Certifying Concept Unlearning in Text-to-Image Diffusion Models

# Certifying Concept Unlearning in Text-to-Image Diffusion Models
Source: [https://arxiv.org/html/2609.12163](https://arxiv.org/html/2609.12163)
###### Abstract

Existing evaluations of concept unlearning in text\-to\-image \(T2I\) diffusion models primarily rely on attack success rates obtained through automated adversarial prompt search\. However, these metrics provide only empirical evidence over a finite set of queries and leave residual leakage over the broader prompt space largely unquantified\. This limitation can lead to overestimating unlearning effectiveness and underestimating safety risks\. To address this gap, we introduce a novel certification framework for T2I concept unlearning that provides high\-confidence guarantees with bounded error on residual concept leakage\. Our approach combines statistical certification with worst\-case analysis along concept\-relevant embedding directions to derive explicit upper bounds on leakage probability under user\-specified confidence levels\. We evaluate our framework across three major concept categories namely NSFW content, artistic styles, and celebrity identities, and six state\-of\-the\-art unlearning methods\. Certified leakage bounds consistently exceed standard attack success rates by 16\.2% averagely, uncovering substantial residual risks missed by existing evaluation protocols\. Crucially, our results demonstrate that empirical attack\-based evaluations can significantly underestimate residual leakage and establish certification as a necessary complement for reliable auditing of concept unlearning in T2I diffusion models\.

1Imperial College London

2TU Wien

m\.\-24@imperial\.ac\.uk, luca\.marzari@tuwien\.ac\.at, f\.leofante@imperial\.ac\.uk

## 1Introduction

Text\-to\-image \(T2I\) diffusion models such as Stable Diffusion\([Rombach et al\. 2022](https://arxiv.org/html/2609.12163#bib.bib1)\), SDXL\([Podell et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib3)\), and DALL\-E 2\([Ramesh et al\. 2022](https://arxiv.org/html/2609.12163#bib.bib4)\)can be prompted to generate NSFW content, imitate protected artistic styles, and reproduce the likeness of real individuals, raising safety, copyright, and privacy concerns\. Concept unlearning methods mitigate this by editing a pretrained model to suppress a target concept \(e\.g\., a keyword, style, or identity\) at generation time, without retraining from scratch\([Gandikota et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib5);[Gandikota et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib6);[Lyu et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib7);[Lu et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib8);[Fan et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib9);[Zhang et al\. 2024b](https://arxiv.org/html/2609.12163#bib.bib10);[Cywiński and Deja 2025](https://arxiv.org/html/2609.12163#bib.bib11)\)\. However, even when empirically effective, none of these methods guarantees that the concept can no longer be generated\.

Obtaining such guarantees is hard because the edits performed by unlearning methods are only approximate: they adjust weights or embeddings locally around the concept rather than removing it from the training distribution, so the edited model’s behaviour near the concept cannot be easily characterised analytically\. Unlearning is therefore only validated empirically by measuringresidual leakage, the rate at which the edited model can still be driven to generate the concept\. This is typically done by running an adversarial prompt search against the edited model and reporting the resulting attack success rate \(ASR\), i\.e\. the fraction of a curated prompt set that still elicits the concept\. ASR, however, is only an estimate over a finite, search\-optimised sample of the prompt space\. Therefore, a low ASR can only show that a particular search method failed to find an attack, not that none exists\. This lack of completeness can create a false sense of safety, as prompts judged safe under one adversarial search have repeatedly been broken by another\([Rando et al\. 2022](https://arxiv.org/html/2609.12163#bib.bib16);[Chin et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib14)\)\.

![Refer to caption](https://arxiv.org/html/2609.12163v1/updated-pipeline.png)Figure 1:Overview of the certification pipeline\.In this paper, we address this gap by introducing a certification framework for residual leakage\. We certify an upper bound on residual leakage for a concept of interest directly, over its whole neighbourhood in embedding space rather than over a finite set of prompts that name it explicitly or elicit it indirectly\. To achieve this, we introduce the certification pipeline shown in Figure[1](https://arxiv.org/html/2609.12163#S1.F1)\. At a high level, the framework combines adversarial steering in a continuous concept neighbourhood with calibrated text\-space and pixel\-space verification to determine whether the concept can still be elicited and whether it survives into the generated output\. These stage\-wise estimates are then combined into a single, high\-confidence, bounded upper bound on end\-to\-end residual leakage\. Notably, this bound holds uniformly over the concept neighbourhood, not only over the prompts a particular search happened to try in prior work\. To substantiate our claims and show the benefits of our proposed pipeline, we make the following contributions:

- •We demonstrate empirically that ASR computed on a finite set of adversarial prompts does not provide a reliable upper bound on residual leakage, effectively making it impossible to rule it out\.
- •We derive a statistical certificate that bounds a T2I model’s true probability of regenerating an unlearned concept under adversarial prompting, over a continuous concept neighbourhood rather than a finite prompt subset\.
- •We instantiate the certificate across three concept categories, namely NSFW content, artistic styles, and celebrity identities, and across six state\-of\-the\-art unlearning methods on two widely used T2I diffusion models, establishing the framework’s generality\.
- •We provide ablations to establish the robustness of our certificates\.

To our knowledge, this is the first method to certify residual concept leakage in unlearned T2I models over an entire concept neighbourhood rather than a finite set of prompts\.

## 2Related Work

Concept unlearning methods edit a pretrained T2I diffusion model to suppress a target concept without retraining from scratch\. Existing approaches do so via gradient\-based fine\-tuning\([Gandikota et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib5);[Lu et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib8);[Fan et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib9)\), closed\-form weight or attention edits\([Gandikota et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib6);[Lyu et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib7)\), adversarial training\([Zhang et al\. 2024b](https://arxiv.org/html/2609.12163#bib.bib10)\)or interpretability\-guided feature suppression\([Cywiński and Deja 2025](https://arxiv.org/html/2609.12163#bib.bib11)\)\.

Existing evaluations of these methods focus primarily on three concept categories: NSFW and violent content, evaluated on the I2P prompt set\([Schramowski et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib21)\); artistic style, evaluated by suppressing a target artist’s style while preserving unrelated styles\([Kumari et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib22)\); and celebrity identity, evaluated by suppressing a named individual’s likeness while leaving other identities intact\([Lu et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib8)\)\. Six\-CD\([Ren et al\. 2025](https://arxiv.org/html/2609.12163#bib.bib23)\)formalizes this convention, organizing its benchmark suite around exactly these three categories\. We adopt the same three categories in our evaluation\.

The effectiveness and robustness of concept unlearning is typically assessed empirically by searching for prompts that still elicit the target concept after unlearning, and the literature distinguishes attacks by the adversary’s knowledge of the deployed model\. Static, black\-box adversaries construct adversarial prompts independently of the target model, relying on transferability from a surrogate\. Ring\-A\-Bell\([Tsai et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib12)\)extracts concept vectors and searches over a proxy visual encoder with a genetic algorithm, while MMA\-Diffusion\([Yang et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib13)\)jointly perturbs text and image inputs using a surrogate model, without querying the target model directly\. Adaptive, white\-box adversaries instead optimise prompts directly against the deployed model\. P4D\([Chin et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib14)\)and UnlearnDiffAtk\([Zhang et al\. 2024c](https://arxiv.org/html/2609.12163#bib.bib15)\)both require gradient access to the unlearned model’s weights to optimise adversarial prompts\. Separately, Rando et al\.\([Rando et al\. 2022](https://arxiv.org/html/2609.12163#bib.bib16)\)showed that Stable Diffusion’s rule\-based safety filter can be manually red\-teamed and bypassed on a majority of held\-out unsafe prompts\. Across both static and adaptive settings, robustness is ultimately reported as attack success rate \(ASR\), i\.e\. the fraction of a finite adversarial prompt set that succeeds\. As such, existing evaluations remain empirical and provide no guarantee beyond the tested prompt set\.

This evaluation gap mirrors one that certification approaches have successfully addressed in other domains\. For instance, randomised smoothing certifies a robustness radius for classifiers instead of reporting empirical adversarial accuracy\([Cohen et al\. 2019](https://arxiv.org/html/2609.12163#bib.bib17)\), and erase\-and\-check certifies, via a one\-sided Hoeffding bound, that an LLM safety filter will not mislabel a harmful prompt as safe under bounded adversarial perturbation\([Kumar et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib18)\)\. In another line of work, certified machine unlearning bounds the statistical distance between an edited model’s parameters and a retrained\-from\-scratch model\([Guo et al\. 2020](https://arxiv.org/html/2609.12163#bib.bib19);[Sekhari et al\. 2021](https://arxiv.org/html/2609.12163#bib.bib20)\)\. However, this is a guarantee about data removal, not about whether an adversary can still elicit a supposedly suppressed concept at inference time\. None of these certificates has been instantiated for the T2I generation pipeline or for the static and adaptive adversarial\-prompting threat models used in current concept\-unlearning evaluations\.

