GRACE is a new framework for concept erasure in text-to-image diffusion models that uses a semantically weighted sensitive subspace to guide localized interventions and lightweight subspace-constrained adapters to avoid global semantic disruption. It replaces manual counterfactual prompts with an automatically decoupled safe-anchor mechanism and controls intervention strength through an energy-driven dynamic gating system. Experiments show GRACE improves NSFW reduction by 17.86% over five state-of-the-art methods while also reducing target CLIP Score and FID, indicating stronger concept suppression with better preservation of generative quality.
By Qinghui Gong, Yihuai Liang, Yuanlun Xie, Deepak Kumar Jain, Vitomir \v{S}truc, Zhengchun Zhou
arXiv:2511. 05865v3 Announce Type: replace-cross Abstract: Recent advancements in large-scale generative models have enabled the creation of high-quality images and videos, but have also raised significant safety concerns regarding the generation of unsafe content.
By Viet Nguyen, Vishal M. Patel
arXiv:2609.37537v1 Announce Type: new
Abstract: Machine unlearning has emerged as a critical post-hoc safety measure to erase sensitive concepts from Text-to-Image (T2I) models without prohibitive re...
By Arian Komaei Koma, Seyed Amir Kasaei, Aida Aryafar, Matin Ghiasi, Ali Aghayari, Amirhossein Souri, Mohammad Mosayyebi, AmirMahdi Sadeghzadeh, Mohammad Hossein Rohban
Text-to-image diffusion models have achieved high visual fidelity and broad adoption, but remain vulnerable to safety violations when adversaries exploit them to synthesize illicit content. Existing alignment paradigms, from input sanitization to structural feature pruning, are largely organized around unsafe concepts explicitly exposed during filtering, editing, or localization.
arXiv:2609.01433v1 Announce Type: new
Abstract: Concept erasure aims to suppress unsafe, privacy-sensitive, or undesirable generations in text-to-image diffusion models while preserving benign semant...
By Qinghui Gong, Xunlei Chen, Yu-Xuan Zhang, Hua Meng, Zhengchun Zhou
DiSCO is a zero‑shot, black‑box defense for text‑to‑image models that operates solely at the prompt level. It expands prompts with a distribution‑guided suffix using beam search and contrastive scoring against safe and unsafe image pools generated by the target model, iteratively refining until safe content is produced. The method improves safety on the I2P benchmark under various red‑teaming attacks, reducing attack success rates by 37.7% and 25.13% while preserving semantic fidelity and image coherence.
By Tong Zhang, Motasem Alfarra, Carlos Hinojosa, Christos Louizos, Bernard Ghanem
arXiv:2412.07658v3 Announce Type: replace-cross
Abstract: Text-to-image diffusion models have rapidly transitioned from research prototypes to widely deployed tools. Along with their impressive capab...
By Anubhav Jain, Takashi Shibuya, Yuya Kobayashi, Yuhta Takida, Nasir Memon, Julian Togelius, Yuki Mitsufuji
arXiv:2607. 23492v1 Announce Type: cross Abstract: Concept erasure techniques (CETs) edit text-to-image diffusion models to erase undesired targets such as NSFW content or copyrighted styles, while preserving model utility on benign concepts.
By Shaswati Saha, Rajasekhar Anguluri, Manas Gaur
The paper introduces Adversarial Scenario Attack (ASA), a query‑based black‑box method that discovers natural transformation vulnerabilities in vision models by exploring background, weather, and material/color edits via a multimodal language model and a text‑guided generative editor. ASA outperforms previous query‑based generative attacks on ImageNet classifiers, achieving higher success rates with fewer queries while maintaining perceptual quality. The approach also shows image‑level and prompt‑level transferability, indicating reusable vulnerabilities across models and images.
By Dongsu Song, DaeYun GO, Jay Hoon Jung
The paper investigates how diffusion models, even after fine‑tuning to unlearn harmful concepts, still retain a linear residual of those concepts in token embeddings. It introduces SubAttack, a jailbreak method that extracts this residual by learning orthogonal attack tokens composed of interpretable textual elements, and SubDefense, a plug‑and‑play defense that projects out the same subspace to suppress the residual. Experiments show SubAttack outperforms prior attacks in power and transferability, while SubDefense offers stronger robustness and better preservation of safe generation quality.
By Siyi Chen, Yimeng Zhang, Sijia Liu, Qing Qu
arXiv:2506. 03933v2 Announce Type: replace-cross Abstract: Vision Language Models (VLMs) have shown remarkable capabilities in multimodal understanding, yet their susceptibility to adversarial perturbations poses a significant threat to their reliability in real-world applications.
By Jia Fu, Yongtao Wu, Yihang Chen, Kunyu Peng, Xiao Zhang, Volkan Cevher, Sepideh Pashami, Anders Holst
arXiv:2608. 03284v1 Announce Type: cross Abstract: Ensuring safety and policy compliance in text-to-image diffusion models remains a critical challenge, as benign or adversarial prompts can often elicit prohibited content, e.
By Jinya Sakurai, Shueicheng Yan, Xun Xu