Certifying Concept Unlearning in Text-to-Image Diffusion Models

1 Introduction

• The certificate bounds residual leakage over a continuous concept neighborhood, rather than only over a finite set of searched prompts.It combines adversarial steering with calibrated text- and pixel-space verification into a high-confidence upper bound.Source: §1 · p. 1
• Finite-prompt ASR is not a reliable upper bound on residual leakage, so a low score cannot rule out successful attacks.The framework targets leakage across the broader prompt space rather than the particular prompts an adversarial search tried.Source: §1 · pp. 1–2
• The framework is evaluated across NSFW content, artistic styles, and celebrity identities, six unlearning methods, and two T2I diffusion models.The authors also report ablations intended to establish certificate robustness.Source: §1 · p. 2

2 Related Work

• Unlearning methods suppress concepts through gradient-based fine-tuning, closed-form weight or attention edits, adversarial training, or interpretability-guided feature suppression.The evaluated concept categories include NSFW and violent content, artistic styles, and celebrity identities.Source: §2 · p. 2
• Static black-box attacks use surrogates, while adaptive white-box attacks optimize prompts against the deployed model with gradient access.Examples include Ring-A-Bell and MMA-Diffusion for static attacks, and P4D and UnlearnDiffAtk for adaptive attacks.Source: §2 · p. 2
• Existing evaluations report ASR as the fraction of a finite adversarial prompt set that succeeds, providing no guarantee beyond that set.The literature distinguishes attacks by whether the adversary can query or access gradients of the target model.Source: §2 · p. 2
• Prior certificates address classifier robustness, LLM safety-filter errors, or statistical distance after machine unlearning, not T2I concept elicitation at inference.The paper identifies no prior certificate instantiated for T2I generation under the static and adaptive prompting threat models used in concept-unlearning evaluations.Source: §2 · p. 2

T2I Diffusion Models

• A latent diffusion model generates images by learning to invert a fixed forward noising process.A conditional denoiser predicts added Gaussian noise, and inference iteratively denoises a sampled latent using the prompt embedding.Source: T2I Diffusion Models · p. 2

Unlearning Concepts in T2I Diffusion Models

• Concept unlearning edits a pretrained model’s parameters so it no longer generates a target concept, without retraining on the full training distribution.Because edits are approximate and limited to parts of the model or representations, behavior near concept-associated prompts is difficult to characterize analytically.Source: Unlearning Concepts in T2I Diffusion… · pp. 2–3

ASR: Unlearning Robustness Quantification

• ASR measures the fraction of a finite set of adversarial prompts whose generated outputs a detector identifies as containing the target concept.The prompts may come from a static adversary without access to the edited model or an adaptive adversary with full gradient access; lower ASR indicates stronger empirical robustness.Source: ASR: Unlearning Robustness… · p. 3

4 Exposing the Limitations of ASR

• ESD ASR rose from 0% at N = 102 to 8% at N = 104, UCE from 0% to 65%, and TraSCE from 0% to 60%; none had saturated by N = 104.The bands reached 20% for ESD and 80% for both UCE and TraSCE; seed-to-seed spread widened as the budget increased.Source: §4 · p. 3
• The budget-dependent ASR pattern spans gradient-based ESD, closed-form UCE, and training-free TraSCE, rather than a single unlearning technique.The evaluation used three SD-Turbo models unlearned for the NSFW sexual concept and three adversarial prompting methods.Source: §4 · p. 3
• Finite-budget ASR does not stabilize over the examined query range, and the observed curves do not reveal how much higher leakage might rise beyond practical search budgets.Reporting ASR at one budget therefore cannot establish leakage beyond that search horizon.Source: §4 · p. 3

5 Problem Formulation

• The target is the end-to-end probability that a bounded perturbation of the concept embedding causes the supposedly unlearned concept to re-emerge in generated output.Perturbations move from the reference concept embedding along concept-relevant directions within a specified budget.Source: §5 · p. 3
• Exact certification would require exhaustive evaluation over continuous perturbations and stochastic sampler noise, plus a perfect concept oracle.The paper therefore relaxes the problem to statistical certification from samples.Source: §5 · p. 4
• Approximate certification seeks an empirical upper bound from N samples, subject to a user-specified confidence level and allowable error margin.The exact problem instead asks for a deterministic upper bound on the true failure probability.Source: §5 · p. 4

