CoreUnlearn: Rethinking Concept Unlearning through Disentangled Component-Level Erasure in Text-guided Diffusion Models
arXiv:2606.01658v1 [cs.CR] 1 Jun 2026
Mengnan Zhao, Lihe Zhang, Baocai Yin
Abstract Text-guided diffusion models have revolutionized image synthesis but also raise ethical concerns, such as privacy violation and harmful content generation. To mitigate these issues, prevailing methods typically leverage an alignment mechanism—with predefined erasure references—to fine-tune pretrained model weights. However, these techniques are intrinsically limited by the representational capacity of textual space and display high sensitivity to the choice of predefined erasure references, e.g., suboptimal references may significantly affect the model utility preservation during erasure. To overcome these limitations, we introduce CoreUnlearn, aiming to disentangle and remove the erasure-critical component of the undesirable concept. Specifically, CoreUnlearn comprises a Component Extraction Module (CEM) and a Swap Disentangling Strategy (SDS). Guided by SDS, CEM is pre-trained to decompose concept embeddings into distinct component types. Leveraging this decomposition, CoreUnlearn then removes the erasure-critical component while retaining non-critical ones by fine-tuning model weights. Extensive experiments demonstrate that CoreUnlearn achieves effective concept erasure with minimal impact on overall model performance.
1
Introduction
Text-to-image generative techniques [43,44,61], especially text-guided diffusion models [37,53], have transformed image synthesis by producing high-quality outputs across diverse domains [23, 34], such as digital art, media content, and healthcare [7, 55]. However, despite their remarkable success, these models often inherit biases or sensitive information from pre-training datasets, raising ethical concerns such as copyright infringement, privacy breaches, and the generation of harmful content [14,22,32,67]. To mitigate these issues, retraining-based methods like Safe Latent Diffusion [45] have been proposed. Unlike retraining-based approaches, machine unlearning (MU) [12, 16, 50] leverages targeted or nontargeted fine-tuning to suppress the generation of undesirable content in diffusion models. Targeted fine-tuning [19] steers the model predictions for undesirable concepts toward predefined textual or semantic anchors, while non-targeted fine-tuning [60, 67] directly suppresses the features associated with undesirable concepts. The predefined anchors in targeted fine-tuning techniques range from empty prompts [24] and broad conceptual categories [25] to partial embedding values derived from text prompts [2, 19] or weighted combinations of multiple text embeddings [11]. Despite recent advancements in unlearning techniques for diffusion models [9,46,52], the preservation performance of model utility during erasure can be seriously compromised by issues like suboptimal target anchors or unnecessary feature removal [4, 38, 39, 49]. Inspired by this, we consider one question: Can we disentangle and remove erasure-critical components of undesirable concepts? By removing such components while retaining others, we aim to mitigate the adverse effects of concept erasure on the overall model performance. Preprint. Under review.
To achieve this, we present CoreUnlearn, integrating the Component Extraction Module (CEM) and the Swap Disentangling Strategy (SDS). Specifically, we first formalize the paradigm for identifying and removing erasure-critical components. We then architect the CEM and define its SDS-based supervision objective. Guided by SDS, CEM is pre-trained to disentangle embeddings of undesirable concepts into distinct component types. Finally, we fine-tune the model weights to remove the erasure-critical components selected by pre-trained CEM while preserving all remaining information. The contributions are four-fold: (1) To mitigate the decline of overall model performance during erasure, we introduce the paradigm of erasure-critical component removal. (2) We propose the Component Extraction Module to decompose concept embeddings into distinct components. (3) To identify the erasure-critical component during the decomposition of CEM, we design the Swap Disentangling Strategy. (4) Extensive experiments on multiple benchmarks demonstrate that CoreUnlearn effectively preserves overall model performance while realizing effective concept erasure.
2
Proposed Method
2.1
Preliminaries
Given the concept embeddings e, the visual noise z ∼ N (0, I), let ft (e, z; θ) : E × Z → X denote the model prediction at timestep t ∈ {1, . . . , T }. The unlearning technique aims to erase undesirable concepts cu (embeddings eu ) while preserving generation quality for retained concepts cn ∈ CRCs (embeddings en ∈ ERCs ), expressed as " # X min Ez∈ZD ∥ft (eu , z; θop ) − ft (ep , z; θ0 )∥2 + ∥ft (en , z; θop ) − ft (en , z; θ0 )∥2 , (1) θop
en ∼ERCs
where θ0 represents the pre-trained model weights. θop denotes optimizable parameters, initialized as θ0 . ZD is the visual dataset. ep means the predefined target anchors for erasing the concept cu . 1) The left term of Eq. 1 alters the model generations for cu . Meanwhile, its initial value exhibits an inverse correlation with model utility preservation [66]. 2) The right term aims to preserve the overall model performance, while researchers should carefully select the retained concepts CRCs . t These observations motivate an issue: Can we construct a target candidate fcand that simultaneously realizes effective concept erasure and preserves model utility (Shallower Erase), such that t t ft (eu , z; θ0 ) − fcand ≪ ∥ft (eu , z; θ0 ) − ft (ep , z; θ0 )∥2 , and arg max g(fcand ) ̸= ℓu , 2
(2)
t where arg max g(fcand ) yields the label index predicted by the fixed classifier g(·) when applied to candidate features, and ℓu denotes the ground-truth label index of cu .
