Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models

Authors: yimeng  zhang
xin  chen
jinghan  jia
yihua  zhang
chongyu  fan
jiancheng  liu
mingyi  hong
ke  ding
sijia  liu
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-05 02:56:20

Abstract: Diffusion models (DMs) have achieved remarkable success in text-to-image generation, but they also pose safety risks, such as the potential generation of harmful content and copyright violations. The techniques of machine unlearning, also known as concept erasing, have been developed to address these risks. However, these techniques remain vulnerable to adversarial prompt attacks, which can prompt DMs post-unlearning to regenerate undesired images containing concepts (such as nudity) meant to be erased. This work aims to enhance the robustness of concept erasing by integrating the principle of adversarial training (AT) into machine unlearning, resulting in the robust unlearning framework referred to as AdvUnlearn. However, achieving this effectively and efficiently is highly nontrivial. First, we find that a straightforward implementation of AT compromises DMs’ image generation quality post-unlearning. To address this, we develop a utility-retaining regularization on an additional retain set, optimizing the trade-off between concept erasure robustness and model utility in AdvUnlearn. Moreover, we identify the text encoder as a more suitable module for robustification compared to UNet, ensuring unlearning effectiveness. And the acquired text encoder can serve as a plug-and-play robust unlearner for various DM types. Empirically, we perform extensive experiments to demonstrate the robustness advantage of AdvUnlearn across various DM unlearning scenarios, including the erasure of nudity, objects, and style concepts. In addition to robustness, AdvUnlearn also achieves a balanced tradeoff with model utility. To our knowledge, this is the first work to systematically explore robust DM unlearning through AT, setting it apart from existing methods that overlook robustness in concept erasing. Codes are available at https://github.com/OPTML-Group/AdvUnlearn.

Warning: This paper contains model outputs that may be offensive in nature.

