Research map / Image generation / Text-to-image diffusion
Towards Resilient Safety-driven Unlearning for Diffusion Models against Downstream Fine-tuning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ResAlign, a safety unlearning framework for T2I diffusion models that uses a Moreau-envelope hypergradient approximation and cross-configuration meta-learning so that unlearning stays resilient to benign downstream fine-tuning.
Problem
Safety-driven unlearning in text-to-image diffusion models is fragile: unsafe behaviors often resurge after downstream fine-tuning, even on benign data.
Approach
Treat downstream fine-tuning as an implicit Moreau-envelope optimization so the unlearning objective can penalize harmfulness regained after simulated fine-tuning, with efficient implicit hypergradients (Richardson iteration with Hessian-vector products), and meta-learn over diverse fine-tuning datasets and configurations to generalize resilience.
Key results
- Before fine-tuning ResAlign reduces IP to 0.0014 (vs 0.3598 for SD v1.4); after fine-tuning on DreamBench++ its IP is 0.0186 vs 0.1038 for AdvUnlearn and 0.3154 for SafeGen.
- After fine-tuning on DiffusionDB, ResAlign's IP is 0.0687 versus 0.2975 for AdvUnlearn and 0.3344 for SafeGen.
- Benign generation is preserved: FID 18.18 / CLIP 31.03 / Aesthetics 5.98, close to SD v1.4 (16.90 / 31.17 / 6.04).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use ResAlign rather than prior unlearning baselines | SD v1.4 · I2P after DreamBench++ fine-tuning | IP: 0.1038 -> 0.0186 | Helped |
| use ResAlign rather than prior unlearning baselines | SD v1.4 · I2P after DiffusionDB fine-tuning | IP: 0.2209 -> 0.0687 | Helped |
| fine-tune an unlearned model on benign data | ESD, SafeGen, AdvUnlearn, LCFDSD-NG, and LCFDSD-LT · I2P harmful generation | IP | Hurt |
| use ResAlign instead of SD v1.4 | SD v1.4 · DreamBooth + Dog | IP: 0.3645 -> 0.0021 | Helped |
| use ResAlign instead of SD v1.4 | SD v1.4 · CustomDiffusion + ArtBench | IP: 0.3416 -> 0.0011 | Helped |
| increase sampled meta-learning configurations from J=1 to J=3 (ablation) | ResAlign · DiffusionDB after fine-tuning | IP: 0.092 -> 0.068 | Helped |
| increase sampled meta-learning configurations from J=3 to J=5 (ablation) | ResAlign · DiffusionDB after fine-tuning | IP: 0.068 -> 0.054 | Helped |
| increase sampled configurations from J=1 to J=3 (ablation) | ResAlign · training | Training time (min): 43.5 -> 58.2 | Hurt |
| add hypergradient approximation (ablation) | ResAlign · DreamBench++ fine-tuning | IP | Helped |
| add dataset meta-learning (ablation) | ResAlign · DreamBench++ fine-tuning | IP | Helped |
| add configuration meta-learning (ablation) | ResAlign · DreamBench++ fine-tuning | IP | Helped |
| replace the negative denoising score matching loss with the ESD unlearning loss (ablation) | ResAlign · I2P before fine-tuning | IP: 0.0014 -> 0.0610 | Hurt |
Surprising findings
- Baseline unlearned models regain harmfulness to near pre-unlearning levels (e.g., AdvUnlearn and SafeGen on DiffusionDB) even when fine-tuned only on benign data.
- The authors state perfect resilience against harmful data is likely impossible, since adversaries can treat recovery as a new learning task.
Limitations
- Theoretical proposition relies on small-perturbation Taylor expansion and an isotropic random perturbation assumption, which may fail for large parameter shifts.
- Resilience to contaminated fine-tuning data degrades as contamination grows; ResAlign is not fully robust to harmful data.
- Evaluation focuses on the sexual category and SD-based models; generalization to other unsafe concepts is not established in the main text.
Experimental setup
Datasets: DreamBench++ DiffusionDB Harmful-Imgs Pokémon Dog ArtBench VGGFace2-HQ I2P Unsafe COCO
Benchmarks: I2P Unsafe COCO DreamBench++ DiffusionDB
Metrics: Inappropriate Rate (IP) Unsafe Score (US) FID CLIP score Aesthetics Score CLIP-I CLIP-T DINO score
Baselines: SD v1.4 ESD SafeGen AdvUnlearn LCFDSD-NG LCFDSD-LT IMMA Meta-Unlearning
Builds on: ESD concept ablation AdvUnlearn meta-unlearning
Closest papers by meaning
- Enabling Preference-driven Unlearning in Few-step Distilled Text-to-Image Diffusion Models (NeurIPS 2026 · similarity 0.91)
- The Illusion of Unlearning: The Unstable Nature of Machine Unlearning in Text-to-Image Diffusion Models (CVPR 2025 · similarity 0.91)
- Leveraging Catastrophic Forgetting to Develop Safe Diffusion Models against Malicious Finetuning (NeurIPS 2024 · similarity 0.90)
- Training-Free Safe Denoisers for Safe Use of Diffusion Models (NeurIPS 2025 · similarity 0.90)
- Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization (CVPR 2025 · similarity 0.90)
- Score Forgetting Distillation: A Swift, Data-Free Method for Machine Unlearning in Diffusion Models (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.