. Different col- ors represent Ring-A-Bell results for nudity unlearning, varying the number of image pairs from to 1024.
stability and reproducibility shows that DUO's Pareto curve is not sensitive ran- dom seed variation and consistently outperforms base- line methods. Figure 14 provides qualitative evidence of similar unlearning results across different seeds.
B Additional experiments
UnlearnDiflAtk [68] We conducte additional exper-
0.7
iments using UnlearnDiffAtt [68], state-of-the-arr white-box attack method designed for assessing the robustness of unlearned diffusion models.
Defense success rate
0.6
0.5
As illustrated Figure 12, DUO achieves Pareto- optimal performance compared existing baselines
0.4
ESD
UCE
when subjected to UnleamDiffAtk. This means that DUO provides the best trade-off between maintaining model performance and resisting attacks, outperform- ing other methods in both aspects simultaneously.
SPM
0.5
0.6
0.7
0.8
0.9
Prior preservation (1-LPIPS)
Impact of DUO on Unrelated Features To fur- ther validate prior preservation performance our ap- proach, we evaluated the model's ability to generate visually similar but safe concepts. For example, we compare the generation of red images (e.g., ketchup, strawberry jam) after removing the Violence
Figure 12: Quantitative result of Unlearn- DiffAtk on nudity.
14

---

ESO
69
DUD
Defesee
666
UCE
150
F45
5%
D.0
12
0.2
Degrecare
Deprodict
Pier prssrvatcttionn (U-LPEP5)
Price preseraaioon (1-IPIS))
Prior prssesation (L-LPIRS)
Pricr prosevationn (PPIP))
Nadity: Ring-A-Hell
Nadit:: Concept Inversion
(c) Violence: Ring-A-Rell
(d) Violence: Concepe
Figure 13: Quantitative result on various seed numbers. DUO (Reproduce) shows the experimental results using different random seeds. DUO consistently outperforms other methods, maintaining its superior performance across different seed numbers, demonstrating its stability and effectiveness.
(wod
Oa) Nodry
(b) Violmee
Figure 14: Qualitative result on various seed numbers. We used 3 = 500 for both nudity and violence. We use and blurring for publication purposes.
concept, which closely related to "Blood", Table 3 below presents mean and standard devidation of LPIPS scores between 128 images generated from the unlearned model and the pretrained model. Lower scores indicate less impact on unrelated features. These results demonstrate that DUO ef- fectively maintains the capability to generate visually similar but unrelated concepts compared to the existing methods. Figure 15 shows qualitative results of prior preservation for visually similar concepts.
In Figures 16, and 17, we successfully applied DUO to Stable Diffusion (SD3), which uses the transformer-ban based mmDiT architecture [10]. The evaluation process for SD3 was identical to that used for SD1.4v. In the Pareto curve, each point from left to right represents (100, 250, 500, 1000, 2000), with consistent learning rate of 3e-5 across all experiments.
Stable-Diffusion 3
Table 3: Impact of unlearning visually similar concept generation. We report the mean + standard deviation of LPIPS scores between 128 images generated from the unlearned model and those from the pretrained model.
Unlearned
Safe
DUO (black box)
DUO (white box)
Concept
Concept
ESD
UCE
SPM
Nudity
Woman Man
0.58 + 0.11
0.42 +
0.16
0.31 1 0.15
0.33 + 0.12 0.14
0.55 + 0.17 0.20 0.13
0.58 + 0.10
0.31
0.17
0.15
Violence
Ketchup
0.69 1 0.15
0.51 0.16
0.20
0.23 0.12
0.35 1 0.14
Tomato
0.58 1 0.19
0.38
0.11
0.18
0.28 1 0.12
Strawberry jam
0.56 0.13
0.42
0.15
0.13
0.11
0.31 0.12
15

