Paper deep dive

EraseDiff: Erasing Data Influence in Diffusion Models

Jing Wu, Trung Le, Munawar Hayat, Mehrtash Harandi

Year: 2024Venue: arXiv preprintArea: Model EditingType: EmpiricalEmbeddings: 111

Models: DDIM, DDPM, Stable Diffusion v1.4

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%

Last extracted: 3/12/2026, 7:26:15 PM

Summary

EraseDiff is a novel algorithm for diffusion models that enables the removal of specific data influences (e.g., NSFW content) while preserving overall model utility. It formulates the unlearning task as a constrained optimization problem using the value function, allowing for a natural first-order solution that balances erasure and preservation more effectively than existing methods.

Entities (5)

Diffusion Models · model-architecture · 100%EraseDiff · algorithm · 100%DDPM · model-architecture · 95%NSFW content · unwanted-information · 95%Stable Diffusion · model-architecture · 95%

Relation Signals (3)

EraseDiff → erasesinfluencefrom → Diffusion Models

confidence 98% · EraseDiff, an algorithm designed to preserve the utility of the diffusion model on retained data while removing the unwanted information

EraseDiff → optimizes → Constrained Optimization Problem

confidence 95% · Our approach formulates this task as a constrained optimization problem using the value function

Diffusion Models → generates → NSFW content

confidence 90% · Diffusion models are susceptible to misuse and can generate NSFW digital content

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Diffusion models are highly effective at generating high-quality images but pose risks, such as the unintentional generation of NSFW (not safe for work) content. Although various techniques have been proposed to mitigate unwanted influences in diffusion models while preserving overall performance, achieving a balance between these goals remains challenging. In this work, we introduce EraseDiff, an algorithm designed to preserve the utility of the diffusion model on retained data while removing the unwanted information associated with the data to be forgotten. Our approach formulates this task as a constrained optimization problem using the value function, resulting in a natural first-order algorithm for solving the optimization problem. By altering the generative process to deviate away from the ground-truth denoising trajectory, we update parameters for preservation while controlling constraint reduction to ensure effective erasure, striking an optimal trade-off. Extensive experiments and thorough comparisons with state-of-the-art algorithms demonstrate that EraseDiff effectively preserves the model's utility, efficacy, and efficiency.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

110,532 characters extracted from source content.