## 3Background

This section reviews the background this paper builds on: how a T2I diffusion model generates images from text, what it means to unlearn a concept from such a model, and how the resulting edit is conventionally evaluated\.

### T2I Diffusion Models

Latent diffusion models\([Rombach et al\. 2022](https://arxiv.org/html/2609.12163#bib.bib1)\)generate images by learning to invert a fixed forward noising process\. Letztz\_\{t\}denote the latent at diffusion timesteptt, withz0z\_\{0\}the noise\-free latent encoding of an image andzTz\_\{T\}the final noisy latent\. A forward process progressively corruptsz0z\_\{0\}intozTz\_\{T\}overTTtimesteps,

q⁡\(zt∣zt−1\):=𝒩⁡\(zt,αt​zt−1,\(1−αt\)​𝐈\),q\(z\_\{t\}\\mid z\_\{t\-1\}\):=\\mathcal\{N\}\\big\(z\_\{t\};\\ \\sqrt\{\\alpha\_\{t\}\}\\,z\_\{t\-1\},\\ \(1\-\\alpha\_\{t\}\)\\mathbf\{I\}\\big\),whereαt∈\(0,1\)\\alpha\_\{t\}\\in\(0,1\)is a fixed variance schedule\. A denoiserεθ\\varepsilon\_\{\\theta\}, implemented as a conditional U\-Net with parametersθ\\theta, is trained to invert this process by predicting the Gaussian noise added at each step,

ℒLDM=𝔼zt,ε,t,x​\[‖ε−εθ​\(zt,x,t\)‖2\],\\mathcal\{L\}\_\{\\mathrm\{LDM\}\}=\\mathbb\{E\}\_\{z\_\{t\},\\varepsilon,t,x\}\\big\[\\\|\\varepsilon\-\\varepsilon\_\{\\theta\}\(z\_\{t\},x,t\)\\\|^\{2\}\\big\],whereε\\varepsilondenotes the Gaussian noise added at timesteptt, andxxis the text embedding of the conditioning prompt, obtained from a pretrained text encoderee\([Rombach et al\. 2022](https://arxiv.org/html/2609.12163#bib.bib1)\)\. At inference time, a prompt is first encoded intoxx,zTz\_\{T\}is sampled from Gaussian noise and iteratively denoised byεθ\\varepsilon\_\{\\theta\}conditioned onxx, and the resulting latent is decoded to pixel space; we writefθf\_\{\\theta\}for this full prompt\-to\-image map\.

### Unlearning Concepts in T2I Diffusion Models

Given a pretrained modelfθf\_\{\\theta\}and a target conceptcc\(e\.g\., NSFW content, an artistic style, or a celebrity identity\), concept unlearning editsθ\\thetaintoθ′\\theta^\{\\prime\}so thatfθ′f\_\{\\theta^\{\\prime\}\}no longer generatescc, without retraining on the full training distribution\. Because the edit adjustsθ\\thetaonly approximately and in a limited part of the model or its representations, rather than removingcc’s influence from the training data,fθ′f\_\{\\theta^\{\\prime\}\}’s behavior around prompts or representations associated withccis difficult to characterize analytically\. Section[2](https://arxiv.org/html/2609.12163#S2)reviews specific unlearning algorithms; here we treat unlearning generically as any procedure producingfθ′f\_\{\\theta^\{\\prime\}\}fromfθf\_\{\\theta\}andcc\.

### ASR: Unlearning Robustness Quantification

The effectiveness of an editfθ′f\_\{\\theta^\{\\prime\}\}is conventionally quantified by attack success rate \(ASR\): given a finite set of adversarial prompts𝒜⁡\(c\)\\mathcal\{A\}\(c\)targeting conceptcc,

ASR=1\|𝒜⁡\(c\)\|​∑p∈𝒜⁡\(c\)D⁡\(fθ′​\(p\)\),\\mathrm\{ASR\}=\\frac\{1\}\{\|\\mathcal\{A\}\(c\)\|\}\\sum\_\{p\\in\\mathcal\{A\}\(c\)\}D\\big\(f\_\{\\theta^\{\\prime\}\}\(p\)\\big\),whereD⁡\(⋅\)∈\{0,1\}D\(\\cdot\)\\in\\\{0,1\\\}is a binary detector returning11ifccis present in the generated image; a lower ASR indicates stronger empirical robustness\. Here,fθ′​\(p\)f\_\{\\theta^\{\\prime\}\}\(p\)denotes the output generated for promptppunder the evaluation protocol, disregarding sampling randomness for simplicity\.𝒜⁡\(c\)\\mathcal\{A\}\(c\)is built either by a*static*adversary, with no access toθ′\\theta^\{\\prime\}, or an*adaptive*adversary, with full gradient access tofθ′f\_\{\\theta^\{\\prime\}\}; Section[2](https://arxiv.org/html/2609.12163#S2)surveys attacks of both kinds\. We useDDonly as a generic stand\-in for the task\-specific criterion used to decide whether the target concept appears in the generated output\.

## 4Exposing the Limitations of ASR

Figure 2:Figure shows a monotonically increasing attack surface with increasing budget provided\.Existing evaluations of concept unlearning report Attack Success Rate \(ASR\) under a fixed adversarial query budget, but it is unclear whether such measurements provide a stable estimate of residual leakage\. To examine this, we study how ASR changes as the attack budget increases\.

To test this, we attacked three SD\-Turbo models unlearned for the NSFW sexual concept using three representative adversarial prompting methods: MMA\-Diffusion\([Yang et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib13)\), P4D\([Chin et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib14)\), and Ring\-A\-Bell\([Tsai et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib12)\)\. The three unlearned models were obtained using ESD\([Gandikota et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib5)\), UCE\([Gandikota et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib6)\), and TraSCE\([Jain et al\. 2025](https://arxiv.org/html/2609.12163#bib.bib32)\)\. We evaluated each attack at adversarial query budgets ofN∈102,103,104N\\in\{10^\{2\},10^\{3\},10^\{4\}\}using five random seeds per budget\. Figure[2](https://arxiv.org/html/2609.12163#S4.F2)plots ASR against query budget on a log axis, with shaded bands indicating the min\-max spread across seeds\.

For all three methods, ASR rises monotonically withNNand has not saturated byN=104N=10^\{4\}: ESD goes from 0% atN=102N=10^\{2\}to 8% atN=104N=10^\{4\}\(band up to 20%\), UCE from 0% to 65% \(band up to 80%\), and TraSCE from 0% to 60% \(band up to 80%\)\. The seed\-to\-seed spread also widens withNNrather than narrowing\. This pattern holds across a gradient\-based method \(ESD\), a closed\-form edit \(UCE\), and a training\-free method \(TraSCE\), so it is not an artefact of any one unlearning technique\.

These results show that finite\-budget ASR does not converge to a stable estimate of leakage over the range of query budgets considered here\. Instead, it remains strongly dependent on the adversary’s search budget, and nothing in the observed curves indicates how much higher it might rise at larger budgets beyond what evaluation can practically afford\. Reporting ASR at a given budget therefore cannot support a claim about the model’s leakage rate beyond that search horizon\. This gap motivates certification: rather than relying on a budget\-limited empirical estimate, we seek a bound on residual leakage that does not depend on how long the adversary searched\.

## 5Problem Formulation

Given the limitations of ASR\-based evaluation discussed in Section[4](https://arxiv.org/html/2609.12163#S4), we now formalise the certification problem addressed in this work\.

Lete⁡\(⋅\)e\(\\cdot\)denote the pretrained text encoder, and letpcp\_\{c\}be a reference prompt containing the target conceptcc\. We writexc=e⁡\(pc\)x\_\{c\}=e\(p\_\{c\}\)for the corresponding concept embedding\. Since our analysis operates in embedding space, we introduce an embedding\-conditioned generation mapgθ′​\(x,ξ\)g\_\{\\theta^\{\\prime\}\}\(x,\\xi\), wherexxis a text embedding,θ′\\theta^\{\\prime\}denotes the parameters of the unlearned diffusion model, andξ\\xidenotes the stochastic noise used by the diffusion sampler\.