---

SDJ dv
ESD
UCE
SPM
DEO
BUO
SD1.4v
ESD
UCE
SPM
DUD
2 MB:
DUJ
"Ae
Nowwhrr
"Tenaro
(4) Sudity
Vialence
Figure 15: Quantitative result on generating close concept related to removed concept. (a) Results of generating "man" " and "woman" after removing nudity. (b) Results generating "ketchup". "strawberry jam" and "tomato sauce" after removing violence.
Table 4: FID for SD3 unlearned nudity.
Method
FID (L)
SD3 DUO (3 = 500)
21.83
21.26
DUO (3 250)
20.49
SD3
DUO -20)
DUO
SD3
DUO
037
(30
Plu (1-LF1P5)
Price Pricprorrakee: (L2255
(a) Ring Bell
[b) Cancept laversion
Figure 16: Quantitative result of SD3 nu- dity. The defense success rate (DSR) refers to the proportion of desirable concepts gen- erated. Prior preservation represents per- ceptual similarity of images generated by the prior model and the unlearned model.
(a) Ring- A-Blll
(b) MS COCO
Figure 17: Qualitative result of SD3 on nu- dity. DUO effectively removes nudity while preserving the model's ability to generate un- related concepts. We use for publication purpose.
Additionally, Table 4 shows FID scores on MS COCO. It demonstrates that applying DUO to SD3 maintains comparable fidelity the pretrained model.
C Implementation details
C.1 Dataset generation
Nudity For generating the unsafe images =,, we use "naked" as prompt with a guidance strength of 7.5. For æt, we use "dressed" as with strength of 7.5, and use "naked" as negative prompt. We generate 256 images. We use nudenet [2] to regenerate images if there was no nudity in x if there was nudity in t.
To generate violence images we use four sub-concepts: Blood, Suffering, Gun, and Horror To generate unsafe images x=, , we use the prompt: "a man, bleeding", "a man, suffering", "a man, with gun", "horror". We generate 64 image per each prompt, total 256 images. For safe images xt, we use the prompt: man, comfort", man, enjoying". "a man, with peace", "comfort", with using unsafe prompt negative prompt.
Violence
16

---

SDEdit When we use SDEdit, the magnitude of the added noise is t = 0.757, where T is the maximum diffusion timesteps, and the guidance scale used is 7.5.
C.2
Optimization.
DUO Since linearly multiplies the learning rate at the time near initialization, we rescale the learning rate, dividing by the same amount each time we increase 5. Using / = 100 as a baseline, we use a learning rate of x 10-4, the batch size of 4, and LoRA rank of 32. When conducting violence unlearning, we generally observe that the training is more unstable compared to nudity, and we mitigate this by training LoRA to unlearn each concept and combine them as violence LoRA. Exploring the relationship between dataset characteristics and optimization stability in DUO is an interesting avenue for future work.
Concept Inversion For Textual Inversion training, we used the Adam optimizer with a learning rate of x 10 3. batch size 4, and 3000 gradient steps. We used the same hyperparameters for all unlearning models.
D Derivation
D.I Deriving the Optimum of the KL--Costrained Reward Maximization Objective
For completeness, we provide the derivation of the solution KL-constrained reward maximization here. For more detailed motivation and explanation of the derivation process, we refer readers to the DPO paper [44] Appendix A.I.
Eq. (4) + Eq. (5) Start from Eq. (4).
max E (xo [r(x))] [r)))()))) P6
MT (po
r(ro) - log (D()
max E Ex (2o)
pet (2(
log Po (2o)
1
min E p Pooppl (mo)
3 (200
Po
Pe (Ir)
log (o(
min E E (po))
-log Z
Po
Pa (xo) exp (fr(z)))
where we have partition function:
Z A Σ ps (20) exp g (((or)
20
Now define the probability p" (xo) as:
1 p² (²(x)) Z(zo)
(o( exp ( ((())))
which is valid probability distribution as p" (xx) 2 0 for all zo and En, p(ao) 1. Since not a function of x, we can then re-organize the final objective as:
log (x() log Z pr (x²)
min E Em (zo)) Ps
Now, since does not depend on pe. the minimum achieved by po (2x) (x()). Hench we have the optimal solution:
(o( p" (2o) po(xo) exp (r(z0)/8)/2
17