2.2
Paradigm of Erasure-critical Component Removal
We employ the latent difference ∆fut,θ ≜ ft (eu , z; θ) − ft (e∅ , z; θ) to represent the arbitrary undesirable concept cu , i.e., the generation differences introduced by the guidance of cu . e∅ means the embeddings of the empty prompt. t To construct the candidate fcand that satisfies Eq. 2, this paradigm first decomposes ∆fut,θ into distinct components, and then replaces the erasure-critical component. Specifically, let T : X → X M be a decomposition operator that partitions the latent difference ∆fut,θ into M distinct components:
∆fut,θ =
M X
T (∆fut,θ )j .
(3)
j=1 t Let k ∈ {0, . . . , M } index the erasure-critical component, fcand is further formulated as follows, t fcand = ft (eu , z; θ0 ) − T (∆fut,θ0 )k + Tknew .
(4)
Eq. 4 reveals that the critical component T (∆fut,θ0 )k for representing cu is replaced by a new component Tknew . Combined with Eq. 4 and Eq. 2, the decomposition operator T and the optimizable model parameters θop should satisfy the following conditions: t Tknew − T (∆fut,θ0 )k 2 ≪ ∥ft (eu , z; θ0 ) − ft (ep , z; θ0 )∥2 , and arg max g(fcand ) ̸= ℓu .
2
(5)
Typically, the target anchors ep are closer to eu than the empty prompt embeddings e∅ , that is, ∥ft (eu , z; θ0 ) − ft (ep , z; θ0 )∥2 ≤ ∥ft (eu , z; θ0 ) − ft (e∅ , z; θ0 )∥2 = ∥∆fut,θ0 ∥2 .
(6)
Hence, we represent the final conditions as follows: t Tknew − T (∆fut,θ0 )k 2 ≪ ∥∆fut,θ0 ∥2 , and arg max g(fcand ) ̸= ℓu .
2.3
(7)
Learning Critical Component Extraction
In this subsection, we describe how to construct the decomposition operator T (·). We propose a Component Extraction Module (CEM) and a Swap Disentangling Strategy (SDS). CEM decomposes each concept representation into distinct components, while SDS enforces that each component exhibits a specific type. The pretrained CEM is utilized as T (·). The encoder in CEM (CEM-E) compresses the input (∆fut,θ0 ) into several groups of feature vectors, while the decoder (CEM-D) then reconstructs the input from these vectors, expressed as fout = CEM-D CEM-E ∆fut,θ0 .
Empirically, in text-guided diffusion models, features strongly related to cu should be robust to visual variations while being sensitive to textual changes. Guided by this assumption, we divide component types into four categories: - Vr Tr : Visual-robust and text-robust, - Vr Ts : Visual-robust and text-sensitive, - Vs Tr : Visual-sensitive but text-robust, - Vs Ts : Visual-sensitive and text-sensitive.
Conv3 ×2
CEM-E
Although CEM effectively decomposes the input, it cannot explicitly specify the type of each decomposed component. This limitation raises an issue: How can we specify the component types and identify which type is most strongly associated with the undesirable concept cu ?
Input
Pooling
...
Conv3
Conv3
Conv3
Conv3 CEM-D
The structure of CEM is illustrated in Figure 1. CEM-D reconstructs several kinds of components, which are summed to produce fout . fout is expected to approximate the input ∆fut,θ0 .
×2
×2
Upsample
Upsample
Conv3
Conv3
...
Conv3
Conv3 ×2
Upsample
...
Conv3
+ Output
Figure 1: Component extraction module (CEM).
To enforce that each component decomposed by CEM exhibits a specific type, we introduce SDS, with the detailed overflow shown in Figure 2. SDS first generates two perturbed variants, - Visual Perturbed Variant: ∆fut,ξz = ft (eu , z ′ ; θ0 ) − ft (e∅ , z ′ ; θ0 ), s.t., z ′ ∼ N (0, I) , z ′ ̸= z
(8)
- Textual Perturbed Variant: ∆fut,ξe = ft (e′u , z; θ0 ) − ft (e∅ , z; θ0 ), s.t., e′u ← eu + β noise ∥eu ∥2 , noise ∼ N (0, I) (9) Let CEM-E : X → R4×d map an input to a set of four component embeddings. Given the inputs ∆fut,θ0 , ∆fut,ξz , and ∆fut,ξe , we further obtain their embeddings extracted by CEM-E: Eori : [e1ori , e2ori , e3ori , e4ori ] = CEM-E(∆fut,θ0 ) Evn : [e1vn , e2vn , e3vn , e4vn ] = CEM-E(∆fut,ξz )
(10)
Etn : [e1tn , e2tn , e3tn , e4tn ] = CEM-E(∆fut,ξe ) We expect that components within E∗ correspond to the Vr Tr , Vr Ts , Vs Tr , and Vs Ts categories, respectively. To achieve this, we introduce the disentanglement constraint, comprising two parts: - Learning Visual-Robust Components (Vr Tr /Vr Ts ): 3:4 1:2 3:4 Lswap1 = ∥CEM-D([e1:2 vn , eori ]) − CEM-D(Eori )∥2 + CEM-D([eori , evn ]) − CEM-D(Evn ) 2 .
3
Align CEM-D
CEM-E
Noise Augment
Align
Visual Sensitive Text Robust
Visual Robust Text Sensitive
CEM-D
Visual Robust Text Robust
Align
Shared
Swap
Visual Sensitive Text Sensitive
: Path for Calculating Loss
Figure 2: The proposed swap disentangling strategy (SDS) operates on the representation ∆fut,θ0 . SDS first perturbs ∆fut,θ0 with visual and textual noise, then enforces the disentanglement of specific component styles by swapping the outputs of the CEM encoder.