To model semantically meaningful variations of the target concept, we consider bounded perturbations along a set of concept\-relevant directions\. LetUc∈ℝd×kU\_\{c\}\\in\\mathbb\{R\}^\{d\\times k\}be a matrix whose columns span akk\-dimensional subspace of concept\-relevant directions aroundxcx\_\{c\}\. For a perturbation budgetr\>0r\>0, we define the admissible perturbation set

𝒮r​\(c\):=\{xc\+Uc​α:‖α‖2≤r\}\.\\mathcal\{S\}\_\{r\}\(c\):=\\\{x\_\{c\}\+U\_\{c\}\\alpha:\\\|\\alpha\\\|\_\{2\}\\leq r\\\}\.Thus,𝒮r​\(c\)\\mathcal\{S\}\_\{r\}\(c\)is the continuous neighborhood of embeddings reachable from the reference concept embedding by bounded movement along concept\-relevant directions\.

LetOc​\(⋅\)∈\{0,1\}O\_\{c\}\(\\cdot\)\\in\\\{0,1\\\}denote an ideal concept oracle that returns11if the target conceptccis present in a generated image and00otherwise\. Let𝒟c\\mathcal\{D\}\_\{c\}denote a specified perturbation distribution supported on𝒮r​\(c\)\\mathcal\{S\}\_\{r\}\(c\)\. We then define the true end\-to\-end failure probability under bounded concept perturbations as

ptotal∗:=Prx∼𝒟c,ξ⁡\(Oc​\(gθ′​\(x,ξ\)\)=1\),p^\{\*\}\_\{\\mathrm\{total\}\}:=\\Pr\_\{x\\sim\\mathcal\{D\}\_\{c\},\\ \\xi\}\\big\(O\_\{c\}\(g\_\{\\theta^\{\\prime\}\}\(x,\\xi\)\)=1\\big\),whereξ\\xiis drawn from the diffusion sampling process\. Intuitively,ptotal∗p^\{\*\}\_\{\\mathrm\{total\}\}measures the probability that the supposedly unlearned concept re\-emerges when the model is queried with a bounded perturbation of the concept embedding\.

###### Definition 1\(Exact Unlearning Certification Problem\)\.

Given an unlearned diffusion model, a target conceptcc, a concept\-relevant perturbation subspaceUcU\_\{c\}, a perturbation budgetr\>0r\>0, and a perturbation distribution𝒟c\\mathcal\{D\}\_\{c\}supported on𝒮r​\(c\)\\mathcal\{S\}\_\{r\}\(c\), the exact unlearning certification problem is to compute a deterministic upper boundB∈\[0,1\]B\\in\[0,1\]such that the true end\-to\-end failure probability satisfies

ptotal∗≤B\.p^\{\*\}\_\{\\mathrm\{total\}\}\\leq B\.

Solving Definition[1](https://arxiv.org/html/2609.12163#Thmdefinition1)is intractable\. It would require exhaustive evaluation over the continuous perturbation set𝒮r​\(c\)\\mathcal\{S\}\_\{r\}\(c\)and over the stochastic noise used by the diffusion sampler, together with access to a perfect oracle for determining whether the target concept appears in the generated output\. We therefore relax this requirement into a statistical certification problem\.

###### Definition 2\(Approximate Unlearning Certification Problem\)\.

Given a target confidence parameterδ∈\(0,1\)\\delta\\in\(0,1\)and an allowable error marginϵ\>0\\epsilon\>0, the approximate unlearning certification problem is to compute, fromNNsamples, an empirical upper boundB^\\hat\{B\}such that

Pr⁡\(ptotal∗≤B^\+ϵ\)≥1−δ\.\\Pr\\big\(p^\{\*\}\_\{\\mathrm\{total\}\}\\leq\\hat\{B\}\+\\epsilon\\big\)\\geq 1\-\\delta\.

## 6Proposed Certification Framework

We now operationalize the certification problem defined in Section[5](https://arxiv.org/html/2609.12163#S5)by introducing a practical pipeline that computes high\-confidence upper bounds on residual concept leakage in unlearned T2I models\.

### Pipeline Overview and Components

Given a text\-to\-image diffusion model and a target conceptcc\(e\.g\., an NSFW category, an artistic style, or a celebrity identity\), our goal is to certify, with high statistical confidence, an upper bound on the probability that, after the unlearning phase, the model still generatesccunder adversarial prompting\. To this end, we propose the following pipeline with three main components:

- •Asteering unitSS, operating on the text encoder’s embedding space\. Given the embeddingxxof a concept\-related prompt,SSsearches for a nearby embeddingxsteered=S⁡\(x\)x\_\{\\mathrm\{steered\}\}=S\(x\)that remains adversarially concept\-bearing, probing the worst case a prompt\-level adversary could reach rather than testing a single fixed prompt\.
- •Anembedding classifierCc​l​f1C\_\{clf\_\{1\}\}, operating on the same text\-embedding space asSS, that independently judges whether a given embedding still encodescc\.Cc​l​f1C\_\{clf\_\{1\}\}is what confirms whetherSS’s search actually reached a valid concept\-bearing embedding, and its decision region defines the adversarial concept subspace used throughout this section\.
- •Apixel classifierCc​l​f2C\_\{clf\_\{2\}\}, operating on generated images, that independently judges whether the image the diffusion model’s U\-Net produces still exhibitscc, downstream of whatever embedding was fed to it\.

Together,SS,Cc​l​f1C\_\{clf\_\{1\}\}, andCc​l​f2C\_\{clf\_\{2\}\}trackccend to end from the adversarial search in text\-embedding space, through the U\-Net’s stochastic de\-noising, and finally to the observable output in pixel space\. Notably, the use of two external classifiers is necessary to overcome fundamental observability limitations\. For instance, the U\-Net produces high\-dimensional pixel outputs without inherent semantic meaning, requiringCc​l​f2C\_\{clf\_\{2\}\}to map them to a measurable binary semantic space\. Since both classifiers are imperfect proxies for ground truth, their generalisation errors are explicitly bounded and incorporated into the final certificate\. Their concrete instantiations are given in subsection[7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx2)\.

### Pipeline in Action

Our complete pipeline is depicted in Fig\.[1](https://arxiv.org/html/2609.12163#S1.F1)\. Letxxdenote the text embedding of a prompt associated with conceptcc\. The pipeline first applies the steering unitSS, producing a steered embeddingxsteered=S⁡\(x\)x\_\{\\mathrm\{steered\}\}=S\(x\)constrained to the adversarial concept subspace𝒳c​o​n​c​e​p​t\\mathcal\{X\}\_\{concept\}, defined as the region of the embedding space classified as concept\-present byCc​l​f1C\_\{clf\_\{1\}\}\. This reframes text\-stage evaluation as concept\-preserving adversarial exploration: rather than testing whetherSSremovesccfrom a fixed prompt, we assess whether it can be driven toward and maintained within the region still associated withcc, probing the neighbourhood ofccwithout relying on a finite set of manually crafted adversarial prompts\. We distinguish two outcomes\.Fp​r​o​m​p​tF\_\{prompt\}denotes steering failure, i\.e\.,Cc​l​f1C\_\{clf\_\{1\}\}does not detectccinxsteeredx\_\{\\mathrm\{steered\}\}, indicating that steering has left𝒳c​o​n​c​e​p​t\\mathcal\{X\}\_\{concept\}\. Conversely,¬Fp​r​o​m​p​t\\neg F\_\{prompt\}denotes successful steering, yielding a valid adversarial test case\. Only in the latter case isxsteeredx\_\{\\mathrm\{steered\}\}, together with encoded random noise, passed to the trained U\-Net\. A second classifier,Cc​l​f2C\_\{clf\_\{2\}\}, then operates on the generated pixel space to determine whether the resulting image exhibits the conceptcc\.

This probabilistic framework introduces inherent components of uncertainty throughout the pipeline that must be rigorously accounted for\. Specifically, our empirical measurements are subject to two primary sources of error: \(i\)sampling variance, since only finitely many steered embeddings and noise trajectories can be evaluated; and \(ii\)observability gaps, sinceCc​l​f1C\_\{clf\_\{1\}\}andCc​l​f2C\_\{clf\_\{2\}\}are imperfect learned models with non\-zero generalisation errors\. In the next section, we formally combine the resulting finite\-sample statistical margins with the classifiers’ worst\-case error bounds to obtain a unified certificate that rigorously guarantees the unlearning process despite these finite, imperfect measurements\.