---

D.2 Diffusion-DPO
For completeness, we provide the derivation of Diffusion- -PO here. For more detailed motivation and explanation of the derivation process, we refer readers to the Diffusion-DPP paper [57].
Eq. (10) - Eq. (11) Start from Eq. (10).
(3( Pa (x)
pel P (14)
Liiffusion-DPO -E [log o po(zialld ( و|ر log
3 log
(
Since - log (.) is a convex function, we can utilize Jensen's inequality.
DDiffusion-DP
-Bat pot Int (10(
log (18 log
(T(= - B log (
Po P
(15a)
Ps po())T))
-B -
p6 ((tter) - B log Pe P(( po p=(
log ([3 log
(15b)
po(Fo.T)
In Eq. (15b), the intractable po (2t (x)) and po p= 1 are approximated by the diffusion forward process q( Now, let us apply the product rule, i.e. p(æo:r) = p(ær) II p(x+-1 xz). to po(our)) and po (.o:)).
Diiftusion-DPO I
-B to .a(xial )=1()
T
Pá ( (ra)
Pā ( ( }) pd ( (
log o (13
log
log
Pa p=(
t=1
=
-Bug to aa( to ).0(
T
log pb 12,) log
log o13 Σ
log p/ |tg.
BR wD =0(x lnd ).0(1 1=
- (1t.
DKL 1 DxI. 11 + DKL. (1
log ((B
Finally, let us express the (xl(()lp) using the Ldsms i.c., ||e ca clll2. According Eq. (48) from Kingma et al. [24], the following relationship holds:
Bay (mo) [Dk (a((x-1111)))) ( = No
(17)
where d₃ is the signal-to-noise ratio (SNR), defined as X = - and a coefficient factor that depends on the SNR, specifically w(A:) 1 d x, dr A. In practice, when training the diffusion model,
often treated constant [21]. By using Eq. (17) to replace each DxL (q(#t-1(x)) ( we obtain the following:
Diffiuusonn - - Ben mp .et motll ),5 ~g(= (x5)
||e 1--ea(z (x+ 1)11 -lle c 1)l2 log (-STW(A))
(18)
(1lc c +t) + ||0-=00 t)))
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: As we claimed in the abstract, we experimentally verify our unlearning method in 8 4.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: $ discusses the limitations of image-based unlearning.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model sell-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't It acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
19

---

Justification:
In this paper, there are no theory to prove. This is experimental paper.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: In Appendix C, we provide every details reproduce our results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
20

---

Answer: [Yes]
Justification:
We will publicly open the source-code for reproducible.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /nips. wwtppcccpp/aaeeecccccccccccceeee httpa//gggiiee/eeSuuniiiiieeeee /Co////oddmssssseeeeeeeee wimbbmisssoooiiyyyy...ooci for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Does the paper specifyy all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
We describe all the hyperparameters, optimizer, and dataset in Appendix C.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: Due to the lack of computational resources, it is infeasible to compute the bar by taking an experiment on multiple random seeds.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
21

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Answer:
[Yes]
Justification: We report computation resources and time complexity of our algorithm in Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics attps://neurips. cc/ppullic/thiccsuiiti ines?
Answer: [Yes]
Justification: Appendix 5, we address potential risk of this work.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper involves impact statements that unlearning research can be abused by malicious users. Our research should be applied to the model so that it communicates with users only through API communication before the open- model is deployed.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
22

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: In our paper, plan release model with not-safe-for-wort (NSFW) concepts removed, so there is no high risk of misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Ys]]
Justification: The Stable Diffusion, I2P benchmark, Sneakprompt, Ring-A-Bell, and Concept Inversion that we used are all open source.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URI
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in package should be provided. For popular datasets, paperswi twwoee.hooo... com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
23

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: We haven'l released the code yet. When we release it later, we will provide proper documentation.
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: this study, do not conduct user study,
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: In this study, do not conduct user study,
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such the institution conducting the review.