- Learning Textual-Robust Components (Vr Tr /Vs Tr ): 2,4 Lswap2 = CEM-D([e1,3 tn , eori ]) − CEM-D(Eori )
2
2,4 + CEM-D([e1,3 ori , etn ]) − CEM-D(Etn )
. 2
The complete training loss combines reconstruction fidelity and disentanglement constraints: min LSDS , θT
LSDS = Lrec + α (Lswap1 + Lswap2 )
(11)
where θT denotes the weights of T . α is a factor balancing loss terms, with Lrec defined as: Lrec = ∥CEM-D(Eori ) − ∆fut,θ0 ∥ + ∥CEM-D(Evn ) − ∆fut,ξz ∥ + ∥CEM-D(Etn ) − ∆fut,ξe ∥. 2.4
Learn to Delete the Erasure-critical Component
We expect that the prediction of the fine-tuned model t ft (eu , z, θop ) can be directly utilized as fcand . In this way, we can omit the unlearning step, such as the alignment process in Eq. 1. Based on Eq. 4, we will have
Align
In this subsection, leveraging the CEM pretrained based on LSDS as T (·), we detail the construction of Tknew , which should satisfy the conditions specified in Eq. 7.
Tknew = ft (eu , z, θop ) − ft (eu , z; θ0 ) + T (∆fut,θ0 )k , X = [T (∆fut,θop )j − T (∆fut,θ0 )j ] + T (∆fut,θop )k . | {z } j,j̸=k
CEm-E
dj
(12) To reduce the impact of finetuning on the overall model P performance, we constrain j,j̸=k dj ≈ 0 and have Tknew ≈ T (∆fut,θop )k .
Figure 3: Learn to delete the erasurecritical component.
The objective for optimizing θop is formulated as min Lop , θop
s.t., d1 ≤ η∥∆fut,θ0 ∥2 ,
where Lop = λ
X
dj −d1 . |{z} {z } Erasure
j∈JRetain
| 4
Preservation
(13)
Algorithm 1: CoreUnlearn Require :Embeddings of undesirable concepts eu , embeddings of the empty concept e∅ , visual noise z, diffusion model f (·) with optimizable weights θop (initialized as θ0 ), maximum iterations Mop for optimizing θop , maximum iterations MCEM for training CEM(·; θCEM ) Ensure :Finetuned model weights θop Define ∆fut,θ ← ft (eu , z; θ) − ft (e∅ , z; θ); // Phase 1: Train θCEM under the supervision of SDS for i ← 1 to MCEM do // Construct visually/textually noised inputs Sample z, z ′ ∼ N (0, I) with z ̸= z ′ ; Sample noise ∼ N (0, I) matching shape of eu ; Compute e′u ← eu + β noise ∥eu ∥2 ; // Decompose components using CEM Compute Eori , Evn , Etn via Eq. 10; // Learn component types with SDS Swap components and compute Lswap1 , Lswap2 , Lrec ; Update θCEM by minimizing LSDS ; // Phase 2: Delete erasure-critical components for i ← 1 to Mop do Compute di in Eq. 12 using fixed θCEM ; if d1 > η ∥∆fut,θ0 ∥2 then break; Compute the reference drift suppression: LRDS = Ez,t [∥ft (e∅ , z; θop ) − ft (e∅ , z; θ0 )∥2 ]; Update θop by minimizing Lop + LRDS ;
Here, JRetain = {0, 2, 3} indexes retained components (Vr Tr , Vs Tr , and Vs Ts components) during erasure. The negative d1 term drives the Vr Ts component away from its original configuration. By adjusting the hyperparameter η, we can meet both requirements of Eq. 7. Specifically, choosing a sufficiently small η enforces Tknew − T (∆fut,θ0 )k 2 ≪ ∥∆fut,θ0 ∥2 , while increasing η ensures t arg max g fcand ̸= ℓu . The complete optimization workflow is depicted in Figure 3. Algorithm details are illustrated in Algorithm 1.
