1 Introduction↩︎

The ability to remove the influence of some training samples from a learned model, often referred to as machine unlearning [2], has become increasingly important. Regulatory frameworks such as the “right to be forgotten” in the General Data Protection Regulation (GDPR) by the European Union and growing concerns about sensitive or proprietary data have created demand for methods that allow models to forget without costly retraining from scratch. Recently, with the development of diffusion models [3], unlearning the unsafe concept or memorization has been actively explored through finetuning [4], output filtering [5], and training-free sampling [6], [7].

In machine unlearning with generative models, two major objectives exist: (a) concept or class unlearning, which refers to preventing the generation of a particular concept or class in samples [8], and (b) data unlearning, which focuses on removing individual samples rather than concepts. As noted by [1], data unlearning is less studied than concept unlearning. Furthermore, removing a single individual while preserving the generation of similar outputs is more challenging than deleting the entire mode of similar examples. Finetuning-based unlearning methods, such as gradient ascent [1] or negative preference optimization [4], rely on loss maximization objectives. The generated images often become noisier and aesthetically degraded, while forgetting might not be complete nor precise, as shown in Figure 1.

To mitigate the drawbacks of the data unlearning in diffusion models, we analyze the dynamics of data unlearning. We argue that forgetting does not occur uniformly, but rather unevenly across time and spectral domains. Diffusion models learn phase-dependent behaviour during training [9]: later diffusion time steps close to Gaussian noise capture coarse semantics, while earlier time steps close to the data refine fine-grained details. However, previous unlearning methods treat all diffusion time steps equally, potentially leading to the inadvertent forgetting of unintended details, as illustrated in Figure 2. Furthermore, we investigate the spectral domain to selectively remove unwanted high-frequency components in the forget set. Overall, our framework effectively implements forgetting and preserves sample quality by focusing on selective components in both the time and frequency domains. We summarize our contributions below:

• We provide a systematic study of data unlearning in diffusion models in time and spectral space, considering both conditional and unconditional scenarios.

• Our time- and frequency-selective unlearning approach is simple, compatible with existing unlearning objectives, and performs effective unlearning across various settings.

• We devise an improved metric, SSCD\(^{\text{norm}}\). Unlike the original SSCD [10], which only measures dissimilarity, SSCD\(^{\text{norm}}\) standardizes perturbation distance for measuring quality.

2 Background↩︎

2.1 Diffusion Models↩︎

Diffusion models [3] aim to generate samples from an unknown data distribution by considering forward (diffusion) and reverse (denoising) processes. The forward process gradually injects noise into samples \({\mathbf{x}}_0\) drawn from the data distribution \(p_0\), forwarding them into a fixed standard Gaussian distribution \(p_T = \mathcal{N}(\boldsymbol{0},\boldsymbol{I})\). The corresponding forward stochastic differential equation (SDE) is: \[d{\mathbf{x}}_t = f({\mathbf{x}}_t,t)dt + g(t)d{\mathbf{w}}_t,\] where \(f:\mathbb{R}^d \times [0,T] \rightarrow \mathbb{R}^d\) represents the drift function, \(g:[0,T] \rightarrow \mathbb{R}\) denotes the diffusion coefficient, and \({\mathbf{w}}_t\) is the Wiener process. As diffusion models learn to reverse the above process, the reverse SDE [11] is formulated as follows: \[d{\mathbf{x}}_t = [f({\mathbf{x}}_t,t) - g(t)^2\nabla_{{\mathbf{x}}_t} \log p({\mathbf{x}}_t)]dt + g(t)d\bar{{\mathbf{w}}}_t,\] where \(p({\mathbf{x}}_t)\) refers to the probability density of \({\mathbf{x}}_t\). Diffusion models learn to match the score function \(\nabla_{{\mathbf{x}}_t} \log p({\mathbf{x}}_t)\) (parameterized by a score network \(s_\theta({\mathbf{x}}_t,t)\)) for denoising [12]. With standard DDPM forward noising process \(q({\mathbf{x}}_t|{\mathbf{x}}_0) = \mathcal{N}\left(\sqrt{\bar\alpha_t}{\mathbf{x}}_0,(1-\bar\alpha_t)\mathbf{I}\right)\), the conditional score function can be written as \(\nabla_{{\mathbf{x}}_t}\log q({\mathbf{x}}_t|{\mathbf{x}}_0)\). With a weighting factor \(w_t\), the training objective \(\mathcal{L}_\mathcal{D}(\theta)\) is \[\mathbb{E}_{{\mathbf{x}}_0\sim p_0}\mathbb{E}_{t\in[0,T]}\Bigl[ w_t\bigl\| s_\theta({\mathbf{x}}_t,t) - \nabla_{{\mathbf{x}}_t}\log q({\mathbf{x}}_t|{\mathbf{x}}_0) \bigr\|_2^2 \Bigr]. \label{eq:diffusion95loss}\tag{1}\]

2.2 Data Unlearning in Diffusion Models↩︎

2.2.0.1 Machine Unlearning.

Suppose a model \(\theta^{*}\) is already trained on a dataset \(\mathcal{D}\). Then, our goal is to delete the influence of the forget set \(\mathcal{D}_F\) from \(\theta^{*}\), while maintaining the model utility on the retain set \(\mathcal{D}_R=\mathcal{D} \setminus \mathcal{D}_F\). Specifically, our goal is to fine-tune the trained model \(\theta^{*}\) using the forget dataset \(\mathcal{D}_F\), often using the retain dataset \(\mathcal{D}_R\) to mitigate quality degradation [2].

2.2.0.2 Diffusion Unlearning.

Unlearning in diffusion models can be categorized as concept unlearning and data unlearning. Concept unlearning [13] refers to prohibiting a diffusion model from producing images categorized in a particular type of high-level concept, including not safe for work (NSFW) material (nude and violent images, for example), or copyrighted content [13]–[15].

Due to the high flexibility of diffusion models in sampling, unlike GANs [16], training-free steering methods have been actively investigated [6], [17], [18]. These methods leverage guidance techniques to repel the generation from specific points or embeddings, achieving concept erasure without finetuning.

