Text to image models erase sensitive concepts more reliably
Weeding Out Bad Seeds: Initial-Noise-Robust Unlearning for Text-to-Image Diffusion Models
Computer Vision and Pattern Recognition
Summary
Text-to-image models sometimes memorize things they should forget, like sensitive or unwanted images. The authors found that current ways of making these models forget can fail depending on random noise during the process, causing the unwanted images to reappear. They propose a new method that focuses the learning effort on parts of the model where the unwanted content actually appears, making forgetting stronger and more stable. Their method works well across different models and kinds of content, reducing unwanted image reappearance by over 60%.
What this means in practice
- •For ai development teams: Build text-to-image systems that reliably remove sensitive or undesired concepts without full retraining using adaptive noise sampling.
- •For ai safety engineers: Improve defenses for generative models against attacks that try to reintroduce forbidden content after unlearning.
- •For digital content moderators: Enhance content filtering tools by integrating models that more robustly forget unsafe image concepts.$Commercial implications: This paper enables developing safer content generation services that comply with moderation policies by better removing unwanted concepts.
Authors
Arian Komaei Koma, Seyed Amir Kasaei, Aida Aryafar, Matin Ghiasi, Ali Aghayari, Amirhossein Souri, Mohammad Mosayyebi, AmirMahdi Sadeghzadeh, Mohammad Hossein Rohban
Abstract
Machine unlearning has emerged as a critical post-hoc safety measure to erase sensitive concepts from Text-to-Image (T2I) models without prohibitive retraining. However, we reveal that current state-of-the-art (SOTA) approaches are brittle due to a severe lack of robustness to noise initialization. We call this phenomenon ``probabilistic forgetting'': suppressed concepts re-emerge under specific random initial noise conditions, despite appearing unlearned on other initializations. We trace this failure to the misalignment between standard Gaussian sampling during unlearning and the unlearning objective. Since the target concept manifests only in specific initial noise regions throughout the unlearning phase, uniform random sampling yields sparse, uninformative gradient updates that fail to drive robust erasure. To overcome this issue, we propose an adaptive, concept-conditioned sampling strategy that dynamically concentrates gradient updates on regions where the target concept manifests, down-weighting uninformative areas. We integrate our framework with six distinct SOTA unlearning methods across four diffusion backbones and evaluate it across safety, object, and artistic-style unlearning, as well as under black-box and white-box adversarial attacks. Our method reduces the conditional nudity re-emergence rate across random initializations by 67.2% on average over four baselines and lowers attack success rates across both adversarial evaluations. Across concept domains, Adaptive Noise Sampling strengthens adversarial robustness and non-target retention while preserving competitive generative quality and target-erasure performance.