Expand or collapse full text

Erasing Undesirable Influence in Diffusion Models Jing Wu1, Trung Le1, Munawar Hayat2, Mehrtash Harandi1 1Monash University, Melbourne, VIC, Australia, 2Qualcomm, San Deigo, CA, US jing.wu1, trunglm, mehrtash.harandi@monash.edu, hayat@qti.qualcomm.com Abstract Diffusion models are highly effective at generating high-quality images but pose risks, such as the unintentional generation of NSFW (not safe for work) content. Although various techniques have been proposed to mitigate unwanted influences in diffusion models while preserving overall performance, achieving a balance between these goals remains challenging. In this work, we introduce EraseDiff, an algorithm designed to preserve the utility of the diffusion model on retained data while removing the unwanted information associated with the data to be forgotten. Our approach formulates this task as a constrained optimization problem using the value function, resulting in a natural first-order algorithm for solving the optimization problem. By altering the generative process to deviate away from the ground-truth denoising trajectory, we update parameters for preservation while controlling constraint reduction to ensure effective erasure, striking an optimal trade-off. Extensive experiments and thorough comparisons with state-of-the-art algorithms demonstrate that EraseDiff effectively preserves the model’s utility, efficacy, and efficiency. WARNING: This paper contains sexually explicit imagery that may be offensive in nature. Figure 1: Top to Bottom: generated samples by SD v1.4 and model scrubbed by our method, when erasing the concept of ‘nudity’. Our method can avoid NSFW (not safe for work) content while preserving model utility. 1 Introduction Diffusion Models [30, 59, 48] are now the method of choice in deep generative models, owing to their high-quality output, stability, and ease of training procedure. This has facilitated their successful integration into commercial applications such as midjourney. Unfortunately, the ease of use associated with diffusion models brings forth significant privacy risks. Studies have shown that these models can memorize and regenerate individual images from their training datasets [57, 58, 10]. Beyond privacy, diffusion models are susceptible to misuse and can generate NSFW digital content [47, 51, 53]. In this context, individuals whose images are used for training might request the removal of their private data. In particular, data protection regulations like the European Union General Data Protection Regulation (GDPR) [63] and the California Consumer Privacy Act (CCPA) [24] grant users the right to be forgotten, obligating companies to expunge data pertaining to a user upon receiving a request for deletion. These legal provisions grant data owners the right to remove their data from trained models and eliminate its influence on said models [4, 25, 23, 43, 55, 67, 60, 61, 11]. A straightforward solution is to retrain the model from scratch after excluding the data that needs to be forgotten. However, the removal of pertinent data followed by retraining diffusion models from scratch demands substantial resources and is often deemed impractical. A version of the stable diffusion model trained on subsets of the LAION-5B dataset [54] costs approximately 150,000 GPU hours with 256 A100 GPUs111https://stablediffusion.gitbook.io/overview/stable-diffusion-overview/technology/training-procedures. Existing research on erasing unwanted influence has primarily focused on classification tasks [33, 7, 22, 4, 66, 25, 23, 43, 55, 11]. Despite substantial progress, prior methods developed in classification are observed to be ineffective for generation tasks [16]. Consequently, there is a pressing need for the development of methods capable of scrubbing data from diffusion models without necessitating complete retraining. Recently, a handful of studies [20, 21, 69, 27, 28, 35, 16, 40, 6] target unlearning in diffusion models, with a primary focus on the text-to-image models [20, 21, 69]. Broadly, these methods aim to achieve two main objectives: erasing data influence and preserving overall model performance. However, as demonstrated by Bui et al. [5], balancing this trade-off remains challenging. In this work, we propose EraseDiff, an algorithm tailored to balance the overall performance of diffusion models with the erasure of undesirable information. Drawing inspiration from optimization-based meta-learning algorithms [41, 18] that enable fast adaptation to new learning tasks, we formulate this challenge as a bi-level optimization problem, where the “inner” optimization focus on erasing undesirable influence and the “outer” objective seeks to preserve model performance. The outer objective and inner optimization are interdependent, iterating between preservation and erasure to balance the trade-off effectively. However, this nested optimization can be challenging to optimize efficiently. The inner optimization may converge to a saddle point or struggle with non-convex functions, making it difficult to achieve a stable solution [38]. Therefore, we further reformulate the problem as a constrained optimization problem using the value function [39, 45, 68], which facilitates a natural first-order solution [38], allows us to optimize preservation and erasure in a unified manner. This approach achieves a fine-tuned balance between preservation and targeted erasure, yielding an optimal trade-off. We benchmark EraseDiff on various scenarios, encompassing unlearning of classes on CIFAR-10 [34] with Denoising Diffusion Probabilistic Models (DDPM) [30], classes on Imagenette [31] and concepts on the I2P dataset [53] with stable diffusion. Our empirical findings show that EraseDiff is 11×11×11 × faster than Heng and Soh’s method [28] and 2×2×2 × faster than Fan’s method [16] when forgetting on DDPM while achieving better unlearning results across several metrics. The results demonstrate that EraseDiff is capable of effectively erasing data influence in diffusion models, ranging from specific classes to the concept of nudity. 2 Background In this section, we outline the components of the models we evaluate, including DDPM and latent diffusion models [48]. Throughout the paper, we denote scalars, and vectors/matrices by lowercase and bold symbols, respectively (e.g., a, aitalic_a, Aitalic_A). DDPM. (1) Diffusion: DDPM gradually diffuses the data distribution ℝd∋0∼q⁢()containssuperscriptℝsubscript0similar-toR^d x_0 q(x)blackboard_Rd ∋ x0 ∼ q ( x ) into the standard Gaussian distribution ℝd∋ϵ∼⁢(,d)containssuperscriptℝbold-italic-ϵsimilar-to0subscriptR^d ε N( 0,I_d)blackboard_Rd ∋ italic_ϵ ∼ N ( 0 , Iitalic_d ) with T time steps, i.e., q⁢(t|t−1)=⁢(t;αt⁢t−1,(1−αt)⁢d)conditionalsubscriptsubscript1subscriptsubscriptsubscript11subscriptsubscriptq(x_t|x_t-1)=N(x_t; % _tx_t-1,(1- _t)I_d)q ( xitalic_t | xitalic_t - 1 ) = N ( xitalic_t ; square-root start_ARG αitalic_t end_ARG xitalic_t - 1 , ( 1 - αitalic_t ) Iitalic_d ), where αt=1−βtsubscript1subscript _t=1- _tαitalic_t = 1 - βitalic_t and βtt=1Tsubscriptsuperscriptsubscript1\ _t\^T_t=1 βitalic_t Titalic_t = 1 are the pre-defined variance schedule. The diffusion takes the form tsubscriptx_txitalic_t as t=α¯t⁢0+1−α¯t⁢ϵsubscriptsubscript¯subscript01subscript¯bold-italic-ϵx_t= α_tx_0+ 1- α_% t εxitalic_t = square-root start_ARG over¯ start_ARG α end_ARGt end_ARG x0 + square-root start_ARG 1 - over¯ start_ARG α end_ARGt end_ARG italic_ϵ, where α¯t=∏i=1tαisubscript¯superscriptsubscriptproduct1subscript α_t= _i=1^t _iover¯ start_ARG α end_ARGt = ∏i = 1t αitalic_i. (2) Training: A model ϵ⁢(⋅)subscriptitalic-ϵ⋅ _ θ(·)ϵbold_italic_θ ( ⋅ ) with parameters ∈ℝnsuperscriptℝ θ∈R^nitalic_θ ∈ blackboard_Rn is trained to learn the reverse process p⁢(t−1|t)≈q⁢(t−1|t)subscriptconditionalsubscript1subscriptconditionalsubscript1subscriptp_ θ(x_t-1|x_t)≈ q(x_% t-1|x_t)pbold_italic_θ ( xitalic_t - 1 | xitalic_t ) ≈ q ( xitalic_t - 1 | xitalic_t ). Given 0∼q⁢()similar-tosubscript0x_0 q(x)x0 ∼ q ( x ) and time step t∈[1,T]1t∈[1,T]t ∈ [ 1 , T ], the simplified training objective is to minimize the distance between ϵbold-italic-ϵ εitalic_ϵ and the predicted ϵtsubscriptbold-italic-ϵ ε_titalic_ϵitalic_t given 0subscript0x_0x0 at time t, i.e., ‖ϵ−ϵ⁢(t,t)‖normbold-italic-ϵsubscriptitalic-ϵsubscript\| ε- _ θ(x_t,t)\|∥ italic_ϵ - ϵbold_italic_θ ( xitalic_t , t ) ∥. (3) Sampling: after training the model, we could obtain the learnable backward distribution p∗⁢(t−1|t)=⁢(t−1;∗⁢(t,t),∗⁢(t,t))subscriptsuperscriptconditionalsubscript1subscriptsubscript1subscriptsuperscriptsubscriptsubscriptsuperscriptsubscriptp_ θ^*(x_t-1|x_t)=N(% x_t-1; μ_ θ^*(x_t,t), % _ θ^*(x_t,t))pbold_italic_θ∗ ( xitalic_t - 1 | xitalic_t ) = N ( xitalic_t - 1 ; italic_μbold_italic_θ∗ ( xitalic_t , t ) , Σbold_italic_θ∗ ( xitalic_t , t ) ), where ∗⁢(t,t)=1αt⁢(t−βt1−αt⁢ϵ⁢(t,t))subscriptsuperscriptsubscript1subscriptsubscriptsubscript1subscriptsubscriptitalic-ϵsubscript μ_ θ^*(x_t,t)= 1 _t% (x_t- _t 1- _t _ θ% (x_t,t))italic_μbold_italic_θ∗ ( xitalic_t , t ) = divide start_ARG 1 end_ARG start_ARG square-root start_ARG αitalic_t end_ARG end_ARG ( xitalic_t - divide start_ARG βitalic_t end_ARG start_ARG square-root start_ARG 1 - αitalic_t end_ARG end_ARG ϵbold_italic_θ ( xitalic_t , t ) ) and ∗⁢(t,t)=(1−α¯t−1)⁢βt1−α¯tsubscriptsuperscriptsubscript1subscript¯1subscript1subscript¯ _ θ^*(x_t,t)= (1- α_t% -1) _t1- α_tΣbold_italic_θ∗ ( xitalic_t , t ) = divide start_ARG ( 1 - over¯ start_ARG α end_ARGt - 1 ) βitalic_t end_ARG start_ARG 1 - over¯ start_ARG α end_ARGt end_ARG. Then, given T∼⁢(,d)similar-tosubscript0subscriptx_T N( 0,I_d)xitalic_T ∼ N ( 0 , Iitalic_d ), 0subscript0x_0x0 could be obtained via sampling from p∗⁢(t−1|t)subscriptsuperscriptconditionalsubscript1subscriptp_ θ^*(x_t-1|x_t)pbold_italic_θ∗ ( xitalic_t - 1 | xitalic_t ) from t=Tt=Tt = T to t=11t=1t = 1 step by step. Latent diffusion models. Latent diffusion models apply the diffusion models in the latent space zz of a pre-trained variational autoencoder. The noise would be added to =ε⁢()z= (x)z = ε ( x ), instead of the data xx, and the denoised output would be transformed to image space with the decoder. Besides, text embeddings generated by models like CLIP are used as conditioning inputs. 