Main paper: 
 introduction: 
 Recent rapid advancements in diffusion models (DMs) [1] [2] [3] [4] [5] [6] [7] [8] have popularized the realm of textto-image generation. These models, trained on extensive online datasets, can generate remarkably realistic images. However, their training heavily relies on diverse internet-sourced content and can introduce safety concerns when prompted with inappropriate texts, such as the generation of NSFW (Not Safe For Work) images, highlighted in several studies [9, 10] . To address this concern, post-hoc safety checkers were initially applied to DMs [10, 11] . However, they were later found to be inadequate in effectively preventing the generation of unsafe content. To further enhance safety, the concept of machine unlearning (MU) has been introduced [12] [13] [14] [15] [16] [17] [18] , aiming to mitigate the influence of undesired textual concepts in DM training or fine-tuning [19] [20] [21] [22] . As a result, DMs post-unlearning (referred to as 'concept-erased DMs' or 'unlearned DMs') are designed to negate the generation of undesirable content, even when faced with inappropriate prompts. 1 : Visualizations of SD v1.4 [7] and its concept-erased version, ESD [19] , conditioned on the prompt 'Hot sexy girl'. The generation of ESD is shown against no attack and UnlearnDiffAtk [23] .Despite the recent progress with unlearned, safetydriven DMs, recent studies [23] [24] [25] [26] have shown that these models remain vulnerable to generating unsafe images when exposed to adversarial prompt attacks, which involve minor adversarial perturbations in input prompts. These attacks can readily jailbreak concept-erased DMs to regenerate content subject to the concept targeted for unlearning, even if these DMs perform well against inappropriate prompts in a non-adversarial context. In Fig. 1 , we exemplify the generation of the stable diffusion (SD) v1.4 model before and post unlearning the 'nudity' concept. The unlearned model is confronted with an inappropriate prompt from the I2P dataset [10] and its adversarial prompt counterpart, generated using the attack method UnlearnDiffAtk [23] . The lack of robustness in concept erasing (or machine unlearning) in DMs gives rise to the key research question tackled in this work:❸ We validate the effectiveness of AdvUnlearn across various DM unlearning scenarios, including the erasure of nudity, objects, and style concepts. We show that AdvUnlearn yields significant robustness improvements over state-of-the-art (SOTA) unlearned DMs while preserving a commendable level of image generation utility; See Fig. 2 for justification and performance highlights. 
related work: 
 Machine unlearning for concept erasing in DMs. Generating visually authentic images from textual descriptions remains a compelling challenge in generative AI. DMs (diffusion models) have notably advanced, surpassing generative adversarial networks (GANs) in various aspects, particularly in conditional generation subject to text prompts [36] [37] [38] [39] [40] [41] [42] [43] [44] . Despite their success, DMs also present safety and ethics concerns, especially in generating images with harmful content when conditioned on inappropriate prompts [9, 10] . To address these concerns, several approaches have been proposed, including post-image filtering [9] , modifying inference guidance [10] , and retraining with curated datasets [7] . However, lightweight interventions like the first two may not fully address the model's inherent propensity to generate controversial content [10, 45, 46] . MU (machine unlearning) [14, 47, 48] is another emerging approach for ensuring safe image generation by erasing the influence of undesired concepts, also referred to as concept erasing in DMs. Leveraging MU principles, various strategies for designing unlearned DMs have been explored, focusing on refining fine-tuning methods such as those by [19-22, 27, 28, 30, 49-56] . For example, UNets within DMs have been fine-tuned to redirect outputs towards either random or anchored outputs, effectively preventing the generation of images associated with the concepts designated for unlearning [19] [20] [21] . Additional efforts [27, 54] have employed gradient-based techniques to map out the weight saliency within UNet related to the concept to be unlearned, concentrating fine-tuning efforts on these salient weights. To enhance the efficiency of unlearning, UCE [22] introduces a method of closed-form parameter editing specifically for DM unlearning. However, this approach lacks robustness against jailbreaking attacks [23] .Adversarial prompt attacks against safety-driven DMs. Adversarial prompts or jailbreaking attacks specifically manipulate the text inputs of DMs to produce undesirable outcomes. Similar to the text-based attacks in natural language processing (NLP), adversarial prompt attacks can involve character or word-level manipulations, such as deletions, additions, and substitutions [57] [58] [59] [60] [61] [62] [63] [64] [65] . Strategies discussed in [66] are designed to bypass NSFW safety protocols, cleverly evading content moderation algorithms. Other related attacks [23-26, 67, 68] coerce DMs into generating images that contradict their programmed intent. For instance, Pham et al. [26] used textual inversion [69] to find a continuous word embedding representing the concept to be unlearned by the model. Chin et al. [24] employed ground truth guidance from an auxiliary frozen UNet [19] and discrete optimization techniques from [70] to craft a white-box adversarial prompt attack. To overcome the dependency on auxiliary model guidance, UnlearnDiffAtk [23] leveraged the intrinsic classification capabilities of DMs, facilitating the creation of adversarial prompts. In this work, we treat machine unlearning for DMs as a defensive challenge. Our approach involves fine-tuning the target model to not only unlearn specific concepts but also to enhance its robustness against adversarial prompt attacks.In the realm of image classification, adversarial attacks that generate subtle perturbations to fool machine learning (ML) models have long posed a robustness challenge for vision systems [71] [72] [73] [74] [75] [76] . In response, AT (adversarial training) [29] , the cornerstone of trainingbased defenses, conceptualizes defense as a two-player game between the attacker and defender [29, 31, 32, 71, [77] [78] [79] [80] [81] [82] [83] [84] 76] . Additionally, TRADES [31] was proposed to strike a better balance between accuracy and robustness. Further studies [32, 33, 80, 85, 86] demonstrated that unlabeled data and self-training have proven effective in enhancing robustness and generalization in adversarial contexts. To improve the efficiency of AT, past research also proposed adopting more efficient attack methods or fewer steps to generate adversarial examples [71, [87] [88] [89] [90] [91] [92] [93] [94] . In particular, the fast gradient sign method (FGSM) was utilized for adversarial generation in AT [71, 87] . And the gradient alignment strategy was proposed to improve the quality of fast AT [89] . 
preliminaries and problem statement: 
 Throughout the work, we focus on latent diffusion models (LDMs) [7, 95] , which have exceled in text-to-image generation by integrating text prompts (such as text-based image descriptions) into image embeddings to guide the generation process. In LDMs, the diffusion process initiates with a random noise sample drawn from the standard Gaussian distribution N (0, 1). This sample undergoes a progressive transformation through a series of T time steps in a gradual denoising process, ultimately resulting in the creation of a clean image x. At each time step t, the diffusion model utilizes a noise estimator ϵ θ (•|c), parameterized by θ and conditioned on an input prompt c (i.e., associated with a textual concept). The diffusion process operates on the latent representation of the image at each time (x t ). The training objective for θ is to minimize the denoising error as below:EQUATION)where D is the training set, and ϵ θ (x t |c) is the LDM-associated noise estimator.Concept erasure in DMs. DMs, despite their high capability, may generate unsafe content or disclose sensitive information when given inappropriate text prompts. For example, the I2P dataset [10] compiles numerous inappropriate prompts capable of leading DMs to generate NSFW content.To mitigate the generation of harmful or sensitive content, a range of studies [19] [20] [21] [22] 27] have explored the technique of concept erasing or machine unlearning within DMs, aiming to enhance the DM training process by mitigating the impact of undesired textual concepts on image generation.A widely recognized concept erasing approach is ESD [19] , notable for its state-of-the-art (SOTA) balance between unlearning effectiveness and model utility preservation [52] . Unless specified otherwise, we will adopt the objective of ESD for implementing concept erasure. ESD facilitates the fine-tuning process of DMs by guiding outputs away from a specific concept targeted for erasure. Let c e denote the concept to erase, then the diffusion process of ESD is modified toEQUATIONwhere θ denotes the concept-erased DM, θ o is the originally pre-trained DM, and ϵ θ (x t |∅) represents unconditional generation of the model θ by considering text prompt as empty. Compared to the standard conditional DM [96] (with classifier-free guidance), the second term -η[ϵ θo (x t |c e )ϵ θo (x t |∅)] encourages the adjustment of the data distribution (with erasing guidance parameter η > 0) to minimize the likelihood of generating an image x that could be labeled as c e . To optimize θ, ESD performs the following model fine-tuning based on (2):EQUATIONwhere for notational simplicity we have used, and will continue to use, to omit the time step t and the random initial noise ϵ under expectation.Adversarial prompts against concept-erased DMs. Although concept erasing enhances safety, recent studies [23] [24] [25] [26] have also shown that concept-erased DMs often lack robustness when confronted with adversarial prompt attacks; see Fig. 1 for examples. Let c ′ represent a perturbed text prompt corresponding to c, obtained through token manipulation in the text space [23, 24] or in the token embedding space [26] . The generation of adversarial prompts can be solved as [23, 24] :EQUATIONwhere θ denotes the concept-erased DM, and θ o is the original DM without concept erasing. Therefore, considering the concept c = c e targeted for erasure, ϵ θo (x t |c) denotes the generation of an unsafe image under c. The objective of problem ( 4) is to devise the perturbed prompt c ′ to steer the generation of the