Research map / Image generation / Text-to-image diffusion
Direct Unlearning Optimization for Robust and Safe Text-to-Image Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DUO, which removes NSFW visual concepts from text-to-image diffusion models by applying Diffusion-DPO on SDEdit-generated safe/unsafe image pairs plus an output-preserving prior regularizer, making it robust to prompt-based red teaming.
Problem
Prompt-based unlearning in text-to-image diffusion models is easily bypassed by adversarial prompts and embeddings, so unsafe content (nudity, violence) can still be generated.
Approach
Reformulate image-based unlearning as preference optimization: unsafe images are dispreferred and SDEdit-generated paired safe images (same layout, concept removed) are preferred, trained with Diffusion-DPO, plus an output-preserving loss at pure noise x_T to retain prior generation ability.
Key results
- On nudity, DUO (beta=250) achieves FID 13.59 and CLIP 30.84 on MS COCO 30k, comparable to SD1.4v (13.52 / 30.95) and SPM (14.05 / 30.84).
- DUO maintains a defense success rate of nearly 90% against Ring-A-Bell, SneakyPrompt, and Concept Inversion for nudity, per the paper's Pareto plots.
- On violence, DUO (beta=1000) achieves FID 13.37 and CLIP 30.78, close to the SD1.4v baseline, while ESD degrades to FID 16.87.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add output-preserving regularization (ablation) | DUO · MS COCO generation during nudity unlearning | prior preservation | Helped |
| Remove output-preserving regularization (ablation) | DUO · MS COCO generation during unlearning | image recognizability | Hurt |
| Decrease β toward 0 (ablation) | DUO · Unrelated-concept generation | image quality | Hurt |
| Increase synthesized image pairs from fewer than 64 to 64 (ablation) | DUO · Ring-A-Bell nudity | Defense Success Rate | Helped |
| Increase synthesized image pairs beyond 64 (ablation) | DUO · Ring-A-Bell nudity | Pareto curve | No clear effect |
| Use SDEdit-generated paired safe images instead of prompt substitution (ablation) | DUO image-pair construction · Paired image synthesis for concept unlearning | preservation of unrelated visual features | Helped |
| Use DUO instead of baseline unlearning methods | Stable Diffusion 1.4 nudity unlearning · MS COCO 30k | FID: 13.52 -> 13.65 | Mixed |
| Use DUO instead of baseline unlearning methods | Stable Diffusion 1.4 violence unlearning · MS COCO 30k | FID: 13.52 -> 13.37 | Helped |
| Apply DUO to Stable Diffusion 3 | Stable Diffusion 3 · MS COCO, nudity | FID: 21.83 -> 20.49 | Helped |
Surprising findings
- Using beta=500 for nudity drops CLIP score to 19.88, showing a sharp trade-off cliff where prior knowledge is rapidly lost.
- Under concept inversion, the model generates completely corrupted images rather than safe ones, suggesting white-box attacks require removing internal features rather than bypassing them.
Limitations
- Unrelated concepts sharing very similar visual features with the unlearned concept may be affected by unlearning.
- Violence unlearning is less complete and training is more unstable, requiring per-sub-concept LoRAs merged together.
- Vulnerable to new adversarial attacks and possible misuse by malicious actors manipulating the unlearning process.
Experimental setup
Datasets: MS COCO 30k validation i2p benchmark Ring-A-Bell prompts SneakyPrompt prompts
Benchmarks: Ring-A-Bell SneakyPrompt Concept Inversion UnlearnDiffAtk MS COCO 30k
Metrics: defense success rate FID CLIP score LPIPS prior preservation
Baselines: ESD UCE SPM SafeGen Ring-A-Bell SneakyPrompt Concept Inversion UnlearnDiffAtk
Builds on: Direct Preference Optimization Diffusion-DPO SDEdit ESD SPM
Closest papers by meaning
- Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models (NeurIPS 2024 · similarity 0.90)
- Boosting Alignment for Post-Unlearning Text-to-Image Generative Models (NeurIPS 2024 · similarity 0.87)
- ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning (ICLR 2025 · similarity 0.87)
- Enabling Preference-driven Unlearning in Few-step Distilled Text-to-Image Diffusion Models (NeurIPS 2026 · similarity 0.87)
- SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation (ICLR 2025 · similarity 0.87)
- Towards Resilient Safety-driven Unlearning for Diffusion Models against Downstream Fine-tuning (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.