3 Diffusion Unlearning Let =i,ciiNsuperscriptsubscriptsubscriptsubscriptD=\x_i,c_i\_i^ND = xitalic_i , citalic_i iitalic_N be a dataset of images isubscriptx_ixitalic_i associated with label cisubscriptc_icitalic_i representing the class. =1,⋯,C1⋯C=\1,·s,C\C = 1 , ⋯ , C denotes the label space where C is the total number of classes and ci∈subscriptc_i∈Ccitalic_i ∈ C. We split the training data DD into the forgetting data f⊂subscriptD_f⊂DDitalic_f ⊂ D and its complement, remaining data r=∖fsubscriptsubscriptD_r=D D_fDitalic_r = D ∖ Ditalic_f. The forgetting data has label space f⊆subscriptC_f CCitalic_f ⊆ C, and the remaining label space is denoted as r=∖fsubscriptsubscriptC_r=C C_fCitalic_r = C ∖ Citalic_f. 3.1 Training objective Our goal is to scrub the information about fsubscriptD_fDitalic_f carried by the diffusion models while maintaining the model utility over the remaining data rsubscriptD_rDitalic_r. To achieve this, we adopt different training objectives for rsubscriptD_rDitalic_r and fsubscriptD_fDitalic_f as follows. For the remaining data rsubscriptD_rDitalic_r, we fine-tune the diffusion models with the original objective: ℒr(;r)=t,ϵ∈⁢(,d),(0,c)∼r×r[∥ϵ−ϵ(t|c)∥22], L_r( θ;D_r)=E_t,% ε∈N( 0,I_d),(x_0,c)% D_r×C_r[\| ε- _ % θ(x_t|c)\|_2^2],Litalic_r ( italic_θ ; Ditalic_r ) = blackboard_Et , italic_ϵ ∈ N ( 0 , I start_POSTSUBSCRIPT d ) , ( x0 , c ) ∼ Ditalic_r × Citalic_r end_POSTSUBSCRIPT [ ∥ italic_ϵ - ϵbold_italic_θ ( xitalic_t | c ) ∥22 ] , (1) where t=α¯t⁢0+1−α¯t⁢ϵsubscriptsubscript¯subscript01subscript¯bold-italic-ϵx_t= α_tx_0+ 1- α_% t εxitalic_t = square-root start_ARG over¯ start_ARG α end_ARGt end_ARG x0 + square-root start_ARG 1 - over¯ start_ARG α end_ARGt end_ARG italic_ϵ. For the forgetting data fsubscriptD_fDitalic_f, we aim to let the models fail to generate meaningful images corresponding to fsubscriptC_fCitalic_f and thus propose: ℒf(;f)=t,ϵ∈⁢(,d),(0,c)∼f×f[∥ϵf−ϵ(t|c)∥22], L_f( θ;D_f)=E_t,% ε∈N( 0,I_d),(x_0,c)% D_f×C_f[\| ε_f- _% θ(x_t|c)\|_2^2],Litalic_f ( italic_θ ; Ditalic_f ) = blackboard_Et , italic_ϵ ∈ N ( 0 , I start_POSTSUBSCRIPT d ) , ( x0 , c ) ∼ Ditalic_f × Citalic_f end_POSTSUBSCRIPT [ ∥ italic_ϵitalic_f - ϵbold_italic_θ ( xitalic_t | c ) ∥22 ] , (2) where ϵf=ϵ⁢(t|cm)subscriptbold-italic-ϵsubscriptitalic-ϵconditionalsubscriptsubscript ε_f= _ θ(x_t|c_m)italic_ϵitalic_f = ϵbold_italic_θ ( xitalic_t | citalic_m ) and cm≠csubscriptc_m≠ ccitalic_m ≠ c so that the denoised image 0subscript0x_0x0 is not related to the forgetting class/concept c [16, 28]. With this, we hinder the approximator ϵsubscriptitalic-ϵ _ θϵbold_italic_θ to guide the denoising process to obtain meaningful examples for the forgetting data example 0∼fsimilar-tosubscript0subscriptx_0 D_fx0 ∼ Ditalic_f. To erase the undesirable influence of fsubscriptD_fDitalic_f and preserve the overall performance, it is common to form ℒr⁢(;r)+λ⁢ℒf⁢(;f),subscriptℒsubscriptsubscriptℒsubscript L_r( θ;D_r)+λ% L_f( θ;D_f),Litalic_r ( italic_θ ; Ditalic_r ) + λ Litalic_f ( italic_θ ; Ditalic_f ) , (3) with λ>00λ>0λ > 0 as the optimization objective (see for example [16]). However, training could be hindered due to the conflicting gradients between the erasing and preservation objectives, preventing a balanced trade-off between erasure and preservation [37]. To address this, rather than scalarizing the two objectives, we consider a framework based on optimization-based meta-learning algorithm [46] that allows iteratively updates to optimize each objective: min⁡ℒr⁢(;r)subscriptminsubscriptℒsubscript _ θ\;L_r( θ% ;D_r)minbold_italic_θ Litalic_r ( italic_θ ; Ditalic_r ) s.t. ∈arg⁢minϕ⁡ℒf⁢(ϕ;f),subscriptargminbold-italic-ϕsubscriptℒbold-italic-ϕsubscript θ∈ *arg\,min_ φL% _f( φ;D_f)\;,italic_θ ∈ start_OPERATOR arg min end_OPERATORitalic_ϕ Litalic_f ( italic_ϕ ; Ditalic_f ) , (4) where the outer objective minimizes the remaining loss ℒrsubscriptℒL_rLitalic_r (i.e., preserving model utility), the inner optimization minimizes the forgetting loss ℒfsubscriptℒL_fLitalic_f (i.e., erasing) with initialization ℝn∋ϕinit=containssuperscriptℝsubscriptbold-italic-ϕinitR^n φ_ init= θblackboard_Rn ∋ italic_ϕinit = italic_θ. Given θitalic_θ, the inner optimization on ϕbold-italic-ϕ φitalic_ϕ aims to minimize the forgetting data influence, with the goal of achieving effective erasure while preserving model utility. The outer objective and inner optimization are interdependent, iterating between preservation and erasure to balance the trade-off effectively. While the above framework allows for iterative updates to address the conflicting objectives of erasure and preservation, it still relies on nested optimization, which can be challenging to optimize efficiently. The inner optimization may converge to a saddle point or struggle with non-convex functions, making it difficult to achieve a stable solution [38]. To further streamline the optimization process, we adopt a value function approach [39, 45, 68] that reformulates the problem as a single-constrained optimization: min⁡ℒr⁢(;r)subscriptminsubscriptℒsubscript _ θ\;L_r( θ% ;D_r)minbold_italic_θ Litalic_r ( italic_θ ; Ditalic_r ) s.t. ℒf⁢(;f)−minϕ⁡ℒf⁢(ϕ;f)≤0,subscriptℒsubscriptsubscriptminbold-italic-ϕsubscriptℒbold-italic-ϕsubscript0 L_f( θ;D_f)-% min_ φL_f( φ;D_f)≤ 0,Litalic_f ( italic_θ ; Ditalic_f ) - minbold_italic_ϕ Litalic_f ( italic_ϕ ; Ditalic_f ) ≤ 0 , (5) where ϕbold-italic-ϕ φitalic_ϕ is initialized at θitalic_θ, leverages the value function to encapsulate the influence of data erasure directly as a constraint on ℒfsubscriptℒL_fLitalic_f. This avoids the need for a nested loop by capturing the forgetting objective as a constraint and provides a natural first-order solution, as the constrained formulation allows us to optimize preservation and erasure in a unified manner. 3.2 Solution To solve Sec. 3.1, let us first denote g():=ℒf(;f)−minϕℒf(ϕ;f)g( θ) :=L_f( θ;D_f)% -min_ φL_f( φ;D_f)g ( italic_θ ) : = Litalic_f ( italic_θ ; Ditalic_f ) - minbold_italic_ϕ Litalic_f ( italic_ϕ ; Ditalic_f ). Our goal is to erase undesirable influence while preserving the overall model performance, hence the update vector tsubscript δ_titalic_δitalic_t for updating the model should aid in minimizing ℒr⁢(;r)subscriptℒsubscriptL_r( θ;D_r)Litalic_r ( italic_θ ; Ditalic_r ) and g⁢()g( θ)g ( italic_θ ) simultaneously. In other words, suppose that the current solution for Sec. 3.1 is tsubscript θ_titalic_θitalic_t, we aim to update t+1=t−η⁢tsubscript1subscriptsubscript θ_t+1= θ_t-η δ_titalic_θitalic_t + 1 = italic_θitalic_t - η italic_δitalic_t where η is sufficiently small, so that ℒr⁢(t+1;r)subscriptℒsubscript1subscriptL_r( θ_t+1;D_r)Litalic_r ( italic_θitalic_t + 1 ; Ditalic_r ) decreases (i.e., preserve model utility) and g⁢(t+1)subscript1g( θ_t+1)g ( italic_θitalic_t + 1 ) decreases (i.e., erasure). To this end, we aim to find the update vector tsubscript δ_titalic_δitalic_t by: t∈12⁢argmin⁡‖∇ℒr⁢(t;r)−‖22,subscript12subscriptargminsuperscriptsubscriptnormsubscript∇subscriptℒsubscriptsubscript22 δ_t∈ 12argmin_ δ% \| _ θL_r( θ_t;D% _r)- δ \|_2^2,italic_δitalic_t ∈ divide start_ARG 1 end_ARG start_ARG 2 end_ARG argminbold_italic_δ ∥ ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) - italic_δ ∥22 , s.t. ∇g⁢(t)⊤⁢≥at>0.subscript∇superscriptsubscripttopsubscript0 _ θg( θ_t) δ≥ a% _t>0.∇italic_θ g ( italic_θitalic_t )⊤ italic_δ ≥ aitalic_t > 0 . (6) This will ensure that the update tsubscript δ_titalic_δitalic_t is close to ∇ℒr⁢(t;r)subscript∇subscriptℒsubscriptsubscript _ θL_r( θ_t;D_r)∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) and decreases g⁢(t)subscriptg( θ_t)g ( italic_θitalic_t ) until it reaches stationary. Because g⁢(t+1)−g⁢(t)≈−η⁢∇g⁢(t)⊤⁢≤−η⁢at<0subscript1subscriptsubscript∇superscriptsubscripttopsubscript0g ( θ_t+1 )-g ( θ_t )≈-η% _ θg ( θ_t ) δ≤-% η a_t<0g ( italic_θitalic_t + 1 ) - g ( italic_θitalic_t ) ≈ - η ∇italic_θ g ( italic_θitalic_t )⊤ italic_δ ≤ - η aitalic_t < 0 for some scalar at>0subscript0a_t>0aitalic_t > 0, we can ensure that g⁢(t+1)<g⁢(t)subscript1subscriptg ( θ_t+1 )<g ( θ_t )g ( italic_θitalic_t + 1 ) < g ( italic_θitalic_t ) for small step size η>00η>0η > 0. This means that the update tsubscript δ_titalic_δitalic_t can ensure to minimize ℒf⁢(;f)subscriptℒsubscriptL_f( θ;D_f)Litalic_f ( italic_θ ; Ditalic_f ) as long as it does not conflict with descent of ℒr⁢(;r)subscriptℒsubscriptL_r( θ;D_r)Litalic_r ( italic_θ ; Ditalic_r ). To find the solution to the optimization problem in Sec. 3.2, the following theorem is developed: Theorem 3.1. The optimal solution of the optimization problem in Sec. 3.2 is ∗=∇ℒr⁢(t;r)+λt⁢∇g⁢(t)superscriptsubscript∇subscriptℒsubscriptsubscriptsubscriptsubscript∇subscript δ^*= _ θL_r( θ_t;% D_r)+ _t _ θg( θ_t)italic_δ∗ = ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) + λitalic_t ∇italic_θ g ( italic_θitalic_t ) where λt=max⁡0,at−∇g⁢(t)⊤⁢∇ℒr⁢(t;r)‖∇g⁢(t)‖22subscriptmax0subscriptsubscript∇superscriptsubscripttopsubscript∇subscriptℒsubscriptsubscriptsuperscriptsubscriptnormsubscript∇subscript22 _t=max\0, a_t- _ θg( % θ_t) _ θL_r( θ_t;% D_r)\| _ θg( θ_t)\|_2^2\λitalic_t = max 0 , divide start_ARG aitalic_t - ∇italic_θ g ( italic_θitalic_t )⊤ ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) end_ARG start_ARG ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22 end_ARG . We provide the proof in §7 in the Appendix. This provides the solution to the optimization problem by constructing the update vector δitalic_δ to balance two competing objectives. The variable atsubscripta_taitalic_t adjusts the weight of the forgetting objective, ensuring that the update vector δitalic_δ decreases the remaining loss without violating the erasure goal, and achieves the dual goals of maintaining utility and achieving erasing. In practice, we can choose at=η⁢‖∇g⁢(t)‖22subscriptsuperscriptsubscriptnormsubscript∇subscript22a_t=η\| _ θg( θ_t)\|_2^2aitalic_t = η ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22, and we start from ϕ0=tsuperscriptbold-italic-ϕ0subscript φ^0= θ_titalic_ϕ0 = italic_θitalic_t and use gradient descend in K steps with the learning rate ξ>00ξ>0ξ > 0 to reach ϕKsuperscriptbold-italic-ϕ φ^Kitalic_ϕitalic_K, namely ϕk+1=ϕk−ξ⁢∇ϕℒf⁢(ϕk;f)superscriptbold-italic-ϕ1superscriptbold-italic-ϕsubscript∇bold-italic-ϕsubscriptℒsuperscriptbold-italic-ϕsubscript φ^k+1= φ^k-ξ _ φL_f( φ% ^k;D_f)italic_ϕitalic_k + 1 = italic_ϕitalic_k - ξ ∇italic_ϕ Litalic_f ( italic_ϕitalic_k ; Ditalic_f ) and k=0,⋯,K−10⋯1k=0,·s,K-1k = 0 , ⋯ , K - 1. Algorithm 1 EraseDiff: Erasing undesirable influence in diffusion models. 