Hiding and Recovering Knowledge in Text-to-Image Diffusion Models via Learnable Prompts
On the map: Diffusion models → Robustness, privacy and adversarial aspects
Abstract (arXiv)
Diffusion models have demonstrated remarkable capability in generating high-quality visual content from textual descriptions. However, since these models are trained on large-scale internet data, they inevitably learn undesirable concepts, such as sensitive content, copyrighted material, and harmful or unethical elements. While previous works focus on permanently removing such concepts, this approach is often impractical, as it can degrade model performance and lead to irreversible loss of information. In this work, we introduce a novel concept-hiding approach that makes unwanted concepts inaccessible to public users while allowing controlled recovery when needed. Instead of erasing knowledge from the model entirely, we incorporate a learnable prompt into the cross-attention module, acting as a secure memory that suppresses the generation of hidden concepts unless a secret key is provided. This enables flexible access control -- ensuring that undesirable content cannot be easily generated while preserving the option to reinstate it under restricted conditions. Our method introduces a new paradigm where concept suppression and controlled recovery coexist, which was not feasible in prior works. We validate its effectiveness on the Stable Diffusion model, demonstrating that hiding concepts mitigate the risks of permanent removal while maintaining the model's overall capability.
Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 24 of its 32 references that are in the map. First posted on arXiv 18 Mar 2024.
Builds on
24 of 32 references.
Closest ancestors · 9
Same direction, newest first
- 2023Unified Concept Editing in Diffusion Models25 Aug
- 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models23 May
- 2023SneakyPrompt: Jailbreaking Text-to-image Generative Models20 May
- 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
- 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesis27 Mar
- 2023Ablating Concepts in Text-to-Image Diffusion Models23 Mar
- 2023Erasing Concepts from Diffusion Models13 Mar
- 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov
- 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct
Other references · 15
- 2017Attention Is All You Needcited by 60,361
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
- 2021Zero-Shot Text-to-Image Generationcited by 4,288
- 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
- 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
- 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,300
- 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,245
- 2020AdapterFusion: Non-Destructive Task Composition for Transfer Learningcited by 788
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
3 more
Built on by
Citing papers per year: 2024: 2; 2025: 5; 2026: 1.
8 papers.
- 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservationcited by 50
- 2025Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Themcited by 37
- 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
- 2025Erasing Concepts, Steering Generations: A Comprehensive Survey of Concept Suppressioncited by 10
- 2026Multimodal Unlearning Across Vision, Language, Video, and Audio: Survey of Methods, Datasets, and Benchmarkscited by 7
- 2025Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocolscited by 4
- 2025From Unlearning to UNBRANDING: A Benchmark for Trademark-Safe Text-to-Image Generationcited by 2
- 2025Mitigating Semantic Collapse in Generative Personalization with Test-Time Embedding Adjustmentcited by 0
- 2026Multimodal Unlearning Across Vision, Language, Video, and Audio: Survey of Methods, Datasets, and Benchmarks8 Jul 2026
- 2025From Unlearning to UNBRANDING: A Benchmark for Trademark-Safe Text-to-Image Generation15 Dec 2025
- 2025Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocols26 Jul 2025
- 2025Mitigating Semantic Collapse in Generative Personalization with Test-Time Embedding Adjustment27 Jun 2025
- 2025Erasing Concepts, Steering Generations: A Comprehensive Survey of Concept Suppression26 May 2025
- 2025Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them31 Jan 2025
- 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservation21 Oct 2024
- 2024Replication in Visual Diffusion Models: A Survey and Outlook7 Jul 2024
Similar, not cited
Close in wording, no citation either way
- 2025A Comprehensive Survey on Concept Erasure in Text-to-Image Diffusion Models
- 2025CE-SDWV: Effective and Efficient Concept Erasure for Text-to-Image Diffusion Models via a Semantic-Driven Word Vocabulary
- 2025Robust Concept Erasure in Diffusion Models: A Theoretical Perspective on Security and Robustness
- 2024Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models
- 2026Erasing Thousands of Concepts: Towards Scalable and Practical Concept Erasure for Text-to-Image Diffusion Models
- 2025Bi-Erasing: A Bidirectional Framework for Concept Removal in Diffusion Models
- 2025Semantic Surgery: Zero-Shot Concept Erasure in Diffusion Models
- 2026Erasing Without Collateral Damage: Precise Concept Removal in Diffusion Models