3
Experiments
3.1
Experimental settings
Details. Following prior works [36,47,57,68], we conduct experiments on Stable Diffusion (SD) [42] using both SD-v1.4 and SD-v2. The optimization process utilizes the Adam optimizer, with learning rates of 1e-4 for updating θCEM and 1e-5 for updating θop , where θop refers to the weights of the cross-attention module. Hyperparameters are set as follows: η in Eq. (9) to 0.03, α in Eq. (11) to 100, λ, γ, and β to 10, MCEM to 500, and Mop to 100. Experiments use two GeForce RTX 3090 GPUs. Baselines. We compare the proposed CoreUnlearn with several state-of-the-art baselines, including FMN [60], SDD [24], ESD [10], AbC [25], UCE [11], RECE [13], and ABO [19]. All experiments are conducted under identical evaluation settings; for example, only the attention layer weights are optimized, and only the empty prompt is employed to preserve the model utility. Evaluation metrics. (1) Image similarity: Fréchet Inception Distance (FID) [18] and Learned Perceptual Image Patch Similarity (LPIPS) [62] are used to measure the similarity between images generated by the original diffusion model (with θ0 ) and the unlearned diffusion model (with θop ). (2) Object classification: A ResNet50 model [17] pre-trained on the ImageNet dataset is employed to classify objects in generated images. (3) Style classification: The fully connected layer of the pre-trained ResNet50 is fine-tuned on a style dataset to obtain a 10-class classifier. The dataset comprises images generated by the original diffusion model, with a blank style and nine artistic styles as prompts: Cézanne, Van Gogh, Picasso, Jackson Pollock, Caravaggio, Keith Haring, Kelly 5
Ours
ORI
Ours
ORI
Ours
ORI
Ours
ORI
Ours
Church
Golf Ball Parachute
French Horn
ORI
Figure 4: Qualitative results of the proposed CoreUnlearn for object unlearning. McKernan, Tyler Edlin, and Kilian Eng. (4) Sexual content classification: Images containing exposed body parts are categorized using Nudenet [1]. (5) I2P category classification: Similar to the setup for style classification, a fine-tuned ResNet50 model is employed. Evaluation Illustrations. (1) For erasure assessment, we highlight the ACC metric, employing FID and LPIPS strictly as supplementary indicators. While increased FID and LPIPS scores signal marked divergence from the original image distribution, they alone cannot conclusively demonstrate complete concept removal. (2) RDS means the reference drift suppression, which only utilizes the empty prompt to preserve the model utility. The definition of RDS is shown in Algorithm 1. Evaluation Data: (1) Object Unlearning: We employ the categories from Imagenette [20] as undesirable targets for erasure. To assess erasure efficacy, we generate 1,000 images (5 per seed) using 200 distinct seeds for each undesirable object. To verify preservation performance on remaining categories (non-erased), we sample 50 independent seeds per preserved category and likewise generate five images per seed. (2) Style Unlearning: Each of the nine artistic styles introduced above is targeted for erasure individually. The data generation protocol mirrors that of Object Unlearning. (3) Sexual Content Removal: We assess erasure effectiveness based on I2P prompts [45], and measure preservation performance on images prompted by ImageNet categories. (4) Unlearning Other I2P Categories except Sexual: The same procedure in the Sexual Content Removal is applied to the remaining I2P categories—Hate, Violence, Self-Harm, Shocking, Illegal Activity, and Harassment. 3.2
Unlearning results
Default unlearning is conducted on SD-v1.4.
Table 1: Comparative results on object unlearning. Object Unlearning. The average results are presented in Table 1. The key observations are as E RASE P RESERVE T OTAL follows: 1) Erasure Performance: Evaluated by RDS FID LPIPS ACC↓ FID↓ LPIPS↓ ACC↑ ∆ACC↑ ACC (lower is better), our method effectively - ORI 0.00 0.00 90.5 0.00 0.00 90.5 0.00 removes undesired objects from the model’s memory, achieving an ACC of 9.42%, which FMN 177.2 0.351 30.2 14.1 0.190 84.5 54.3 SDD 244.6 0.402 14.5 22.3 0.238 74.2 59.7 is comparable to SDD (9.39%), AbC (7.24%), ESD 242.2 0.399 9.24 15.9 0.194 81.4 72.1 and RECE (9.10%). Although UCE attains the ✗ A B C 237.5 0.397 12.4 21.9 0.228 75.7 63.3 lowest ACC at 1.94%, it exhibits significant RECE 210.1 0.395 7.18 18.4 0.203 78.7 71.5 UCE 237.5 0.429 3.32 26.0 0.258 72.6 69.3 degradation in other performance metrics. 2) ABO 207.8 0.378 23.9 20.5 0.223 78.2 54.3 Preservation Quality: Our approach achieves the FMN 177.0 0.350 30.5 14.1 0.190 84.4 53.9 lowest FID of 11.9 and LPIPS of 0.166, outperSDD 279.4 0.423 9.39 15.8 0.195 82.1 72.7 forming the next-best method (ESD: FID=14.2, ESD 233.3 0.387 15.2 14.2 0.189 83.8 68.6 ✓ A B C 258.6 0.417 7.24 14.9 0.188 82.9 75.7 LPIPS=0.189). Moreover, with a classification RECE 201.7 0.381 9.10 15.7 0.196 81.0 71.9 accuracy of 87.8%—surpassing FMN (84.5%) UCE 258.7 0.451 1.94 19.9 0.237 76.8 74.9 and ESD (83.8%)—we demonstrate that our ABO 154.5 0.341 32.1 15.5 0.201 83.1 51.0 method preserves overall model performance ✓ O URS 259.5 0.462 9.42 11.9 0.166 87.8 78.4 while effectively erasing the undesirable concept. 3) Overall Efficiency: ∆ACC quantifies the trade-off between erasure effectiveness and 6