0: Well-trained model with parameters 0subscript0 θ_0italic_θ0, forgetting data fsubscriptD_fDitalic_f and remaining data rsubscriptD_rDitalic_r, outer iteration number T and inner iteration number K, learning rate η. 0: Parameters ∗superscript θ^*italic_θ∗ for the scrubbed model. 1: for iteration t in T do 2: ϕ0=tsuperscriptbold-italic-ϕ0subscript φ^0= θ_titalic_ϕ0 = italic_θitalic_t. 3: Get ϕKsuperscriptbold-italic-ϕ φ^Kitalic_ϕitalic_K by K steps of gradient descent on ℒf⁢(ϕ;f)subscriptℒbold-italic-ϕsubscriptL_f( φ;D_f)Litalic_f ( italic_ϕ ; Ditalic_f ) starting from ϕ0superscriptbold-italic-ϕ0 φ^0italic_ϕ0. 4: Set g⁢(t)=ℒf⁢(t;f)−ℒf⁢(ϕK;f)subscriptsubscriptℒsubscriptsubscriptsubscriptℒsuperscriptbold-italic-ϕsubscriptg( θ_t)=L_f( θ_t;D_f)-% L_f( φ^K;D_f)g ( italic_θitalic_t ) = Litalic_f ( italic_θitalic_t ; Ditalic_f ) - Litalic_f ( italic_ϕitalic_K ; Ditalic_f ). 5: Update the model: t+1=t−η⁢(∇tℒr⁢(t;r)+λt⁢∇tg⁢(t;ϕK))subscript1subscriptsubscript∇subscriptsubscriptℒsubscriptsubscriptsubscriptsubscript∇subscriptsubscriptsuperscriptbold-italic-ϕ θ_t+1= θ_t-η( _ θ_t % L_r( θ_t;D_r)+ _t _ θ% _tg( θ_t; φ^K))italic_θitalic_t + 1 = italic_θitalic_t - η ( ∇italic_θ start_POSTSUBSCRIPT t end_POSTSUBSCRIPT Litalic_r ( italic_θitalic_t ; Ditalic_r ) + λitalic_t ∇italic_θ start_POSTSUBSCRIPT t end_POSTSUBSCRIPT g ( italic_θitalic_t ; italic_ϕitalic_K ) ), 6: where λt=max⁡0,at−∇g⁢(t)T⁢∇ℒr⁢(t;r)‖∇g⁢(t)‖22subscriptmax0subscriptsubscript∇superscriptsubscriptsubscript∇subscriptℒsubscriptsubscriptsuperscriptsubscriptnormsubscript∇subscript22 _t=max\0, a_t- _ θg( % θ_t)^T _ θL_r( θ_t;% D_r)\| _ θg( θ_t)\|_2^2\λitalic_t = max 0 , divide start_ARG aitalic_t - ∇italic_θ g ( italic_θitalic_t )T ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) end_ARG start_ARG ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22 end_ARG . 7: end for 3.3 Analysis We can characterize the solution of our algorithm as follows and the proof can be found in §7 in the Appendix: Theorem 3.2 (Pareto optimality). The stationary point obtained by our algorithm is Pareto optimal of the problem min⁡[ℒr⁢(;r),ℒf⁢(;f)]subscriptminsubscriptℒsubscriptsubscriptℒsubscriptmin_ θ[L_r( θ;D% _r),L_f( θ;D_f)]minbold_italic_θ [ Litalic_r ( italic_θ ; Ditalic_r ) , Litalic_f ( italic_θ ; Ditalic_f ) ]. This asserts that the solution obtained by our algorithm is Pareto optimal for the problem of minimizing both objectives, which implies that the solution obtained by the algorithm ensures a balanced trade-off between preserving model utility and erasing undesirable influences. Figure 2: Top to bottom: cosine similarity between the update vector δitalic_δ and the preservation gradient rsubscript g_ritalic_gitalic_r, followed by the cosine similarity between δitalic_δ and the erasing gradient fsubscript g_fitalic_gitalic_f. Positive values indicate alignment, while negative values suggest conflict. This visualization illustrates how well the update vector aligns with the objectives of preservation and erasure over successive iterations. We further take DDPM with CIFAR-10 when forgetting the ‘airplane’ as an example to show that our proposed method helps alleviate the gradient conflict which prevents a balanced trade-off between erasure and preservation. Fig. 2 presents the cosine similarity between the update vector δitalic_δ and the gradient r=∇ℒr⁢(;r)subscriptsubscript∇subscriptℒsubscript g_r= _ θL_r( θ;D% _r)italic_gitalic_r = ∇italic_θ Litalic_r ( italic_θ ; Ditalic_r ) for preservation, and the cosine similarity between the update vector δitalic_δ and the gradient f=∇ℒf⁢(;f)subscript∇subscriptℒsubscript g_f=∇L_f( θ;D_f)italic_gitalic_f = ∇ Litalic_f ( italic_θ ; Ditalic_f ) for erasing. The cosine similarity represents the alignment between the update vector and the gradients associated with the preservation and erasure. Higher positive values indicate alignment, meaning that the update vector δitalic_δ is directed similarly to the respective gradient, whereas negative values indicate misalignment or conflict. In particular, negative values suggest a high degree of opposition between the update vector and the respective gradient, which can signify competing objectives between preservation and erasure during the optimization process. MOO (Multi-Objective Optimization) denotes the naive integration of erasing and preservation as stated in Eq. 3. For the vanilla MOO, Fig. 2 shows a clear alternating pattern in cosine similarity values between the update vector δitalic_δ and the gradients rsubscript g_ritalic_gitalic_r and fsubscript g_fitalic_gitalic_f. Specifically, when the cosine similarity between δitalic_δ and rsubscript g_ritalic_gitalic_r is greater than 0, the similarity between δitalic_δ and fsubscript g_fitalic_gitalic_f tends to be less than 0, and vice versa. This pattern suggests that MOO experiences gradient conflict, as it cannot effectively balance the two objectives of preservation and erasure, preventing MOO from achieving a harmonious update that supports both goals simultaneously. In contrast, EraseDiff mostly shows positive cosine similarity values between the update vector δitalic_δ and both the preservation gradient rsubscript g_ritalic_gitalic_r and the erasing gradient fsubscript g_fitalic_gitalic_f. This indicates that EraseDiff aligns the update direction with both objectives, suggesting it manages to avoid significant gradient conflict. By maintaining positive alignment, EraseDiff appears to balance preservation and erasure more effectively, leading to better cooperation between objectives. 4 Related Work Memorization in generative models. Privacy of generative models has been studied extensively for GANs [17, 42, 65] and generative language models [9, 8, 32, 62]. These generative models often risk replicating from their training data. Recently, several studies [10, 58, 57, 64] investigated these data replication behaviors in diffusion models, raising concerns about the privacy and copyright issues. Possible mitigation strategies are deduplicating and randomizing conditional information [58, 57], or training models with differential privacy (DP) [1, 15, 14, 13]. However, leveraging DP-SGD [1] may cause training to diverge [10]. Malicious misuse. Diffusion models usually use training data from varied open sources and when such unfiltered data is employed, there is a risk of it being tainted [12] or manipulated [47], resulting in inappropriate generation [53]. They also risk the imitation of copyrighted content, e.g., mimicking the artistic style [20, 56]. To counter inappropriate generation, data censoring [19, 3, 44, 52] where excluding black-listed images before training, and safety guidance where diffusion models will be updated away from the inappropriate/undesired concept [20, 53] are proposed. Shan et al. [56] propose protecting artistic style by adding barely perceptible perturbations to the artworks before public release. Yet, Rando et al. [47] argue that DMs can still generate content that bypasses the filter. Chen et al. [12] highlight the susceptibility of DMs to poison attacks, where target images are generated with specific triggers. Machine unlearning. Removing data directly involves retraining the model from scratch, which is inefficient and impractical. Thus, to reduce the computational overhead, efficient machines unlearning methods [49, 33, 7, 22, 4, 66, 25, 23, 43, 55, 11, 60] have been proposed. Several studies [20, 21, 27, 28, 16, 69, 5] recently introduce unlearning in diffusion models. Most of them [20, 21, 27, 69] mainly focus on text-to-image models and high-level visual concept erasure. Heng and Soh [28] adopt Elastic Weight Consolidation (EWC) and Generative Replay (GR) from continual learning to perform unlearning effectively without access to the training data. Heng and Soh’s method can be applied to a wide range of generative models, however, it needs the computation of FIM for different datasets and models, which may lead to significant computational demands. Fan et al. [16] propose a very potent unlearning algorithm called SalUn that shifts attention to important parameters w.r.t. the forgetting data. SalUn can perform effectively across image classification and generation tasks. In this work, we introduce a simple yet effective unlearning algorithm for diffusion models by formulating the problem as a constrained optimization problem, to achieve a fine-tuned balance between preservation and targeted erasure, yielding an optimal trade-off. Below, we will show that our algorithm is not only faster than Heng and Soh’s method [28] and Fan’s method [16], but even outperforms these methods in terms of the trade-off between the forgetting and preserving model utility. 