Data unlearning, on the other hand, is closely related to individual data memorization and aims to remove specific data examples in accordance with the “Right to be Forgotten" by the aforementioned GDPR. For example, if a user requests the deletion of a particular face image used to train a diffusion model, the goal is to eliminate the influence of that image from the trained model. In contrast to concept erasing, for which various practical solutions have been developed, data unlearning remains relatively underexplored [1]. In general, the objective of diffusion unlearning \(\min_\theta \mathcal{L}_{\text{UL}}(\theta)\) is \[\begin{cases} \max_\theta \mathcal{L}_{\mathcal{D_F}}(\theta) = \min_\theta -\mathcal{L}_{\mathcal{D_F}}(\theta), & \text{\mathcal{D}_F only} \\ \min_\theta \bigl( - \mathcal{L}_{\mathcal{D_F}}(\theta)+ \mathcal{L}_{\mathcal{D_R}}(\theta) \bigr), & \text{\mathcal{D}_F and \mathcal{D}_R. } \end{cases} \label{eq:unlearn}\tag{2}\]

Gradient ascent (GA) or negative gradient on forget data samples \(\mathcal{D}_F\) is a key component for data unlearning [19]. For GA, the loss function on the forget set \(\mathcal{L}_{\text{GA}}(\theta)\) is formulated as follows: \[-\underbrace{\mathbb{E}_{ {\mathbf{x}}_0 \sim \mathcal{D}_F}\mathbb{E}_{t\in[0,T]} \Bigl[ w_t\bigl\| s_\theta( {\mathbf{x}}_t,t) - \nabla_{ {\mathbf{x}}_t}\log q( {\mathbf{x}}_t| {\mathbf{x}}_0) \bigr\|_2^2 \Bigr]}_{\text{Negative loss in Equation~(\ref{eq:diffusion95loss}) on forget set }\mathcal{D}_F}. \label{eq:ga}\tag{3}\] EraseDiff [20] replaces the true score of the forget samples with a randomly sampled noisy image. SISS [1] investigated the unlearning as a mixture distribution of forget and retain data with importance sampling. In conclusion, previous methods investigate how to formulate Equation (2 ) well.

2.3 Evaluation of Data Unlearning in Diffusion Models↩︎

We follow the evaluation of [1] based on unconditional or conditional scenarios.

Memorization on Unconditional Reconstruction. In unconditional generation, memorization is assessed by the diffusion model’s ability to reconstruct the training data. In particular, we noise a clean image \({\mathbf{x}}_0\) via the DDPM forward process to an intermediate time step \({\mathbf{x}}_t\) (e.g., \(t=250\)) where the model can easily reconstruct, and measure the similarity between the original \({\mathbf{x}}_0\) and the reconstructed \(\hat{\mathbf{x}}_0\) using model \(\theta\) from \({\mathbf{x}}_t\).

Memorization on Conditional Guidance. In conditional generation, conditioning on text or class embeddings can lead to stronger overfitting to the conditional distribution over the images given those conditions [21]. Therefore, measuring the effects of condition \(\epsilon_\theta({\mathbf{x}}_t, e_p)\) or its guidance norm \(\|\epsilon_\theta({\mathbf{x}}_t, e_p) - \epsilon_\theta({\mathbf{x}}_t, e_\emptyset)\|^2_2\) is crucial to track conditional memorization [1], [22], [23], with conditional embedding \(e_p\) and null embedding \(e_\emptyset\). Thus, unlike unconditional memorization, its evaluation starts by sampling from pure noise \(t=T=1000\) with the conditions.

3 Time and Frequency Selection for Data Unlearning in Diffusion Models↩︎

In this section, we first empirically investigate the effects of time steps and frequency on diffusion unlearning and propose a selective framework for data unlearning, followed by a theoretical analysis.

3.1 Not Every Time Step Needs to Be Forgotten↩︎

3.1.1 Motivation↩︎

Several theoretical papers analyze the dynamics of diffusion models [24]–[27]. Starting from the Gaussian noise, diffusion models learn distinct attributes across different phases. Phase I involves learning coarse features at late time steps near time \(T\). Phase II involves generating content at intermediate steps, and Phase III involves refining details toward convergence at early time steps near \(t=0\) [9]. [25] describes the diffusion dynamics in terms of these three distinct phases divided by two important transition points in time: (a) speciation time \(t_S\); and (b) collapse time \(t_C\). The denoising trajectories begin to separate by semantic class at the speciation time \(t_S\) (phase I-II), for example via embedding similarity or consistency scores. For \(t > t_S\), trajectories are nearly class-agnostic noise, whereas for \(t < t_S\), they encode semantic identity. Afterwards, trajectories converge toward individual training samples at the collapse time \(t_C\) (phase II-III), which quantifies instance-level attraction, such as nearest-neighbor consistency. For \(t < t_C\), diffusion paths are drawn to a single point and lose their generalization capability, indicating memorization. Empirically, as shown in Figure 3¹, [29] observed that the likelihood that the noisy data \({\mathbf{x}}_t\) is classified into a certain class in speciation time \(t_S\). Also, [28] observed that data converges into a stable point, indicating collapse time \(t_C\).

To investigate data unlearning in the aforementioned view, we will exploit the use of the transition points in data unlearning. We conduct a toy experiment with a shallow diffusion model on a half-moon dataset, as visualized in Figure 2. We only change the unlearning time steps while using the same data samples, with the loss function of Equation (3 ). Deleting only the early time steps (phase III) does not help forget data samples; instead, it leads to quality degradation in real samples. Unlearning the middle time steps (phase II) is most aligned with the instance-level attraction before reaching the collapse time \(t_C\). For stronger forgetting of semantic conditioning, targeting the late time steps (phase I) preceding speciation at \(t_S\) is effective.

