Paper deep dive
eval-unlearn: Benchmarking unlearning in Text-to-Image Diffusion Models
Mansi, Nikhil Raghavan, Zixia Huang, Kai Sheng Ong, Ji Shen Lim, Brandon Siao Xiang Ling, Francesco Leofante
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rising number of concept unlearning techniques for text-to-image (T2I) diffusion models has produced a fragmented evaluation landscape. Methods are assessed under heterogeneous experimental conditions making principled cross-method comparison difficult. We present eval-unlearn, an open-source Python library providing a unified, reproducible benchmarking framework for concept unlearning in T2I Diffusion models. eval-unlearn integrates twelve published unlearning techniques spanning fine-tuning, closed-form model editing, and inference-time intervention, alongside nine complementary evaluation metrics covering erasure efficacy, adversarial robustness, generative quality, and concept retention. Its plugin architecture lets third-party techniques and metrics self-register without modifying the core framework, and its streaming, batched pipeline supports efficient evaluation of both standard NSFW concepts and arbitrary general concepts. As a further contribution, we release a public leaderboard on HuggingFace along with an interactive tool for real-time evaluation of unlearning techniques. The leaderboard compares nudity concept erasure case study across all twelve techniques, exposing significant accuracy-quality trade-offs that are obscured by heterogeneous evaluation. eval-unlearn is released under the MIT license; the package, code, leaderboard, and documentation are all available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2609.35269v1
- Canonical: https://arxiv.org/abs/2609.35269v1
Trouble viewing inline? Open PDF directly →
Full Text
15,317 characters extracted from source content.
Expand or collapse full text
eval-unlearn: Benchmarking unlearning in Text-to-Image Diffusion Models Mansi Nikhil Raghavan Zixia Huang Kai Sheng Ong Ji Shen Lim Brandon Siao Xiang Ling Francesco Leofante Abstract The rising number of concept unlearning techniques for text-to-image (T2I) diffusion models has produced a fragmented evaluation landscape. Methods are assessed under heterogeneous experimental conditions making principled cross-method comparison difficult. We present eval-unlearn, an open-source Python library providing a unified, reproducible benchmarking framework for concept unlearning in T2I Diffusion models. eval-unlearn integrates twelve published unlearning techniques spanning fine-tuning, closed-form model editing, and inference-time intervention, alongside nine complementary evaluation metrics covering erasure efficacy, adversarial robustness, generative quality, and concept retention. Its plugin architecture lets third-party techniques and metrics self-register without modifying the core framework, and its streaming, batched pipeline supports efficient evaluation of both standard NSFW concepts and arbitrary general concepts. As a further contribution, we release a public leaderboard on HuggingFace along with an interactive tool for real-time evaluation of unlearning techniques. The leaderboard compares nudity concept erasure case study across all twelve techniques, exposing significant accuracy-quality trade-offs that are obscured by heterogeneous evaluation. eval-unlearn is released under the MIT license; the package, code, leaderboard, and documentation are all available at https://eval-unlearn.readthedocs.io. 1Imperial College London m.-24, nikhil.raghavan, zixia.huang, kai-sheng.ong, dylan.lim, brandon.ling, f.leofante@imperial.ac.uk Figure 1: The figure shows the pipeline for eval-unlearn on an abstract level. 1 Introduction Text-to-image diffusion models such as Stable Diffusion (Rombach et al. 2022) synthesize high-quality images from natural language prompts, but training on large, internet-scraped corpora makes them capable of generating inappropriate content, with many negative implications (Schramowski et al. 2023). Fully retraining on curated data is both expensive and often ineffective due to compositionality (Okawa et al. 2023). Machine unlearning offers a practical alternative, using targeted weight modifications or inference-time interventions to selectively suppress a concept from a trained model (Beerens et al. 2025). A recent survey (Kim and Qi 2025) groups T2I unlearning techniques into three categories: fine-tuning methods (ESD (Gandikota et al. 2023), CA (Kumari et al. 2023), CoGFD (hongyi nie et al. 2025), AdvUnlearn (Zhang et al. 2024b), SSD (Foster et al. 2023)) that iteratively adjust U-Net or text-encoder weights; closed-form model editing methods (UCE (Gandikota et al. 2024), MACE (Lu et al. 2024)) that compute single-step weight updates without iterative optimisation; and inference-time interventions (SLD (Schramowski et al. 2023), SAFREE (Yoon et al. 2025), TraSCE (Jain et al. 2025), ConceptSteerers (Kim and Ghadiyaram 2025), SAeUron (Cywiński and Deja 2025)) that reshape guidance or latent representations at inference time without modifying weights. Despite this taxonomy, techniques are evaluated on different datasets, metrics, and hyperparameter regimes, making reliable cross-method comparison difficult. Existing frameworks, namely UnlearnCanvas (Zhang et al. 2024a) and the Holistic Unlearning Benchmark (Moon et al. 2025), provide fixed dataset-and-script packages covering a narrow, largely