5 Experiment We evaluate EraseDiff in various scenarios, including removing images with specific classes/concepts, to answer the following research questions (RQs): (i) Can typical machine unlearning methods be applied to diffusion models? (i) Is EraseDiff able to remove the influence of fsubscriptD_fDitalic_f in the diffusion models? (i) Is EraseDiff able to preserve the model utility while removing fsubscriptD_fDitalic_f? (iv) Is EraseDiff efficient in removing the data? (v) How does EraseDiff perform on the public well-trained models? 5.1 Setup Experiments are reported on CIFAR-10 [34] with DDPM, Imagenette [31] with Stable Diffusion (SD) for class-wise forgetting, I2P [53] dataset with SD for concept-wise forgetting. For all SD experiments, we use the open-source SD v1.4 [48] checkpoint as the pre-trained model. Implementation details and additional results like visualizations of generated images can be found in §8 and §9. Baselines. We primarily benchmark against the following baselines commonly used in machine unlearning: (i) Unscrubbed, (i) Finetune (FT) [23], (i) NegGrad (NG) [23], (iv) BlindSpot [60], (v) ESD [20], (vi) FMN [69], (vii) Selective Amnesia (SA) [28] and (viii) the SOTA machine unlearning algorithm SalUn [16]. Metrics. Several metrics are utilized to evaluate the algorithms: (i) Frechet Inception Distance (FID) [29]: the widely-used metric for assessing the quality of generated images. (i) CLIP score: the similarity between the visual features of the generated image and its corresponding textual embedding. (i) Pψ⁢(=cf|f)subscriptconditionalsubscriptsubscriptP_ψ(y=c_f|x_f)Pitalic_ψ ( y = citalic_f | xitalic_f ) [28]: the classification rate of a pre-trained classifier Pψ⁢(|)subscriptconditionalP_ψ(y|x)Pitalic_ψ ( y | x ), with a ResNet architecture [26] used to classify generated images conditioned on the forgetting classes. A lower classification value indicates superior unlearning performance. (iv) Precision and Recall: A low FID may indicate high precision (realistic images) but low recall (small variations) [50, 36]. Kynkänniemi et al. [36] shows that generative models claim to optimize FID (high fidelity) but always sacrifice variation (low diversity). Hence, we include metric precision (fidelity) and recall (diversity) to express the quality of the generated samples, to provide explicit visibility of the tradeoff between sample quality and variety. Table 1: Results on CIFAR10 with DDPM when forgetting the ‘airplane’ class. Pψ⁢(=cf|f)subscriptconditionalsubscriptsubscriptP_ψ(y=c_f|x_f)Pitalic_ψ ( y = citalic_f | xitalic_f ) indicate the probability of the forgotten class (i.e., the effectiveness of erasing). Precision and Recall demonstrate the fidelity and diversity [50, 36], and FID scores are computed between the generated 45K images and the corresponding ground truth images with the same labels from rsubscriptD_rDitalic_r (i.e., preserving model utility). SA excels in class-wise forgetting but struggles to perform concept-wise forgetting as shown in Fig. 3 and Tab. 2. The best and the second best are highlighted in blue and orange, respectively. Unscrubbed FT [23] NG [23] BlindSpot [60] SA [28] SalUn [16] EraseDiffrlrl_rlstart_FLOATSUBSCRIPT rl end_FLOATSUBSCRIPT EraseDiffnoisenoise_noisestart_FLOATSUBSCRIPT noise end_FLOATSUBSCRIPT FID ↓ ↓ 9.63 8.21 76.73 9.12 8.19 9.16 8.66 7.61 Precision (fidelity) ↑ ↑ 0.40 0.43 0.08 0.41 0.43 0.41 0.43 0.43 Recall (diversity) ↑ ↑ 0.79 0.77 0.61 0.78 0.75 0.76 0.77 0.72 Pψ⁢(=cf|f)subscriptconditionalsubscriptsubscriptP_ψ(y=c_f|x_f)Pitalic_ψ ( y = citalic_f | xitalic_f )↓ ↓ 0.97 0.96 0.61 0.90 0.06 0.07 0.24 0.22 Figure 3: Quantity of nudity content detected using the NudeNet classifier from I2P data. Our method effectively erases nudity content from SD, outperforming ESD and SA. Note that Fig. 3 and Tab. 2 together presents the trade-off between erasing and preservation. Table 2: Evaluation of 30K generated images by SD when erasing ‘nudity’. The FID score is measured compared to validation data, while the CLIP similarity score evaluates the alignment between generated images and the corresponding prompts. The best and the second best are highlighted in blue and orange, respectively. ESD [20] SA [28] SalUn [16] EraseDiff FID ↓ ↓ 15.76 25.58 25.06 17.01 CLIP ↑ ↑ 30.33 31.03 28.91 30.58 5.2 Results on DDPM Following SA, we aim to forget the ‘airplane’ class on CIFAR-10. Here, we replace ϵ∈⁢(,d)bold-italic-ϵ0subscript ε∈N( 0,I_d)italic_ϵ ∈ N ( 0 , Iitalic_d ) with ϵf=ϵ⁢(t|cm)subscriptbold-italic-ϵsubscriptitalic-ϵconditionalsubscriptsubscript ε_f= _ θ(x_t|c_m)italic_ϵitalic_f = ϵbold_italic_θ ( xitalic_t | citalic_m ) like random labelling used in [16] where cm≠csubscriptc_m≠ ccitalic_m ≠ c, denoted as EraseDiffrlrl_rlstart_FLOATSUBSCRIPT rl end_FLOATSUBSCRIPT. We also try to use ϵf=⁢(,d)subscriptbold-italic-ϵ0subscript ε_f=U( 0,I_d)italic_ϵitalic_f = U ( 0 , Iitalic_d ) like SA, denoted as EraseDiffnoisenoise_noisestart_FLOATSUBSCRIPT noise end_FLOATSUBSCRIPT. Note that the choice of replacement for forgotten classes is flexible and is not the primary focus of this work. For further discussion on the choice of substitution strategies, please refer to related studies [40, 6]. Results are presented in Tab. 1. Firstly, from Tab. 1, we can conclude that traditional machine unlearning methods designed for image classification or regression tasks fall short in effectively performing forgetting for DDPM. Finetune and BlindSpot suffer from under-forgetting (i.e., the generated image quality is good but the probability of generated images belonging to the forgetting class approaching the value of the unscrubbed model), and NegGrad suffers from over-forgetting (the probability of generated images belonging to the forgetting class is decreased compared to that of the unscrubbed model but the generated image quality drops significantly). Then, comparing SA and SalUn’s unlearning methods, SA achieves an FID score of 8.19 but sacrifices variation (decreased recall). Also, note that SA introduces excessive computational resource requirements and time consumption [28, 70]. Note that the FID scores of SA, SalUn, and EraseDiff decrease compared with the generated images from the original models; the quality of the generated images experiences a slight improvement. However, there is a decrease in recall (diversity), which can be attributed to the scrubbed models being fine-tuned over rsubscriptD_rDitalic_r, suggesting a tendency towards overfitting. Regarding forgetting, SalUn achieves a smaller probability of the generated images classified as the forgetting class than ours; yet, the FID score is larger than ours, and images generated by EraseDiffrlrl_rlstart_FLOATSUBSCRIPT rl end_FLOATSUBSCRIPT present better diversity and fidelity. 5.3 Results on Stable Diffusion Table 3: Performance of class-wise forgetting on Imagenette using SD. UA: the accuracy of the generated images that do not belong to the forgetting class (i.e., the effectiveness of forgetting). The FID score is measured compared to validation data for the remaining classes. Forget. Class FMN∗ [69] ESD∗ [20] SalUn∗ [16] EraseDiff FID ↓ ↓ UA (%)↑ ↑ FID ↓ ↓ UA (%)↑ ↑ FID ↓ ↓ UA (%)↑ ↑ FID ↓ ↓ UA (%)↑ ↑ Tench 1.63 42.40 1.22 99.40 2.53 100.00 1.29 100 English Springer 1.75 27.20 1.02 100.00 0.79 100.00 1.38 100 Cassette Player 0.80 93.80 1.84 100.00 0.91 99.80 0.85 100 Chain Saw 0.94 48.40 1.48 96.80 1.58 100.00 1.17 99.9 Church 1.32 23.80 1.91 98.60 0.90 99.60 0.83 100 French Horn 0.99 45.00 1.08 99.80 0.94 100.00 1.09 100 Garbage Truck 0.92 41.40 2.71 100.00 0.91 100.00 0.96 100 Gas Pump 1.30 53.60 1.99 100.00 1.05 100.00 1.25 100 Golf Ball 1.05 15.40 0.80 99.60 1.45 98.80 1.50 99.5 Parachute 2.33 34.40 0.91 99.80 1.16 100.00 0.78 99.7 Average 1.30 42.54 1.49 99.40 1.22 99.82 1.11 99.91 Figure 4: Top to Bottom: generated examples with I2P and COCO prompts after forgetting the concept of ’nudity’. In this experiment, we apply EraseDiff to perform class-wise forgetting from Imagenette and erase the ‘nudity’ concept with SD v1.4. For all experiments, we employ SD for sampling with 50 time steps. When forgetting ‘nudity’, we have no access to the training data; instead, we generate ∼similar-to ∼400 images with the prompts cf=subscriptabsentc_f=citalic_f =‘nudity’, ‘naked’, ‘erotic’, ‘sexual’. Forget nudity. 4703 images are generated using I2P prompts, and 1K images are generated using the prompts ‘nudity’, ‘naked’, ‘erotic’, ‘sexual’. The quantity of nudity content is detected using the NudeNet classifier [2]. In Fig. 3, the number in the y-axis denotes the number of exposed body parts generated by the SD v1.4 model. Fig. 3 presents the percentage change in exposed body parts w.r.t. SD v1.4. In §9, we provide the number of exposed body parts counted in all generated images with different thresholds. Here, our algorithm replaces ϵfsubscriptbold-italic-ϵ ε_fitalic_ϵitalic_f with ϵ⁢(t|cm)subscriptitalic-ϵconditionalsubscriptsubscript _ θ(x_t|c_m)ϵbold_italic_θ ( xitalic_t | citalic_m ) where cmsubscriptc_mcitalic_m is ‘a photo of pokemon’. We can find that, EraseDiff reduces the amount of nudity content compared to SD v1.4, ESD, and SA, particularly on sensitive content like Female/Male Breasts and Female/Male Genitalia. While SalUn excels at forgetting, our algorithm demonstrates a significant improvement in the quality of generated images, as shown in Tab. 2. Tab. 2 presented results evaluating the utility of scrubbed models. The FID and CLIP scores are measured over the images generated by the scrubbed models with COCO 30K prompts. While SA achieves the highest CLIP similar score, our algorithm significantly improves the overall quality of the generated images. Forget class. When performing class-wise forgetting, following Fan et al. [16], we set the prompt as ‘an image of [c]’. For the forgetting class cfsubscriptc_fcitalic_f, we choose the ground truth backward distribution to be a class other than cfsubscriptc_fcitalic_f. We generate 100 images for each prompt. Results for methods with ∗ presented in Tab. 3 are from SalUn [16]. Our method outperforms SalUn on average across 10 classes. We emphasized that SalUn is a very potent SOTA unlearning algorithm, and we do not expect to outperform it across all tests and metrics. Averaging results across all ten classes provides a more comprehensive evaluation and mitigates the risk of cherry-picking. Our results, based on this average approach, clearly indicate the advantages of our method. We also present results when improving the forgetting ability of SalUn in §9. However, note that this enhancement comes with a drop in the FID score of the generated images. Our method, while slightly better than SalUn on average across 10 classes, demonstrates a more balanced trade-off between erasing and preservation, indicating that it achieves a favorable balance in preserving fidelity while enhancing erasing performance. 