{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/probing-unlearned-diffusion-models-a","title":"Probing Unlearned Diffusion Models: A Transferable Adversarial Attack Perspective","arxiv_id":"2404.19382","date":"2024-04-30","proceeding":null,"authors":["Xiaoxuan Han","Songlin Yang","Wei Wang","Yang Li","Jing Dong"],"abstract":"Advanced text-to-image diffusion models raise safety concerns regarding identity privacy violation, copyright infringement, and Not Safe For Work content generation. Towards this, unlearning methods have been developed to erase these involved concepts from diffusion models. However, these unlearning methods only shift the text-to-image mapping and preserve the visual content within the generative space of diffusion models, leaving a fatal flaw for restoring these erased concepts. This erasure trustworthiness problem needs probe, but previous methods are sub-optimal from two perspectives: (1) Lack of transferability: Some methods operate within a white-box setting, requiring access to the unlearned model. And the learned adversarial input often fails to transfer to other unlearned models for concept restoration; (2) Limited attack: The prompt-level methods struggle to restore narrow concepts from unlearned models, such as celebrity identity. Therefore, this paper aims to leverage the transferability of the adversarial attack to probe the unlearning robustness under a black-box setting. This challenging scenario assumes that the unlearning method is unknown and the unlearned model is inaccessible for optimization, requiring the attack to be capable of transferring across different unlearned models. Specifically, we employ an adversarial search strategy to search for the adversarial embedding which can transfer across different unlearned models. This strategy adopts the original Stable Diffusion model as a surrogate model to iteratively erase and search for embeddings, enabling it to find the embedding that can restore the target concept for different unlearning methods. Extensive experiments demonstrate the transferability of the searched adversarial embedding across several state-of-the-art unlearning methods and its effectiveness for different levels of concepts.","url_abs":"https://arxiv.org/abs/2404.19382v1","url_pdf":"https://arxiv.org/pdf/2404.19382v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"probing-unlearned-diffusion-models-a","repo_url":"https://github.com/hxxdtd/pund","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2404.19382","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2404.19382"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/hxxdtd/pund","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":2,"unverified":3},"by_repo_kind":{"official":{"samples":5,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d4261419af604243","entry":"get_dataset","repo":"hxxdtd/pund","repo_kind":"official","path":"src/attackers/utils/datasets.py","file_url":"https://github.com/hxxdtd/pund/blob/HEAD/src/attackers/utils/datasets.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d4261419af604243"}},{"code_sha256_prefix":"5bd0fa0e7a1dfa96","entry":"get_transform","repo":"hxxdtd/pund","repo_kind":"official","path":"src/attackers/utils/datasets.py","file_url":"https://github.com/hxxdtd/pund/blob/HEAD/src/attackers/utils/datasets.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5bd0fa0e7a1dfa96"}},{"code_sha256_prefix":"dfb052a0af48540f","entry":"renew_resnet_paths","repo":"hxxdtd/pund","repo_kind":"official","path":"stable-diffusion/train-scripts/convertModels.py","file_url":"https://github.com/hxxdtd/pund/blob/HEAD/stable-diffusion/train-scripts/convertModels.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dfb052a0af48540f"}},{"code_sha256_prefix":"c5ec9c13e456a046","entry":"renew_vae_resnet_paths","repo":"hxxdtd/pund","repo_kind":"official","path":"stable-diffusion/train-scripts/convertModels.py","file_url":"https://github.com/hxxdtd/pund/blob/HEAD/stable-diffusion/train-scripts/convertModels.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c5ec9c13e456a046"}},{"code_sha256_prefix":"cea0bc82e0c96896","entry":"shave_segments","repo":"hxxdtd/pund","repo_kind":"official","path":"stable-diffusion/train-scripts/convertModels.py","file_url":"https://github.com/hxxdtd/pund/blob/HEAD/stable-diffusion/train-scripts/convertModels.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cea0bc82e0c96896"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}