3.1.2 Time-selective Diffusion Forgetting↩︎

Based on the previous analysis, we suggest a simple framework of selective time steps as \[\mathbb{E}_{{\mathbf{x}}_0\sim p_0} \underbrace{\mathbb{E}_{t \sim P(t)}}_{\text{Time selection}} \Bigl[ w_t \| s_\theta({\mathbf{x}}_t,t) - \nabla_{{\mathbf{x}}_t} \log q({{\mathbf{x}}_t}| {\mathbf{x}}_0) \|^{2} \Bigr]. \label{eq:ours95time}\tag{4}\] Here, \(P(t)\) is a time step weighting. In detail, we utilize the time scales that give a higher probability to a specific interval \(t_1 \leq t \leq t_2\) for the forget data samples as follows: \[P(t) = \begin{cases} {1-k}{/(t_2 - t_1)}, & t_1 \le t \le t_2, \\ {k}/({T - (t_2 - t_1))}, & \text{otherwise}, \end{cases} \label{eq:time}\tag{5}\] where \(0 \le k \le 1\) is the suppression intensity and \(t_1,t_2 \in (0,T]\) with \(t_1 < t_2\) and we use \(k=0\) for simplicity. As explained in Section 2.3, the evaluation scenarios for unconditional and conditional settings differ significantly. Therefore, we investigate appropriate time steps \(P(t)\) in Equation (5 ).

3.1.2.1 Unconditional Unlearning.

The gradient norm \(\|\nabla_\theta\mathcal{L}({\mathbf{x}};\theta)\|_2^2\) reflects the magnitude of the update required to forget a sample \({\mathbf{x}}\) [30], [31], allowing us to identify which stages are most affected by the unlearning. In Figure [fig:distribution95time95b], to compare the actual changes after standard unlearning with uniform time steps in the image-level unlearning with CelebA-HQ, we unlearn a pre-trained model with SISS. The gradient norm increases significantly after unlearning, with the gap being most pronounced in the middle time steps (Phase II). The gradient gap indicates that unlearning induces a substantial shift in the model’s parameter space during Phase II.

Furthermore, as shown in Figure [fig:distribution95time95a], when we calculate the similarity on DINOv3 [32] of the noisy data \({\mathbf{x}}_t\) between other clean data samples, the similarity towards the original data \({\mathbf{x}}_0\) is drastically increased in the refinement stage, compared to other nearest samples. Thus, to prevent the diffusion trajectory from heading toward memorization, we need to control the preceding memorization at \(t_C\). Note that the evaluation scheme also compares the difference between the original and reconstructed images from intermediate time steps, such as \(t=250, 500\).

3.1.2.2 Conditional Unlearning.

In conditional memorization, the effect of conditional guidance, such as class or text embeddings, acts more strongly than its unconditional counterpart [21]. Therefore, calculating the guidance magnitude \(\|\epsilon_\theta({\mathbf{x}}_t, e_p) - \epsilon_\theta({\mathbf{x}}_t, e_\emptyset)\|_2^2\) is key for conditional memorization [22], [33]. In Figure [fig:adaptive95a], we measured the trajectory of conditional guidance with memorized prompts in Stable Diffusion v1.4 [34], with detailed settings provided in Section 4.1. We can observe a peak in guidance norms in phase I before speciation begins [23], [33].

Based on the experiments, we can hypothesize that controlling the diffusion trajectory for \(t>t_S\) before specification begins is important for the conditional case. Similarly, training-free methods observed that guiding only late time steps \(t>t_S\) is sufficient to steer the generation away from harmful concepts. For example, [6] applied guidance within \(t>780\), while [35] noted that their repellency terms are significant in late time steps.

In summary, \(t_C<t<t_S\) (phase II) is critical for controlling unconditional behavior, while \(t>t_S\) (phase I) matters for conditional generation, where conditional guidance dominates the diffusion dynamics after speciation, and the trajectory should be regulated before each critical time step begins.

r0.55

3.1.2.3 Optimal Selection of Transition Time \(t_S\) and \(t_C\).

Finding the optimal \(t_S,t_C\) is an open question in diffusion models. We summarize previous researches in Table 1, where \(t_S\) and \(t_C\) are approximately similar to the transition points \((t_C,t_S)=(250,750)\) used in Figure 2.

Since the guideline in Table 1 is not sample-wise, we further consider an adaptive method on conditional unlearning based on [23], analogue to the speciation time \(t_S\): (i) the guidance magnitude \(\|\epsilon_\theta({\mathbf{x}}_t, e_p) - \epsilon_\theta({\mathbf{x}}_t, e_\emptyset)\|_2^2\) is computed, and (ii) set the transition point \(\tau\) as the first local minimum observed in sampling, detailed in Algorithm 9 (Appendix 7). As the \(\tau\) searching method is prompt adaptive, we can consider the transition \(\tau\) as \(t_S\). As shown in Figure [fig:adaptive95b], although the optimal \(\tau\) varies across prompts, the median of \(\tau\) is \(761.1\), similar to the fixed \(t_S=750\).

3.2 Not Every Frequency Mode Needs to Be Forgotten↩︎

3.2.1 Motivation↩︎

From a time-selective perspective, Phase I (\(t > t_S\)) and Phase II (\(t_C < t < t_S\)) represent the primary stages where semantic- and individual-level memorization are established, respectively. Maintaining time steps \(t < t_C\) (Phase III) is essential for quality preservation because this phase only refines the quality of the generated sample determined in earlier stages. This motivates the use of low-pass filters in diffusion models to avoid forgetting fine-grained and high-frequency details [37], [38].

We evaluate the impact of unlearning in the frequency domain via the power spectral density in Figure [fig:psa]. For the retain set, the high-frequency distribution is preserved post-unlearning. Conversely, the forget set exhibits unwanted high-frequency components that risk degrading sample quality.