### Theoretical Guarantees

To formalise the probabilistic certification of our pipeline, we must explicitly distinguish between the true, unobservable failure probabilities \(ground truth\) and the empirical rates reported by our proxy classifiers\. Over a joint draw of a concept\-related prompt and its resulting stochastic generation, we first defineFp​r​o​m​p​tF\_\{prompt\}as the true event that the steering unit fails to produce a valid adversarial embedding \(i\.e\., the true conceptccis absent fromxsteeredx\_\{\\mathrm\{steered\}\}\), withpp​r​o​m​p​t∗=P⁡\(Fp​r​o​m​p​t\)p^\{\*\}\_\{prompt\}=P\(F\_\{prompt\}\)representing the true steering failure rate\. Correspondingly, letpCc​l​f1p\_\{C\_\{clf\_\{1\}\}\}denote the observable rate at whichCc​l​f1C\_\{clf\_\{1\}\}reports a steering failure, and letec​l​f1∗e^\{\*\}\_\{clf\_\{1\}\}denote the true, intrinsic generalization error rate ofCc​l​f1C\_\{clf\_\{1\}\}\. Conditional on a successful steering step \(¬Fp​r​o​m​p​t\\neg F\_\{prompt\}\), we defineFu​n​e​tF\_\{unet\}as the true event that the generated image still exhibitscc\(i\.e\., the U\-Net fails to unlearn the concept despite being conditioned on a concept\-bearing embedding\)\. We denote this true conditional failure rate aspu​n​e​t∗=P⁡\(Fu​n​e​t∣¬Fp​r​o​m​p​t\)p^\{\*\}\_\{unet\}=P\(F\_\{unet\}\\mid\\neg F\_\{prompt\}\)\. Analogously for the pixel space, letpCc​l​f2p\_\{C\_\{clf\_\{2\}\}\}denote the observable rate at whichCc​l​f2C\_\{clf\_\{2\}\}flags the generated image as exhibitingcc, and letec​l​f2∗e^\{\*\}\_\{clf\_\{2\}\}denote the true generalization error rate ofCc​l​f2C\_\{clf\_\{2\}\}\. Finally, letFt​o​t​a​lF\_\{total\}denote the true event that the final output image exhibitscc, regardless of whether the failure originated in the text space or the pixel space, withpt​o​t​a​l∗=P⁡\(Ft​o​t​a​l\)p^\{\*\}\_\{total\}=P\(F\_\{total\}\)representing the true, end\-to\-end probability that the unlearned model generates the forbidden concept\. By establishing these definitions, we mathematically decouple the true phenomena \(pp​r​o​m​p​t∗p^\{\*\}\_\{prompt\},pu​n​e​t∗p^\{\*\}\_\{unet\},pt​o​t​a​l∗p^\{\*\}\_\{total\}\) from the imperfect measurements \(pCc​l​f1p\_\{C\_\{clf\_\{1\}\}\},pCc​l​f2p\_\{C\_\{clf\_\{2\}\}\}\) governed by the classifiers’ error margins \(ec​l​f1∗e^\{\*\}\_\{clf\_\{1\}\},ec​l​f2∗e^\{\*\}\_\{clf\_\{2\}\}\)\. The following lemmas leverage these definitions to construct a strict upper bound onpt​o​t​a​l∗p^\{\*\}\_\{total\}\.

To satisfy Definition[2](https://arxiv.org/html/2609.12163#Thmdefinition2), our framework evaluates a finite sample sizeNNto compute the empirical rates \(p^p​r​o​m​p​t\\hat\{p\}\_\{prompt\}andp^u​n​e​t\\hat\{p\}\_\{unet\}\)\. We then apply Lemma[1](https://arxiv.org/html/2609.12163#Thmlemma1)to rigorously bound the divergence between these empirical measurements and the true underlying probabilities \(pp​r​o​m​p​t∗p^\{\*\}\_\{prompt\}andpu​n​e​t∗p^\{\*\}\_\{unet\}\), systematically aggregating the statistical sampling margins \(ϵ\\epsilon\) with the structural classifier errors \(ec​l​f1∗e^\{\*\}\_\{clf\_\{1\}\}andec​l​f2∗e^\{\*\}\_\{clf\_\{2\}\}\) to compute the final certified boundB^=p^p​i​p​e​l​i​n​e\\hat\{B\}=\\hat\{p\}\_\{pipeline\}\.

###### Lemma 1\(One\-Sided[Hoeffding \(1963\)](https://arxiv.org/html/2609.12163#bib.bib2)’s Inequality\)\.

LetX1,…,XnX\_\{1\},\\dots,X\_\{n\}be independent random variables withXi∈\[0,1\]X\_\{i\}\\in\[0,1\],μ=𝔼⁡\[Xi\]\\mu=\\mathbb\{E\}\[X\_\{i\}\], andμ^=1n​∑i=1nXi\\hat\{\\mu\}=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}X\_\{i\}\. Then for anyϵ\>0\\epsilon\>0,

Pr⁡\(μ−μ^≥ϵ\)≤exp⁡\(−2​n​ϵ2\)\.\\Pr\(\\mu\-\\hat\{\\mu\}\\geq\\epsilon\)\\leq\\exp\(\-2n\\epsilon^\{2\}\)\.

By exploiting Lemma[1](https://arxiv.org/html/2609.12163#Thmlemma1)we derive the following lemmas\.

###### Lemma 2\(Text Space: Steering Success Bound\)\.

Letp^p​r​o​m​p​t\\hat\{p\}\_\{prompt\}be the empirical rate, overNNindependent concept\-related prompts, at whichCc​l​f1C\_\{clf\_\{1\}\}fails to confirm the concept is present in the steered embedding\. IfN≥ln⁡\(1/δp​r​o​m​p​t\)2​ϵp​r​o​m​p​t2,N\\geq\\frac\{\\ln\(1/\\delta\_\{prompt\}\)\}\{2\\epsilon\_\{prompt\}^\{2\}\},thenPr⁡\(pCc​l​f1≤p^p​r​o​m​p​t\+ϵp​r​o​m​p​t\)≥1−δp​r​o​m​p​t\\Pr\\big\(p\_\{C\_\{clf\_\{1\}\}\}\\leq\\hat\{p\}\_\{prompt\}\+\\epsilon\_\{prompt\}\\big\)\\geq 1\-\\delta\_\{prompt\}\.

###### Lemma 3\(Embedding Classifier Calibration\)\.

Lete^c​l​f1\\hat\{e\}\_\{clf\_\{1\}\}be the empirical error rate ofCc​l​f1C\_\{clf\_\{1\}\}, evaluated on a validation set ofWWindependently drawn embeddings with known ground\-truth concept labels\. IfW≥ln⁡\(1/δc​l​f1\)2​ϵc​l​f12,W\\geq\\frac\{\\ln\(1/\\delta\_\{clf\_\{1\}\}\)\}\{2\\epsilon\_\{clf\_\{1\}\}^\{2\}\},thenPr⁡\(ec​l​f1∗≤e^c​l​f1\+ϵc​l​f1\)≥1−δc​l​f1\\Pr\\big\(e^\{\*\}\_\{clf\_\{1\}\}\\leq\\hat\{e\}\_\{clf\_\{1\}\}\+\\epsilon\_\{clf\_\{1\}\}\\big\)\\geq 1\-\\delta\_\{clf\_\{1\}\}\.

###### Lemma 4\(Pixel Space: Classifier Calibration\)\.

Lete^c​l​f2\\hat\{e\}\_\{clf\_\{2\}\}be the empirical error rate ofCc​l​f2C\_\{clf\_\{2\}\}evaluated on a validation set ofVVindependently drawn images\. IfV≥ln⁡\(1/δc​l​f2\)2​ϵc​l​f22,V\\geq\\frac\{\\ln\(1/\\delta\_\{clf\_\{2\}\}\)\}\{2\\epsilon\_\{clf\_\{2\}\}^\{2\}\},thenPr⁡\(ec​l​f2∗≤e^c​l​f2\+ϵc​l​f2\)≥1−δc​l​f2\\Pr\\big\(e^\{\*\}\_\{clf\_\{2\}\}\\leq\\hat\{e\}\_\{clf\_\{2\}\}\+\\epsilon\_\{clf\_\{2\}\}\\big\)\\geq 1\-\\delta\_\{clf\_\{2\}\}\.

###### Lemma 5\(Pixel Space: U\-Net Adversarial Leakage Bound\)\.

Letp^u​n​e​t\\hat\{p\}\_\{unet\}be the empirical rate at whichCc​l​f2C\_\{clf\_\{2\}\}detects the concept inMMimages generated from prompts confirmed byCc​l​f1C\_\{clf\_\{1\}\}to be concept\-bearing \(i\.e\.¬Fp​r​o​m​p​t\\neg F\_\{prompt\}held\)\. LetpCc​l​f2p\_\{C\_\{clf\_\{2\}\}\}be the expected detection rate ofCc​l​f2C\_\{clf\_\{2\}\}\. IfM≥ln⁡\(1/δu​n​e​t\)2​ϵu​n​e​t2,M\\geq\\frac\{\\ln\(1/\\delta\_\{unet\}\)\}\{2\\epsilon\_\{unet\}^\{2\}\},thenPr⁡\(pCc​l​f2≤p^u​n​e​t\+ϵu​n​e​t\)≥1−δu​n​e​t\\Pr\\big\(p\_\{C\_\{clf\_\{2\}\}\}\\leq\\hat\{p\}\_\{unet\}\+\\epsilon\_\{unet\}\\big\)\\geq 1\-\\delta\_\{unet\}\.