Pipeline Overview and Components

• The three pipeline components are a text-embedding steering unit, an embedding classifier, and a pixel classifier for generated images.Together they track the target concept from adversarial search through image generation to observable output.Source: Pipeline Overview and Components · p. 4

Pipeline in Action

• The pipeline steers embeddings within the concept-bearing region, verifies concept presence in text space, then checks whether the generated image exhibits the concept.Only successfully steered embeddings, paired with random noise, are passed to the U-Net; sampling variance and imperfect classifier generalization are also accounted for.Source: Pipeline in Action · p. 4

Theoretical Guarantees

• The certificate combines finite-sample statistical margins with worst-case classifier-error bounds to provide an absolute upper bound rather than only empirical failure rates.The framework explicitly accounts for sampling variance and the generalization errors of both proxy classifiers.Source: Pipeline in Action · p. 4, Theoretical Guarantees · p. 6
• Theorem 1 bounds total leakage using the empirical prompt-failure and image-leakage rates, with error margins and confidence budgets covering the component estimates.The total error allowance and failure probability are partitioned across prompt steering, U-Net leakage, and both classifiers; the sample sizes must satisfy the one-sided bounds.Source: Theoretical Guarantees · p. 5
• With 99% confidence, the unedited SDXL-Turbo baseline’s true violence-generation probability under adversarial prompting in the probe-identified concept subspace is at most 73.7%.This is a baseline example before any unlearning method is applied; the paper describes the bound as loose, as expected.Source: Theoretical Guarantees · pp. 5–6

Models and Datasets

• SD-Turbo and SDXL-Turbo were evaluated on 10 styles, three NSFW categories, and 10 celebrity identities, with 2,400 training and 600 validation prompts per concept.The models use single- and dual-text-encoder designs, respectively.Source: Models and Datasets · p. 6

Certification Pipeline Components

• Per-concept logistic-regression probes define steering directions, while text- and image-embedding classifiers assess expanded trials under a 99% target confidence.The pipeline uses approximately 138,156 text-side and 12,270 image-generation samples per concept.Source: Certification Pipeline Components · p. 6

Unlearning Techniques

• The six evaluated techniques span gradient-based fine-tuning, closed-form edits, parameter-importance dampening, and structured feature decoupling.The methods are CA, ESD, MACE, SSD, UCE, and CoGFD.Source: Unlearning Techniques · p. 6

Adversarial Baselines

• Baselines include static Ring-A-Bell and adaptive MMA-Diffusion and P4D; P4D was evaluated only on SD-Turbo because its single-encoder path is incompatible with SDXL-Turbo.MMA-Diffusion and P4D use adaptive access to the target model, whereas Ring-A-Bell does not query it.Source: Adversarial Baselines · pp. 6–7

Comparison against robustness metrics

• Across the 36 (unlearning method, category) cases, the certified bound exceeded every reported baseline in 32 cases (88.89%) across both SD-Turbo and SDXL-Turbo models, showing the incomplete nature of existing robustness metrics to capture unlearning capabilities.Source: Comparison against robustness metrics · p. 7
• The two largest Celebrity gaps were SSD on SD-Turbo (0.652 vs. 0.074–0.133) and ESD on SDXL-Turbo (0.542 vs. 0.023–0.108); UCE’s NSFW gap was 0.009.Adaptive attacks generally captured more corner cases than static attacks, and the probe direction could miss semantically incoherent outliers.Source: Comparison against robustness metrics · p. 7

Runtime analysis

• Computing a certification bound took less time than robustness checks by adaptive adversaries.Table 2 compares attack-method runtimes on one A100 80 GB GPU.Source: Table 2 · p. 7, Runtime analysis · p. 7

• Existing robustness metrics are unreliable proxies for residual risk because the attack surface rises monotonically with the budget.Source: §8 · p. 7
• The proposed framework estimates a comprehensive attack surface and provides certified bounds for leakage.Source: §8 · p. 7
• Empirical metrics can substantially understate residual risk, so certification is a necessary complement, not an alternative, to attack-based auditing.Source: §8 · p. 7