3.2.2 Frequency-selective Diffusion Forgetting↩︎

Thus, to preserve fine-grained image quality and make less perturbation in the manifold during unlearning, we add a low-pass filter to remove the high-frequency components of the forget set as \[\mathbb{E}_{\mathbf{x}_0\sim p_0}\mathbb{E}_t\Bigl[w_t\bigl\|\underbrace{\mathcal{F}\bigl(s_\theta(\mathbf{x}_t,t)-\nabla{\mathbf{x}_t}\log q(\mathbf{x}_t\mid\mathbf{x}_0)\bigr)}_{\text{Low-pass filter}}\bigr\|^2\Bigr] \label{eq:ours}\tag{6}\] Notice that the denoiser input remains the noisy natural sample \(\mathbf{x}_t\) during unlearning; only the loss residual is projected to low frequencies. Hence, the input distribution during unlearning and inference is identical, and only the gradient signal used for unlearning is projected. In practice, we employ the discrete Fast Fourier Transform (FFT) as follows: \[\mathcal{T}(u,v) = \text{FFT}({\mathbf{x}}) = \sum_{x=1}^{H}\sum_{y=1}^{W} {\mathbf{x}}(x,y) e^{-j2\pi\left(\frac{u}{H}x + \frac{v}{W}y\right)},\] where \({\mathbf{x}}(x,y)\) is the pixel intensity at position \((x,y)\), \(\mathcal{T}(u,v)\) is the complex coefficient at frequency \((u,v)\), and \(e\) and \(j\) represent Euler’s constant and the imaginary unit, respectively. To remove only the high-frequency terms, we apply a masking function to the FFT results and then reconstruct the image using the inverse FFT with radius \(r\) as \(\mathcal{F}({\mathbf{x}}_{i,t}) = \text{IFFT} \left(\text{FFT}({\mathbf{x}}_{i,t}) \odot \beta_{i,t}(r)\right),\) where \(\beta_{i,t}(r) = s \text{ if the radius } r > r_t, 1 \text{ otherwise}\). \(r_t\) is a radius cutoff frequency threshold. \(0 \leq s \leq 1\) is a high frequency weight, where we set \(s=0\) to exclude high frequency in unlearning.

3.3 Theoretical Justification↩︎

Data unlearning must remove the influence of specific samples while preserving the overall data manifold. To this end, we analyze the enhanced forgetting within the selected region and the minimized distortion in the non-selected region, showing the strength in the forgetting–preservation trade-off.

Setup. Let \(\mathbb{P}_{\mathrm{orig}}\) and \(\mathbb{P}_m\) (\(m \in \{\mathrm{full}, \mathrm{sel}\}\)) be the path measures of the original and unlearned diffusion models. We denote the score perturbation as \(\Delta s_m(x_t, t) := s_{\theta_m}(x_t, t) - s_{\theta_{\mathrm{orig}}}(x_t, t)\). By Girsanov’s theorem [39], the KL divergence between the original and unlearned path measures is \[D_{\mathrm{KL}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) = \frac{1}{2}\int_0^T g(t)^2 \mathbb{E}_{x_t} \left[ \|\Delta s_m(x_t, t)\|_2^2 \right] dt.\] To evaluate unlearning efficacy, we decompose this total unlearning-induced distortion into a selected target window \(\mathcal{S}\) (e.g., selected time-steps or frequencies) and its complement \(\mathcal{S}^c\). Let \(D_{\mathrm{KL}}^{\mathcal{W}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) := \frac{1}{2}\int_{\mathcal{W}} g(t)^2 \mathbb{E}_{x_t} [\|\Delta s_m\|_2^2] dt\) denote the regional divergence over a window \(\mathcal{W}\). Thus, the total divergence is \(D_{\mathrm{KL}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) = D_{\mathrm{KL}}^{\mathcal{S}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) + D_{\mathrm{KL}}^{\mathcal{S}^c}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m).\) For \(\beta > 0\), we define the forgetting–preservation utility as: \[\label{eq:trade95off} \mathcal{J}_{\beta}(m) := D_{\mathrm{KL}}^{\mathcal{S}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) - \beta D_{\mathrm{KL}}^{\mathcal{S}^c}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m).\tag{7}\] Note that \(D_{\mathrm{KL}}^{\mathcal{S}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m)\) is a proxy for the intended forgetting and, \(D_{\mathrm{KL}}^{\mathcal{S}^c}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m)\) is a proxy for collateral distortion without intend to unlearn, detailed in Appendix 6.

Assumptions. (i) Finite divergence: \(D_{\mathrm{KL}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) < \infty\). (ii) Focused updates in \(\mathcal{S}\): Due to the frequent update on the selected region under the same training budget, selective unlearning amplifies changes in the target region (\(\|\Delta s_{\mathrm{sel}}\|_2 \ge \mu \|\Delta s_{\mathrm{full}}\|_2\) for \(\mu \ge 1\) in \(\mathcal{S}\)) and weaker changes in \(\mathcal{S}^c\) (\(\|\Delta s_{\mathrm{sel}}\|_2 \le \eta \|\Delta s_{\mathrm{full}}\|_2\) for \(\eta \in [0,1]\) in \(\mathcal{S}^c\)). See Appendix 6 for empirical validation and proofs.

Remark 1. The bracketed term \((\mu^2-1)(1-\lambda) + \beta(1-\eta^2)\lambda\) is always non-negative under our assumptions (\(\mu \ge 1, \eta \le 1, \beta>0, \lambda \in [0,1]\)). Then, the improvement in utility is strictly positive.

Remark 2. The utility gap \(\mathcal{J}_{\beta}(\mathrm{sel}) - \mathcal{J}_{\beta}(\mathrm{full})\geq0\) indicates our selective mechanism focuses score updates on the selected forget-region while mitigating unwanted distortion in non-selected parts.

4 Experiments↩︎

4.1 Experimental Setups↩︎

4.1.0.1 Datasets and Baselines.

We follow the settings of [1]. For CelebA-HQ [40], we evaluate the deletion of individual samples at the image level in unconditional image generation. For Stable Diffusion v1.4 [34], we evaluated the memorization of the LAION dataset corresponding to each prompt in text-to-image generation. Further experimental details are in the Appendix 7.

4.1.0.2 Hyperparameters.

We use both time selection (4 ) and frequency selection (6 ) for experiments. Although we acknowledge that the choice of thresholds might vary, we fix \((t_C,t_S)=(250,750)\) based on Table 1. Thus, we mainly use \((t_1,t_2)=(250,750)\) for the unconditional case and \((t_1,t_2)=(750,1000)\) for the conditional case. Based on the observation in Figure [fig:psa], as our goal is to filter out the high-frequency, we tune \(r_t \in [0.1, 0.15]\), and unless otherwise specified, we set \(r_t=0.15\). For CelebA-HQ and Stable Diffusion from the Hugging Face Diffusers, we fine-tune the model with Adam with a batch size of 64 and 16 with a learning rate of \(5\cdot10^{-6}\) and \(10^{-5}\), respectively.