Reviews:
[{"review_id": "gHQWNiokpm", "reviewer": "Reviewer_Ub4z", "summary": "The authors address the issue of adversarial attack to diffusion model generating inappropriate image contents in this paper, critiquing the previous work on unlearning technique unlearns harmful prompt but making themself vulnerable to adversarial prompt. Instead they propose the image-based unlearning technique to remove unsafe visual features while retain the performance to generate image for safe concepts. During the training, they propose the method to generate a pair of safe and unsafe content and employ preference optimization to encourage diffusion model to generate the safe counterpart. The present the result in the evaluation to show that their model is better at defending adversarial attacks such as SneakyPrompt, Ring-A-Bell and Concept Inversion.", "questions": "Please clarify the missing detail", "limitations": "The authors discuss the limitation in the conclusion.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- The paper is is structured in a clear and logical manner, making it easy to follow. Both the introduction and the related work sections are well-written providing comprehensive context for the problem and the clear overview of previous work.\n\n- The necessity of addressing this problem is convincingly justified, and the proposed solution is closely aligned with this motivation. The derivation of the proposed method is elaborated in detail and is technically sound.\n\n- The authors demonstrate strong results in the evaluation and show convincing results successfully defend adversarial attack. The present ablation study to prove the effectiveness of output preserving regularization.", "weaknesses": "- There is a missing detail in experiments setup. The authors mention in line 194 that they decompose the violence concept into four categories and apply DUO to each of them and then merge the final models. If I understand correctly, the authors apply DUO independently for the four concepts resulting in four final models with LoRA. Please clarify how merging works to combine the four models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "First, thank you for your recognition of our paper's clear structure and strong evaluation results.\n\n---\n\n> *[W1] Construction of Violence Unlearning LoRA*\n\nWe appreciate the opportunity to clarify this process. As you correctly surmised, we applied DUO independently to four subcategories of violence: \"blood\", \"suffering\", \"gun\", and \"horror\". For each concept, we trained a separate LoRA using DUO.\n\nTo create the final model, we merged these individual LoRAs. Specifically, if we denote the pretrained model weight as $W$, and the LoRA matrices trained on the $i$-th concept as $A_i$ and $B_i$, the merged weight matrix can be expressed as:\n\n$\\tilde{W} = W+ \\sum_i B_iA_i$\n\nThis approach allows us to comprehensively address the violence concept while maintaining the efficiency of LoRA-based fine-tuning. We will provide a detailed explanation of this merging process in the appendix of our final manuscript to ensure full clarity and reproducibility.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FgkDE0KSDA", "reviewer": "Reviewer_tvVC", "summary": "The authors introduce synthesized image data and preference optimization for concept unlearning in diffusion models. Additionally, they consider the regularization of model preservation performance to ensure a balanced approach.", "questions": "Check the weaknesses section for more details.", "limitations": "Effectiveness of the proposed method heavily relies on the synthesized image pairs and different synthesized image pairs might cause high performance variance.", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The presentation is clear and well-structured.\n2. There is a solid theoretical basis for the proposed preference optimization.", "weaknesses": "1. The efficacy of the proposed method is heavily dependent on the quality and diversity of the synthesized image pairs. The utilization of a small dataset, consisting of only 64 pairs, raises significant concerns about the potential for overfitting. To enhance the credibility of the findings, it is imperative for the authors to conduct comprehensive ablation studies. These studies should explore the impact of different sets of synthesized image pairs on model performance, potentially revealing critical insights into the method's robustness and generalizability.