concept-erased DM θ towards the unsafe content produced by ϵ θo . The constraint of (4) implies that c ′ remains proximate to c, subject to the number of altered tokens ϵ (measured by the ℓ 0 norm) or via additive continuous perturbation in the token embedding space.AdvUnlearn: A defensive unlearning setup via AT. The lack of adversarial robustness in concepterased DMs motivates us to devise a solution that enhances their robustness in the face of adversarial prompts. AT [29] offers a principled algorithmic framework for addressing this challenge. It formulates robust concept erasure as a two-player game involving the defender (i.e., the unlearner for concept erasing) and the attacker (i.e., the adversarial prompt). The original AT constrains the attacker's objective to precisely oppose the defender's objective. To loosen this constraint, we consider a generalized AT formulation based on bi-level optimization [92, [97] [98] [99] , where the defender and attacker are delineated through the upper-level and lower-level optimization problems, respectively:EQUATIONIn (5) , the upper-level optimization aims to optimize the DM parameters θ according to an unlearning objective ℓ u , considering the concept c * targeted for erasure. For instance, the objective of ESD (3) could serve as one specification of ℓ u . On the other hand, the lower-level optimization problem minimizes the attack generation loss ℓ atk , as given by (4), to acquire the optimized adversarial prompt c * under the current model θ. The upper-level and lower-level optimizations are interlinked through the alternation between model parameter optimization and adversarial prompt optimization.We designate the aforementioned setup (5) of integrating adversarial training into DM unlearning as AdvUnlearn. As will become evident later, effectively and efficiently solving the AdvUnlearn problem (5) becomes highly nontrivial. There exist two main challenges.(Effectiveness challenge) As will be demonstrated in Sec. 4, a naive implementation of the ESD objective (2) for upper-level concept erasure may lead to a considerable loss in DM utility for generating normal images. Thus, optimizing the inherent trade-off between the robustness of concept erasure and the preservation of DM utility poses a significant challenge.(Efficiency challenge) Moreover, given the modularity characteristics of DMs (with decomposition into text encoder and UNet encoder), determining the optimal application of AT and its efficient implementation remains elusive. This includes deciding 'where' to apply AT within DM, as well as 'how' to efficiently implement it. We will address this challenge in Sec. 5.4 Effectiveness Enhancement of AdvUnlearn: Improving Tradeoff between Robustness and Utility Warm-up: Difficulty of image generation quality retention. A straightforward implementation of AdvUnlearn (5) is to specify the upper-level optimization using ESD (2) and combine it with adversarial prompt generation (4). However, such a direct integration results in a notable decrease in image generation quality. Tab. 1 compares the performance of the vanilla ESD (i.e., concept-erased stable diffusion ) [19] with its direct AT variant. The robustness of concept erasure is evaluated using ASR (attack success rate) against the adversarial prompt attack UnlearnDiffAtk [23] . Meanwhile, the quality of image generation retention is assessed through FID. As we can see, while the direct AT variant of ESD (AT-ESD) enhances adversarial robustness with approximately a 20% reduction in ASR, it also leads to a considerable increase in FID. Fig. 3 presents visual examples of the generation produced by AT-ESD compared to the original SD v1.4 and vanilla ESD. As demonstrated, the decline in image generation authenticity under a benign prompt using AT-ESD is substantial.Utility-retaining regularization in AdvUnlearn. We next improve the unlearning objective ℓ u in AdvUnlearn (5) by explicitly prioritizing the retention of the DM's generation utility. One potential explanation for the diminished image generation quality after AT-ESD is that ESD (2) primarily focuses on de-generating the unlearning concept in the diffusion process, thus lacking the capability to preserve image generation quality when further pressured by the robustness enhancement induced by AT. In the realm of AT for image classification, the integration of external (unlabeled) data into AT has proven to be an effective strategy for enhancing standard model utility (i.e., test accuracy) while simultaneously improving adversarial robustness [32] . Drawing inspiration from this, we suggest the curation of a retain set C retain comprising additional text prompts utilized for retaining model utility. Together with the ESD-based unlearning objective, we customize the upper-level optimization objective of (5) asEQUATIONwhere ℓ ESD was defined in (3), and the second loss term penalizes the degradation of image generation quality using the current DM θ compared to the original θ o under a retained concept c.When selecting the retain set C retain , it is essential to ensure that the enhancement in image generation quality does not come at the expense of the effectiveness of concept erasure, i.e., minimizing ESD loss in (6) . Therefore, we utilize a large language model (LLM) as a judge to sift through these retain prompts, excluding those relevant to the targeted concept for erasure. Further details regarding the LLM judge system are available in Appx. A. We obtain these retain prompts from an external dataset, such as ImageNet [100] or COCO [101] As shown in Tab. 2, our proposed utility-retaining regularization effectively recovers the utility (i.e., FID of AdvUnlearn vs. that of ESD), which is otherwise compromised by AT-ESD. Yet, AdvUnlearn in Tab. 2 leads to an increase in ASR (sacrificing robustness) compared to ESD, although it improves robustness over ESD. Thus, there is room for further enhancement in AdvUnlearn. As will be shown in Sec. 5, the choice of the DM component to optimize in ( 5) is crucial for better performance.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [NA] Justification: Observing the vulnerability of existing unlearned Diffusion Models (DMs), we have systematically explored robust DM unlearning through adversarial training (AT).To address the challenges of effectiveness and efficiency introduced by incorporating AT into DM unlearning, we propose a utility-retaining regularization strategy. Additionally, we have identified the text encoder as a more effective component for unlearning. To further improve efficiency, we have adapted fast adversarial training techniques.Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems.• The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 
experimental result reproducibility: 
 Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?Answer: [Yes] Justification: Experiment setups can be found in Sec. 6.1 and Appx. C. Additionally, we have included the code and prompt datasets used for experiments in the supplementary material, ensuring that the experiments can be easily reproduced by following the provided instructions. 
efficiency enhancement of advunlearn: modularity exploration and fast attack generation: 
 Where to robustify: Text encoder or UNet? Initially, concept erasure by ESD (3) was confined to the UNet component of a DM [19] . However, as shown in Tab. 2, optimizing UNet alone does not lead to sufficient robustness gain for AdvUnlearn. Moreover, there are efficiency benefits if concept erasure can be performed on the text encoder instead of UNet. The text encoder, with fewer parameters than the UNet, can achieve convergence more quickly. Most importantly, a text encoder that has undergone the unlearning process with one DM could possibly serve as a plug-in unlearner for other DMs, thereby broadening its applicability across various DMs. Furthermore, a recent study [102] demonstrates that causal components corresponding to the DM's visual generation are concentrated in the text encoder. Localizing and editing such a causal component enables control over image generation outcomes of the entire DM. [19] . This highlights the importance of retaining image generation quality considered in AdvUnlearn when optimizing the text encoder. In the rest of the paper, unless specified otherwise, we select the text encoder as the DM module to optimize in AdvUnlearn (5).Fast attack generation in AdvUnlearn. Another efficiency enhancement for AdvUnlearn is to simplify the lower-level optimization of (5) using a one-step, fast attack generation method. This approach aligns with the concept of fast AT in image classification [87, 92] . The rationale is that the lower-level problem of ( 5) can be approximated using a quadratic program [92] , and solving it can be achieved using the fast gradient sign method (FGSM) [71, 87] . Specifically, let δ represent the perturbation added to the text prompt c, e.g., via a prefix vector [103] . With an abuse of notation, we denote the perturbed prompt by c ′ = c + δ, where the symbol + represents the prefix attachment. FGSM determines δ using FGSM to solve the lower-level problem of ( 5): where δ 0 represents random initialization, α denotes the step size, and sign(•) is element-wise sign operation. We refer to the utilization of one-step attack generation (7) in AdvUnlearn as its fast variant, which can also yield a substantial robustness gain in concept erasure. Tab. 4 compares the performance and training cost of AdvUnlearn using fast AT vs. (standard) AT, where the attack step of standard AT is set to 30. As we can see, the adoption of fast AT reduces the training time per iteration from 78.57s to 12.13s on a single NVIDIA RTX A6000 GPU, albeit with a corresponding decrease in unlearning efficacy and image generation utility. Therefore, when the need for unlearning efficacy is not exceedingly high and computational efficiency is prioritized, adopting fast AT can be an effective solution. We summarize the AdvUnlearn algorithm in Appx. B.EQUATION6 Experiments 
experiment setups: 