Ours
ORI
Ours
ORI
Ours
ORI
Ours
Ours
ORI
Caravaggio Kilian Eng
Picasso
Cezanne
ORI
Figure 5: Qualitative results of the proposed CoreUnlearn for style unlearning. preservation performance. Our method achieves a ∆ACC of 78.4%, about 3 points higher than the next best (AbC: ∆ACC=75.7%), demonstrating the strongest balance between the two objectives. 4) By suppressing reference drift, most existing unlearning techniques enhance preservation performance while maintaining comparable erasure effectiveness. 5) All unlearning methods effectively remove undesirable objects from pre-trained diffusion models, evidenced by a significant increase in FID and LPIPS scores for erased object categories. For instance, the original FID and LPIPS scores, both initially zero, increase to an average of 222.4 and 0.393, respectively, across existing methods. The improved performance of our method likely results from its emphasis on erasure-critical components, thereby minimizing unnecessary modifications to the model weights. We further present qualitative results of object unlearning in Figure 4. The proposed CoreUnlearn removes undesirable objects while preserving the generation quality of retained objects. Style Unlearning. Following the Object Unlearning section, we conduct experiments on Table 2: Comparative results on style unlearning. Style Unlearning and show the results in Table E RASE P RESERVE T OTAL 2. Our method achieves competitive erasure per- RDS formance, reducing classification accuracy on FID LPIPS ACC↓ FID↓ LPIPS↓ ACC↑ ∆ACC↑ undesirable style categories to 7.85%, on par - ORI 0.00 0.00 98.9 0.00 0.00 98.9 0.00 with leading baselines such as ESD (6.98%), FMN 272.8 0.419 30.6 86.9 0.242 55.1 24.5 UCE (9.14%), and RECE (10.8%). In terms of SDD 258.7 0.439 16.5 53.8 0.232 84.3 67.8 ESD 261.6 0.413 13.9 41.4 0.195 92.4 78.5 preservation, it yields the lowest FID and LPIPS ✗ UCE 256.9 0.479 12.8 67.5 0.260 82.0 69.2 scores while attaining the highest classification RECE 273.1 0.445 9.00 54.3 0.231 83.2 74.2 accuracy for retrained concepts. Additionally, A B C 246.6 0.410 25.8 53.6 0.223 85.9 60.1 ABO 296.8 0.466 4.71 63.9 0.220 79.5 74.8 evaluated by overall gain (∆ACC), our approach reaches 87.8%, surpassing all comparative techFMN 281.0 0.429 26.6 58.1 0.251 84.8 58.2 SDD 280.2 0.456 9.96 42.4 0.196 91.3 81.3 niques. These results highlight the superior efESD 283.4 0.455 6.98 38.2 0.183 94.3 87.3 fectiveness of our method in style unlearning. ✓ UCE 272.4 0.497 9.14 51.9 0.241 89.5 80.4 Qualitative results of style unlearning are shown in Figure 5. CoreUnlearn effectively eliminates undesirable styles while maintaining high generation quality for the retained styles.
✓
RECE 255.0 0.421 A B C 244.3 0.388 ABO 265.7 0.430
10.8 21.6 15.9
42.9 42.4 40.1
0.194 0.187 0.181
90.2 93.3 94.1
79.4 71.7 78.2
O URS 294.2 0.459
7.85
35.8
0.172
95.6
87.8
Sexual Content Removal. Experimental results are shown in Table 3. 1) UCE, RECE and our method (η = 0.06) show comparable erasure performance, but our approach achieves the best preservation performance, yielding the lowest FID and the highest ACC among the three. 2) Compared to FMN, AbC, ABO and SDD, our approach (η = 0.03) realizes the optimal erasure and preservation effectiveness. The qualitative results in Figure 6 further validate the efficacy of CoreUnlearn, showing its capability to eliminate exposed content. I2P Categories removal. Table 4 compares CoreUnlearn with other methods for I2P category removal. The key observations are as follows: 1) Our method achieves strong erasure performance, reducing classification accuracy on undesirable concepts to 12.65%, on par with RECE (11.45%) and 7
Table 3: Comparative results on sexual content removal. ‘F.B’, ‘F.G’, ‘M.B’, and ‘M.G’ denote ‘Female.BREAST’, ‘Female.GENITALIA’, ‘Male.GENITALIA’, and ‘Male.GENITALIA’, respectively. E XPOSED B ODY R EGIONS
M ETHODS
E RASE
P RESERVE
F.B F.G M.G M.B BUTTOCKS ARMPITS BELLY FEET T OTAL↓ FID↓ LPIPS↓ ACC↑ ORI 200 FMN 106 ABC 75 76 ABO SDD 69 UCE 32 RECE 20 73 ESD O URS (η = 0.03) 53 O URS (η = 0.06) 21
ORI
AbConcept
ESD
26 6 3 3 3 1 1 5 1 1
22 2 3 3 4 3 1 4 1 1
Forget-Me-Not
46 18 13 19 17 5 3 16 13 3
SDD
51 17 10 7 9 7 3 10 13 2
All-But-One
211 94 64 72 66 18 18 68 70 20
196 109 69 81 79 20 22 61 58 22
63 23 14 22 21 11 8 26 18 10
815 375 251 283 259 97 76 263 227 80
0.00 21.99 22.53 21.96 22.32 23.37 22.93 22.82 21.42 22.03
0.00 0.181 0.188 0.185 0.186 0.189 0.187 0.189 0.181 0.186
54.89 51.92 50.16 51.88 50.86 51.61 51.43 52.37 53.60 52.13
Ours
Table 4: Comparative results of I2P unlearning. All experiments are enhanced by RDS. E RASE
P RESERVE
T OTAL
ACC↓ FID↓ LPIPS↓ ACC↑ ∆ACC↑
Figure 6: Qualitative results of the proposed CoreUnlearn for sexual content removal.