4.1.0.3 Evaluation Metrics.

The traditional evaluation of unlearning methods is two-fold: the quality of retained data samples, measured by Frechet Inception Distance (FID) [41], and the dissimilarity of forgotten samples from the originals, measured by SSCD [10]. However, SSCD ignores the quality of the generated samples, e.g., a blurry image achieves a very low SSCD, though it is not a meaningful outcome. To address this, we introduce a normalized SSCD score that considers the normalized distance between the generated image \(\hat{\mathbf{x}}_0({\mathbf{x}}_t,\theta)\) and the original image \({\mathbf{x}}_0\). Motivated by adversarial attacks [42], we project the difference onto \(\ell_2\) ball with radius \(\rho\) as \[\small \mathrm{SSCD}^\text{norm} = \mathrm{SSCD}({\mathbf{x}}_0,{\mathbf{x}}_0 + \rho \frac{\hat{\mathbf{x}}_0({\mathbf{x}}_t,\theta) - {\mathbf{x}}_0}{\|\hat{\mathbf{x}}_0({\mathbf{x}}_t,\theta) - {\mathbf{x}}_0\|_2^2+\varepsilon}). \label{eq:sscd95norm}\tag{8}\] Here, \(\varepsilon\) is a small constant to avoid division by zero, and we use \(\rho=100\) with a normalized image with 256x256 resolution. As a quality metric, we compute sample-wise aesthetic scores using the LAION-Aesthetic V2 predictor². For Stable Diffusion, we evaluate generation quality using CLIP-IQA [43] and measure unlearning performance through the unlearning success rate, defined as the proportion of cases where all 16 memorized samples are removed. We tested with the five runs and report their mean. Variance is comparably small, shown in Table 9.

4.2 Experimental Results↩︎

4.2.0.1 Unconditional Data Unlearning.

For CelebA-HQ, our objective is to delete six randomly sampled celebrity faces selected by [1] from pre-trained unconditional diffusion models. Unlearning is applied image-by-image in a continual setting. As GA erases all details in a continual manner, we initialize the model as a pretrained point after each individual deletion. As explained in Section 2.3, we first inject noise to certain time steps \(t=250,500\) (only \(t=250\) in [1]) and compare the denoised image using the unlearned model and the original image.

In Figure 5, similar to the toy results in Figure 2, we focus on the middle steps, which show stable forgetting and better quality preservation in image-level unconditional unlearning. For a low-pass filter, a cutoff threshold \(r=0.15\) effectively maintains the quality. Thus, we apply our selective unlearning framework to various optimization methods (GA, SISS, DPO, and KTO) in Table 2. To ensure that a positive value consistently indicates an improvement over metric \(V\), the relative gain (%) is calculated as \((V_{\text{ours}} - V_{\text{base}}) / V_{\text{base}}\) for higher is better metric and \((V_{\text{base}} - V_{\text{ours}}) / V_{\text{base}}\) for lower is better metric. The results indicate that both time and frequency selection achieve forgetting and preserve the quality of unlearned data examples. At \(t=250\), it maintains the SSCD while improving SSCD\(^{\text{norm}}\), and at \(t=500\), it improves both metrics compared to base models. Since our selective method is optimized for the forget data, we observe a minor increase in FID for retained data.

The comparison between SSCD and SSCD\(_{\text{norm}}\) highlights the limitations of using raw similarity to evaluate unlearning. For instance, deletion-focused methods like EraseDiff and GA achieve low SSCD scores. While the results are well-aligned with target forgetting, it is merely an artifact of severe image quality degradation. Their high SSCD\(_{\text{norm}}\) scores correctly reveal that their perturbation direction is ineffective for true unlearning. In contrast, our selective framework demonstrates a superior unlearning direction by achieving significant SSCD\(_{\text{norm}}\) gains.

4.2.0.2 Conditional Text-to-Image Data Unlearning.

For Stable Diffusion, we evaluated to unlearn 45 memorized prompts selected by [1] from the LAION datasets. Fully-memorized prompts consistently generate exact replicas of the training images, whereas partially-memorized prompts contain weaker memorization prompts, thus easier to unlearn. For conditional cases, we unlearn only time steps \(t>t_S\), utilizing the condition on a text embedding of “memorized prompt". As shown in Figure 7, our method achieves a higher unlearning success rate and faster convergence than the baseline SISS throughout the training process. Figure 7 (c) further confirms that our approach yields superior unlearning (lower attack success) and better image quality (higher CLIP-IQA).

4.3 Additional Experiments↩︎

Adaptive method.\(None\) As illustrated in Figure 7 (a-b), the adaptive method in Algorithm 9 shows similar performance with the fixed window. However, the adaptive method introduces computational overhead in a pre-sampling step to determine \(t_S=\tau\). Therefore, we mainly adopt the fixed interval, leaving the adaptive method for future exploration. Furthermore, we also observed that frequency threshold scheduling can also improve the quality, as shown in Table 8.

Computation.\(None\) As shown in Table 8 using Stable Diffusion, our method requires an additional computational cost for FFT of 5.99% per epoch. Additionally, the adaptive method requires a sampling step before training begins. However, since our method converges significantly faster, the actual total training time can be reduced. Inference time remains unchanged for our methods.

Membership inference attack (MIA).\(None\) We further conduct a membership inference attack (MIA) [44], [45] evaluation based on diffusion loss, testing on a member set, hold-out dataset, and unlearned set. As shown in Table [tab:mia], existing methods suffer from over-forgetting, with relative errors reaching \(\times 107.98\) (SecMI) and \(\times 278.22\) (PIAN) on the unlearned set, far exceeding the hold-out baseline (\(\times 1.32\) and \(\times 1.12\)). Our method substantially mitigates this collateral distortion (\(\times 5.76\) and \(\times 53.20\)).

Supplementary Experiments.\(None\) Refer to Appendix 8 for supplementary experiments, including additional base analyses (Figures 11-14), evaluations on different backbones such as transformer-based architectures and Stable Diffusion v3 (Tables 3 and 4), concept unlearning results (Figure 10), LLM-based evaluations for anomaly detection (Table 5), the effect of unlearning on nearby samples (Table 6), filter band and frequency cutoff scheduling ablations (Tables 7 and 8), and statistical reliability across independent runs (Table 9). Refer to Appendix 9 for additional visualizations.