 Concept-erasing tasks, datasets, and models. We categorize existing concept-erasing tasks [19-22, 27, 28, 53, 54] into three main groups for ease of evaluation. ( 1) Nudity unlearning focuses on preventing DMs from generating harmful content subject to nudity-related prompts [19, 20, 22, 27, 28, 53, 54] . ( 2) Style unlearning aims to remove the influence of an artistic painting style in DM generation, which mimics the degeneration of copyrighted information such as the painting style [19] [20] [21] [22] 28] . (3) Object unlearning, akin to the previous tasks, targets the degeneration of DMs corresponding to a specific object [19, 20, 27, 28, 53, 54] . The dataset for testing nudity unlearning is derived from the inappropriate image prompt (I2P) dataset [10] , whereas the testing dataset for style unlearning is aligned with the setup described in [19] . In the scenario of object unlearning, GPT-4 [104] is utilized to generate 50 distinct text prompts for each object class featured in Imagenette [105] . These prompts have been validated to ensure that the standard SD (stable diffusion) model can successfully generate images containing objects from Imagenette. Model-wise, unless specified otherwise, the pre-trained SD (Stable Diffusion) v1.4 is utilized as the base DM in concept erasing.We include 8 open-sourced DM unlearning methods as our baselines: (1) ESD (erased stable diffusion) [19] , (2) FMN (Forget-Me-Not) [20] , (3) AC (ablating concepts) [21] , (4) UCE (unified concept editing) [22] , (5) SalUn (saliency unlearning) [27] , ( 6) SH (ScissorHands) [54] , ( 7) ED (EraseDiff) [53] , and ( 8) SPM (concept-SemiPermeable Membrane) [28] . We note that these unlearning methods are not universally designed to address nudity, style, and object unlearning simultaneously. Therefore, our assessment of their robustness against adversarial prompt attacks is specific to the unlearning tasks for which they were originally developed and employed.Training setups. The implementation of AdvUnlearn (5) follows Algorithm 1 in Appx. B. As demonstrated in Sec. 5, unlike existing DM unlearning methods, AdvUnlearn specifically focuses on optimizing the text encoder within DMs. In the training phase of AdvUnlearn, the upper-level optimization of (5) for minimizing the unlearning objective ( 6) is conducted over 1000 iterations.Each iteration uses a single data batch with the erasing guidance parameter η = 1.0 in (3) and a batch of 5 retaining prompts with a utility regularization parameter of γ = 0.3 for nudity unlearning and 0.5 for style and object unlearning. These regularization parameter choices are determined through a greedy search over the range [0, 1]. Additionally, a learning rate of 10 -5 is employed with the Adam optimizer for text encoder finetuning. Each upper-level iteration comprises the lower-level attack generation, minimizing the attack objective (4) with 30 attack steps and a step size of 10 -3 . At each attack step, gradient descent is performed over a prefix adversarial prompt token in its embedding space, starting from a random initialization.Evaluation setups. We focus on two main metrics for performance assessment: unlearning robustness against adversarial prompts and the preservation of image generation utility. For robustness evaluation, we measure the attack success rate (ASR) of DMs in the presence of adversarial prompt attacks, where a lower ASR indicates better robustness. Unless specified otherwise, we utilize UnlearnDiffAtk [23] for generating adversarial prompts at testing time, as it can be regarded as an unseen attack strategy different from (4) used in AdvUnlearn. Detailed settings for attack evaluation are presented in Appx. C. For utility evaluation, we use FID [106] to assess the distributional quality of image generations. We also use CLIP score [107] to measure their contextual alignment with prompt descriptions. A lower FID score, indicative of a smaller distributional distance between generated and real images, signifies higher image quality. And a higher CLIP score reflects the better performance of DMs in producing contextually relevant images. To compute these utility metrics, we employ DMs to generate 10k images under 10k prompts, randomly sampled from the COCO caption dataset [108] .Robustness-utility evaluation of AdvUnlearn for nudity unlearning. In Tab. 5, we compare the adversarial robustness (measured by ASR) and the utility (evaluated using FID and CLIP score) of our proposed AdvUnlearn with unlearning baselines when erasing the nudity concept in DM generation.For ease of presentation, we also refer to the DM post-unlearning (i.e., the unlearned DM) with the name of the corresponding unlearning method. Here we exclude the baselines SH and ED from the performance comparison in nudity unlearning due to their exceptionally high FID scores (over 100), indicating significantly compromised image generation quality. Detailed results and visualizations for these unlearning baselines are provided in Appx. D. As we can see, our proposal (AdvUnlearn) demonstrates significantly improved ASR, with over 50% ASR reduction compared to ESD, except for the lowest ASR achieved by SalUn. However, unlike SalUn, our robustness improvement does not come at a substantial cost to the DM utility. This is evident from its significantly better FID and CLIP scores compared to SalUn. To complement our quantitative findings, Fig. 4 showcases the but includes AC, based on whether they were originally developed for style unlearning. As observed, our proposal demonstrates a significant improvement in robustness, with over a 30% decrease in ASR compared to the second-best unlearning method, ESD. Crucially, this is accomplished without sacrificing model utility, as indicated by the comparable FID and CLIP scores compared to the base SD v1.4. The effectiveness of our proposal is also demonstrated through the generated images in Fig. 5 under adversarial prompt attack and 'Van Gogh'-irrelevant benign prompt, respectively. in performance of the text encoder obtained from AdvUnlearn when applied to SD v1.5, DreamShaper [109] ,and Protogen [110] for nudity unlearning. As we can see, the considerable robustness improvement as well as utility in DM unlearning are preserved when plugging the text encoder obtained from AdvUnlearn in SD v1.4 into other DMs (see 'Transfer' performance vs. 'Original' performance). This is most significant when transferring to SD v1.5 due to its similarity with SD v1.4. For dissimilar DMs like DreamShaper [109] and Protogen [110] , the AdvUnlearn-acquired text encoder in SD v1.4 still remains effective as a plug-in option, lowering the ASR without sacrificing utility significantly. The effect of text encoder layers on DM unlearning. In Fig. 8 , we show the ASR (robustness metric) and the CLIP score (a utility metric) of post-nudity unlearning against various choices of text encoder layers for optimization in AdvUnlearn. Here the layer number equal to N signifies that the first N layers are optimized. We observe that the robustness gain escalates as more layers are optimized. In particular, optimizing only the initial layers failed to provide adequate robustness for DM unlearning against adversarial attacks, contrary to findings in [102] , where shallower encoder layers suffice for guiding DMs in image editing albeit in a non-adversarial context. Yet, we also find that for object or style unlearning, optimizing only the first layer of the text encoder has demonstrated satisfactory robustness and utility in DM unlearning. This suggests that nudity unlearning presents a more challenging task in ensuring robustness. Utility-wise, we observe a slight performance degradation as more encoder layers are robustified, which is under expectation. Choice of adversarial attacks. In Tab. 9, we show the attack success rate (ASR), the robustness metric of post-nudity unlearning against various choices of adversarial prompt attacks: ① CCE (circumventing concept erasure) [111] utilizes textual inversion to generate universal adversarial attacks in the embedding space. By inverting an erased concept into a 'new' token embedding, learned from multiple images featuring the target concept, this embedding is then inserted into the target text prompt. ② PEZ (hard prompts made easy) [111] is to generate an entire text prompt for the target image by optimizing through the cosine similarity. ③ PH2P (prompting hard or hardly prompting) [112] is similar to PEZ but with different optimization objective. ④ UnlearnDiffAtk [23] has been used as the default method for generating attacks in this work. When the attack is based on discrete prompts (such as UnlearnDiffAtk, PEZ, and PH2P), our proposed method AdvUnlearn consistently achieves remarkable erasure performance and robustness. Notably, UnlearnDiffAtk consistently achieves a higher ASR than PEZ and PH2P, reaffirming its use as our primary tool for robustness evaluation among text-based adversarial attacks. In parallel, the CCE attack achieves a higher ASR compared to text prompt-based methods, as it leverages continuous embeddings, offering a larger search space with greater attack flexibility. This is not surprising as the textual inversion is engineered to learn a 'new' continuous token embedding, enabling the representation of objects not encountered during training.Other ablation studies. In Appx. F, we demonstrate more ablation studies. This includes: ① the impact of the utility-retaining regularization weight on AdvUnlearn (Fig. A3 ); ② the selection of retain sets for utility-retaining regularization (Tab. A3); ③ the impact of adversarial prompting strategy for AdvUnlearn (Tab. A4); ④ the robustness of SD v1.4 finetuned through AdvUnlearn against different adversarial prompt attack (Tab. A5). 
conclusion: 