By combining these lemmas, we can provide the following formal theoretical result\.

###### Theorem 1\(Certified Adversarial Unlearning Leakage Bound\)\.

Letp^p​i​p​e​l​i​n​e=p^p​r​o​m​p​t\+p^u​n​e​t\\hat\{p\}\_\{pipeline\}=\\hat\{p\}\_\{prompt\}\+\\hat\{p\}\_\{unet\}\. For total error toleranceϵ∈\(0,1\)\\epsilon\\in\(0,1\)and total confidence parameterδ∈\(0,1\)\\delta\\in\(0,1\), partition the budgets such that

ϵ\\displaystyle\\epsilon=e^c​l​f1\+ϵc​l​f1\+e^c​l​f2\+ϵc​l​f2\\displaystyle=\\hat\{e\}\_\{clf\_\{1\}\}\+\\epsilon\_\{clf\_\{1\}\}\+\\hat\{e\}\_\{clf\_\{2\}\}\+\\epsilon\_\{clf\_\{2\}\}\+ϵp​r​o​m​p​t\+ϵu​n​e​t,\\displaystyle\\quad\{\}\+\\epsilon\_\{prompt\}\+\\epsilon\_\{unet\},δ\\displaystyle\\delta=δp​r​o​m​p​t\+δc​l​f1\+δu​n​e​t\+δc​l​f2\.\\displaystyle=\\delta\_\{prompt\}\+\\delta\_\{clf\_\{1\}\}\+\\delta\_\{unet\}\+\\delta\_\{clf\_\{2\}\}\.If the sample sizes\(N,M,V,W\)\(N,M,V,W\)satisfy the one\-sided bounds in Lemmas[2](https://arxiv.org/html/2609.12163#Thmlemma2)\-[5](https://arxiv.org/html/2609.12163#Thmlemma5), then

Pr⁡\(pt​o​t​a​l∗≤p^p​i​p​e​l​i​n​e\+ϵ\)≥1−δ\.\\Pr\\big\(p^\{\*\}\_\{total\}\\leq\\hat\{p\}\_\{pipeline\}\+\\epsilon\\big\)\\geq 1\-\\delta\.

###### Proof\.

By the law of total probability, the true end\-to\-end failure rate decomposes as

P⁡\(Ft​o​t​a​l\)=P⁡\(Fp​r​o​m​p​t\)​P​\(Ft​o​t​a​l∣Fp​r​o​m​p​t\)\+\\displaystyle P\(F\_\{total\}\)=P\(F\_\{prompt\}\)P\(F\_\{total\}\\mid F\_\{prompt\}\)\+P⁡\(¬Fp​r​o​m​p​t\)​P​\(Ft​o​t​a​l∣¬Fp​r​o​m​p​t\)\.\\displaystyle P\(\\neg F\_\{prompt\}\)P\(F\_\{total\}\\mid\\neg F\_\{prompt\}\)\.Conservatively treating an unconfirmed steering attempt as a potential failure boundsP⁡\(Ft​o​t​a​l∣Fp​r​o​m​p​t\)≤1P\(F\_\{total\}\\mid F\_\{prompt\}\)\\leq 1\. SinceP⁡\(Ft​o​t​a​l∣¬Fp​r​o​m​p​t\)=pu​n​e​t∗P\(F\_\{total\}\\mid\\neg F\_\{prompt\}\)=p^\{\*\}\_\{unet\}by definition andP⁡\(¬Fp​r​o​m​p​t\)≤1P\(\\neg F\_\{prompt\}\)\\leq 1, we obtain the absolute upper boundpt​o​t​a​l∗≤pp​r​o​m​p​t∗\+pu​n​e​t∗p^\{\*\}\_\{total\}\\leq p^\{\*\}\_\{prompt\}\+p^\{\*\}\_\{unet\}\.

To bound these unobservable true rates, we apply our observability constraints,\|pCc​l​f1−pp​r​o​m​p​t∗\|≤ec​l​f1∗\|p\_\{C\_\{clf\_\{1\}\}\}\-p^\{\*\}\_\{prompt\}\|\\leq e^\{\*\}\_\{clf\_\{1\}\}and\|pCc​l​f2−pu​n​e​t∗\|≤ec​l​f2∗\|p\_\{C\_\{clf\_\{2\}\}\}\-p^\{\*\}\_\{unet\}\|\\leq e^\{\*\}\_\{clf\_\{2\}\}\. Substituting the proxy probabilities and true error rates with their probabilistically bounded empirical estimations yieldspp​r​o​m​p​t∗≤p^p​r​o​m​p​t\+e^c​l​f1\+ϵp​r​o​m​p​t\+ϵc​l​f1p^\{\*\}\_\{prompt\}\\leq\\hat\{p\}\_\{prompt\}\+\\hat\{e\}\_\{clf\_\{1\}\}\+\\epsilon\_\{prompt\}\+\\epsilon\_\{clf\_\{1\}\}andpu​n​e​t∗≤p^u​n​e​t\+e^c​l​f2\+ϵu​n​e​t\+ϵc​l​f2p^\{\*\}\_\{unet\}\\leq\\hat\{p\}\_\{unet\}\+\\hat\{e\}\_\{clf\_\{2\}\}\+\\epsilon\_\{unet\}\+\\epsilon\_\{clf\_\{2\}\}\. Summing these two inequalities directly bounds the true failure probability such thatpt​o​t​a​l∗≤p^p​i​p​e​l​i​n​e\+ϵp^\{\*\}\_\{total\}\\leq\\hat\{p\}\_\{pipeline\}\+\\epsilon, wherep^p​i​p​e​l​i​n​e=p^p​r​o​m​p​t\+p^u​n​e​t\\hat\{p\}\_\{pipeline\}=\\hat\{p\}\_\{prompt\}\+\\hat\{p\}\_\{unet\}andϵ\\epsilonaggregates all intrinsic classifier errors and statistical margins\.

Because this combined upper bound depends on the intersection of four independently estimated empirical bounds, by union bound over their respective failure probabilities the joint probability that all four statistical bounds hold simultaneously is at least1−\(δp​r​o​m​p​t\+δc​l​f1\+δu​n​e​t\+δc​l​f2\)=1−δ1\-\(\\delta\_\{prompt\}\+\\delta\_\{clf\_\{1\}\}\+\\delta\_\{unet\}\+\\delta\_\{clf\_\{2\}\}\)=1\-\\delta, obtainingPr⁡\(pt​o​t​a​l∗≤p^p​i​p​e​l​i​n​e\+ϵ\)≥1−δ\\Pr\(p^\{\*\}\_\{total\}\\leq\\hat\{p\}\_\{pipeline\}\+\\epsilon\)\\geq 1\-\\delta\. ∎

###### Example 1\.

We instantiate Theorem[1](https://arxiv.org/html/2609.12163#Thmtheorem1)on the base, unedited SDXL\-Turbo model for the NSFW/violence concept category, i\.e\., before applying any unlearning method\. This provides a baseline against which the certificate values of the unlearned checkpoints in Section[7](https://arxiv.org/html/2609.12163#S7)can be compared\. Suppose we select a target confidence of1−δ=99%1\-\\delta=99\\%and we allocate the budget error as:

ϵp​r​o​m​p​t=0\.005\\epsilon\_\{prompt\}=0\.005δp​r​o​m​p​t=0\.001\\delta\_\{prompt\}=0\.001ϵu​n​e​t=0\.015\\epsilon\_\{unet\}=0\.015δu​n​e​t=0\.004\\delta\_\{unet\}=0\.004ϵc​l​f1=0\.005\\epsilon\_\{clf\_\{1\}\}=0\.005δc​l​f1=0\.001\\delta\_\{clf\_\{1\}\}=0\.001ϵc​l​f2=0\.015\\epsilon\_\{clf\_\{2\}\}=0\.015δc​l​f2=0\.004\\delta\_\{clf\_\{2\}\}=0\.004which sum toδ=0\.01\\delta=0\.01as required\. By Lemmas[2](https://arxiv.org/html/2609.12163#Thmlemma2)\-[5](https://arxiv.org/html/2609.12163#Thmlemma5), these slacks fix the required sample sizes, drawn from 714 concept\-targeted validation prompts\. The text\-only quantities, steering success and embedding\-classifier calibration, needN=W≈138,156N=W\\approx 138\{,\}156samples; the image\-generation quantities, pixel\-classifier calibration and U\-Net leakage, needV=M≈12,270V=M\\approx 12\{,\}270samples\.