5 Conclusion↩︎

In this paper, we address the critical issues of quality degradation and slow convergence in data unlearning for diffusion models. Our analysis reveals that forgetting is not a uniform process, but an effective region exists across time steps and spectral domains. As a limitation, this work does not provide a method for automatically discovering the optimal unlearning regions. We believe that this work assists the social impact of machine unlearning within generative models.

6 Justification of Proposition 1↩︎

Setup. Let \(\mathbb{P}_{\mathrm{orig}}\) and \(\mathbb{P}_m\) (\(m \in \{\mathrm{full}, \mathrm{sel}\}\)) be the path measures of the original and unlearned diffusion models. We denote the score perturbation as \[\Delta s_m(x_t, t) := s_{\theta_m}(x_t, t) - s_{\theta_{\mathrm{orig}}}(x_t, t).\] By Girsanov’s theorem [39], the KL divergence between the original and unlearned path measures is \[D_{\mathrm{KL}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) = \frac{1}{2}\int_0^T g(t)^2 \mathbb{E}_{x_t} \left[ \|\Delta s_m(x_t, t)\|_2^2 \right] dt.\] To evaluate unlearning efficacy, we decompose this total unlearning-induced distortion into a selected target window \(\mathcal{S}\) (e.g., selected time-steps or specific frequencies) and its complement \(\mathcal{S}^c\). Let \[D_{\mathrm{KL}}^{\mathcal{W}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) := \frac{1}{2}\int_{\mathcal{W}} g(t)^2 \mathbb{E}_{x_t} [\|\Delta s_m\|_2^2] dt\] denote the regional divergence over a window \(\mathcal{W}\). Thus, the total divergence can be formulated as \[D_{\mathrm{KL}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) = D_{\mathrm{KL}}^{\mathcal{S}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) + D_{\mathrm{KL}}^{\mathcal{S}^c}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m).\] For \(\beta > 0\), we define the forgetting–preservation utility as: \[\label{qefivnbw} \mathcal{J}_{\beta}(m) := D_{\mathrm{KL}}^{\mathcal{S}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) - \beta D_{\mathrm{KL}}^{\mathcal{S}^c}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m).\tag{9}\] Note that \(D_{\mathrm{KL}}^{\mathcal{S}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m)\) is a proxy for the forgetting action. If \(\mathcal{S}\) is chosen to contain the components that encode the forget-set information, a larger divergence on \(\mathcal{S}\) means the method is actively modifying the targeted information. Conversely, \(D_{\mathrm{KL}}^{\mathcal{S}^c}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m)\) is a proxy for collateral distortion. Since \(\mathcal{S}^c\) is not the region we intend to unlearn, score changes there are undesirable side effects that can degrade retained content and sample quality.

Assumptions.

1. Finite divergence: \(D_{\mathrm{KL}}(\mathbb{P}_{\mathrm{orig}} \,\|\, \mathbb{P}_m) < \infty\).

2. Focused updates in \(\mathcal{S}\): Due to the frequent update on the selected region under the same training budget, selective unlearning amplifies changes in the target region (\(\|\Delta s_{\mathrm{sel}}\|_2 \ge \mu \|\Delta s_{\mathrm{full}}\|_2\) for \(\mu \ge 1\) in \(\mathcal{S}\)) and weaker changes in \(\mathcal{S}^c\) (\(\|\Delta s_{\mathrm{sel}}\|_2 \le \eta \|\Delta s_{\mathrm{full}}\|_2\) for \(\eta \in [0,1]\) in \(\mathcal{S}^c\)). Empirical validations are presented in Appendix 6.1.

Remark 1. The bracketed term \((\mu^2-1)(1-\lambda) + \beta(1-\eta^2)\lambda\) is always non-negative under our assumptions (\(\mu \ge 1, \eta \le 1, \beta>0, \lambda \in [0,1]\)). Then, the improvement in utility is strictly positive.

Remark 2. The utility gap \(\mathcal{J}_{\beta}(\mathrm{sel}) - \mathcal{J}_{\beta}(\mathrm{full})\geq0\) indicates our selective mechanism focuses score updates on the selected forget-region while mitigating unwanted distortion in non-selected parts.

6.1 Empirical Validation of Assumptions↩︎

Our theoretical analysis relies on two key assumptions: enhanced forgetting in the target region (Assumption 2, \(\mu \ge 1\)) and suppressed distortion in the non-target region (Assumption 2, \(\eta \le 1\)). We empirically validate both assumptions across the time and frequency domains.

6.1.0.1 Enhanced Forgetting (\(\mu \ge 1\)).

To verify that targeted training induces stronger score updates within the specified region compared to full unlearning, we evaluate the \(\mu\)-ratio (\(\|\Delta s_{\mathrm{sel}}\|_2^2 / \|\Delta s_{\mathrm{full}}\|_2^2\)) strictly within the targeted window \(\mathcal{S}\). As shown in Table ¿tbl:tab:mu95ratio?, the relative ratios are strictly greater than 1 across all targeted time windows (Table [tab:window95ratio95time95mu]) and frequency bands (Table [tab:window95ratio95freq95mu]). This confirms that selective unlearning strengthens its update energy on the selected region.

6.1.0.2 Suppressed Distortion (\(\eta \le 1\)).

To quantify the bounded out-of-region effect, we measure the normalized perturbation across different evaluation domains when the model is trained on a specific target region. The results in Table ¿tbl:tab:eta95ratio? indicate that selective unlearning predominantly affects the intended phase or band compared to non-target counterparts. The off-diagonal elements in both the time domain (Table [tab:window95ratio95time95eta]) and the frequency domain (Table [tab:window95ratio95freq95eta]) experimentally support \(\eta < 1\).