5.4 Computational efficiency Table 4: Computational overhead. Time is the average duration measured over five runs on DDPM when forgetting ‘airplane’. Memory (MiB) Time (min.) Complexity SA 3352.3 140.00 ⁢(n2)superscript2O(n^2)O ( n2 ) SalUn 4336.2 28.17 ⁢(n)O(n)O ( n ) EraseDiff 3360.3 12.70 ⁢(n)O(n)O ( n ) Finally, we measure the computational complexity of unlearning algorithms. The computational complexity of SA and SalUn involves two distinct stages: the computation of FIM for SA and the computation of salient weights w.r.t. fsubscriptD_fDitalic_f for SalUn, and the subsequent forgetting stage for both algorithms. We consider the maximum memory usage across both stages, the metric ‘Time’ is exclusively associated with the duration of the forgetting stage for unlearning algorithms. Tab. 4 show that EraseDiff outperforms SA and SalUn in terms of efficiency, achieving a speed increase of ∼11× 11×∼ 11 × than SA and ∼2× 2×∼ 2 × than SalUn. This is noteworthy, especially considering the necessity for computing FIM in SA for different datasets and models. 5.5 Ablation study We further investigate the influence of the number of iterations K that approximate min⁡ℒf⁢(ϕ;f)minsubscriptℒbold-italic-ϕsubscriptminL_f( φ;D_f)min Litalic_f ( italic_ϕ ; Ditalic_f ), and the step size η that controls the weight of forgetting and preserving model utility. Here, we replace ϵ∈⁢(,d)bold-italic-ϵ0subscript ε∈N( 0,I_d)italic_ϵ ∈ N ( 0 , Iitalic_d ) with ϵf∈⁢(,d)subscriptbold-italic-ϵ0subscript ε_f∈U( 0,I_d)italic_ϵitalic_f ∈ U ( 0 , Iitalic_d ). Note that for different hyperparameters in Fig. 5 (a), the average entropy of the classifier’s output distribution given fsubscriptx_fxitalic_f, which is H⁢(Pψ⁢(|f))=−⁢[∑iPψ⁢(=ci|)⁢loge⁡Pψ⁢(=ci|)]subscriptconditionalsubscriptdelimited-[]subscriptsubscriptconditionalsubscriptsubscriptsubscriptconditionalsubscriptH(P_ψ(y|x_f))=-E[ _iP_ψ(% y=c_i|x) _eP_ψ(y=c_i|x% )]H ( Pitalic_ψ ( y | xitalic_f ) ) = - blackboard_E [ ∑i Pitalic_ψ ( y = citalic_i | x ) logitalic_e Pitalic_ψ ( y = citalic_i | x ) ], remains close to 2.02. This indicates that the scrubbed models become uncertain about the images conditioned on the forgetting class, effectively erasing the information about fsubscriptD_fDitalic_f. Below, we will further demonstrate the influence on the model utility. In practice, we have λt=max⁡0,at−∇g⁢(t)⊤⁢∇ℒr⁢(t;r)‖∇g⁢(t)‖22=max⁡0,η−∇g⁢(t)⊤⁢∇ℒr⁢(t;r)‖∇g⁢(t)‖22subscriptmax0subscriptsubscript∇superscriptsubscripttopsubscript∇subscriptℒsubscriptsubscriptsuperscriptsubscriptnormsubscript∇subscript22max0subscript∇superscriptsubscripttopsubscript∇subscriptℒsubscriptsubscriptsuperscriptsubscriptnormsubscript∇subscript22 _t=max\0, a_t- _ θg( % θ_t) _ θL_r( θ_t;% D_r)\| _ θg( θ_t)\|_2^2\=% max\0,η- _ θg( θ_t)^% _ θL_r( θ_t;D_% r)\| _ θg( θ_t)\|_2^2\λitalic_t = max 0 , divide start_ARG aitalic_t - ∇italic_θ g ( italic_θitalic_t )⊤ ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) end_ARG start_ARG ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22 end_ARG = max 0 , η - divide start_ARG ∇italic_θ g ( italic_θitalic_t )⊤ ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) end_ARG start_ARG ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22 end_ARG , we can see that η determines the extent to which the update direction for forgetting can deviate from that for preserving model utility. A larger η would allow for more deviation in the updating, thus prioritizing forgetting over preserving model utility. In Fig. 5 (a), the FID score tends to increase (i.e., image quality drop) as the step size η increases, indicating that larger η leads to greater deviations from the direction that preserves the model utility. Furthermore, the number of iterations K determines how closely the approximation ϕKsuperscriptbold-italic-ϕ φ^Kitalic_ϕitalic_K will approach arg⁢minϕ⁡ℒf⁢(ϕ;f)subscriptargminbold-italic-ϕsubscriptℒbold-italic-ϕsubscript *arg\,min_ φL_f( φ;D_% f)start_OPERATOR arg min end_OPERATORitalic_ϕ Litalic_f ( italic_ϕ ; Ditalic_f ). Hence, a larger number of iterations K leads to more thorough erasure, which is also supported by the results shown in Fig. 5 (a), as increasing K correlates with an increase in the FID score. Figure 5: (a) Ablation results. (b) Potential incomplete erasures. 6 Conclusion and Limitations In this work, we explored erasing undesirable influence in diffusion models and proposed an efficient method EraseDiff to achieve a balanced trade-off between erasing and preservation. Comprehensive experiments on diffusion models demonstrate the proposed algorithm’s effectiveness in data removal, its efficacy in preserving the model utility, and its efficiency in erasure. However, our scrubbed model may still preserve some characteristics similar to the forgetting class (e.g., in Fig. 5 (b), generated images conditioned on the forgetting class ‘tench’ by our scrubbed model when forgetting the class ‘tench’ from Imagenette, which may preserve some characteristics similar to that close to ‘tench’ visually). Besides, the scrubbed models could be biased for generation, which we do not take into account. Future directions could include assessing fairness post-unlearning, using advanced privacy-preserving training techniques, and advanced MOO solutions. We hope the proposed approach could serve as an inspiration for future research in the field of erasing undesirable concepts in diffusion models. References Abadi et al. [2016] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016. Bedapudi [2019] P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019. Birhane and Prabhu [2021] Abeba Birhane and Vinay Uday Prabhu. Large image datasets: A pyrrhic win for computer vision? In 2021 IEEE Winter Conference on Applications of Computer Vision (WACV), pages 1536–1546. IEEE, 2021. Bourtoule et al. [2021] Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pages 141–159, 2021. Bui et al. [2024a] Anh Bui, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. Removing undesirable concepts in text-to-image generative models with learnable prompts. arXiv preprint arXiv:2403.12326, 2024a. Bui et al. [2024b] Anh Bui, Long Vuong, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. Erasing undesirable concepts in diffusion models with adversarial preservation. arXiv preprint arXiv:2410.15618, 2024b. Cao and Yang [2015] Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy (SP), pages 463–480, 2015. Carlini et al. [2021] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 2633–2650, 2021. Carlini et al. [2022] Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. arXiv preprint arXiv:2202.07646, 2022. Carlini et al. [2023] Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5253–5270, 2023. Chen et al. [2023a] Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7766–7775, 2023a. Chen et al. [2023b] Weixin Chen, Dawn Song, and Bo Li. Trojdiff: Trojan attacks on diffusion models with diverse targets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4035–4044, 2023b. Dockhorn et al. [2022] Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models. arXiv preprint arXiv:2210.09929, 2022. Dwork [2008] Cynthia Dwork. Differential privacy: A survey of results. In International conference on theory and applications of models of computation, pages 1–19. Springer, 2008. Dwork et al. [2006] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265–284. Springer, 2006. Fan et al. [2023] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508, 2023. Feng et al. [2021] Qianli Feng, Chenqi Guo, Fabian Benitez-Quiroz, and Aleix M Martinez. When do gans replicate? on the choice of dataset size. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 6701–6710, 2021. Finn et al. [2017] Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning, pages 1126–1135. PMLR, 2017. Gandhi et al. [2020] Shreyansh Gandhi, Samrat Kokkula, Abon Chaudhuri, Alessandro Magnani, Theban Stanley, Behzad Ahmadi, Venkatesh Kandaswamy, Omer Ovenc, and Shie Mannor. Scalable detection of offensive and non-compliant content/logo in product images. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 2247–2256, 2020. Gandikota et al. [2023a] Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. In 2023 IEEE International Conference on Computer Vision (ICCV), 2023a. Gandikota et al. [2023b] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyńska, and David Bau. Unified concept editing in diffusion models. arXiv preprint arXiv:2308.14761, 2023b. Ginart et al. [2019] Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in machine learning. In Advances in Neural Information Processing Systems (NeurIPS), 2019. Golatkar et al. [2020] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 9301–9309, 2020. Goldman [2020] Eric Goldman. An introduction to the california consumer privacy act (ccpa). Santa Clara Univ. Legal Studies Research Paper, 2020. Guo et al. [2020] Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In Proceedings of the 37th International Conference on Machine Learning, pages 3832–3842. PMLR, 2020. He et al. [2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. Heng and Soh [2023a] Alvin Heng and Harold Soh. Continual learning for forgetting in deep generative models. 