fine-tuning/closed-form set of techniques, with no interface for extension without modifying core code. eval-unlearn closes these gaps with a plugin architecture spanning all three categories. Its contributions are: (i) a shared execution pipeline supporting all three technique categories on a common base model; (i) nine standardized metrics spanning erasure efficacy, adversarial robustness, quality, and retention; (i) a plugin architecture, with a validation notebook for community-contributed techniques and metrics, enabling extension without modifying the core framework; and (iv) a public HuggingFace leaderboard, logged with full hyperparameters for reproducibility, enabling real-time comparison of unlearning techniques. The library is further accompanied by tutorial notebooks and a test suite exercised in continuous integration, currently at 99.82% coverage. Figure 1 illustrates the resulting pipeline. 2 Implemented Techniques and Metrics eval-unlearn v1.1.2 integrates twelve techniques spanning the three categories introduced in Section 1 (fine-tuning, closed-form editing, inference-time intervention), all targeting Stable Diffusion v1.4 as the base model, with the exception of SLD, which couples to its safety-fine-tuned variant. The framework additionally allows any custom checkpoint or HuggingFace model ID to be evaluated without writing wrapper code, and technique packages are separately installable so users need only the components required for their experiment. Alongside these, the library provides nine evaluation metrics spanning four categories. Erasure efficacy is measured via attack success rate (ASR) on the I2P benchmark (Schramowski et al. 2023). Adversarial robustness is measured via ASR under three optimisation-based red-teaming attacks: Ring-A-Bell’s genetic search (Tsai et al. 2024), MMA-Diffusion’s GCG suffix attack (Yang and others 2023), and P4D’s gradient-based prompt optimisation (Chin et al. 2024). Generative quality is captured by FID and CLIP Score against COCO 2017 (Lin et al. 2014), and by TIFA for compositional fidelity (Hu et al. 2023). Concept retention is assessed via the ERR erasure-retention metric (Liu et al. 2025) and UA-IRA, a retention score computed over user-provided prompts. The configuration for both the unlearning method and the metric computation is exposed through the technique_config and metric_configs variables of SingleBenchmarkRunner and MultiBenchmarkRunner, respectively. Default values follow either accepted standardised conventions or the values reported in each metric’s or technique’s original publication, as documented in the library documentation. 3 Software Design eval-unlearn is organised around a small set of core components following the Adapter design pattern (McDonough 2017): the framework defines fixed abstract interfaces, while external implementations are integrated through wrapper classes, keeping orchestration logic agnostic to technique and metric internals. Technique versions are pinned to their most recent release (Sept 2026) for reproducibility. Technique. A technique is a concept-erasure method exposed through a wrapper implementing a fixed generate() interface. Techniques are discovered via Python entry points declared in a package’s pyproject.toml: on runner initialisation, load_entrypoints scans all installed packages and registers each class under its declared name, making it immediately addressable in configuration files without manual imports or framework modification. The same mechanism applies to metrics and dataset loaders. Metric. A metric computes a single evaluation score (e.g., attack success rate, fidelity) over a stream of generated images via an update() method called per batch and a compute() method called at the end of the run. Dataset Loader. Dataset loaders supply prompts using one of two strategies. Algorithmically generated prompts are produced on first use and optionally cached to disk to avoid repeating costly optimisation. Fixed benchmark datasets (I2P, COCO, TIFA) are streamed from HuggingFace datasets, ensuring no complete dataset is held in memory. Configuration. Techniques and metrics are paired with frozen dataclass configurations that validate all hyperparameters at initialisation, surfacing misconfigurations before any model weights are loaded. Each experiment writes a concise report (metric scores) and an extended report (scores plus full configuration) to an output directory identified by a unique ID derived from the technique name, metric names, configurations, and timestamp. Runner. The runner ties together an unlearning technique, one or more metrics, and their configurations into a single experiment. SingleBenchmarkRunner executes one technique against one metric; MultiBenchmarkRunner evaluates one technique across multiple metrics in a single pass, reusing the loaded model. The run loop streams batches from each metric’s dataset loader, calls technique.generate(prompts), and accumulates statistics via metric.update(), with final aggregation deferred to metric.compute(). Metric objects are explicitly deleted and garbage-collected between evaluations to reclaim VRAM. Inference runs in FP16, with FP32 used for fine-tuning where numerical stability requires it. Runners are launched via CLI or script, driven by a JSON or YAML configuration file. 4 Conclusion eval-unlearn provides a unified, reproducible benchmarking framework for concept unlearning in T2I diffusion models. By standardizing