\n\n2. The current robustness assessments of the study are limited by the employment of relatively weak attack scenarios. For a more robust evaluation of the unlearned models, it is crucial to incorporate a stronger, white-box attack methodology. The use of UnlearnDiffAtk [1], a commonly applied tool for assessing the robustness of unlearned diffusion models, is recommended. This approach would not only adhere to contemporary research standards but also significantly bolster the validity of the results. Furthermore, detailed reporting of the attack success rate (ASR) associated with UnlearnDiffAtk would provide a more precise quantification of the models' resilience against sophisticated attacks.\n\n\n[1] \"To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy to Generate Unsafe Images ... For Now\", ECCV 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "First, thank you for acknowledging that our paper is clear and well-structured.\n\n---\n\n> *[W1] Impact of the number of synthesized image pairs on DUO performance*\n\nThank you for your constructive comment. Figure R7 from the global rebuttal PDF demonstrates how varying the number of synthesized image pairs affects the Pareto curve. The figure clearly shows that when the number of pairs is less than 64, there is a noticeable improvement in the Defense Success Rate. However, increasing the number beyond 64 pairs does not yield significant changes in the Pareto curve.\n\nThis analysis suggests that 64 pairs provide a good balance between performance and computational efficiency for our method. We will include this discussion in our final manuscript to address concerns about the dataset size and its impact on model performance.\n\n---\n\n> *[W2] Stronger White-Box Red Teaming results*\n\nWe appreciate your valuable suggestion to incorporate more robust evaluation techniques. We have conducted additional experiments using UnlearnDiffAtk [1], a state-of-the-art white-box attack method designed for assessing the robustness of unlearned diffusion models.\n\nAs illustrated in Figure R4 of our global rebuttal PDF, **DUO achieves Pareto-optimal performance compared to existing baselines** when subjected to UnlearnDiffAtk. This means that DUO provides the best trade-off between maintaining model performance and resisting attacks, outperforming other methods in both aspects simultaneously.\n\nWe will incorporate a detailed analysis of the UnlearnDiffAtk results in our final manuscript, including qualitative comparisons to baseline methods.\n\n[1]: Zhang et al., To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now https://arxiv.org/abs/2310.11868", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZbHix3agGz", "reviewer": "Reviewer_rmhF", "summary": "This paper proposes a diffusion unlearning optimization framework to achieve NSFW visual content removal in T2I models. Specifically, the authors develop an image-based unlearning method that utilizes curated paired image data (unsafe images and their corresponding safe images generated by the SDEdit model) for preference optimization. Additionally, they introduce a regularization term to preserve the denoising capability of the diffusion model. This work claims to be the first to apply preference optimization to the unlearning problem. Experimental results demonstrate that their method effectively removes unsafe visual concepts without significant performance degradation on unrelated topics.", "questions": "Please refer to the above weakness section.", "limitations": "Refer to previous sections.", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. The model is well-explained, and the paper is well-written.\n2. The novel perspective of applying preference optimization to the unlearning problem is interesting and promising.\n3. The red teaming results are encouraging.", "weaknesses": "1. The authors only fine-tuned Stable Diffusion v1.4 for evaluation, which employs U-Net for denoising. However, other popular text-to-image (T2I) diffusion models, such as PixArt[1] and Stable Diffusion v3, which use Transformers for denoising, are not mentioned. It is somewhat limited in discussing the proposed method on only one T2I model. Can the proposed method be applied to the above models?\n\n2. The unsafe concept may introduce some unrelated visual features when generating images, such as image details. How can the authors ensure that the proposed method does not affect these unrelated features when removing unsafe content?\n\n[1] PixArt-$\\alpha$: Fast Training of Diffusion Transformer for Photorealistic Text-to-Image Synthesis. ICLR 2024", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging our paper's clarity and the novelty of connecting preference optimization to unlearning.