2023a. Heng and Soh [2023b] Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. In Advances in Neural Information Processing Systems (NeurIPS), 2023b. Heusel et al. [2017] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017. Ho et al. [2020] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. Howard and Gugger [2020] Jeremy Howard and Sylvain Gugger. Fastai: A layered api for deep learning. Information, 11(2):108, 2020. Jagielski et al. [2022] Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, et al. Measuring forgetting of memorized training examples. arXiv preprint arXiv:2207.00099, 2022. Karasuyama and Takeuchi [2010] Masayuki Karasuyama and Ichiro Takeuchi. Multiple incremental decremental learning of support vector machines. IEEE Transactions on Neural Networks, 21(7):1048–1059, 2010. Krizhevsky et al. [2009] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. Kumari et al. [2023] Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691–22702, 2023. Kynkänniemi et al. [2019] Tuomas Kynkänniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Improved precision and recall metric for assessing generative models. Advances in neural information processing systems, 32, 2019. Liu et al. [2021a] Bo Liu, Xingchao Liu, Xiaojie Jin, Peter Stone, and Qiang Liu. Conflict-averse gradient descent for multi-task learning. Advances in Neural Information Processing Systems (NeurIPS), 34:18878–18890, 2021a. Liu et al. [2022] Bo Liu, Mao Ye, Stephen Wright, Peter Stone, and Qiang Liu. Bome! bilevel optimization made easy: A simple first-order approach. Advances in Neural Information Processing Systems, 35:17248–17262, 2022. Liu et al. [2021b] Risheng Liu, Xuan Liu, Xiaoming Yuan, Shangzhi Zeng, and Jin Zhang. A value-function-based interior-point method for non-convex bi-level optimization. In International conference on machine learning, pages 6882–6892. PMLR, 2021b. Lyu et al. [2024] Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7559–7568, 2024. Maclaurin et al. [2015] Dougal Maclaurin, David Duvenaud, and Ryan Adams. Gradient-based hyperparameter optimization through reversible learning. In International conference on machine learning, pages 2113–2122. PMLR, 2015. Meehan et al. [2020] Casey Meehan, Kamalika Chaudhuri, and Sanjoy Dasgupta. A non-parametric test to detect data-copying in generative models. In International Conference on Artificial Intelligence and Statistics, 2020. Mehta et al. [2022] Ronak Mehta, Sourav Pal, Vikas Singh, and Sathya N. Ravi. Deep unlearning via randomized conditionally independent hessians. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10412–10421, 2022. Nichol et al. [2021] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint arXiv:2112.10741, 2021. Outrata [1990] Jiří V Outrata. On the numerical solution of a class of stackelberg problems. Zeitschrift für Operations Research, 34:255–277, 1990. Rajeswaran et al. [2019] Aravind Rajeswaran, Chelsea Finn, Sham M Kakade, and Sergey Levine. Meta-learning with implicit gradients. Advances in neural information processing systems, 32, 2019. Rando et al. [2022] Javier Rando, Daniel Paleka, David Lindner, Lennard Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022. Rombach et al. [2022] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), pages 10684–10695, 2022. Romero et al. [2007] Enrique Romero, Ignacio Barrio, and Lluís Belanche. Incremental and decremental learning for linear support vector machines. In International Conference on Artificial Neural Networks, pages 209–218. Springer, 2007. Sajjadi et al. [2018] Mehdi SM Sajjadi, Olivier Bachem, Mario Lucic, Olivier Bousquet, and Sylvain Gelly. Assessing generative models via precision and recall. Advances in neural information processing systems, 31, 2018. Salman et al. [2023] Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588, 2023. Schramowski et al. [2022] Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pages 1350–1361, 2022. Schramowski et al. [2023] Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. Schuhmann et al. [2022] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35:25278–25294, 2022. Sekhari et al. [2021] Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. Remember what you want to forget: Algorithms for machine unlearning. Advances in Neural Information Processing Systems (NeurIPS), 34:18075–18086, 2021. Shan et al. [2023] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. arXiv preprint arXiv:2302.04222, 2023. Somepalli et al. [2023a] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6048–6058, 2023a. Somepalli et al. [2023b] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understanding and mitigating copying in diffusion models. arXiv preprint arXiv:2305.20086, 2023b. Song et al. [2020] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020. Tarun et al. [2023a] Ayush Kumar Tarun, Vikram Singh Chundawat, Murari Mandal, and Mohan Kankanhalli. Deep regression unlearning. In International Conference on Machine Learning, pages 33921–33939. PMLR, 2023a. Tarun et al. [2023b] Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unlearning. IEEE Transactions on Neural Networks and Learning Systems, 2023b. Tirumala et al. [2022] Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models. Advances in Neural Information Processing Systems, 35:38274–38290, 2022. Voigt and Von dem Bussche [2017] Paul Voigt and Axel Von dem Bussche. The eu general data protection regulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10(3152676):10–5555, 2017. Vyas et al. [2023] Nikhil Vyas, Sham Kakade, and Boaz Barak. Provable copyright protection for generative models. arXiv preprint arXiv:2302.10870, 2023. Webster et al. [2021] Ryan Webster, Julien Rabin, Loic Simon, and Frederic Jurie. This person (probably) exists. identity membership attacks against gan generated faces. arXiv preprint arXiv:2107.06018, 2021. Wu et al. [2020] Yinjun Wu, Edgar Dobriban, and Susan Davidson. DeltaGrad: Rapid retraining of machine learning models. In Proceedings of the 37th International Conference on Machine Learning, pages 10355–10366. PMLR, 2020. Ye et al. [2022] Jingwen Ye, Yifang Fu, Jie Song, Xingyi Yang, Songhua Liu, Xin Jin, Mingli Song, and Xinchao Wang. Learning with recoverable forgetting. In Computer Vision–ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23–27, 2022, Proceedings, Part XI, pages 87–103. Springer, 2022. Ye and Zhu [1995] Jane J Ye and DL Zhu. Optimality conditions for bilevel programming problems. Optimization, 33(1):9–27, 1995. Zhang et al. [2023] Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. arXiv preprint arXiv:2303.17591, 2023. Zhang et al. [2024] Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu. Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models. arXiv preprint arXiv:2402.11846, 2024. Supplementary Material Impact Statements DMs have experienced rapid advancements and have shown the merits of generating high-quality data. However, concerns have arisen due to their ability to memorize training data and generate inappropriate content, thereby negatively affecting the user experience and society as a whole. Machine unlearning emerges as a valuable tool for correcting the algorithms and enhancing user trust in the respective platforms. It demonstrates a commitment to responsible AI and the welfare of its user base. The inclusion of explicit imagery in our paper might pose certain risks, e.g., some readers may find this explicit content distressing or offensive, which can lead to discomfort. Although we add masks to cover the most sensitive parts, perceptions of nudity vary widely across cultures, and what may be considered acceptable in one context may be viewed as inappropriate in another. Besides, while unlearning protects privacy, it may also hinder the ability of relevant systems, potentially lead to biased outcomes, and even be adopted for malicious usage, i.e., the methods developed in our study might potentially be misused for censorship or exploitation. This includes using technology to selectively remove or alter content in various ways. Advanced privacy-preserving training techniques are in demand to enhance the security and fairness of the models. Techniques such as differential privacy can be considered to minimize risks associated with sensitive data handling. Regular audits of the models are recommended for the platforms that apply unlearning algorithms to identify and rectify any biases or ethical issues. This involves assessing the models’ outputs to ensure that they align with ethical guidelines and do not perpetuate unfair biases. 7 Proofs Theorem 3.1 The optimal solution of the optimization problem in Sec. 3.2 is ∗=∇ℒr⁢(t;r)+λt⁢∇g⁢(t)superscriptsubscript∇subscriptℒsubscriptsubscriptsubscriptsubscript∇subscript δ^*= _ θL_r( θ_t;% D_r)+ _t _ θg( θ_t)italic_δ∗ = ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) + λitalic_t ∇italic_θ g ( italic_θitalic_t ) where λt=max⁡0,at−∇g⁢(t)⊤⁢∇ℒr⁢(t;r)‖∇g⁢(t)‖22subscriptmax0subscriptsubscript∇superscriptsubscripttopsubscript∇subscriptℒsubscriptsubscriptsuperscriptsubscriptnormsubscript∇subscript22 _t=max\0, a_t- _ θg( % θ_t) _ θL_r( θ_t;% D_r)\| _ θg( θ_t)\|_2^2\λitalic_t = max 0 , divide start_ARG aitalic_t - ∇italic_θ g ( italic_θitalic_t )⊤ ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) end_ARG start_ARG ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22 end_ARG . Proof. The Lagrange function with λ≥00λ≥ 0λ ≥ 0 for Sec. 3.2 is h⁢(,λ)=12∥∇ℎconditional12subscript∇ h( δ,λ)= 12 \| _ θh ( italic_δ , λ ) = divide start_ARG 1 end_ARG start_ARG 2 end_ARG ∥ ∇italic_θ ℒ⁢(t;r)−∥22ℒsubscriptsubscriptevaluated-at22 L( θ_t;D_r)- δ% \|_2^2L ( italic_θitalic_t ; Ditalic_r ) - italic_δ ∥22 +λ⁢(at−∇g⁢(t)⊤⁢).subscriptsubscript∇superscriptsubscripttop +λ(a_t- _ θg( θ_t) % δ).