Running the pipeline over these samples gives the empirical estimates

p^p​r​o​m​p​t\\displaystyle\\hat\{p\}\_\{prompt\}=0\.268,\\displaystyle=0\.268,p^u​n​e​t\\displaystyle\\hat\{p\}\_\{unet\}=0\.158,\\displaystyle=0\.158,e^c​l​f1\\displaystyle\\hat\{e\}\_\{clf\_\{1\}\}=0\.134,\\displaystyle=0\.134,e^c​l​f2\\displaystyle\\hat\{e\}\_\{clf\_\{2\}\}=0\.137\.\\displaystyle=0\.137\.By Theorem[1](https://arxiv.org/html/2609.12163#Thmtheorem1),p^p​i​p​e​l​i​n​e=p^p​r​o​m​p​t\+p^u​n​e​t=0\.426\\hat\{p\}\_\{pipeline\}=\\hat\{p\}\_\{prompt\}\+\\hat\{p\}\_\{unet\}=0\.426and

ϵ\\displaystyle\\epsilon=e^c​l​f1\+ϵc​l​f1\+e^c​l​f2\+ϵc​l​f2\\displaystyle=\\hat\{e\}\_\{clf\_\{1\}\}\+\\epsilon\_\{clf\_\{1\}\}\+\\hat\{e\}\_\{clf\_\{2\}\}\+\\epsilon\_\{clf\_\{2\}\}\+ϵp​r​o​m​p​t\+ϵu​n​e​t=0\.311,\\displaystyle\\quad\{\}\+\\epsilon\_\{prompt\}\+\\epsilon\_\{unet\}=0\.311,so

Pr⁡\(pt​o​t​a​l∗≤0\.737\)≥0\.99\.\\Pr\\big\(p^\{\*\}\_\{total\}\\leq 0\.737\\big\)\\geq 0\.99\.
With 99% confidence, the base SDXL\-Turbo model’s true probability of generating the targeted concept\(violence in this case\) under adversarial prompting anywhere in the probe\-identified concept subspace is at most 73\.7%: a loose bound, as expected, since no unlearning has been applied yet\.

In the next section, we compute the same certificate for each of the six unlearning techniques and report the resulting reduction in the bound, if any\. Unlike the finite\-budget ASR curves in Section[4](https://arxiv.org/html/2609.12163#S4), this comparison provides an absolute certified upper bound rather than relying solely on empirical failure rates\.

Table 1:Attack success rates across unlearning methods by domain\. For every category, the highest value is in bold and the second highest underlined\.

## 7Experiments and Results

### Evaluation Setup

#### Models and Datasets

We evaluate the certification pipeline on SD\-Turbo and SDXL\-Turbo, distilled few\-step T2I diffusion models built on Stable Diffusion 1\.5 and SDXL respectively\. These models span differnet architecute of the text encoders \(single encoder vs\. dual encoder\), letting us test the pipeline across both designs\.

We certify unlearning across three concept categories:

- •Artistic Styles\.Prompts are drawn from UnlearnCanvas\([Zhang et al\. 2024a](https://arxiv.org/html/2609.12163#bib.bib25)\), a 60\-style benchmark; UnlearnCanvas is the standard evaluation set for style erasure in T2I diffusion models\. Its prompts are short and templated, so we paraphrase each one with Claude Sonnet 4\.5\([Anthropic 2025](https://arxiv.org/html/2609.12163#bib.bib28)\)into diverse variants, giving 2,400 training and 600 validation prompts per style\. We select 10 of the 60 styles for certification\.
- •Not Safe For Work\(NSFW\)\.Target prompts are drawn from CoProV2\([Liu et al\. 2025](https://arxiv.org/html/2609.12163#bib.bib24)\), which spans seven categories: Hate, Sexual, Violence, Shocking, Illegal Activity, Harassment, and Self\-harm\. CoProV2 prompts are empirically confirmed to elicit NSFW generations on SD\-Turbo\-family models, making them a realistic source for the categories our certificate must bound\. We select the three categories with the most prompts, Hate, Sexual, and Violence, and filter each with ModerationBERT\([ifmain 2024](https://arxiv.org/html/2609.12163#bib.bib26)\)to retain the most harmful prompts, giving 2,400 training and 600 validation prompts per category\.
- •Celebrity \.Target prompts are built from a 200\-identity subset of CelebA\([Liu et al\. 2015](https://arxiv.org/html/2609.12163#bib.bib27)\); CelebA gives real, verifiable identities rather than synthetic names, so identity\-erasure results are checkable against a known ground truth\. We select 10 identities and, as with Art, diversify CelebA’s templated prompts with Claude Sonnet 4\.5, giving 2,400 training and 600 validation prompts per identity\.

Control set\.Every concept’s 2,400\-prompt training set pairs target prompts with an equal\-sized control set of generic, concept\-unrelated prompts drawn from a single shared pool derived from the reLAION 2B dataset\([LAION e\.V\. 2024](https://arxiv.org/html/2609.12163#bib.bib29)\), exclusive of the target concept prompts\.

#### Certification Pipeline Components

For each concept, the probe is a logistic regression classifier fit on mean\-pooled prompt embeddings from the model’s text encoder\(s\); its normalized weight vector gives the steering direction used bySS\.Cc​l​f1C\_\{clf\_\{1\}\}is a logistic regression over the text encoder’s mean\-pooled prompt embedding\.Cc​l​f2C\_\{clf\_\{2\}\}is a logistic regression classifier over CLIP image embeddings of generated images\. Each concept’s target 2,400\-prompt training set is split into three equal, non\-overlapping 800\-prompt shards combined with 800\-neutral control prompt sets, used to train the probe,Cc​l​f1C\_\{clf\_\{1\}\}, andCc​l​f2C\_\{clf\_\{2\}\}\.

Certification uses the same\(ϵ,δ\)\(\\epsilon,\\delta\)budget allocation and 99% target confidence as in Example[1](https://arxiv.org/html/2609.12163#Thmexample1):ϵp​r​o​m​p​t=ϵc​l​f1=0\.005\\epsilon\_\{prompt\}=\\epsilon\_\{clf\_\{1\}\}=0\.005,ϵu​n​e​t=ϵc​l​f2=0\.015\\epsilon\_\{unet\}=\\epsilon\_\{clf\_\{2\}\}=0\.015,δp​r​o​m​p​t=δc​l​f1=0\.001\\delta\_\{prompt\}=\\delta\_\{clf\_\{1\}\}=0\.001,δu​n​e​t=δc​l​f2=0\.004\\delta\_\{unet\}=\\delta\_\{clf\_\{2\}\}=0\.004, givingN=W≈138,156N=W\\approx 138\{,\}156text\-only samples andV=M≈12,270V=M\\approx 12\{,\}270image\-generation samples per concept, drawn from each concept’snn= 600 validation prompts\. Every prompt is expanded toN/nN/nprompt embeddings by steering within the concept bounds in the steering direction identified by the probe\.

#### Unlearning Techniques

We evaluate six unlearning techniques: CA\([Kumari et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib22)\),ESD\([Gandikota et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib5)\), MACE\([Lu et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib8)\), SSD\([Foster et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib31)\), UCE\([Gandikota et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib6)\), and CoGFD\([Nie et al\. 2025](https://arxiv.org/html/2609.12163#bib.bib30)\)\. These six span the main mechanisms used for T2I concept unlearning, gradient\-based fine\-tuning, closed\-form weight edits, parameter\-importance dampening, and structured feature decoupling, respectively, letting us test whether certified leakage bounds are sensitive to how the underlying edit is performed\.

#### Adversarial Baselines

We measure empirical robustness with three adversarial prompt search methods, used in their standard configuration for both models except where noted\. Ring\-A\-Bell\([Tsai et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib12)\)is a static, black\-box attack that extracts a concept vector from contrastive prompt pairs and searches over a proxy visual encoder with a genetic algorithm, without querying the target model\. MMA\-Diffusion\([Yang et al\. 2024](https://arxiv.org/html/2609.12163#bib.bib13)\)is an adaptive attack that optimizes adversarial prompt tokens directly against the target model’s text encoder\. P4D\([Chin et al\. 2023](https://arxiv.org/html/2609.12163#bib.bib14)\)is an adaptive, white\-box attack that optimizes a continuous adversarial embedding by minimizing the discrepancy between the target model’s noise prediction and that of an unprotected reference model\. Together these cover both threat levels: Ring\-A\-Bell represents a static adversary with no access to the deployed model, while MMA\-Diffusion and P4D represent adaptive adversaries with gradient access to it\. P4D’s optimization backpropagates directly through the model’s U\-Net cross\-attention via pipeline code that hardcodes a single text encoder and embedding stream; this is incompatible with SDXL\-Turbo’s dual\-encoder conditioning, so P4D is evaluated only on SD\-Turbo in Table[1](https://arxiv.org/html/2609.12163#S6.T1)\.