ORI
20.07
0.00
0.00
54.89
34.82
ABC ABO SSD RECE ESD O URS
16.76 17.74 14.54 11.45 15.76 12.65
22.06 22.08 22.16 23.01 22.08 22.34
0.183 0.183 0.184 0.195 0.184 0.188
52.58 51.64 51.43 50.14 52.18 52.37
35.82 33.90 36.89 38.69 36.42 39.72
outperforming other baselines such as SSD (14.54%). 2) In preservation evaluation, our approach maintains excellent fidelity to retained concepts (FID = 22.34, LPIPS = 0.188, ACC = 52.37%), closely matching the strongest baseline AbC (FID = 22.06, LPIPS = 0.183, ACC = 52.58%). 3) Combining erasure and preservation via the ∆ACC metric, our method achieves a 39.72% score, surpassing all competitors (next best: RECE at 38.69%). Comparative results on SD-v2. Table 5 Table 5: Comparative results of object and style unlearnpresents a comparative analysis of object ing on SD-V2, both enhanced by RDS. and style unlearning performance on SDv2. 1) Object Unlearning. Our method E RASE P RESERVE T OTAL T YPE achieves the strongest overall performance, FID LPIPS ACC↓ FID↓ LPIPS↓ ACC↑ ∆ACC↑ reflected by the highest ∆ACC of 73.4%. ORI 0.00 0.00 91.3 0.00 0.00 91.3 0.00 2) Style Unlearning. Our approach excels ESD 231.9 0.350 25.2 8.31 0.104 90.0 64.8 in utility preservation (FID = 24.4, LPIPS = O BJECT A B C 263.6 0.407 15.5 9.61 0.120 88.5 73.0 ABO 231.7 0.362 26.6 8.10 0.101 90.4 63.8 0.109, ACC = 83.0%), surpassing all baseO URS 244.6 0.372 17.0 7.32 0.104 90.4 73.4 lines, such as ESD (FID = 27.4, LPIPS ORI 0.00 0.00 86.4 0.00 0.00 86.4 0.00 = 0.124, ACC = 79.1%). Meanwhile, it ESD 197.2 0.354 29.2 27.4 0.124 79.1 49.9 attains the largest ∆ACC of 51.6%, indiS TYLE A B C 196.0 0.369 37.0 28.7 0.131 82.4 45.4 ABO 202.4 0.359 30.7 30.7 0.125 78.7 48.0 cating the most favorable trade-off between O URS 212.0 0.371 31.4 24.4 0.109 83.0 51.6 style removal and retained model utility. 3.3
Ablation Studies
Impact of β on CoreUnlearn. Figure 7 illustrates the effect of increasing the textual-noise augmentation parameter β on Picasso-style erasure. The key observations are as follows: 1) The classification accuracy for erased concepts remains consistently low, varying only slightly between 1.4% and 2.2%. 2) Preservation quality improves markedly with higher β. The FID score falls from 63.2 at β = 0 to 49.2 at β = 20, with a 22.3% reduction, while ACC climbs from 86.1% at β = 0 to 91.0% at β = 20, yielding a 5.7% relative gain. Therefore, the default value of β is set to 10. 8
FID Evaluation
ACC Evaluation
250
80
200
FID
40
100
ACC
60
150
20
50 0 FID for Erased
FID for Preserved
ACC for Erased
ACC for Preserved
0
Figure 8: Impact of different component types. Figure 7: Impact of varying textual noise levels. Impact of using various component types on CoreUnlearn. Figure 8 compares the performance of using different component types. All variants achieve high FID and low ACC scores for the undesirable concepts, confirming their effectiveness at concept removal. Under comparable erasure efficacy, Vr Ts and Vs Tr can better preserve overall model utility. However, Vs Tr suffers from insufficient erasure, as reflected by its relatively high ACC score for erased concepts. These observations validate our hypothesis that the erasure-critical component should be visual-robust but text-sensitive.
4
Related Work
Diffusion Models (DMs) have revolutionized text-to-image generation, producing high-fidelity images [27, 54]. By progressively refining Gaussian noise into coherent visuals, DMs exhibit greater stability compared to Generative Adversarial Networks [6, 35, 48]. Their versatility spans applications like style transfer [65], image inpainting [28], and super-resolution [8, 59]. However, these advancements raise concerns about security, privacy, and ethical issues [8, 26], particularly regarding the generation of NSFW content and copyrighted materials [58, 69]. MU has emerged as a solution to these concerns by selectively removing the influence of specific concepts from pretrained models without requiring complete retraining [31, 40, 63]. Particularly, MU methods for DMs [30] can be broadly categorized into adaptor-based and adaptor-free approaches. Adaptor-based methods introduce additional trainable layers, such as lightweight adapters [33, 56] or modular frameworks [32]. In contrast, adaptor-free methods directly modify the parameters of pre-trained models. For example, techniques like ESD [10] and SepME [67] focus on fine-tuning cross-attention layers or restricting updates to image-independent parameters. Notably, both adaptor-based and adaptor-free approaches rely on predefined references to guide the erasure process [15, 21, 41]. For instance, SDD [24] and AbC [25] utilize empty prompts and broader conceptual categories as references, respectively. Additionally, researchers [3, 29, 63] propose various strategies for designing the retained concept set to enhance model utility preservation. In contrast, we realize both erasure effectiveness and model utility preservation by extracting and removing erasure-critical components from the embeddings of undesirable concepts. Limitations. There is an increasing emphasis on erasure robustness [51] (Deeper Erase). For instance, researchers have developed several evaluation protocols [5, 64] to quantify erasure resilience and have devised adversarial training methods [22, 63] to reinforce models. However, CoreUnlearn (Shallower Erase) focuses on mitigating the effect on utility preservation during erasure and has not been augmented for erasure robustness, leaving it vulnerable to adversarial prompts.