 Current unlearned DMs (diffusion models) remain vulnerable to adversarial prompt attacks. Our proposed robust unlearning framework, AdvUnlearn, illuminates potential strategies for enhancing the robustness of unlearned DMs against such attacks while preserving image generation utility. Notably, our framework employs utility-retaining regularization on a retained prompt set and identifies the text encoder as a more effective module for robustification compared to the UNet within DMs.Through extensive experiments, we demonstrate that AdvUnlearn strikes a graceful balance between robust unlearning and image generation utility. Despite the possibility of using fast attack generation to speed up AdvUnlearn, continual improvement in computational efficiency remains a crucial area for future research. Limitations and broader impacts are further discussed in Appx. G and Appx. H. 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: The discussion on broader impacts can be found in Appx. H. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: Our paper is designed for defensive DM unlearning. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: We cite the original paper that produced the code package and dataset. Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL.• The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: A System Prompt for LLM as a JudgerWe utilize a Large Language Model (LLM) like GPT-4 to act as a judger to filter out prompts that are relevant to the concept to be unlearned. Since nudity is a global concept [19] , even if 'nudity' is not mentioned in the prompt, the generated image conditioned on the prompt might still involve the 'nudity' concept. As a result, the system prompt for the LLM to act as a prompt judger for the 'nudity' concept is shown below:"Could you identify the prompts from my uploaded CSV file that are likely to lead the Stable Diffusion model to generate images with sensitive content? For instance, prompts that mention attire with an emphasis on attractiveness or those that focus on specific body parts may unintentionally prompt the generation of images with nudity."Unlike 'nudity', objects are local concepts, so we only need to filter out the name of the object that needs to be unlearned directly in the prompt. Thus, the system prompt for the LLM to act as a prompt judger for the specific object is shown below:"Could you analyze the prompts from my uploaded CSV file to identify those that are likely to direct the Stable Diffusion model to generate images containing '{OBJECT}' or any of its synonyms?"Algorithm 1 outlines the steps of AdvUnlearn. Each iteration consists of two stages: adversarial prompt generation and unlearning with utility-retaining regularization. During adversarial prompt generation, the optimized adversarial prompt embedding is randomly initialized and iteratively updated. When attack step number K = 1, one-step FGSM ( 7) is utilized to generate adversarial promtps. In the unlearning stage, the adversarial prompt optimized in the previous stage is used to compute the unlearning loss, while a batch of prompts from the retain set is used to compute the utility-retaining regularization loss. The combination of unlearning loss and retaining loss is then used to update the trainable module parameters. Randomly initialize adversarial soft prompt embedding δ 0 5: ♢ Defensive unlearning with utility-retaining regularization 11:if K = 1 then 6: δ = δ 0 -α • sign (∇ δ ℓ atk (θ i , c + δ 0 )) ▷ Fast AT variant: One-Step FGSM (7) 7:ℓ u (θ i , c + δ K ) = ℓ ESD (θ i , c + δ K ) + γE c∼Cretain ∥ϵ θi (x t |c) -ϵ θo (x t |c)∥ 2 212:θ i+1 = θ i -β∇ θ ℓ u (θ i , c + δ K )13: end forFollowing the methodology of [23] , we introduce prepended prompt perturbations using N tokens, where N = 5 is designated for nudity unlearning and N = 3 for both style and object unlearning. To optimize these adversarial perturbations, we sample 50 diffusion time steps and execute UnlearnDiffAtk over 40 iterations with a learning rate of 0.01, using the AdamW optimizer. For the classification of generated images, we use NudeNet [113] for nudity unlearning, a ViT-base model [23] fine-tuned on the WikiArt dataset for style unlearning, and an ImageNet-pretrained ResNet-50 for object unlearning tasks. The metrics used for this evaluation are Attack Success Rate (ASR), Fréchet Inception Distance (FID), and CLIP score. As shown in Tab. A1, although ScissorHands (SH) [54] and EraseDiff (ED) [53] achieve high unlearning robustness against adversarial prompt attacks, the trade-offs are significant. Their dramatically high FID and low CLIP scores indicate an inability to generate high-quality images that align with the condition text prompts. This is further corroborated by their visualization examples. In Fig. A1 , we observe that, regardless of the condition prompts, the generated images are similar, demonstrating that SH and ED fail to generate varied and contextually appropriate images. Therefore, we do not include them in the main performance evaluation table for nudity unlearning to maintain clarity. The unlearning methods compared include FMN (Forget-Me-Not) [20] , SPM (concept-SemiPermeable Membrane) [28] , SalUn (saliency unlearning) [27] , ED (EraseDiff) [53] , ESD (erased stable diffusion) [19] , SH (ScissorHands) [54] , and our proposed DM unlearning scheme, referred to as AdvUnlearn. As shown, our proposed DM unlearning method, AdvUnlearn, consistently achieves the best unlearning efficacy (around 10%) with competitive image generation utility. In comparison, FMN and SPM prioritize retaining image generation utility but exhibit weak unlearning robustness against adversarial prompt attacks. Conversely, SH achieves strong robustness but at the high cost of image generation utility degradation. The remaining methods (SalUn, ED, and ESD) attempt to find a balance between robustness and utility; however, their unlearning robustness is not stable across different object concepts, and their ASR is multiple times higher than that of our proposed AdvUnlearn. The visualization examples associated with the results presented in Tab. A2 can be found in In this section, we explore the influence of utility-retaining regularization weight and attack step number of adversarial prompt generation for our proposed DM unlearning scheme, AdvUnlearn. Regularization weight. As depicted in Fig. A3 , there is a clear upward trend in both the CLIP Score and ASR as the utility-retaining regularization weight increases. The CLIP Score, represented by the blue line, shows a gradual and consistent rise, starting from 0.282 at a regularization weight of 0.1 and reaching 0.3 at a weight of 0.7, indicating improved image generation utility. However, this improvement comes at a cost, as the ASR, illustrated by the red bars, demonstrates a significant increase from 13.18% at a weight of 0.1 to 36.63% at a weight of 0.7, suggesting a degradation in unlearning efficacy. Consequently, we have selected a regularization weight of 0.3 as our default setting due to its balanced performance, providing a compromise between enhanced image generation utility and acceptable unlearning efficacy. Retain set selection. We introduce a utility-retaining regularization, defined in (6) , designed to reduce the degradation of image generation utility commonly associated with adversarial training for unlearning. In Tab. A3, we examine the influence of object class sources on the retain set, using the template 'a photo of [OBJECT]', and evaluate the effectiveness of employing a Large Language Model (LLM) as a prompt filter, which helps exclude prompts potentially related to the concept being erased. We ensure that each retain set contains an equal number of prompts to allow for fair comparison. Our findings indicate that retain sets sourced from the COCO dataset consistently outperform those from ImageNet in terms of unlearning efficacy, with only minor utility loss. Additionally, the table underscores the benefits of the LLM prompt filter: prompts refined through this filter significantly boost unlearning efficacy while preserving image generation utility, in stark contrast to datasets assembled without such filtering. Clearly, the choice of object class for prompt dataset creation plays a crucial role in balancing unlearning efficacy against image generation utility. Adversarial prompting strategy. We evaluate three distinct adversarial prompting strategies for adversarial prompt generation in AdvUnlearn: ① Replace: This strategy involves directly replacing the original concept prompt with an optimized adversarial soft prompt. ② Add: This method adds the optimized adversarial soft prompt to the original concept prompt within the token embedding space. ③ Prefix: This approach prepends the optimized adversarial soft prompt before the original concept prompt, and is the default setting for our study. As demonstrated in Tab. A4, the Prefix strategy emerges as the most effective, achieving the highest unlearning efficacy-with nearly half the Attack Success Rate (ASR) of the other strategies-while maintaining competitive image generation utility compared to the Replace and Add strategies. Robustness gain from AdvUnlearn at different test-time attacks. In Tab. A5, we present the robustness of SD v1.4 post-nudity unlearning when facing different test-time adversarial prompt attacks, UnlearnDiffAtk [23] (default choice) and P4D [24] . As we can see, AdvUnlearn maintains its effectiveness in improving robustness under both attack methods at testing time. Notably, the ASR against P4D is even lower than that against UnlearnDiffAtk. This result is expected, as P4D employs the same attack loss (4) used during training for generating adversarial prompts in (5) . Therefore, we default to UnlearnDiffAtk for test-time attacks in robustness evaluation due to its unseen nature during training.This work seeks to improve the robustness of concept erasing by incorporating the principles of adversarial training (AT) into the process of machine unlearning, resulting in a robust unlearning framework named AdvUnlearn. In AT, generating adversarial examples with a K-step attack typically requires nearly K times more computation time than vanilla training. Although we considered faster attack generation methods, such as the Fast Gradient Sign Method (FGSM), these were found to suffer from some robust performance degradation. Additionally, to maintain image generation utility, we introduced a utility-retaining regularization, which also demands additional computation time. Therefore, future efforts to enhance computational efficiency without significantly compromising performance are essential for improving the current work.The broader impacts of this study include social and ethical implications, where improved reliability of concept erasing aligns AI technologies with societal norms and ethical standards, potentially reducing the spread of harmful digital content. Additionally, AdvUnlearn addresses significant legal concerns by reducing the likelihood of DMs inadvertently producing content that violates copyright laws, supporting the responsible deployment of AI in creative industries. This advancement also marks a significant step forward in AI safety and security by integrating adversarial training into machine unlearning, ensuring AI systems are not only capable of forgetting specific concepts but also resilient to manipulations intended to circumvent these protections. While demonstrating a balanced trade-off between robustness and utility, the complexity of AdvUnlearn's implementation highlights the need for further studies on the impacts of robustification techniques on AI model performance and scalability. Furthermore, this work opens new avenues for research in AI model robustness and necessitates continuous research, thoughtful policy-making, and cross-disciplinary collaboration to fully realize the potential of these technologies in a manner that benefits society as a whole.NeurIPS Paper Checklist Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: We have made sure to preserve anonymity.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).38th Conference on Neural Information Processing Systems (NeurIPS 2024). 