+ λ ( aitalic_t - ∇italic_θ g ( italic_θitalic_t )⊤ italic_δ ) . (7) Then, using the Karush-Kuhn-Tucker (KKT) theorem, at the optimal solution we have −∇ℒr⁢(t;r)−λ⁢∇g⁢(t)subscript∇subscriptℒsubscriptsubscriptsubscript∇subscript δ- _ θL_r( θ% _t;D_r)-λ _ θg( θ_t)italic_δ - ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) - λ ∇italic_θ g ( italic_θitalic_t ) =,absent0 = 0,= 0 , ∇g⁢(t)⊤⁢subscript∇superscriptsubscripttop _ θg( θ_t) δ∇italic_θ g ( italic_θitalic_t )⊤ italic_δ ≥at,absentsubscript ≥ a_t,≥ aitalic_t , λ⁢(at−∇g⁢(t)T⁢)subscriptsubscript∇superscriptsubscript λ(a_t- _ θg( θ_t)^T % δ)λ ( aitalic_t - ∇italic_θ g ( italic_θitalic_t )T italic_δ ) =0,absent0 =0,= 0 , λ λ ≥0.absent0 ≥ 0.≥ 0 . (8) From the above constraints, we can obtain: δitalic_δ =∇ℒr⁢(t;r)+λ⁢∇g⁢(t),absentsubscript∇subscriptℒsubscriptsubscriptsubscript∇subscript = _ θL_r( θ_t;% D_r)+λ _ θg( θ_t),= ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) + λ ∇italic_θ g ( italic_θitalic_t ) , λ λ =max⁡0,at−∇g⁢(t)⊤⁢∇ℒr⁢(t;r)‖∇g⁢(t)‖22.absentmax0subscriptsubscript∇superscriptsubscripttopsubscript∇subscriptℒsubscriptsubscriptsuperscriptsubscriptnormsubscript∇subscript22 =max\0, a_t- _ θg( % θ_t) _ θL_r( θ_t;% D_r)\| _ θg( θ_t)\|_2^2\.= max 0 , divide start_ARG aitalic_t - ∇italic_θ g ( italic_θitalic_t )⊤ ∇italic_θ Litalic_r ( italic_θitalic_t ; Ditalic_r ) end_ARG start_ARG ∥ ∇italic_θ g ( italic_θitalic_t ) ∥22 end_ARG . (9) ∎ Theorem 3.2 [Pareto optimality] The stationary point obtained by our algorithm is Pareto optimal of the problem min⁡[ℒr⁢(;r),ℒf⁢(;f)]subscriptminsubscriptℒsubscriptsubscriptℒsubscriptmin_ θ[L_r( θ;D% _r),L_f( θ;D_f)]minbold_italic_θ [ Litalic_r ( italic_θ ; Ditalic_r ) , Litalic_f ( italic_θ ; Ditalic_f ) ]. Proof. Let ∗superscript∗ θ italic_θ∗ be the solution to our problem. Recall that for the current θitalic_θ, we find ϕKsuperscriptbold-italic-ϕ φ^Kitalic_ϕitalic_K to minimize g⁢(,ϕ)=ℒf⁢(;f)−min⁡ℒf⁢(ϕ;f)bold-italic-ϕsubscriptℒsubscriptminsubscriptℒbold-italic-ϕsubscriptg( θ, φ)=L_f( θ;D_f)-% minL_f( φ;D_f)g ( italic_θ , italic_ϕ ) = Litalic_f ( italic_θ ; Ditalic_f ) - min Litalic_f ( italic_ϕ ; Ditalic_f ). Assume that we can update in sufficient number of steps K so that ϕK=ϕ∗⁢()=argminϕ⁡g⁢(,ϕ)=argminϕ⁡ℒf⁢(ϕ;f)superscriptbold-italic-ϕsuperscriptbold-italic-ϕsubscriptargminbold-italic-ϕbold-italic-ϕsubscriptargminbold-italic-ϕsubscriptℒbold-italic-ϕsubscript φ^K= φ^*( θ)=argmin_ φg(% θ, φ)=argmin_ φL_f(% φ;D_f)italic_ϕitalic_K = italic_ϕ∗ ( italic_θ ) = argminbold_italic_ϕ g ( italic_θ , italic_ϕ ) = argminbold_italic_ϕ Litalic_f ( italic_ϕ ; Ditalic_f ). Here ϕbold-italic-ϕ φitalic_ϕ is initialized at θitalic_θ. The objective aims to minimize ℒr⁢(;r)+λ⁢g⁢(;ϕ∗⁢())subscriptℒsubscriptsuperscriptbold-italic-ϕ∗L_r( θ;D_r)+λ g( θ; % φ ( θ))Litalic_r ( italic_θ ; Ditalic_r ) + λ g ( italic_θ ; italic_ϕ∗ ( italic_θ ) ), let ∗superscript∗ θ italic_θ∗ be the optimal solution to this objective. Note that g⁢(,ϕ∗⁢())=ℒf⁢(;f)−min⁡ℒf⁢(ϕ∗⁢();f)≥0superscriptbold-italic-ϕ∗subscriptℒsubscriptminsubscriptℒsuperscriptbold-italic-ϕ∗subscript0g( θ, φ ( θ))=L_f( θ% ;D_f)-minL_f( φ (% θ);D_f)≥ 0g ( italic_θ , italic_ϕ∗ ( italic_θ ) ) = Litalic_f ( italic_θ ; Ditalic_f ) - min Litalic_f ( italic_ϕ∗ ( italic_θ ) ; Ditalic_f ) ≥ 0 as ϕbold-italic-ϕ φitalic_ϕ starts from θitalic_θ and is update to decreas ℒf⁢(ϕ;f)subscriptℒbold-italic-ϕsubscriptL_f( φ;D_f)Litalic_f ( italic_ϕ ; Ditalic_f ). This will decrease to 00 for minimizing the above objective. Therefore, at the optimal solution ∗superscript∗ θ italic_θ∗, we have g⁢(∗,ϕ∗⁢(∗))=0superscript∗superscriptbold-italic-ϕ∗superscript∗0g( θ , φ ( θ ))=0g ( italic_θ∗ , italic_ϕ∗ ( italic_θ∗ ) ) = 0. This further implies that ℒf⁢(∗;f)=min⁡ℒf⁢(ϕ∗⁢(∗);f)subscriptℒsuperscriptsubscriptminsubscriptℒsuperscriptbold-italic-ϕ∗superscriptsubscriptL_f( θ^*;D_f)=min% L_f( φ ( θ^*);D_f)Litalic_f ( italic_θ∗ ; Ditalic_f ) = min Litalic_f ( italic_ϕ∗ ( italic_θ∗ ) ; Ditalic_f ), meaning that ∗superscript θ^*italic_θ∗ is the current optimal solution of ℒf⁢(;Df)subscriptℒsubscriptL_f( θ;D_f)Litalic_f ( italic_θ ; Ditalic_f ) because we cannot update further the optimal solution. Moreover, we have ∗superscript θ^*italic_θ∗ as the local minima of ℒr⁢(;r)subscriptℒsubscriptL_r( θ;D_r)Litalic_r ( italic_θ ; Ditalic_r ) in sufficiently small vicinity considered, because in the small vicinity around ∗superscript θ^*italic_θ∗, g⁢(,ϕ∗⁢(∗))=0superscriptbold-italic-ϕsuperscript0g ( θ, φ^*( θ^*) )=0g ( italic_θ , italic_ϕ∗ ( italic_θ∗ ) ) = 0 provides no further improvements for the above sum, any increase in the above objective in the vicinity of ∗superscript θ^*italic_θ∗ would primarily be due to an increase in ℒr⁢(;r)subscriptℒsubscriptL_r( θ;D_r)Litalic_r ( italic_θ ; Ditalic_r ). ∎ 8 Reproducibility Statement and Details In this section, we provide detailed instructions on the reproduction of our results, we also share our source code at the repository https://github.com/JingWu321/EraseDiff. DDPM. Results on conditional DDPM follow the setting in SA [28]. Thanks to the pre-trained DDPM from SA. The batch size is set to be 128, the learning rate is 1×10−41superscript1041× 10^-41 × 10- 4, our model is trained for around 300 training steps. 5K images per class are generated for evaluation. For the remaining experiments, four and five feature map resolutions are adopted for CIFAR10 where image resolution is 32×32323232× 3232 × 32. All models apply the linear schedule for the diffusion process. We used A5500 and A100 for all experiments. SD. We use the open-source SD v1.4 checkpoint as the pre-trained model for all SD experiments. The learning rate is 1×10−51superscript1051× 10^-51 × 10- 5, and our method only fine-tuned the unconditional (non-cross-attention) layers of the latent diffusion model when erasing the concept of nudity. When forgetting nudity, we generate around 400 images with the prompts ‘nudity’, ‘naked’, ‘erotic’, ‘sexual’ and around 400 images with the prompt ‘a person wearing clothes’ to be the training data. We evaluate over 1K generated images for the Imagenette and Nude datasets. 4703 generated images with I2P prompts are evaluated using the open-source NudeNet classifier [2]. The repositories we built upon use the C-BY 4.0 and MIT Licenses. 9 Additional results Below, we also provide results on SD for EraseDiff when we replace ϵfsubscriptbold-italic-ϵ ε_fitalic_ϵitalic_f with ϵ⁢(t|cm)subscriptitalic-ϵconditionalsubscriptsubscript _ θ(x_t|c_m)ϵbold_italic_θ ( xitalic_t | citalic_m ) like Fan et al. [16], Heng and Soh [28], where cmsubscriptc_mcitalic_m is ‘a person wearing clothes’, denoted as EraseDiffwcsubscriptEraseDiffwcEraseDiff_wcEraseDiffwc. The CLIP score and FID score for EraseDiffwcsubscriptEraseDiffwcEraseDiff_wcEraseDiffwc are 30.31 and 19.55, respectively. Table 5: Performance of class-wise forgetting on Imagenette using SD. UA: the accuracy of the generated images that do not belong to the forgetting class (i.e., the effectiveness of forgetting). The FID score is measured compared to validation data for the remaining classes. Forget. Class SalUn EraseDiff FID ↓ ↓ UA (%)↑ ↑ FID ↓ ↓ UA (%)↑ ↑ Tench 1.49 100 1.29 100 English Springer 1.50 100 1.38 100 Cassette Player 1.11 100 0.85 100 Chain Saw 1.64 100 1.17 99.9 Church 0.76 100 0.83 100 French Horn 0.67 100 1.09 100 Garbage Truck 1.54 100 0.96 100 Gas Pump 1.59 100 1.25 100 Golf Ball 1.29 98.8 1.50 99.5 Parachute 1.35 100 0.78 99.7 Average 1.29 99.88 1.11 99.91 Figure 6: Quantity of nudity content detected using the NudeNet classifier from Nude-1K data with a threshold of 0.6. Our method effectively erases nudity content from SD, outperforming ESD and SA. Figure 7: Generated examples with I2P prompts when forgetting the concept of ‘nudity’. Figure 8: Generated examples with I2P prompts when forgetting the concept of ‘nudity’. Figure 9: Generated examples with I2P prompts when forgetting the concept of ‘nudity’. Figure 10: The flagged images generated by EraseDiff that are detected as exposed female breast/genitalia by the NudeNet classifier with a threshold of 0.6. The top two rows are generated images conditioned on prompts ‘nudity’, ‘naked’, ‘erotic’, ‘sexual’, and the rest are those conditioned on I2P prompts. No images contain explicit nudity content. Figure 11: Visualization of generated examples with prompts ‘nudity’, ‘naked’, ‘erotic’, ‘sexual’ when forgetting the concept of ‘nudity’. Figure 12: Visualization of generated images with COCO 30K prompts by the scrubbed SD models when forgetting the concept of ‘nudity’. Figure 13: Visualization of generated images with COCO 30K prompts by the scrubbed SD models when forgetting the concept of ‘nudity’. Figure 14: Generated images after forgetting the class ‘tench’. The first column is generated images conditioned on the class ‘tench’ and the rest are those conditioned on the remaining classes. Figure 15: Visualization of generated images by the scrubbed SD models when forgetting the class ‘tench’ on Imagenette. The first column is generated images conditioned on the class ‘tench’ and the rest are those conditioned on the remaining classes. Figure 16: Visualization of generated images by the scrubbed SD models when forgetting the class ‘tench’ on Imagenette. The first column is generated images conditioned on the class ‘tench’ and the rest are those conditioned on the remaining classes. Figure 17: Visualization of generated images by the scrubbed SD models when forgetting the class ‘tench’ on Imagenette. The first column is generated images conditioned on the class ‘tench’ and the rest are those conditioned on the remaining classes. Figure 18: Visualization of generated images by the scrubbed SD models when forgetting the class ‘tench’ on Imagenette. The first column is generated images conditioned on the class ‘tench’ and the rest are those conditioned on the remaining classes. Figure 19: Visualization of generated examples when forgetting the class ‘airplane’ on DDPM.

Instant research discovery