• The appendix covers artistic styles, NSFW categories, and celebrity identities, with a shared neutral control set for probe training.Source: §A.1 · p. 9
• Ten styles were selected from UnlearnCanvas and diversified from templated prompts, yielding 2,400 training and 600 validation prompts per style.Source: §A.1 · p. 9
• Celebrity prompts were diversified for selected CelebA identities; each identity received 2,400 training and 600 validation prompts.The control prompts were selected to be neutral, safe, and exclusive of target prompts.Source: §A.1 · p. 9
• Figure 3 shows the frequency of CoProV2 prompts available for each harmful category.Source: Figure 3 · p. 9

A.2: Perturbation and dataset expansion for certification pipeline

• With only 600 validation prompts per concept, perturbation expands each base prompt into many trials within its own concept-relevant embedding neighborhood.In the implementation, each neighborhood is formed by steering along a single probe direction.Source: §A.2 · p. 9
• Fresh steering distances and sampler noise produce independent trials, allowing Hoeffding-based bounds to apply without requiring distinct base prompts.Source: §A.2 · pp. 9–10

A.3: Out of distribution prompt examples

• Some bounds were exceeded by adversarial prompts that authors describe as semantically incoherent and unrealistic in real scenarios.The appendix gives a P4D example for an unlearned Ukiyoe style and refers to further examples in Table 3.Source: §A.3 · p. 10

B.1: Hyper-parameters

• Classifier and adversarial-baseline settings are specified for reproducibility, including fixed attack budgets and method-specific optimization parameters.The baselines generate up to 500 prompts per concept; Ring-A-Bell uses a genetic algorithm, MMA-Diffusion uses GCG, and P4D follows its default settings.Source: §B.1 · p. 10

B.2: Compute Resources

• All certification and attack evaluations ran on one NVIDIA A100 80GB GPU; reported timings cover unlearning, certification, and classifier training.Unlearning time is averaged separately over SD-Turbo and SDXL-Turbo training runs; certification and classifier training times are reported in Tables 2 and 5.Source: §B.2 · p. 10

C Ablations to justify design choices

• Ablations compare classifier and steering-unit architectures to select designs described as efficient and feasible.The classifier comparison evaluates logistic regression, cosine similarity, and RBF-SVM; the steering comparison considers two techniques.Source: C Ablations to justify design choices · p. 10

C.1: Classifier Architecture

• Logistic regression has the best test-time accuracy among the compared classifiers, without the over- or under-fitting reported for RBF-SVM and cosine similarity.The comparisons cover both Cclf1 and Cclf2; Table 6 reports classifier accuracy across models.Source: §C.1 · p. 10, Table 6 · p. 11

Linear Probe:

• The steering unit searches near the target concept; a normalized logistic-regression weight defines the Linear Probe direction, whose scale changes output configuration.The reported comparison says Linear Probe identifies a cleaner clock direction than SAE steering.Source: §C.2 · p. 10, Linear Probe · p. 12, Figure 4 · p. 13

Sparse Auto-encoder(SAEs):

• The SAE is trained on non-padding SDXL Turbo token embeddings, treating each token as a separate 2048-dimensional sample.It retains 32 of 16,384 dictionary atoms and trains on 3.85 million Conceptual Captions tokens.Source: Sparse Auto-encoder(SAEs) · pp. 10–11
• The adversarial prompts shown in Table 3 do not reference their target concepts in a semantically meaningful way.The paper characterizes these prompts as unrealistic for real scenarios against which the techniques aim to provide protection.Source: Table 3 · p. 11
• SAE reconstruction error reached 0.00006, yet generated images remained distorted at 0.95 prompt cosine, prompting a shift to Linear Probe.The clock example reports that gradual SAE steering removed the concept, but reconstruction without steering was already distorted.Source: Sparse Auto-encoder(SAEs) · p. 11

Ethics Statement

• The authors state that generated NSFW or violent images were used internally and not released, and celebrity tests used public CelebA identities already studied in prior benchmarks.They describe releasing the certification pipeline for auditing, not evasion.Source: Ethics Statement · p. 12