Decision: **Summary:**
Diffusion models are highly effective in text-to-image generation but risk generating harmful content and violating copyrights. To address this, machine unlearning techniques, or concept erasing, have been developed but are vulnerable to adversarial prompt attacks. This work introduces AdvUnlearn, a robust unlearning framework using adversarial training (AT) to strengthen concept erasing. A direct use of AT can harm image quality, so a utility-retaining regularization is used to maintain balance. The text encoder, rather than UNet, is found more effective for robustification. AdvUnlearn shows superior robustness and maintains model utility, marking the first systematic exploration of robust DM unlearning with AT.

**Strengths:**
- Motivation: 
  - "Significant" problem solving and "intuitive and reasonable" (gHPo)
  - "Relatively new and important" (4rR4)
- Results:
  - Relatively "thorough" experiment (gHPo)
  - "Enhanced robustness" maintaining "image quality" (hd8m)
  - "Plug-and-play usability" (hd8m)
- Clarity:
  - Formulated "clearly" (4rR4)

**Weaknesses:**
Initially, all the reviewers (gHPo, 4rR4, hd8m) shared concerns about insufficient model comparison, but the authors appear to have successfully addressed these issues. Reviewer 4rR4 raised a concern about the lack of quantitative results, which the authors thoroughly addressed in their rebuttal. As a result, Reviewer 4rR4 ultimately shifted to acceptance. The AC acknowledges the authors' persistent efforts and the active engagement of our reviewers.