### Results

#### Comparison against robustness metrics

For every \(model, unlearning technique\) pair, we unlearn the targeted concepts using the six techniques independently for every concept, then run adversarial attacks against the unlearned model and separately compute our certificate on the validation prompts, using the certification pipeline\. Table[1](https://arxiv.org/html/2609.12163#S6.T1)reports the mean attack success rates of the baseline unlearned models and the mean certified bound \(Ours\), averaged over the 10 art styles, 3 NSFW categories, and 10 celebrity identities in each column group\.

Across the 36 \(unlearning method, category\) cases, the certified bound exceeds every reported baseline in 32 \(88\.89%\) cases across both SD\-Turbo and SDXL\-Tubro models, showing the incomplete nature of existing robustness metrics to capture the unlearning capabilities\.

The two largest gaps between the certification bound and ASR are both on the Celebrity category: SSD on SD\-Turbo \(Ours 0\.652 vs\. a 0\.074–0\.133 baseline range, a margin of at least 0\.52\) and ESD on SDXL\-Turbo \(Ours 0\.542 vs\. 0\.023–0\.108, a margin of at least 0\.43\), exposing major errors in the bounds\. At the other extreme, the certification bound rides the baselines closely in several of the cases, e\.g\. UCE’s NSFW bound on SD\-Turbo \(0\.492\) sits just 0\.009 above the best baseline \(0\.483\); in UCE and CoGFD the baseline ASR on Art and Celeb stays just below the certification bound by 0\.09\. The certificate is therefore not a uniformly loose bound, it stays close to empirical ASR where the two agree, and diverges sharply exactly on the identity\-erasure cases where residual leakage is largest, which is precisely where an incomplete metric is most dangerous to rely on\.

We also notice that, in general, the adaptive adversarial attacks \(MMA Diffusion, and P4D\) are able to capture more corner cases than static adversarial attacks \(Ring\-a\-Bell\)\. Investigating further on the cases where the attack surface identified by the existing robustness checks is marginally greater than that identified by our certification bound, we observe that the adversarial prompts were hardly semantically coherent \(see examples in the Appendix A\.3\), showcasing a minor limitation of our certification bound\. The steering direction identified by our probe could potentially miss these outlier cases\. We hypothesize that this could be solved using these adversarial prompts itself for training the probes, thus making the steering direction more informed of these cases, but we leave this analysis for future work\. NSFW has 3 concepts against 10 for Art and Celeb, so its per\-technique mean is more sensitive to any single concept’s certificate, a plausible source for these outliers\.

#### Runtime analysis

From table[2](https://arxiv.org/html/2609.12163#S7.T2), we can conclude that computing a certification bound takes less time than the unlearning robustness checks by adaptive adversaries\.

Table 2:Runtime comparison of attack methods on one A100 80 GB GPU

## 8Conclusion

To conclude, we empirically demonstrated that existing robustness metrics for T2I concept unlearning evaluation are unreliable proxy for residual risk as the attack surface is a monotonically rising function of the budget\. We propose a certification framework for estimating a comprehensive attack surface, giving a certified bound for leakage\. Empirical results shows that existing robustness metrics can substantially understate an unlearning technique’s true residual risk, and that certification is a necessary complement, not merely an alternative, to attack\-based auditing\.