5
Conclusion
In this work, we introduce CoreUnlearn, an innovative framework designed for efficient concept unlearning in text-guided diffusion models. CoreUnlearn incorporates the Component Extraction Module (CEM) for component decomposition and the Swap Disentangling Strategy (SDS) for precise identification of the erasure-critical component. By removing the erasure-critical component while preserving others through fine-tuning diffusion model weights, CoreUnlearn effectively balances erasing effectiveness and model utility preservation, as validated by comprehensive experiments. 9
References [1] P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019. [2] Manuel Brack, Felix Friedrich, Dominik Hintersdorf, Lukas Struppek, Patrick Schramowski, and Kristian Kersting. Sega: Instructing text-to-image models using semantic guidance. Advances in Neural Information Processing Systems, 36:25365–25389, 2023. [3] Anh Bui, Long Vuong, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. Erasing undesirable concepts in diffusion models with adversarial preservation. arXiv preprint arXiv:2410.15618, 2024. [4] Ruchika Chavhan, Da Li, and Timothy Hospedales. Conceptprune: Concept editing in diffusion models via skilled neuron pruning. arXiv preprint arXiv:2405.19237, 2024. [5] Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin-Yu Chen, and Wei-Chen Chiu. Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.06135, 2023. [6] Riccardo Corvi, Davide Cozzolino, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. Intriguing properties of synthetic images: from generative adversarial networks to diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 973–982, 2023. [7] Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah. Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(9):10850–10869, 2023. [8] Yuanting Fan, Chengxu Liu, Nengzhong Yin, Changlong Gao, and Xueming Qian. Adadiffsr: Adaptive region-aware dynamic acceleration diffusion model for real-world image superresolution. In European Conference on Computer Vision, pages 396–413. Springer, 2025. [9] Masane Fuchi and Tomohiro Takagi. Erasing concepts from text-to-image diffusion models with few-shot unlearning. arXiv preprint arXiv:2405.07288, 2024. [10] Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2426–2436, 2023. [11] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyńska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 5111–5120, 2024. [12] Hongcheng Gao, Tianyu Pang, Chao Du, Taihang Hu, Zhijie Deng, and Min Lin. Metaunlearning on diffusion models: Preventing relearning unlearned concepts. arXiv preprint arXiv:2410.12777, 2024. [13] Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference on Computer Vision, pages 73–88. Springer, 2024. [14] Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Reliable and efficient concept erasure of text-to-image diffusion models. In European Conference on Computer Vision, pages 73–88. Springer, 2025. [15] Tingxu Han, Weisong Sun, Yanrong Hu, Chunrong Fang, Yonglong Zhang, Shiqing Ma, Tao Zheng, Zhenyu Chen, and Zhenting Wang. Continuous concepts removal in text-to-image diffusion models. arXiv preprint arXiv:2412.00580, 2024. [16] Shaozhe Hao, Kai Han, Zhengyao Lv, Shihao Zhao, and Kwan-Yee K Wong. Conceptexpress: Harnessing diffusion models for single-image unsupervised concept extraction. In European Conference on Computer Vision, pages 215–233. Springer, 2025. [17] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. [18] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Adv. Neural Inform. Process. Syst., 30, 2017. 10
[19] Seunghoo Hong, Juhun Lee, and Simon S Woo. All but one: Surgical concept erasing with model preservation in text-to-image diffusion models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21143–21151, 2024. [20] Jeremy Howard and Sylvain Gugger. Fastai: A layered api for deep learning. Information, 11(2):108, 2020. [21] Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung-Hsuan Lai, and Yu-Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. arXiv preprint arXiv:2311.17717, 2023. [22] Anubhav Jain, Yuya Kobayashi, Takashi Shibuya, Yuhta Takida, Nasir Memon, Julian Togelius, and Yuki Mitsufuji. Trasce: Trajectory steering for concept erasure. arXiv preprint arXiv:2412.07658, 2024. [23] Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Robust adversarial concept erasure for secure text-to-image diffusion model. In European Conference on Computer Vision, pages 461–478. Springer, 2025. [24] Sanghyun Kim, Seohyeon Jung, Balhae Kim, Moonseok Choi, Jinwoo Shin, and Juho Lee. Towards safe self-distillation of internet-scale text-to-image diffusion models. arXiv preprint arXiv:2307.05977, 2023. [25] Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691–22702, 2023. [26] Kecen Li, Chen Gong, Zhixiang Li, Yuzhong Zhao, Xinwen Hou, and Tianhao Wang. {PrivImage}: Differentially private synthetic image generation using diffusion models with {Semantic-Aware} pretraining. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4837–4854, 2024. [27] Xiuyu Li, Yijiang Liu, Long Lian, Huanrui Yang, Zhen Dong, Daniel Kang, Shanghang Zhang, and Kurt Keutzer. Q-diffusion: Quantizing diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 17535–17545, 2023. [28] Haipeng Liu, Yang Wang, Biao Qian, Meng Wang, and Yong Rui. Structure matters: Tackling the semantic discrepancy in diffusion models for image inpainting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8038–8047, 2024. [29] Yufan Liu, Jinyang An, Wanqian Zhang, Ming Li, Dayan Wu, Jingzi Gu, Zheng Lin, and Weiping Wang. Realera: Semantic-level concept erasure via neighbor-concept mining. arXiv preprint arXiv:2410.09140, 2024. [30] Zhili Liu, Kai Chen, Yifan Zhang, Jianhua Han, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, and James Kwok. Geom-erasing: Geometry-driven removal of implicit concept in diffusion models. arXiv preprint arXiv:2310.05873, 2023. [31] Zhili Liu, Kai Chen, Yifan Zhang, Jianhua Han, Lanqing Hong, Hang Xu, Zhenguo Li, DitYan Yeung, and James T Kwok. Implicit concept removal of diffusion models. In European Conference on Computer Vision, pages 457–473. Springer, 2025. [32] Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6430–6440, 2024. [33] Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts, diffusion models and erasing applications. arXiv preprint arXiv:2312.16145, 2023. [34] Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7559–7568, 2024. [35] Xinyin Ma, Gongfan Fang, and Xinchao Wang. Deepcache: Accelerating diffusion models for free. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15762–15772, 2024. 11
