Research map / Image generation / Text-to-image diffusion
Ring-A-Bell! How Reliable are Concept Removal Methods For Diffusion Models?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Ring-A-Bell, a model-agnostic red-teaming tool that builds concept embeddings from contrastive prompt pairs in a CLIP text encoder and uses a genetic algorithm to find problematic prompts that revive removed concepts in T2I models and online services.
Problem
Safety mechanisms for text-to-image diffusion models (safety checkers and concept removal methods) are rarely tested against a wide range of prompts, and their reliability under adversarial prompting is unclear, especially for black-box or online services.
Approach
Extract a holistic concept embedding as the averaged difference between CLIP text embeddings of concept-containing and concept-free prompt pairs, add it (scaled by eta) to a target prompt's embedding, and invert it to discrete tokens with a genetic algorithm, so the attack needs only the text encoder and can be prepared offline.
Key results
- Ring-A-Bell-Union raises nudity ASR on ESD from 12.63% (original prompts) to 55.79% without safety checker, and on SLD-Medium to 100%.
- On violence, Ring-A-Bell-Union reaches 99.6% ASR on SD and 86% on ESD without safety checker, versus 60.4% and 42.4% for original prompts.
- Ring-A-Bell increases ASR by more than 30% for most concept removal methods, and bypasses the safety checker on online services such as Midjourney and DALL-E 2.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace QF-Attack with Ring-A-Bell | ESD · Nudity (w/o SC) | ASR: 6.32% -> 35.79% | Helped |
| Replace QF-Attack with Ring-A-Bell-Union | ESD · Nudity (w/o SC) | ASR: 6.32% -> 55.79% | Helped |
| Replace QF-Attack with Ring-A-Bell | ESD · Violence (w/o SC) | ASR: 56% -> 54% | No clear effect |
| Replace QF-Attack with Ring-A-Bell-Union | ESD · Violence (w/o SC) | ASR: 56% -> 86% | Helped |
| Use the union of three Ring-A-Bell configurations | concept removal methods · Nudity and violence (w/o SC) | ASR: ESD nudity: 35.79% -> 55.79%; ESD violence: 54% -> 86% | Helped |
| Increase prompt length from K=16 to K=77 (ablation) | Ring-A-Bell · Nudity, ESD (w/o SC) | ASR: 35.79% -> 20% | Hurt |
| Increase prompt length from K=16 to K=77 (ablation) | Ring-A-Bell · Violence, ESD (w/o SC) | ASR: 38.8% -> 54% | Helped |
| Set η to 5 instead of 4 (ablation) | Ring-A-Bell · Violence, ESD (w/o SC) | ASR: 50.4% -> 59.2% | Helped |
| Increase η from 5 to 5.5 (ablation) | Ring-A-Bell · Violence, ESD (w/o SC) | ASR: 59.2% -> 54% | Hurt |
| Use GA instead of PeZ (ablation) | Ring-A-Bell · Nudity, ESD (w/o SC) | ASR: 11.58% -> 35.79% | Helped |
| Use GA instead of PeZ (ablation) | Ring-A-Bell · Violence, ESD (w/o SC) | ASR: 32.00% -> 54.00% | Helped |
Surprising findings
- Safety checker reduces nudity ASR sharply, but its effectiveness drops noticeably when detecting violence.
- Prompt dilution alone, without Ring-A-Bell prompts, does not produce inappropriate images.
Limitations
- Validation depends on the accuracy of external classifiers (NudeNet, Q16), which can produce false positives and mis-detections.
- Model-specific attack requires white-box access and is only theoretical; the practical method relies on a surrogate text encoder.
Experimental setup
Datasets: I2P ChatGPT-generated prompt pairs
Benchmarks: I2P
Metrics: attack success rate NudeNet detection Q16 classification
Baselines: QF-Attack P4D Original Prompts PeZ
Builds on: Stable Diffusion CLIP Erased Stable Diffusion Safe Latent Diffusion PeZ
Closest papers by meaning
- Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts (ICML 2024 · similarity 0.90)
- Six-CD: Benchmarking Concept Removals for Text-to-image Diffusion Models (CVPR 2025 · similarity 0.89)
- Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization (CVPR 2025 · similarity 0.89)
- MMA-Diffusion: MultiModal Attack on Diffusion Models (CVPR 2024 · similarity 0.88)
- T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation (CVPR 2025 · similarity 0.88)
- Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Models (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.