mlsanityData to 14 Oct 2026

To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now

arXiv 2310.11868 ↗First posted 18 Oct 2023cs.CVcited by 210

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

The recent advances in diffusion models (DMs) have revolutionized the generation of realistic and complex images. However, these models also introduce potential safety hazards, such as producing harmful content and infringing data copyrights. Despite the development of safety-driven unlearning techniques to counteract these challenges, doubts about their efficacy persist. To tackle this issue, we introduce an evaluation framework that leverages adversarial prompts to discern the trustworthiness of these safety-driven DMs after they have undergone the process of unlearning harmful concepts. Specifically, we investigated the adversarial robustness of DMs, assessed by adversarial prompts, when eliminating unwanted concepts, styles, and objects. We develop an effective and efficient adversarial prompt generation approach for DMs, termed UnlearnDiffAtk. This method capitalizes on the intrinsic classification abilities of DMs to simplify the creation of adversarial prompts, thereby eliminating the need for auxiliary classification or diffusion models. Through extensive benchmarking, we evaluate the robustness of widely-used safety-driven unlearned DMs (i.e., DMs after unlearning undesirable concepts, styles, or objects) across a variety of tasks. Our results demonstrate the effectiveness and efficiency merits of UnlearnDiffAtk over the state-of-the-art adversarial prompt generation method and reveal the lack of robustness of current safetydriven unlearning techniques when applied to DMs. Codes are available at https://github.com/OPTML-Group/Diffusion-MU-Attack. WARNING: There exist AI generations that may be offensive in nature.

Key facts. Cited by 210 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 79 of its 94 references that are in the map. First posted on arXiv 18 Oct 2023.

Builds on

79 of 94 references.

Closest ancestors · 10

Same direction, newest first

  1. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts12 Sep
  2. 2023Unified Concept Editing in Diffusion Models25 Aug
  3. 2023Degeneration-Tuning: Using Scrambled Grid shield Unwanted Concepts from Stable Diffusion2 Aug
  4. 2023Robust Classification via a Single Diffusion Model24 May
  5. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
  6. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion29 Mar
  7. 2023Ablating Concepts in Text-to-Image Diffusion Models23 Mar
  8. 2023Erasing Concepts from Diffusion Models13 Mar
  9. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov
  10. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 69

  1. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2023GPT-4 Technical Reportcited by 18,396
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  10. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,503
  11. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  12. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
38 more
  1. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  2. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,614
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  4. 2021Learning to Prompt for Vision-Language Modelscited by 2,281
  5. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,245
  6. 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  8. 2022Imagic: Text-Based Real Image Editing with Diffusion Modelscited by 1,178
  9. 2022Diffusion Models in Vision: A Surveycited by 1,015
  10. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  11. 2022MotionDiffuse: Text-Driven Human Motion Generation with Diffusion Modelcited by 780
  12. 2016Generative Adversarial Text to Image Synthesiscited by 735
  13. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
  14. 2017AttnGAN: Fine-Grained Text to Image Generation with Attentional Generative Adversarial Networkscited by 664
  15. 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 618
  16. 2017Adversarial Patchcited by 517
  17. 2023Scaling up GANs for Text-to-Image Synthesiscited by 492
  18. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 465
  19. 2018Generating Natural Language Adversarial Examplescited by 424
  20. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  21. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
  22. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 336
  23. 2020Visual Transformers: Token-based Image Representation and Processing for Computer Visioncited by 334
  24. 2021Multimodal datasets: misogyny, pornography, and malignant stereotypescited by 327
  25. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  26. 2022A Survey of Machine Unlearningcited by 312
  27. 2023Your Diffusion Model is Secretly a Zero-Shot Classifiercited by 306
  28. 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearningcited by 279
  29. 2021Machine Unlearning of Features and Labelscited by 229
  30. 2023Model Sparsity Can Simplify Machine Unlearningcited by 214
  31. 2019Controllable Text-to-Image Generationcited by 187
  32. 2015Large-scale Classification of Fine-Art Paintings: Learning The Right Metric on The Right Featurecited by 182
  33. 2022Learning Fast Samplers for Diffusion Models by Differentiating Through Sample Qualitycited by 182
  34. 2023Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Modelscited by 177
  35. 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearningcited by 171
  36. 2020DF-GAN: A Simple and Effective Baseline for Text-to-Image Synthesiscited by 162
  37. 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 155
  38. 2021Federated Unlearning via Class-Discriminative Pruningcited by 115

50 most cited of 69 All 69 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 49; 2025: 89; 2026: 68.