\n\n---\n\n> *[W1] Applicability of DUO to Diffusion Transformers*\n\nWe appreciate your inquiry about DUO's applicability to other architectures. We have successfully extended our evaluation to include Transformer-based models. As shown in Figures R1 and R2 in the global rebuttal PDF, DUO effectively removes unwanted concepts in Stable Diffusion 3, which employs a Transformer architecture (mmDiT).\n\nWe will incorporate these findings into our revised manuscript to provide a more comprehensive evaluation of DUO's capabilities across different model architectures.\n\n---\n\n> *[W2] Impact of DUO on Unrelated Features*\n\nWe acknowledge that claiming DUO has absolutely no impact on unrelated features would be an overstatement. However, our comprehensive evaluations demonstrate that DUO significantly reduces the impact on unrelated features compared to existing baselines.\n\nAs detailed in the global rebuttal (paragraph 3 and Fig. R3), we conducted comprehensive evaluations of DUO's prior preservation performance. Our results demonstrate that DUO maintains model prior for unrelated concepts while effectively removing unwanted content.\n\nIn our revised manuscript, we will provide a more nuanced discussion, emphasizing that DUO significantly reduces impact on unrelated features compared to existing baselines, while still acknowledging the potential for minor, unintended effects.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MWoSmYNgNq", "reviewer": "Reviewer_huMh", "summary": "The paper proposes a new method for unlearning diffusion-based generative models. The proposed method uses the basic idea of reinforcement learning with human feedback. To collect pairs of images to be unlearned and corrected for preference optimization, the author uses SDEdit to modify the NSFW content. Experimental results show that the proposed model successfully unlearns harmful content from the generated images.", "questions": "- The reason why the gradient ascent term reduces the model's denoising ability, even in the presence of the KL term, is unclear. Could you provide more details on how adding a L_prior loss, which minimizes the difference between denoising directions at time T, can address this issue? The explanation is insufficient to grasp the logic behind the loss.\n- What does ‘prior’ mean in ‘prior preservation performance’? If LPIPS measures the perceptual similarity between images, can we just use perceptual similarity? Since the prior in ‘prior preservation performance’ and the prior in ‘L_prior’ are different, it’s a bit confusing to follow section 4.3.", "limitations": "Limitations are well-addressed.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The use of SDEdit for curating semantically similar paired images sounds novel and effective.", "weaknesses": "- Although this paper shows some promising results about diffusion model unlearning, the main technical contribution is limited to a combination of SDEdit and DiffDPO.\n- It is clearly an overstatement that the preference optimization does not affect the quality of the unrelated concepts (in line 149).\n- I have concerns about the reproducibility of this work.\n- Minor\n    - The main text and appendix have multiple typos and require careful proofreading.\n    - Typo: Eq 17 → Eq 11 in the main text\n    - Type: line 275: lambda?\n    - Is DCO in line 285 a typo?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed review and for recognizing the novelty and effectiveness of our approach in using SDEdit for curating paired images.\n\n---\n\n> *[W1] Novelty of Technical Contribution*\n\nWe want to clarify that our main contribution is proposing **a new image-based unlearning framework** to overcome the limitations of the previous prompt-based approach, not just combining two well-known techniques, SDEdit and DPO. \n\nAs our framework is new, we provide **a new perspective on unlearning by formulating the diffusion models unlearning problem as preference optimization**. This perspective naturally arose from our image-based approach and offers a fresh paradigm for tackling unlearning challenges.\n\nWe then introduce the **a output-preserving regularization** to specifically preserve unrelated features, a crucial aspect not addressed in standard preference optimization. Additionally, we adapt preference optimization for unlearning by using SDEdit to generate paired data, eliminating the need for human labeling.\n\nIn summary, our work introduces a novel image-based unlearning framework, reframes unlearning as preference optimization, and incorporates output-preserving regularization. These innovations collectively offer a robust, efficient approach to diffusion model unlearning, addressing key limitations of existing methods.