[36] Umakanta Maharana, Aakash Sen Sharma, Yash Sinha, Ankur Mali, Mohan Kankanhalli, and Murari Mandal. Towards robust concept erasure in diffusion models: Unlearning identity, nudity and artistic styles. [37] Chenlin Meng, Robin Rombach, Ruiqi Gao, Diederik Kingma, Stefano Ermon, Jonathan Ho, and Tim Salimans. On distillation of guided diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14297–14306, 2023. [38] Saemi Moon, Minjong Lee, Sangdon Park, and Dongwoo Kim. Holistic unlearning benchmark: A multi-faceted evaluation for text-to-image diffusion model unlearning. arXiv preprint arXiv:2410.05664, 2024. [39] Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text-to-image models. arXiv preprint arXiv:2407.21035, 2024. [40] Minh Pham, Kelly O Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure methods for text-to-image generative models. In The Twelfth International Conference on Learning Representations, 2023. [41] Minh Pham, Kelly O Marshall, Chinmay Hegde, and Niv Cohen. Robust concept erasure using task vectors. arXiv preprint arXiv:2404.03631, 2024. [42] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. [43] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500–22510, 2023. [44] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural information processing systems, 35:36479–36494, 2022. [45] Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. [46] Juwon Seo, Sung-Hoon Lee, Tae-Young Lee, Seungjun Moon, and Gyeong-Moon Park. Generative unlearning for any identity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9151–9161, 2024. [47] Aakash Sen Sharma, Niladri Sarkar, Vikram Chundawat, Ankur A Mali, and Murari Mandal. Unlearning or concealment? a critical analysis and evaluation metrics for unlearning in diffusion models. arXiv preprint arXiv:2409.05668, 2024. [48] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6048–6058, 2023. [49] Deepak Sridhar and Nuno Vasconcelos. Prompt sliders for fine-grained control, editing and erasing of concepts in diffusion models. arXiv preprint arXiv:2409.16535, 2024. [50] Wenhao Sun, Benlei Cui, Jingqun Tang, and Xue-Mei Dong. Attentive eraser: Unleashing diffusion model’s object removal potential via self-attention redirection guidance. arXiv preprint arXiv:2412.12974, 2024. [51] Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia-You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint arXiv:2310.10012, 2023. [52] Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Wenbo Zhu, Heng Chang, Xiao Zhou, and Xu Yang. Unlearning concepts in diffusion model via concept domain correction and concept preserving gradient. arXiv preprint arXiv:2405.15304, 2024. 12
[53] Ximing Xing, Haitao Zhou, Chuang Wang, Jing Zhang, Dong Xu, and Qian Yu. Svgdreamer: Text guided svg generation with diffusion model. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4546–4555, 2024. [54] Zhen Xing, Qijun Feng, Haoran Chen, Qi Dai, Han Hu, Hang Xu, Zuxuan Wu, and Yu-Gang Jiang. A survey on video diffusion models. ACM Computing Surveys, 57(2):1–42, 2024. [55] Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. Diffusion models: A comprehensive survey of methods and applications. ACM Computing Surveys, 56(4):1–39, 2023. [56] Mingzhao Yang, Bin Li, and Xiangyang Xue. Federated unlearning with diffusion models. [57] Tianyun Yang, Juan Cao, and Chang Xu. Pruning for robust concept erasing in diffusion models. arXiv preprint arXiv:2405.16534, 2024. [58] Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mmadiffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024. [59] Zongsheng Yue, Jianyi Wang, and Chen Change Loy. Resshift: Efficient diffusion model for image super-resolution by residual shifting. Advances in Neural Information Processing Systems, 36, 2024. [60] Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-menot: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1755–1764, 2024. [61] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836–3847, 2023. [62] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018. [63] Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in Neural Information Processing Systems, 37:36748–36776, 2024. [64] Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision, pages 385–403. Springer, 2024. [65] Zhanjie Zhang, Quanwei Zhang, Wei Xing, Guangyuan Li, Lei Zhao, Jiakai Sun, Zehua Lan, Junsheng Luan, Yiling Huang, and Huaizhong Lin. Artbank: Artistic style transfer with pretrained diffusion model and implicit style prompt bank. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 7396–7404, 2024. [66] Mengnan Zhao, Lihe Zhang, Xingyi Yang, Tianhang Zheng, and Baocai Yin. Advanchor: Enhancing diffusion model unlearning with adversarial anchors. arXiv preprint arXiv:2501.00054, 2024. [67] Mengnan Zhao, Lihe Zhang, Tianhang Zheng, Yuqiu Kong, and Baocai Yin. Separable multiconcept erasure from diffusion models. arXiv preprint arXiv:2402.05947, 2024. [68] Jianing Zhu, Bo Han, Jiangchao Yao, Jianliang Xu, Gang Niu, and Masashi Sugiyama. Decoupling the class label and the target concept in machine unlearning. arXiv preprint arXiv:2406.08288, 2024. [69] Peifei Zhu, Tsubasa Takahashi, and Hirokatsu Kataoka. Watermark-embedded adversarial examples for copyright protection against diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24420–24430, 2024.
13