the evaluation pipeline across twelve techniques and nine metrics, it enables fair cross-method comparison that is otherwise impractical. Its plugin architecture ensures the framework will remain current as the field evolves, and its MIT license minimizes barriers to community adoption and contribution. Future work will support newer Stable Diffusion variants (v2, SDXL), add computational overhead metrics (latency, peak VRAM), expand concept coverage beyond nudity and violence. References Beerens et al. (2025) L. Beerens, A. D. Richardson, K. Zhang, and D. Chen On the vulnerability of concept erasure in diffusion models. arXiv preprint arXiv:2502.17537. Cited by: §1. Chin et al. (2024) Z. Chin, C. Jiang, C. Huang, P. Chen, and W. Chiu Prompting4debugging: red-teaming text-to-image diffusion models by finding problematic prompts. In International Conference on Machine Learning (ICML), Cited by: §2. Cywiński and Deja (2025) B. Cywiński and K. Deja SAeUron: interpretable concept unlearning in diffusion models with sparse autoencoders. In Proceedings of the 42nd International Conference on Machine Learning (ICML), Cited by: §1. Foster et al. (2023) J. Foster, S. Schoepf, and A. Brintrup Fast machine unlearning without retraining through selective synaptic dampening. arXiv preprint arXiv:2308.07707. Cited by: §1. Gandikota et al. (2023) R. Gandikota, J. Materzyńska, J. Fiotto-Kaufman, and D. Bau Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), Cited by: §1. Gandikota et al. (2024) R. Gandikota, H. Orgad, Y. Belinkov, J. Materzyńska, and D. Bau Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), p. 5099–5108. Cited by: §1. hongyi nie et al. (2025) hongyi nie, Q. Yao, Y. Liu, Z. Wang, and Y. Bian Erasing concept combination from text-to-image diffusion model. In The Thirteenth International Conference on Learning Representations, External Links: Link Cited by: §1. Hu et al. (2023) Y. Hu, B. Liu, J. Kasai, Y. Wang, M. Ostendorf, R. Krishna, and N. A. Smith TIFA: accurate and interpretable text-to-image faithfulness evaluation with question answering. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), Cited by: §2. Jain et al. (2025) A. Jain, Y. Kobayashi, T. Shibuya, Y. Takida, N. Memon, J. Togelius, and Y. Mitsufuji TraSCE: trajectory steering for concept erasure. External Links: 2412.07658, Link Cited by: §1. Kim and Qi (2025) C. Kim and Y. Qi A comprehensive survey on concept erasure in text-to-image diffusion models. arXiv preprint arXiv:2502.14896. Cited by: §1. Kim and Ghadiyaram (2025) D. Kim and D. Ghadiyaram Concept steerers: leveraging k-sparse autoencoders for controllable generations. arXiv preprint arXiv:2501.19066. Cited by: §1. Kumari et al. (2023) N. Kumari, B. Zhang, S. Wang, E. Shechtman, R. Zhang, and J. Zhu Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), Cited by: §1. Lin et al. (2014) T. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick Microsoft COCO: common objects in context. arXiv preprint arXiv:1405.0312. Cited by: §2. Liu et al. (2025) F. Liu, C. Fan, H. Cui, A. Gupta, Z. Wang, F. Tramer, J. C. Niebles, S. Savarese, M. Salehi, and E. Kim Genμ: the generative machine unlearning challenge. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops, Cited by: §2. Lu et al. (2024) S. Lu, Z. Wang, L. Li, Y. Liu, and A. W. Kong MACE: mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Cited by: §1. McDonough (2017) J. E. McDonough Adapter design pattern. External Links: Link Cited by: §3. Moon et al. (2025) S. Moon, M. Lee, S. Park, and D. Kim Holistic unlearning benchmark: a multi-faceted evaluation for text-to-image diffusion model unlearning. External Links: 2410.05664, Link Cited by: §1. Okawa et al. (2023) M. Okawa, E. S. Lubana, R. P. Dick, and H. Tanaka Compositional abilities emerge multiplicatively: exploring diffusion models on a synthetic task. In Thirty-seventh Conference on Neural Information Processing Systems, External Links: Link Cited by: §1. Rombach et al. (2022) R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 10684–10695. Cited by: §1. Schramowski et al. (2023) P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting Safe latent diffusion: mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 22522–22531. Cited by: §1, §1, §2. Tsai et al. (2024) Y. Tsai, C. Hsu, C. Xie, C. Lin, J. Chen, B. Li, P. Chen, C. Yu, and C. Huang Ring-a-bell! How reliable are concept removal methods for diffusion models?. In International Conference on Learning Representations (ICLR), Cited by: §2. Yang et al. (2023) Y. Yang et al. MMA-diffusion: multimodal attack on diffusion models. arXiv preprint arXiv:2311.17516. Cited by: §2. Yoon et al. (2025) J. Yoon, S. Yu, V. Shin, H. Jiang, and M. Bansal SAFREE: training-free and adaptive guard for safe text-to-image and video generation. In The Thirteenth International Conference on Learning Representations (ICLR), Cited by: §1. Zhang et al. (2024a) Y. Zhang, C. Fan, Y. Zhang, Y. Yao, J. Jia, J. Liu, G. Zhang, G. Liu, R. R. Kompella, X. Liu, and S. Liu UnlearnCanvas: stylized image dataset for enhanced machine unlearning evaluation in diffusion models. In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track, External Links: Link Cited by: §1. Zhang et al. (2024b) Y. Zhang, X. Chen, J. Jia, Y. Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu Defensive unlearning with adversarial training for robust concept erasure in diffusion models. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §1.