**Justifications for Recommendation:**
Overall, the authors' rebuttal efforts were effective, and the major issues raised were well addressed. It appears that all major concerns from the reviewers were adequately resolved during the author-reviewer discussion period. Based on these, AC is pleased to recommend acceptance.

Reviews: review: paper_summary: paper_summary: This paper proposes AdvUnlearn, a method aimed at enhancing the robustness of concept erasing. The approach integrates the principles of adversarial training into the unlearning process. Specifically, the text encoder is identified as the most suitable module for robustification. Experiments are conducted on eight DM unlearning methods, including nudity unlearning, style unlearning, and object unlearning.
strength_weakness: strength_weakness: The experimental section lacks a sufficient number of attack methods.

The introduction to C_{retrain} is inadequate.
questions: questions: The key questions preventing me from increasing my rating are:

I don't understand why only UnlearnDiffAtk is used for robustness evaluation. Since the robustification targets the text encoder, it seems that the textual inversion-based attack [65] should also be used for robustness evaluation. Additionally, I suggest that more reasonable attacks be considered for robustness evaluation.

I also question the approach of mainly robustifying the text encoder. Even after adversarial training, I believe there will still be an embedding that can generate the target concept. This defense could be easily bypassed by some embedding-based attack.

I don't understand how C_{retrain} is selected to retain model utility. Are the concepts not covered in C_{retrain} still suffering from degradation?
limitations: limitations: The limitations have been discussed in the appendix.
paper_summary: paper_summary: The authors propose a method for robust (against adversarial attacks) concept-erasing for latent diffusion models. Specifically text-to-image diffusion models.

The main contributions are:
1. Integrating adversarial training into machine unlearning by modifying it as a bi-level optimization problem.
2. Contrary to the conventional techniques where only the parameters of the UNeT is updated, the authors show that updating the text encoder can effectively maintains a robustness-utility trade-off.
strength_weakness: strength_weakness: Lack of Sufficient Evaluation:
1. The authors majorly evaluate the robustness of the method against only the UnlearnDiff attack, which is a text-based attack.
2. They have not extended their evaluations to other recent peer-reviewed SOTA attacks such as the CCE (ICLR-24) [1] and RAB (ICLR-24) [2] attacks. 
3. Specifically, CCE is a strong inversion-based attack that introduces a new token into the vocabulary. CCE relatively takes much less time than the UnlearnDiffAttack. 
4. GIVEN CCE ATTACK INVERTS THE ERASED CONCEPT INTO A NEW TOKEN, THE AUTHOR'S CLAIMS OF UPDATING ONLY THE TEXT-ENCODER FOR A BETTER ROBUSTNESS-UTILITY TRADEOFF CAN BE CALLED INTO QUESTION.
5. In addition to the UnlearnDiffAttack, the performance of AdvUnlearn on CCE would be the right benchmark to assess the model's robustness.

Lack of Completeness:
1. The authors have not presented the quantitative erasing results of AdvUnlearn for any of the unlearning scenarios. In addition to the robustness and utility performance, studying the erasing performance of the method is important to understand whether optimizing for the former two properties has any compromise on the latter's performance.

References:
[1] https://arxiv.org/pdf/2308.01508 (Circumventing Concept Erasure Methods For
Text-to-Image Generative Models)
[2] https://arxiv.org/pdf/2310.10012 (RING-A-BELL! HOW RELIABLE ARE CONCEPT REMOVAL METHODS FOR DIFFUSION MODELS?)
questions: questions: Nudity Unlearning:
1. Why have the authors chosen only a subset of the 4703 I2P prompts?
2. How many prompts are there in the subset?
2. On what filters was the subset chosen?
3. Please elaborate on why the erasing results on the original I2P benchmark and the nudity count are missing.

Style Unlearning:
1. Please elaborate on why the erasing results for the art unlearning scenario is not discussed.
2. The authors have not discussed how erasing the style of one artist affects the other artistic styles.

Objects Unlearning:
1. Please elaborate on why the erasing results of each of the object scenarios are not discussed.
2. For the object unlearning scenarios, the experimental setup of evaluating against only 50 prompts seems limited. Baseline method such as ESD evaluate on a large set of 500 samples and also present the results on the remaining classes to understand the loss of utility. This analysis is missing here.

