Text to image models get reliable concept unlearning certification
Certifying Concept Unlearning in Text-to-Image Diffusion Models
Machine Learning
Summary
When computers learn to create images from text, sometimes they are taught to forget or unlearn certain ideas, like unsafe content or famous faces. The usual tests only check a few examples and might miss hidden remnants of these ideas. The authors created a way to give strong guarantees that the computer really forgot what it was supposed to, by carefully measuring the chances that unwanted content still appears. Their method found hidden risks that older tests missed, showing it’s important to use their certification to truly check safety.
What this means in practice
- •For ai safety teams: Provide reliable guarantees of removed harmful content in text-to-image AI systems to improve safety audits.
- •For content moderation teams: Assess residual risks of unauthorized or inappropriate concepts remaining in generative image models after unlearning procedures.
Authors
Mansi, Luca Marzari, Francesco Leofante
Abstract
Existing evaluations of concept unlearning in text-to-image (T2I) diffusion models primarily rely on attack success rates obtained through automated adversarial prompt search. However, these metrics provide only empirical evidence over a finite set of queries and leave residual leakage over the broader prompt space largely unquantified. This limitation can lead to overestimating unlearning effectiveness and underestimating safety risks. To address this gap, we introduce a novel certification framework for T2I concept unlearning that provides high-confidence guarantees with bounded error on residual concept leakage. Our approach combines statistical certification with worst-case analysis along concept-relevant embedding directions to derive explicit upper bounds on leakage probability under user-specified confidence levels. We evaluate our framework across three major concept categories namely NSFW content, artistic styles, and celebrity identities, and six state-of-the-art unlearning methods. Certified leakage bounds consistently exceed standard attack success rates by 16.2%, uncovering substantial residual risks missed by existing evaluation protocols. Crucially, our results demonstrate that empirical attack-based evaluations can significantly underestimate residual leakage and establish certification as a necessary complement for reliable auditing of concept unlearning in T2I diffusion models.