mlsanityData to 7 Oct 2026

When Are Concepts Erased From Diffusion Models?

arXiv 2505.17013 ↗First posted 22 May 2025cs.LG cs.CVcited by 14

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

In concept erasure, a model is modified to selectively prevent it from generating a target concept. Despite the rapid development of new methods, it remains unclear how thoroughly these approaches remove the target concept from the model. We begin by proposing two conceptual models for the erasure mechanism in diffusion models: (i) interfering with the model's internal guidance processes, and (ii) reducing the unconditional likelihood of generating the target concept, potentially removing it entirely. To assess whether a concept has been truly erased from the model, we introduce a comprehensive suite of independent probing techniques: supplying visual context, modifying the diffusion trajectory, applying classifier guidance, and analyzing the model's alternative generations that emerge in place of the erased concept. Our results shed light on the value of exploring concept erasure robustness outside of adversarial text inputs, and emphasize the importance of comprehensive evaluations for erasure in diffusion models.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 29 of its 35 references that are in the map. First posted on arXiv 22 May 2025.

Builds on

29 of 35 references.

Closest ancestors · 13

Same direction, newest first

  1. 2024TraSCE: Trajectory Steering for Concept Erasure10 Dec
  2. 2024Memories of Forgotten Concepts1 Dec
  3. 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generation16 Oct
  4. 2024Unlearning or Concealment? A Critical Analysis and Evaluation Metrics for Unlearning in Diffusion Models9 Sep
  5. 2024STEREO: A Two-Stage Framework for Adversarially Robust Concept Erasing from Text-to-Image Diffusion Models29 Aug
  6. 2024Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models17 Jul
  7. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now18 Oct
  8. 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?16 Oct
  9. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts12 Sep
  10. 2023Unified Concept Editing in Diffusion Models25 Aug
  11. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
  12. 2023Erasing Concepts from Diffusion Models13 Mar
1 more
  1. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov

Other references · 16

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  2. 2020Denoising Diffusion Implicit Modelscited by 9,655
  3. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  5. 2021CLIPScore: A Reference-free Evaluation Metric for Image Captioningcited by 2,388
  6. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,231
  7. 2022Editing Models with Task Arithmeticcited by 1,076
  8. 2023Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Modelscited by 175
  9. 2023Cones: Concept Neurons in Diffusion Models for Customized Generationcited by 150
  10. 2023Concept Sliders: LoRA Adaptors for Precise Control in Diffusion Modelscited by 148
  11. 2023Circumventing Concept Erasure Methods For Text-to-Image Generative Modelscited by 81
  12. 2024Interpreting the Weight Space of Customized Diffusion Modelscited by 35
4 more
  1. 2024Diffusion Lens: Interpreting Text Encoders in Text-to-Image Pipelinescited by 28
  2. 2024Robust Concept Erasure Using Task Vectorscited by 27
  3. 2025Distilling Diversity and Control in Diffusion Modelscited by 21
  4. 2023How Much Training Data is Memorized in Overparameterized Autoencoders? An Inverse Problem Perspective on Memorization Evaluationcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 11.

14 papers.

Sort:

By area:

  1. 2025Image Can Bring Your Memory Back: A Novel Multi-Modal Guided Attack against Image Generation Model Unlearningcited by 9
  2. 2025SAEmnesia: Erasing Concepts in Diffusion Models with Supervised Sparse Autoencoderscited by 8
  3. 2025Locality-Aware Continual Unlearning for Diffusion Modelscited by 5
  4. 2026Localized Concept Erasure in Text-to-Image Diffusion Models via High-Level Representation Misdirectioncited by 2
  5. 2026The Illusion of Forgetting: Attack Unlearned Diffusion via Initial Latent Variable Optimizationcited by 1
  6. 2026PROBE: Diagnosing Residual Concept Capacity in Erased Text-to-Video Diffusion Modelscited by 1
  7. 2026Evaluation without Generation: Non-Generative Assessment of Harmful Model Specialization with Applications to CSAMcited by 1
  8. 2026Understanding Empirical Unlearning with Combinatorial Interpretabilitycited by 0
  9. 2026Whispers in the Noise: Surrogate-Guided Concept Awakening via a Multi-Agent Frameworkcited by 0
  10. 2026Concept Unlearning via Cross-Attention Activation Projection for Diffusion Modelscited by 0
  11. 2026TILDE: TILt-based Distributional Erasure for Concept Unlearningcited by 0
  12. 2026Stress Testing Concept Erasure with Large Language Model Agentscited by 0
2 more
  1. 2026Data Unlearning via Inverse Distillationcited by 0
  2. 2026Weeding Out Bad Seeds: Initial-Noise-Robust Unlearning for Text-to-Image Diffusion Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservation
  2. 2025Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them
  3. 2025Erased or Dormant? Rethinking Concept Erasure Through Reversibility
  4. 2025Rethinking Robust Adversarial Concept Erasure in Diffusion Models
  5. 2026Erasing Without Collateral Damage: Precise Concept Removal in Diffusion Models
  6. 2026No Concept Escapes the Audit: Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models
  7. 2026AEGIS: Adversarial Target-Guided Retention-Data-Free Robust Concept Erasure from Diffusion Models
  8. 2026Empty SPACE: Cross-Attention Sparsity for Concept Erasure in Diffusion Models