\n\n---\n\n> *[W2] How can we ensure that DUO does not affect unrelated features?*\n\nWe acknowledge that claiming DUO has absolutely no impact on unrelated features would be an overstatement. However, our comprehensive evaluations demonstrate that DUO significantly reduces the impact on unrelated features compared to existing baselines.\n\nAs detailed in the global rebuttal (paragraph 3 and Fig. R3), we conducted comprehensive evaluations of DUO's prior preservation performance. Our results demonstrate that DUO maintains model prior for unrelated concepts while effectively removing unwanted content.\n\nIn our revised manuscript, we will provide a more nuanced discussion, emphasizing that DUO significantly reduces impact on unrelated features compared to existing baselines, while still acknowledging the potential for minor, unintended effects.\n\n---\n\n> *[W3] Reproducibility*\n\nWe have taken several steps to address reproducibility concerns:\n\n- **Robustness to Random Seeds**\nWe have conducted experiments using different random seeds (1 to 4) to demonstrate the stability of our results. Figure R5 in the global rebuttal PDF shows that DUO's Pareto curve is not sensitive to random seed variation and consistently outperforms baseline methods. Figure R6 provides qualitative evidence of similar unlearning results across different seeds.\n\n- **Code Release**\nTo ensure full reproducibility and contribute to the field's advancement, we commit to releasing our unlearning and evaluation code upon publication.\n\nWe believe these measures significantly enhance the reproducibility of our work. We welcome any suggestions for additional experiments or information that could further address reproducibility concerns.\n\n---\n\n> *[W4] Minor errors*\n\nThank you for bringing these typos and grammatical errors to our attention. We have made the following corrections:\n\n- L104: DSO → DUO  \n- L175, 180, 506: Eq 17 → Eq 11  \n- L275: lambda → output-preserving regularization\n- L285: DCO → DPO  \n- L271: Ulike → Unlike\n- Figure 6: Quanlitative → Qualitative\n\nWe appreciate your careful review. These corrections will be reflected in the final manuscript.\n\n---\n\n> *[Q1] Logic Behind L_prior Loss*\n\nThe L_prior loss, i.e., output preservation regularization, was designed to maintain the model's prior effectively, even when the KL divergence regularization is weak. While DPO's KL divergence regularization theoretically prevents significant deviation from the pretrained model's distribution, there's a trade-off:\n\n- Strong KL regularization hinders effective unlearning.\n- Weak KL regularization can cause the model to lose its denoising capability due to the gradient ascent term.\n\nL_prior addresses this by **enforcing output preservation for specific inputs**, particularly those unrelated to unsafe concepts.\n\nConsider $x_t^- = \\sqrt{\\alpha_t} x_0^- + \\sqrt{1 - \\alpha_t} \\epsilon$, where $x_0^-$ represents an unsafe image and $\\epsilon \\sim N(0, I)$. Our goal is to unlearn features related to $x_0^-$ while maintaining the model's behavior for features related to $\\epsilon$. L_prior achieves this by preserving outputs for $x_T = \\epsilon$, effectively maintaining the model prior for unrelated concepts while allowing unlearning of unsafe content.\n\nFigure 8 demonstrates that L_prior's effect becomes more pronounced as beta decreases, highlighting its importance in maintaining model performance on safe concepts.\n\n---\n\n> *[Q2] Meaning of Prior Preservation (1-LPIPS)*\n\nPrior preservation is a crucial objective in unlearning, aiming to maintain the model's performance on concepts unrelated to the unlearned content. \n\nTo quantify this, we measure how much the model's output changes for unrelated concepts after unlearning. This is done by generating images using MS COCO prompts with both the pretrained and unlearned models. We use LPIPS to measure the perceptual difference between these generated images. Prior preservation is defined as 1-LPIPS. A higher value indicates that the unlearned model generates perceptually similar images to the pretrained model when given the same prompts and initial noise.\n\nThis metric helps us ensure that our unlearning method effectively removes unwanted content without significantly impacting the model's performance on unrelated topics.\n\nTo avoid confusion in the final manuscript, we will change the notation from L_prior to L_output for the output-preserving regularization term, distinguishing it clearly from the prior preservation metric.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their insightful feedback, which we will integrate into the final manuscript. 

