Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Roots Beneath the Cut: Uncovering the Risk of Concept Revival in Pruning-Based Unlearning for Diffusion Models

Ci Zhang, Zhaojun Ding, Chence Yang, Jun Liu, Xiaoming Zhai, Shaoyi Huang, Beiwen Li, Xiaolong Ma, Jin Lu, Geng Yuan

TL;DR

It is found that the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals that leak critical information about the erased concepts, confirming that pruning-based unlearning is not inherently secure.

Abstract

Pruning-based unlearning has recently emerged as a fast, training-free, and data-independent approach to remove undesired concepts from diffusion models. It promises high efficiency and robustness, offering an attractive alternative to traditional fine-tuning or editing-based unlearning. However, in this paper we uncover a hidden danger behind this promising paradigm. We find that the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals that leak critical information about the erased concepts. To verify this vulnerability, we design a novel attack framework capable of reviving erased concepts from pruned diffusion models in a fully data-free and training-free manner. Our experiments confirm that pruning-based unlearning is not inherently secure, as erased concepts can be effectively revived without any additional data or retraining. Extensive experiments on diffusion-based unlearning based on concept related weights lead to the conclusion: once the critical concept-related weights in diffusion models are identified, our method can effectively recover the original concept regardless of how the weights are manipulated. Finally, we explore potential defense strategies and advocate safer pruning mechanisms that conceal pruning locations while preserving unlearning effectiveness, providing practical insights for designing more secure pruning-based unlearning frameworks.

Roots Beneath the Cut: Uncovering the Risk of Concept Revival in Pruning-Based Unlearning for Diffusion Models

TL;DR

It is found that the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals that leak critical information about the erased concepts, confirming that pruning-based unlearning is not inherently secure.

Abstract

Pruning-based unlearning has recently emerged as a fast, training-free, and data-independent approach to remove undesired concepts from diffusion models. It promises high efficiency and robustness, offering an attractive alternative to traditional fine-tuning or editing-based unlearning. However, in this paper we uncover a hidden danger behind this promising paradigm. We find that the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals that leak critical information about the erased concepts. To verify this vulnerability, we design a novel attack framework capable of reviving erased concepts from pruned diffusion models in a fully data-free and training-free manner. Our experiments confirm that pruning-based unlearning is not inherently secure, as erased concepts can be effectively revived without any additional data or retraining. Extensive experiments on diffusion-based unlearning based on concept related weights lead to the conclusion: once the critical concept-related weights in diffusion models are identified, our method can effectively recover the original concept regardless of how the weights are manipulated. Finally, we explore potential defense strategies and advocate safer pruning mechanisms that conceal pruning locations while preserving unlearning effectiveness, providing practical insights for designing more secure pruning-based unlearning frameworks.
Paper Structure (17 sections, 7 equations, 12 figures, 12 tables)

This paper contains 17 sections, 7 equations, 12 figures, 12 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Motivations and Preliminaries
  4. Methodology
  5. Low-rank Matrix Completion
  6. Top-K Sign Retention
  7. Neuron-Max Scaling
  8. Gaussian Obfuscation Defense for Pruning-Based Unlearning
  9. Experiments
  10. Experiment settings
  11. Revive Erased Object
  12. Revive Erased Art Style
  13. Revive Explicit Content
  14. Defense Evaluation via Gaussian Obfuscation
  15. Ablation Study
  16. ...and 2 more sections

Figures (12)

  • Figure 1: Inherent risk of pruning-based machine unlearning.
  • Figure 2: Restored accuracy on erased concept class.
  • Figure 3: Overview of sparsity driven unlearning and our proposed revival framework.
  • Figure 4: Visual results of revived art styles.
  • Figure 5: Visual results for twelve erased object classes. We compare the pretrained Stable Diffusion model, the unlearned model by ConceptPrune chavhan2024conceptprune, and four revival methods. Our NMS restores high-fidelity object appearances and preserves scene coherence, outperforming Quant Recover zhang2024catastrophic, Neuron Average, and Neuron Sample.
  • ...and 7 more figures