6.2 Time and Frequency Understanding for \(\lambda\)↩︎

6.2.0.1 Time-Selective Unlearning.

Defining the target region as a specific time window \(\mathcal{S} = \mathcal{T}_s \subset [0, T]\) formulates time-selective unlearning. In this case, the ratio \(\lambda_t\) represents the fraction of the full-unlearning distortion that occurs outside the targeted time window \(\mathcal{T}_s\): \[\label{eq:lambda95time95vC} \lambda_t \;:=\; \frac{\int_{[0,T]\setminus\mathcal{T}_s} g(t)^2\,\mathbb{E}_{x_t}\!\left[\|\Delta s_{\mathrm{full}}(x_t, t)\|_2^2\right] dt}{\int_0^T g(t)^2\,\mathbb{E}_{x_t}\!\left[\|\Delta s_{\mathrm{full}}(x_t, t)\|_2^2\right] dt} \;\in\;[0,1].\tag{10}\]

6.2.0.2 Frequency-Selective Unlearning.

Plancherel’s theorem [46] establishes an equivalence between spatial and spectral energy: \[\label{eq:plancherel95vC} \|\Delta s_m(x_t, t)\|_2^2 \;=\; \sum_{\boldsymbol{\omega}} \|\widehat{\Delta s}_m(\boldsymbol{\omega},t)\|_2^2,\tag{11}\] where \(\widehat{\Delta s}_m(\boldsymbol{\omega},t)\) is the discrete Fourier transform of the score perturbation across spatial dimensions at frequency \(\boldsymbol{\omega}\). By applying a low-pass filter with cutoff \(r\), we define our targeted forgetting region in the frequency domain as \(\mathcal{S} = \Omega_r := \{|\boldsymbol{\omega}|\le r\}\). Consequently, the collateral distortion ratio \(\lambda_\omega\), corresponding to the unselected high-frequency band, is defined as: \[\label{eq:lambda95freq95vC} \lambda_\omega \;:=\; \frac{\int_0^T g(t)^2\!\sum_{|\boldsymbol{\omega}|>r}\mathbb{E}_{x_t}\!\left[\|\widehat{\Delta s}_{\mathrm{full}}(\boldsymbol{\omega},t)\|_2^2\right] dt}{\int_0^T g(t)^2\!\sum_{\boldsymbol{\omega}}\mathbb{E}_{x_t}\!\left[\|\widehat{\Delta s}_{\mathrm{full}}(\boldsymbol{\omega},t)\|_2^2\right] dt} \;\in\;[0,1].\tag{12}\]

7 Experimental Details↩︎

7.0.0.1 Experimental Setups.

We basically follow the experimental setups in SISS [1]. We first make note of an important detail in their paper.

All the diffusion models were provided in the Huggingface diffusers library with a U-Net backbone. For the CelebA-HQ dataset, we used a pretrained checkpoint released by [3] at https://huggingface.co/google/ddpm-celebahq-256. For the Stable Diffusion experiments, we used version 1.4 at https://huggingface.co/CompVis/stable-diffusion-v1-4 as the pretrained checkpoint and used a 50-step DDIM sampler [47].

Regarding hyperparameters, we follow [1] without additional tuning.

For the experimental setups, we mainly use NVIDIA A40 GPUs with the PyTorch library and utilize NVIDIA A100 GPUs for parallel runs.

7.0.0.2 Memorized Prompts of Stable Diffusion.

[1] constructed 45 prompts in Stable Diffusion v1.4. Since only one LAION image corresponds to each prompt, synthetic datasets are generated by sampling 128 images and applying k-means clustering for classification. A “fully-memorized” prompt refers to a case where Stable Diffusion repeatedly reproduces the same outcome, whereas a “partially-memorized” prompt is obtained by manually adding or deleting tokens, producing more diverse outputs that are easier to unlearn.

7.0.0.3 Preference Optimization.

Direct Preference Optimization (DPO) [48] is widely used to evaluate preference alignment in language models. Originally developed for Reinforcement Learning from Human Feedback (RLHF), it has recently also been applied to diffusion fine-tuning [49]. For unlearning, Negative Preference Optimization (NPO) [50] has been proposed as an alternative to gradient descent. Unlike gradient ascent [50], NPO leverages the initial model as a reference point, which helps mitigate overfitting by keeping the optimization close to the initialization. In the diffusion setting, [4] applied NPO for alignment. Another line of work, Kahneman–Tversky Optimization (KTO) [51], has its own strength since the method does not require positive–negative pairs. [52] extended KTO to diffusion for pair-free feedback alignment. In this paper, we follow the formulation of forget loss with DPO [49] and KTO [52].

To formulate this, let the per-sample diffusion loss be \(\ell(\theta, {\mathbf{x}}) = \mathbb{E}_{t}[w_t \| s_\theta({\mathbf{x}}_t, t) - \nabla_{{\mathbf{x}}_t} \log q({\mathbf{x}}_t|{\mathbf{x}}) \|_2^2]\). We define the implicit reward as the loss reduction relative to the reference model: \(r(\theta, {\mathbf{x}}) = \ell(\theta_{\text{ref}}, {\mathbf{x}}) - \ell(\theta, {\mathbf{x}})\). By maximizing the implicit reward gap defined by the difference in diffusion loss relative to the reference model \(\theta_{\text{ref}}\), the framework effectively minimizes the likelihood of generating forget concepts while preserving general capabilities. The objectives for DPO and KTO are then given by for forget data \({\mathbf{x}}_f\) and retain data \({\mathbf{x}}_r\): \[\begin{align} \mathcal{L}_{\text{DPO}}(\theta) &= - \mathbb{E}_{{\mathbf{x}}_r \sim \mathcal{D}_R, {\mathbf{x}}_f \sim \mathcal{D}_F} \Bigl[ \log \sigma \Bigl( \beta \bigl( r(\theta, {\mathbf{x}}_r) - r(\theta, {\mathbf{x}}_f) \bigr) \Bigr) \Bigr]. \tag{13} \\ \mathcal{L}_{\text{KTO}}(\theta) &= \mathbb{E}_{{\mathbf{x}}_r \sim \mathcal{D}_R} \Bigl[ 1 - \sigma \bigl( \beta r(\theta, {\mathbf{x}}_r) - z_{\text{ref}} \bigr) \Bigr] \nonumber \\ &\quad + \lambda \mathbb{E}_{{\mathbf{x}}_f \sim \mathcal{D}_F} \Bigl[ 1 - \sigma \bigl( z_{\text{ref}} - \beta r(\theta, {\mathbf{x}}_f) \bigr) \Bigr]. \tag{14} \end{align}\] \(\sigma\) is the sigmoid function, \(\beta\) is a temperature hyperparameter, and \(z_{\text{ref}}\) is the reference point for the reward.