Utility:
1. Why have the authors chosen to compute the FID and CLIP scores on the subset of 10K prompts and not the standard 30K prompts like previous methods in the benchmark?
2. Why do the FID and CLIP scores of AdvUnlearn vary significantly for different concept/unlearning scenarios? eg: FID/CLIP score is 19.34/0.29 for nudity-unlearning and 16.96/0.30 for style-unlearning? On the other hand, the performance of baseline ESD does not vary as significantly: 18.18/0.30 (nudity) vs 18.71/0.30 (style).
limitations: limitations: 1. The authors have discussed the limitations of the proposed method.
2. However, as highlighted in the "weakness" section, the author's claim of robustification through updating only the text-encoder cannot be verified unless evaluated against other adversarial attacks from the literature such as CCE and RAB.
paper_summary: paper_summary: This paper introduces AdvUnlearn, a robust unlearning framework that integrates adversarial training into diffusion models to enhance concept erasure. This method aims to prevent DMs from generating harmful or inappropriate content, such as nudity, even under adversarial prompt attacks. AdvUnlearn focuses on optimizing the text encoder rather than the UNet, achieving a balance between effective concept erasure and high image generation quality. Extensive experiments demonstrate AdvUnlearn's robustness and utility across various unlearning scenarios.
strength_weakness: strength_weakness: 1. ASR needs to be measured based on more baseline attacks. Since the proposed method is based on the CLIP text encoder, incorporating CLIP-based adversarial attack methods [1] and [2] would provide greater understanding.


[1] Wen et al., Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery\
[2] Mahajan et al., Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Models
questions: questions: 1. I thoroughly reviewed the algorithm in the Appendix. However, I need more details on how the text encoder is optimized using Eq.(5). The current form of Eq.(5) does not seem to include the text encoder. Please provide more details on this process.
limitations: limitations: 1. More discussion comparing the proposed method with CLIP-based attacks [1] and [2] would be welcomed.

[1] Wen et al., "Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery"\
[2] Mahajan et al., "Prompting Hard or Hardly Prompting: Prompt Inversion for Text-to-Image Diffusion Models"

Comments: title: Gratitude for Your Positive Feedback and Continued Discussion
Gratitude for Your Positive Feedback and Willingness to Increase Rating
Gratitude for Your Positive Feedback and Continued Discussion
comment: Dear Reviewer gHPo,

Thank you for your recognition of our detailed rebuttal and for maintaining your positive assessment with a score of 5. We are glad to hear that our responses have successfully addressed **most of your questions**.

Based on your insightful comments regarding "The key questions preventing me from increasing my rating..", we sincerely hope that our detailed responses have adequately addressed these questions and helped to reinforce your confidence in our work. If you believe our rebuttal efforts in addressing these questions are meritorious, we would greatly appreciate it if you could consider increasing your rating.

Should there be any more questions or need for further discussion, please feel free to reach out. We are fully prepared to continue our dialogue to ensure that all aspects of your concerns are thoroughly addressed before the rebuttal period concludes.

Thank you once again for your thoughtful feedback and consideration.


Warm regards,

Authors
Dear Reviewer 4rR4,

We are delighted to learn that our rebuttal has **successfully addressed all your questions and concerns.** We are committed to further enhancing our paper based on your insightful feedback.

Additionally, we are very grateful for **your willingness to consider increasing the original rating (a score of 4) to a higher rating.** It would be highly appreciated if you could make this adjustment during the author-reviewer discussion phase. Your support and acknowledgment of the efforts we have put into our rebuttal are incredibly encouraging. 

Thank you!

Authors
Dear Reviewer hd8m,

Thank you for recognizing our rebuttal efforts and for your continued engagement with our submission, particularly your request for further clarification. We provide our further response below. 

We have now included the ASR for the original base model (SD v1.4) across different attack methods in **Table R8** of our response. As indicated, UnlearnDiffAtk demonstrates higher ASRs compared to PEZ and PH2P, as well as CCE (see GR1). We acknowledge your correct assessment that PEZ, operating more like a black-box attack, leverages only the text encoder within the DM, thus exhibiting a weaker attack profile. In contrast, UnlearnDiffAtk, designed specifically to test the robustness of concept erasing/unlearning in DMs, shows a significantly stronger attack performance than other attack methods. This is also noted in our paper (Tables 5-7), where we showed a 100% ASR for UnlearnDiffAtk against the original DM to underscore its effectiveness as an effective attack method in evaluation.  This high ASR reflects UnlearnDiffAtk's tailored approach as a white-box, text-based adversarial prompt method, which is valid for a rigorous assessment of unlearned models.

In light of your feedback, we will include these experimental justifications in the revised manuscript to address concerns regarding the selection of UnlearnDiffAtk and its comparative analysis with other prompt-level attack methods. Although these revisions strengthen our paper, they do not deviate from the original contributions, e.g., the validity of using UnlearnDiffAtk in evaluation.

**Table R8: Attack evaluation of **base model** (w/o applying AdvUnlearn) in ASR across various generation concepts of our interest (Nudity, Style, Object)  under distinct attacks. A higher ASR indicates stronger  attack performance.**
|                           | Nudity | Van Gogh | Church | Parachute | Tench | Garbage Truck |
|-------------------------------|--------|----------|--------|-----------|-------|---------------|
| ASR (Under UnlearnDiffAtk)    | 100%   | 100%     | 100%   | 100%      | 100%  | 100%          |
| ASR (Under CCE Attack)        | 82.39% | 90%      | 88%    | 96%       | 80%   | 88%           |
| ASR (Under PEZ Attack)        | 45.07% | 34%      | 48%    | 52%       | 42%   | 46%           |
| ASR (Under PH2P Attack)       | 54.93% | 42%      | 62%    | 58%       | 48%   | 56%           |

We hope the above response addresses your remaining concerns adequately. If you have any more questions or need further discussion, please feel free to reach out. We will try our best to ensure that all your concerns can be thoroughly addressed before the rebuttal period concludes.

Thank you very much,

Authors
I appreciate the author's detailed rebuttal.
The authors have clarified all my queries and I am willing to increase my rating.
Thank you for your clarification and for providing the additional experimental results. However, I believe further clarification is still needed. Specifically, I noticed that Table 1 of the additional PDF does not include results from the naive model for comparison. To make a proper comparison, it is essential to show the ASR of PEZ and PH2P first. After that, reporting the robustness would provide a clearer understanding. Additionally, it seems evident that UnlearnDiff has a higher success rate than PEZ, as PEZ is more akin to a black-box attack in terms of access to the U-Net.

Given these points, I will maintain my score. While the paper presents good motivation, it requires revisions to address the questions raised by other reviewers and myself.
I appreciate the authors' detailed rebuttal and additional insights. Most of my questions have been addressed, and I will be maintaining my original rating.