210 papers.

Sort:

By area:

  1. 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generationcited by 386
  2. 2024MACE: Mass Concept Erasure in Diffusion Modelscited by 307
  3. 2024Rethinking Machine Unlearning for Large Language Modelscited by 257
  4. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
  5. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 168
  6. 2024Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Modelscited by 133
  7. 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generationcited by 133
  8. 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Eraserscited by 120
  9. 2025SAeUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoderscited by 80
  10. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 72
  11. 2023Self-Discovering Interpretable Diffusion Latent Directions for Responsible Text-to-Image Generationcited by 69
  12. 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradientcited by 69
38 more
  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  2. 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 62
  3. 2025Set You Straight: Auto-Steering Denoising Trajectories to Sidestep Unwanted Conceptscited by 62
  4. 2025Discrete Diffusion in Large Language and Multimodal Models: A Surveycited by 61
  5. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 58
  6. 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruningcited by 55
  7. 2024UnlearnCanvas: Stylized Image Dataset for Enhanced Machine Unlearning Evaluation in Diffusion Modelscited by 50
  8. 2024Direct Unlearning Optimization for Robust and Safe Text-to-Image Modelscited by 50
  9. 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservationcited by 50
  10. 2024Machine Unlearning in Generative AI: A Surveycited by 49
  11. 2024Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearningcited by 44
  12. 2024STEREO: A Two-Stage Framework for Adversarially Robust Concept Erasing from Text-to-Image Diffusion Modelscited by 42
  13. 2024Meta-Unlearning on Diffusion Models: Preventing Relearning Unlearned Conceptscited by 40
  14. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 39
  15. 2025SPEED: Scalable, Precise, and Efficient Concept Erasure for Diffusion Modelscited by 36
  16. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 35
  17. 2025Localized Concept Erasure for Text-to-Image Diffusion Models Using Training-Free Gated Low-Rank Adaptationcited by 33
  18. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  19. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 32
  20. 2024Separable Multi-Concept Erasure from Diffusion Modelscited by 28
  21. 2025CURE: Concept Unlearning via Orthogonal Representation Editing in Diffusion Modelscited by 27
  22. 2024TraSCE: Trajectory Steering for Concept Erasurecited by 26
  23. 2024Score Forgetting Distillation: A Swift, Data-Free Method for Machine Unlearning in Diffusion Modelscited by 23
  24. 2024Pruning for Robust Concept Erasing in Diffusion Modelscited by 22
  25. 2024Holistic Unlearning Benchmark: A Multi-Faceted Evaluation for Text-to-Image Diffusion Model Unlearningcited by 21
  26. 2024Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editingcited by 21
  27. 2025Training-Free Safe Denoisers for Safe Use of Diffusion Modelscited by 21
  28. 2025Learning to Unlearn while Retaining: Combating Gradient Conflicts in Machine Unlearningcited by 19
  29. 2024Targeted Unlearning with Single Layer Unlearning Gradientcited by 18
  30. 2024MUNBa: Machine Unlearning via Nash Bargainingcited by 17
  31. 2025GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detectioncited by 17
  32. 2024Efficient Fine-Tuning and Concept Suppression for Pruned Diffusion Modelscited by 16
  33. 2025One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Frameworkcited by 16
  34. 2025When Are Concepts Erased From Diffusion Models?cited by 16
  35. 2025Concept Pinpoint Eraser for Text-to-image Diffusion Models via Residual Attention Gatecited by 16
  36. 2024On Catastrophic Inheritance of Large Foundation Modelscited by 15
  37. 2024RealEra: Semantic-level Concept Erasure via Neighbor-Concept Miningcited by 15
  38. 2025TRCE: Towards Reliable Malicious Concept Erasure in Text-to-Image Diffusion Modelscited by 15

50 most cited of 210 All 210 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds
  2. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models
  3. 2024Probing Unlearned Diffusion Models: A Transferable Adversarial Attack Perspective
  4. 2025Embedding Hidden Adversarial Capabilities in Pre-Trained Diffusion Models
  5. 2023Distilling Adversarial Prompts from Safety Benchmarks: Report for the Adversarial Nibbler Challenge
  6. 2025Explore the vulnerability of black-box models via diffusion models
  7. 2025Diffusion Models are Robust Pretrainers
  8. 2024Concept Arithmetics for Circumventing Concept Inhibition in Diffusion Models