7.0.0.4 Algorithm of Adaptive Search.

Based on [23], we present pseudocode of the adaptive transition point \(\tau=t_S\) search method in Algorithm 9.

8 Supplementary Experiments↩︎

8.1 Different Backbones↩︎

To evaluate the adaptability of latent models for image-level generation, we conduct experiments using the Latent Diffusion Model (LDM) [34] pretrained on the CelebHQ dataset³. The results are presented in Table 3. Furthermore, we extend our evaluation to Stable Diffusion v3.0. built upon the Diffusion Transformer (DiT) architecture [53]. Since Stable Diffusion v3.0 has practical guardrail methods to prevent the memorization observed in previous Stable Diffusion v1.4, it is difficult to generate the memorized example in Stable 1.4. Thus, we rather calculate the SSCD and SSCD\(^{\text{norm}}\) while using the same prompts. The corresponding results are reported in Table 4. The gains of our method are smaller compared to Stable Diffusion v1.4 due to the flow-matching-based property, but we still observe that controlling time and frequency helps unlearning.

Tables 3 and 4 demonstrate the adaptability and effectiveness of our proposed method across diverse architectures. We did not perform additional hyperparameter tuning for these experiments.

8.2 Concept Unlearning↩︎

As stated in the introduction, unlearning specific concepts, such as nudity or violence, is another major direction in unlearning research. We examine whether the choice of timesteps also affects concept generation in terms of “memorization of certain concepts.” We utilize the nudity prompts used in Ring-a-bell [54] using the GitHub⁴ of SAFREE [5].

We compare SISS and SISS+Ours using the same time window used SD 1.4, and compute the CLIP-IQA quality score. For the unlearning measure, we measure the nudity detection rate using NudeNet⁵, where an attack is counted if the NudeNet classifier probability exceeds 0.45. As shown in Figure 10, the proposed one shows faster convergence and superior forgetting behavior.

8.3 Importance of Unlearned Quality↩︎

We argue that significant degradation or distinct artifacts in these outputs can create a privacy vulnerability. If the unlearned model generates evident anomalies for specific queries, it provides a clue to adversaries, allowing them to identify which data points were deleted (i.e., membership inference via outlier detection).

To verify this hypothesis, we conducted an experiment using advanced Large Language Models (LLMs) as anomaly detectors. We provided the LLMs with generated images and instructed them to evaluate whether the images are realistic (in-distribution) or abnormal (out-of-distribution) based on the following prompt:

Prompt: “You are an image quality and anomaly detection expert. You are given two image sets: The first set contains reference (in-distribution) images. Assign a score to each query image: 1.0 = Realistic / In-distribution (no visible generation problem), 0.0 = Abnormal / Out-of-distribution (clear generation failure or artifacts).”

As shown in Table 5, baseline methods like SISS exhibited low scores, indicating that their outputs are easily distinguishable as anomalies. In contrast, our method maintains higher generation quality, effectively masking the trace of unlearning. Furthermore, recent studies [55], [56] warn that unlearning mechanisms are vulnerable against relearning attacks, which can recover deleted data using residual information such as embedding similarity. Therefore, ensuring the quality of unlearned samples is crucial not only for aesthetics but also for preventing privacy attacks.

To investigate the impact of unlearning on similar samples, we choose the five nearest neighbors for each forgotten image, and report the mean SSCD between their original and reconstructed images as well as the aesthetic score of the reconstructed samples in Table 6. As data unlearning focuses on individual deletion, the SSCD on these nearest images does not decrease. However, we do observe a slight drop in aesthetic quality after unlearning. By implementing our selective unlearning, this aesthetic degradation is mitigated. Consequently, selective unlearning helps preserve both the semantics and the overall quality of nearby examples.

8.4 Ablation on Frequency Filtering↩︎

Filter band ablation.\(None\) We evaluate low-pass (our method), mid-pass, and high-pass filters for unlearning in Table 7. The results indicate that deleting low-frequency information while preserving high-frequency details performs the best, similar to not deleting Phase III in time steps. Otherwise, both unlearning and quality preservation fail.

Frequency cutoff scheduling.\(None\) Our frequency selection can be further improved with different filtering schedules. Therefore, we test four additional variants during training, including Linear Increase (\(0.05 \to 0.2\)), Linear Decay (\(0.2 \to 0.05\)), and Stepwise strategies, to assess the impact of filtering high-frequency content over the unlearning fine-tuning. As shown in Table 8, the Linear Increase strategy, which retains a greater amount of high-frequency information during the later training stages, results in the highest image quality. This indicates that frequency filtering should be dynamically adjusted to preserve fine-grained details during the later stages of unlearning.

8.5 Statistical reliability↩︎

To verify that the gap is statistically significant, we further evaluate the SISS and KTO experiments in Table 9 across five independent runs, which yield small standard deviations.

6pt

6pt

3pt

3pt

8.6 Base Experiments↩︎

We illustrate some details through a toy example. For Figure 2, we construct a multi-layer perceptron diffusion model trained with the DDPM objective [3]. The model is trained until convergence. After training, we delete the forget samples (\(\times\)) using gradient ascent, while applying gradient descent to certain retain data points (◆).

Except for Figure 2, all experiments in Section 3 are conducted on the CelebHQ dataset used in the main table 2. We now provide additional results. In Figure [fig:distribution95time], we utilize the DINOv3 embedding [32] to calculate the similarity between data samples. We also measured in pixel-wise similarity in Figure 12, where we failed to observe similar patterns. The nearest images of individual data samples are in Figure 11. Individual gradient norms are in Figure [fig:gradient95norms95supp]. Finally, we report the remaining results of Figure [fig:psa] in Figures 13 and 14.

9 Visualization↩︎

9.0.0.1 CelebA-HQ Results.

We first visualize the results for each method: SISS, SISS+Ours, and variational results on different time steps in Figures 15 to 19.

9.0.0.2 Stable Diffusion Results.

We visualize the results of text-to-image data unlearning in Figures 20 to 23.

References↩︎