We appreciate the acknowledgment of our paper's clear structure and presentation (Ub4z, tvVC, rmhF), the novelty of connecting preference optimization to unlearning (rmhF), the use of SDEdit for curating paired images (huMh), and our robust results in defending against adversarial attacks (Ub4z, rmhF). 

---  

### Applicability of DUO to Diffusion Transformers 

**Reviewer *rmhF* asked DUO's applicability to diffusion models beyond U-Net architecture, e.g., diffusion transformers.**

We appreciate this important question. We have extended our evaluation to include Transformer-based models. As shown in Figures R1 and R2 of the global rebuttal PDF, **we successfully applied DUO to Stable Diffusion 3 (SD3)**, which uses the transformer-based mmDiT architecture. The evaluation process for SD3 was identical to that used for SD1.4v. In the Pareto curve, each point from left to right represents $\beta \in \{100, 250, 500, 1000, 2000\}$, with a consistent learning rate of 3e-5 across all experiments. 

Additionally, FID scores on MS COCO demonstrate that applying DUO to SD3 maintains comparable fidelity to the pretrained model:

| SD3   | DUO ($\beta=500$)   | DUO ($\beta=250$) |
|:-----:|:-----:|:-----:|
| 21.83 | 21.26 | 20.49 |

These results confirm DUO's effectiveness across different diffusion model architectures, including Transformer-based models like SD3.

---

### Impact of DUO on Unrelated Features 

**Reviewers *rmhF* and *huMh* asked how DUO affects unrelated features when removing unsafe content.**

We appreciate the opportunity to clarify this important aspect of our work. Our "prior preservation" metric (1-LPIPS) specifically measures the model's ability to maintain unrelated feature generation. This is evaluated by comparing images generated from MS COCO prompts using both pretrained and unlearned models. A high prior preservation score indicates that the unlearned model produces perceptually similar images to the pretrained model when given the same prompts and noise.

To further validate our approach, we evaluated the model's ability to generate visually similar but safe concepts. For example, we compare the generation of red images (e.g., ketchup, strawberry jam) after removing the Violence concept, which is closely related to "Blood". The table below presents mean and standard devidation of LPIPS scores between 128 images generated from the unlearned model and the pretrained model. Lower scores indicate less impact on unrelated features. These results demonstrate that DUO effectively maintains the capability to generate visually similar but unrelated concepts compared to the existing methods. 

| unlearned concept | safe concept | ESD    | UCE    | SPM    | DUO (black box) | DUO (white box) |
|:-----------------:|:------------:|:------:|:------:|:------:|:---------------:|:---------------:|
| **Nudity**        | Woman        | 0.58 ± 0.11 | 0.42 ± 0.16 | **0.31 ± 0.15** | *0.33 ± 0.12*     | 0.55 ± 0.17     |
|                   | Man          | 0.58 ± 0.10 | 0.31 ± 0.17 | *0.15 ± 0.13* | **0.14 ± 0.09**     | 0.20 ± 0.13     |
| **Violence**      | Ketchup      | 0.69 ± 0.15 | 0.51 ± 0.16 | **0.20 ± 0.15** | *0.23 ± 0.12*     | 0.35 ± 0.14     |
|                   | Tomato sauce | 0.58 ± 0.19 | 0.38 ± 0.16 | **0.11 ± 0.13** | *0.18 ± 0.12*     | 0.28 ± 0.12     |
|                   | Strawberry jam | 0.56 ± 0.13 | 0.42 ± 0.15 | **0.13 ± 0.12** | *0.20 ± 0.11*     | 0.31 ± 0.12     |

**bold**: first place  
*itelic*: second place  

Additionally, Figure R3 in the PDF provides qualitative evidence of DUO's capability to maintain the capability to generate unrelated features.

However, we acknowledge that claiming DUO has absolutely no impact on unrelated features would be an overstatement. In our final manuscript, we will provide a more nuanced discussion, emphasizing that DUO significantly reduces impact on unrelated features compared to existing baselines, while still acknowledging the potential for minor, unintended effects.

Meta-review: This paper was evaluated by four experts who generally praised its novel approach and robust experimental results. Although the initial review scores were mixed and several concerns were raised, the authors effectively addressed these issues during the rebuttal phase. Consequently, reviewers who had initially provided lower scores revised their assessments in favor of acceptance. With unanimous support for acceptance, AC deems the paper a strong candidate for acceptance.
Decision: Accept (poster)