mlsanityData to 14 Oct 2026

Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?

arXiv 2310.10012 ↗First posted 16 Oct 2023cs.LGcited by 250

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models for text-to-image (T2I) synthesis, such as Stable Diffusion (SD), have recently demonstrated exceptional capabilities for generating high-quality content. However, this progress has raised several concerns of potential misuse, particularly in creating copyrighted, prohibited, and restricted content, or NSFW (not safe for work) images. While efforts have been made to mitigate such problems, either by implementing a safety filter at the evaluation stage or by fine-tuning models to eliminate undesirable concepts or styles, the effectiveness of these safety measures in dealing with a wide range of prompts remains largely unexplored. In this work, we aim to investigate these safety mechanisms by proposing one novel concept retrieval algorithm for evaluation. We introduce Ring-A-Bell, a model-agnostic red-teaming tool for T2I diffusion models, where the whole evaluation can be prepared in advance without prior knowledge of the target model. Specifically, Ring-A-Bell first performs concept extraction to obtain holistic representations for sensitive and inappropriate concepts. Subsequently, by leveraging the extracted concept, Ring-A-Bell automatically identifies problematic prompts for diffusion models with the corresponding generation of inappropriate content, allowing the user to assess the reliability of deployed safety mechanisms. Finally, we empirically validate our method by testing online services such as Midjourney and various methods of concept removal. Our results show that Ring-A-Bell, by manipulating safe prompting benchmarks, can transform prompts that were originally regarded as safe to evade existing safety mechanisms, thus revealing the defects of the so-called safety mechanisms which could practically lead to the generation of harmful contents. Our codes are available at https://github.com/chiayi-hsu/Ring-A-Bell.

Key facts. Cited by 250 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 33 of its 40 references that are in the map. First posted on arXiv 16 Oct 2023.

Builds on

33 of 40 references.

Closest ancestors · 8

Same direction, newest first

  1. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts12 Sep
  2. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models23 May
  3. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
  4. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion29 Mar
  5. 2023Ablating Concepts in Text-to-Image Diffusion Models23 Mar
  6. 2023Erasing Concepts from Diffusion Models13 Mar
  7. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov
  8. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 25

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2023GPT-4 Technical Reportcited by 18,396
  5. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  6. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  7. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  8. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  9. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  10. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  11. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
  12. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,245
13 more
  1. 2019Language Models as Knowledge Bases?cited by 1,936
  2. 2020Making Pre-trained Language Models Better Few-shot Learnerscited by 1,256
  3. 2022Red Teaming Language Models with Language Modelscited by 1,026
  4. 2019How Can We Know What Language Models Know?cited by 959
  5. 2021Towards a Unified View of Parameter-Efficient Transfer Learningcited by 872
  6. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 336
  7. 2019A Unified MRC Framework for Named Entity Recognitioncited by 199
  8. 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 155
  9. 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 83
  10. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 83
  11. 2023Red Teaming Language Model Detectors with Language Modelscited by 55
  12. 2022Toward Human Readable Prompt Tuning: Kubrick's The Shining is a good movie, and a good prompt too?cited by 49
  13. 2023Query-Efficient Black-Box Red Teaming via Bayesian Optimizationcited by 32

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 52; 2025: 84; 2026: 110.

250 papers.

Sort:

By area:

  1. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
  2. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 168
  3. 2024Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Modelscited by 133
  4. 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generationcited by 133
  5. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 126
  6. 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Eraserscited by 120
  7. 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 83
  8. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 72
  9. 2024Latent Guard: a Safety Framework for Text-to-image Generationcited by 71
  10. 2024SafeGen: Mitigating Sexually Explicit Content Generation in Text-to-Image Modelscited by 66
  11. 2024T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Modelscited by 66
  12. 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 62
38 more
  1. 2025Set You Straight: Auto-Steering Denoising Trajectories to Sidestep Unwanted Conceptscited by 62
  2. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 58
  3. 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruningcited by 55
  4. 2024UnsafeBench: Benchmarking Image Safety Classifiers on Real-World and AI-Generated Imagescited by 53
  5. 2024UnlearnCanvas: Stylized Image Dataset for Enhanced Machine Unlearning Evaluation in Diffusion Modelscited by 50
  6. 2024Direct Unlearning Optimization for Robust and Safe Text-to-Image Modelscited by 50
  7. 2024STEREO: A Two-Stage Framework for Adversarially Robust Concept Erasing from Text-to-Image Diffusion Modelscited by 42
  8. 2024Perception-guided Jailbreak against Text-to-Image Modelscited by 40
  9. 2024Meta-Unlearning on Diffusion Models: Preventing Relearning Unlearned Conceptscited by 40
  10. 2024Precise, Fast, and Low-cost Concept Erasure in Value Space: Orthogonal Complement Matterscited by 40
  11. 2024RIGID: A Training-free and Model-Agnostic Framework for Robust AI-Generated Image Detectioncited by 36
  12. 2025SPEED: Scalable, Precise, and Efficient Concept Erasure for Diffusion Modelscited by 36
  13. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 35
  14. 2025Localized Concept Erasure for Text-to-Image Diffusion Models Using Training-Free Gated Low-Rank Adaptationcited by 33
  15. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 32
  16. 2024Universal Prompt Optimizer for Safe Text-to-Image Generationcited by 28
  17. 2024Robust Concept Erasure Using Task Vectorscited by 27
  18. 2024Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Modelscited by 27
  19. 2025CURE: Concept Unlearning via Orthogonal Representation Editing in Diffusion Modelscited by 27
  20. 2024TraSCE: Trajectory Steering for Concept Erasurecited by 26
  21. 2025Fine-Grained Erasure in Text-to-Image Diffusion-based Foundation Modelscited by 25
  22. 2024MLLM-as-a-Judge for Image Safety without Human Labelingcited by 23
  23. 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimizationcited by 22
  24. 2024Holistic Unlearning Benchmark: A Multi-Faceted Evaluation for Text-to-Image Diffusion Model Unlearningcited by 21
  25. 2025Training-Free Safe Denoisers for Safe Use of Diffusion Modelscited by 21
  26. 2024AlignGuard: Scalable Safety Alignment for Text-to-Image Generationcited by 20
  27. 2024MU-Bench: A Multitask Multimodal Benchmark for Machine Unlearningcited by 17
  28. 2025One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Frameworkcited by 16
  29. 2025When Are Concepts Erased From Diffusion Models?cited by 16
  30. 2025Concept Pinpoint Eraser for Text-to-image Diffusion Models via Residual Attention Gatecited by 16
  31. 2025TRCE: Towards Reliable Malicious Concept Erasure in Text-to-Image Diffusion Modelscited by 15
  32. 2024Espresso: Robust Concept Filtering in Text-to-Image Modelscited by 14
  33. 2025VideoEraser: Concept Erasure in Text-to-Video Diffusion Modelscited by 14
  34. 2024Probing Unlearned Diffusion Models: A Transferable Adversarial Attack Perspectivecited by 13
  35. 2024Unlearning or Concealment? A Critical Analysis and Evaluation Metrics for Unlearning in Diffusion Modelscited by 13
  36. 2024Multimodal Pragmatic Jailbreak on Text-to-image Modelscited by 13
  37. 2025Yuan: Yielding Unblemished Aesthetics Through A Unified Network for Visual Imperfections Removal in Generated Imagescited by 13
  38. 2025Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimizationcited by 13

50 most cited of 250 All 250 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Six-CD: Benchmarking Concept Removals for Benign Text-to-image Diffusion Models
  2. 2023Degeneration-Tuning: Using Scrambled Grid shield Unwanted Concepts from Stable Diffusion
  3. 2025Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Models
  4. 2024DiffGuard: Text-Based Safety Checker for Diffusion Models
  5. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks
  6. 2026i1: A Simple and Fully Open Recipe for Strong Text-to-Image Models
  7. 2024Unstable Unlearning: The Hidden Risk of Concept Resurgence in Diffusion Models
  8. 2024MACE: Mass Concept Erasure in Diffusion Models