## References

- Anthropic \(2025\)AnthropicClaude Sonnet 4\.5 System Card\.Anthropic\.Note:https://www\.anthropic\.com/claude\-sonnet\-4\-5\-system\-cardCited by:[1st item](https://arxiv.org/html/2609.12163#A1.I1.i1.p1.1),[1st item](https://arxiv.org/html/2609.12163#S7.I1.i1.p1.1)\.
- Chinet al\.\(2023\)Z\. Chin, C\. Jiang, C\. Huang, P\. Chen, and W\. ChiuPrompting4Debugging: red\-teaming text\-to\-image diffusion models by finding problematic prompts\.arXiv preprint arXiv:2309\.06135\.Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p2.1),[§2](https://arxiv.org/html/2609.12163#S2.p3.1),[§4](https://arxiv.org/html/2609.12163#S4.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx4.p1.1)\.
- Cohenet al\.\(2019\)J\. Cohen, E\. Rosenfeld, and Z\. KolterCertified adversarial robustness via randomized smoothing\.ICML\.Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p4.1)\.
- Cywiński and Deja \(2025\)B\. Cywiński and K\. DejaSAeUron: interpretable concept unlearning in diffusion models with sparse autoencoders\.arXiv preprint arXiv:2501\.18052\.Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1)\.
- Fanet al\.\(2024\)C\. Fan, J\. Liu, Y\. Zhang, E\. Wong, D\. Wei, and S\. LiuSalUn: empowering machine unlearning via gradient\-based weight saliency in both image classification and generation\.InICLR,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1)\.
- Fosteret al\.\(2023\)J\. Foster, S\. Schoepf, and A\. BrintrupFast machine unlearning without retraining through selective synaptic dampening\.arXiv preprint arXiv:2308\.07707\.Cited by:[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx3.p1.1)\.
- Gandikotaet al\.\(2023\)R\. Gandikota, J\. Materzynska, J\. Fiotto\-Kaufman, and D\. BauErasing concepts from diffusion models\.InICCV,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1),[§4](https://arxiv.org/html/2609.12163#S4.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx3.p1.1)\.
- Gandikotaet al\.\(2024\)R\. Gandikota, H\. Orgad, Y\. Belinkov, J\. Materzyńska, and D\. BauUnified concept editing in diffusion models\.InWACV,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1),[§4](https://arxiv.org/html/2609.12163#S4.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx3.p1.1)\.
- Gaoet al\.\(2025\)L\. Gao, T\. D\. la Tour, H\. Tillman, G\. Goh, R\. Troll, A\. Radford, I\. Sutskever, J\. Leike, and J\. WuScaling and evaluating sparse autoencoders\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=tcsZt9ZNKD)Cited by:[Appendix C](https://arxiv.org/html/2609.12163#A3.SSx2.SSSx1.p1.1)\.
- Google Research \(2018\)Google ResearchConceptual captions\.Note:https://ai\.google\.com/research/ConceptualCaptions/Accessed: 2026\-08\-25Cited by:[Appendix C](https://arxiv.org/html/2609.12163#A3.SSx2.SSSx1.p1.1)\.
- Guoet al\.\(2020\)C\. Guo, T\. Goldstein, A\. Hannun, and L\. Van Der MaatenCertified data removal from machine learning models\.InICML,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p4.1)\.
- Hoeffding \(1963\)W\. HoeffdingProbability inequalities for sums of bounded random variables\.Journal of the American statistical association58\(301\),pp\. 13–30\.Cited by:[Lemma 1](https://arxiv.org/html/2609.12163#Thmlemma1)\.
- ifmain \(2024\)ifmainModerationBERT\-En\-02\.Hugging Face\.Note:https://huggingface\.co/ifmain/ModerationBERT\-En\-02Multi\-label text moderation model fine\-tuned from bert\-base\-multilingual\-cased on the text\-moderation\-410K datasetCited by:[2nd item](https://arxiv.org/html/2609.12163#A1.I1.i2.p1.1),[2nd item](https://arxiv.org/html/2609.12163#S7.I1.i2.p1.1)\.
- Jainet al\.\(2025\)A\. Jain, Y\. Kobayashi, T\. Shibuya, Y\. Takida, N\. Memon, J\. Togelius, and Y\. MitsufujiTraSCE: trajectory steering for concept erasure\.External Links:2412\.07658,[Link](https://arxiv.org/abs/2412.07658)Cited by:[§4](https://arxiv.org/html/2609.12163#S4.p2.1)\.
- Kumaret al\.\(2023\)A\. Kumar, C\. Agarwal, S\. Srinivas, S\. Feizi, and H\. LakkarajuCertifying llm safety against adversarial prompting\.arXiv preprint arXiv:2309\.02705\.Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p4.1)\.
- Kumariet al\.\(2023\)N\. Kumari, B\. Zhang, S\. Wang, E\. Shechtman, R\. Zhang, and J\. ZhuAblating concepts in text\-to\-image diffusion models\.InICCV,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx3.p1.1)\.
- LAION e\.V\. \(2024\)LAION e\.V\.relaion2B\-en\-research\-safe\.Hugging Face\.Note:https://huggingface\.co/datasets/laion/relaion2B\-en\-research\-safeCited by:[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx1.p3.1)\.
- Liuet al\.\(2025\)R\. Liu, I\. C\. Chen, J\. Gu, J\. Zhang, R\. Pi, Q\. Chen, P\. Torr, A\. Khakzar, and F\. PizzatiAlignGuard: scalable safety alignment for text\-to\-image generation\.In2025 IEEE/CVF International Conference on Computer Vision \(ICCV\),Vol\.,pp\. 17024–17034\.External Links:[Document](https://dx.doi.org/10.1109/ICCV51701.2025.01581)Cited by:[2nd item](https://arxiv.org/html/2609.12163#A1.I1.i2.p1.1),[2nd item](https://arxiv.org/html/2609.12163#S7.I1.i2.p1.1)\.
- Liuet al\.\(2015\)Z\. Liu, P\. Luo, X\. Wang, and X\. TangDeep learning face attributes in the wild\.InProceedings of International Conference on Computer Vision \(ICCV\),Cited by:[3rd item](https://arxiv.org/html/2609.12163#A1.I1.i3.p1.1),[3rd item](https://arxiv.org/html/2609.12163#S7.I1.i3.p1.1)\.
- Luet al\.\(2024\)S\. Lu, Z\. Wang, L\. Li, Y\. Liu, and A\. W\. KongMACE: mass concept erasure in diffusion models\.InCVPR,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx3.p1.1)\.
- Lyuet al\.\(2024\)M\. Lyu, Y\. Yang, H\. Hong, H\. Chen, X\. Jin, Y\. He, H\. Xue, J\. Han, and G\. DingOne\-dimensional adapter to rule them all: concepts, diffusion models and erasing applications\.InCVPR,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1)\.
- Nieet al\.\(2025\)H\. Nie, Q\. Yao, Y\. Liu, Z\. Wang, and Y\. BianErasing concept combination from text\-to\-image diffusion model\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=OBjF5I4PWg)Cited by:[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx3.p1.1)\.
- Podellet al\.\(2023\)D\. Podell, Z\. English, K\. Lacey, A\. Blattmann, T\. Dockhorn, J\. Müller, J\. Penna, and R\. RombachSDXL: improving latent diffusion models for high\-resolution image synthesis\.arXiv preprint arXiv:2307\.01952\.Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1)\.
- Rameshet al\.\(2022\)A\. Ramesh, P\. Dhariwal, A\. Nichol, C\. Chu, and M\. ChenHierarchical text\-conditional image generation with clip latents\.arXiv preprint arXiv:2204\.06125\.Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1)\.
- Randoet al\.\(2022\)J\. Rando, D\. Paleka, D\. Lindner, L\. Heim, and F\. TramèrRed\-teaming the stable diffusion safety filter\.InNeurIPS ML Safety Workshop,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p2.1),[§2](https://arxiv.org/html/2609.12163#S2.p3.1)\.
- Renet al\.\(2025\)J\. Ren, K\. Chen, Y\. Cui, S\. Zeng, H\. Liu, Y\. Xing, J\. Tang, and L\. LyuSix\-cd: benchmarking concept removals for benign text\-to\-image diffusion models\.InCVPR,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p2.1)\.
- Rombachet al\.\(2022\)R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. OmmerHigh\-resolution image synthesis with latent diffusion models\.InCVPR,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§3](https://arxiv.org/html/2609.12163#S3.SSx1.p1.1),[§3](https://arxiv.org/html/2609.12163#S3.SSx1.p1.3)\.
- Schramowskiet al\.\(2023\)P\. Schramowski, M\. Brack, B\. Deiseroth, and K\. KerstingSafe latent diffusion: mitigating inappropriate degeneration in diffusion models\.InCVPR,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p2.1)\.
- Sekhariet al\.\(2021\)A\. Sekhari, J\. Acharya, G\. Kamath, and A\. T\. SureshRemember what you want to forget: algorithms for machine unlearning\.InNeurIPS,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p4.1)\.
- Tsaiet al\.\(2023\)Y\. Tsai, C\. Hsu, C\. Xie, C\. Lin, J\. Chen, B\. Li, P\. Chen, C\. Yu, and C\. HuangRing\-a\-bell\! how reliable are concept removal methods for diffusion models?\.arXiv preprint arXiv:2310\.10012\.Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p3.1),[§4](https://arxiv.org/html/2609.12163#S4.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx4.p1.1)\.
- Yanget al\.\(2024\)Y\. Yang, R\. Gao, X\. Wang, T\. Ho, N\. Xu, and Q\. XuMMA\-diffusion: multimodal attack on diffusion models\.InCVPR,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p3.1),[§4](https://arxiv.org/html/2609.12163#S4.p2.1),[§7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx4.p1.1)\.
- Zhanget al\.\(2024a\)Y\. Zhang, C\. Fan, Y\. Zhang, Y\. Yao, J\. Jia, J\. Liu, G\. Zhang, G\. Liu, R\. Kompella, X\. Liu, and S\. LiuUNLEARNCANVAS: a stylized image dataset for enhanced machine unlearning evaluation in diffusion models\.InProceedings of the 38th International Conference on Neural Information Processing Systems,NIPS ’24,Red Hook, NY, USA\.External Links:ISBN 9798331314385Cited by:[1st item](https://arxiv.org/html/2609.12163#A1.I1.i1.p1.1),[1st item](https://arxiv.org/html/2609.12163#S7.I1.i1.p1.1)\.
- Zhanget al\.\(2024b\)Y\. Zhang, X\. Chen, J\. Jia, Y\. Zhang, C\. Fan, J\. Liu, M\. Hong, K\. Ding, and S\. LiuDefensive unlearning with adversarial training for robust concept erasure in diffusion models\.InNeurIPS,Cited by:[§1](https://arxiv.org/html/2609.12163#S1.p1.1),[§2](https://arxiv.org/html/2609.12163#S2.p1.1)\.
- Zhanget al\.\(2024c\)Y\. Zhang, J\. Jia, X\. Chen, A\. Chen, Y\. Zhang, J\. Liu, K\. Ding, and S\. LiuTo generate or not? safety\-driven unlearned diffusion models are still easy to generate unsafe images … for now\.InECCV,Cited by:[§2](https://arxiv.org/html/2609.12163#S2.p3.1)\.

## Appendix ADataset Construction

### A\.1: Dataset for probe and classifier training

As discussed in[7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx1), we demonstrate the certification framework working on multiple concepts from three major domains of Artistic Style, NSFW, and Celebrity\. The detailed description of the dataset usage and filtering is as follows:

- •Artistic Styles\.Prompts are drawn from UnlearnCanvas\([Zhang et al\. 2024a](https://arxiv.org/html/2609.12163#bib.bib25)\)\(repository link:https://huggingface\.co/datasets/OPTML\-Group/UnlearnCanvas\)\. The dataset originally consists of prompt\-image pairs for 60 different artistic styles\. We pick 10 artistic styles from the dataset to perform unlearning, namely: Fauvism, Monet, Pointillism, Ukiyoe, Artist Sketch, Mosaic, Picasso, Van Gogh, Abstractionism, and Crayon\. The original prompts in the dataset were limited and templated e\.g\.: "A <object\> image in <style\_name\> style", therefore, we paraphrased these benign prompts with Claude Sonnet 4\.5\([Anthropic 2025](https://arxiv.org/html/2609.12163#bib.bib28)\)to add diversity to the dataset, giving 2,400 training and 600 validation prompts per style\.
- •Not Safe For Work \(NSFW\)\.Target prompts are drawn from CoProV2\([Liu et al\. 2025](https://arxiv.org/html/2609.12163#bib.bib24)\)\(repository link:https://huggingface\.co/datasets/Visualignment/CoProv2\-SDXL\), which spans seven categories: Hate, Sexual, Violence, Shocking, Illegal Activity, Harassment, and Self\-harm\. The dataset consists of diverse prompts from each of these categories with an additional labelling for safe and unsafe\. Figure[3](https://arxiv.org/html/2609.12163#A1.F3)shows the prompts present per category in the selected portion of the dataset \(including both safe and unsafe variants\)\. CoProV2 prompts are empirically confirmed to elicit NSFW generations on SD\-Turbo\-family models, making them a realistic source for the categories our certificate must bound\. We select the three categories with the highest number of prompts, namely: Hate, Sexual, and Violence\. However, closely monitoring the harmful class per category, we observed that there were still some irrelevant and safe prompts in the unsafe category\. Therefore, we used ModerationBERT\([ifmain 2024](https://arxiv.org/html/2609.12163#bib.bib26)\)to get the classification score for each harmful category, and used prompts with harmfulness score more than 0\.7 to retain the most harmful prompts, giving 2,400 training and 600 validation prompts per category\.
- •Celebrity\.Target prompts are built from a 200\-identity subset of CelebA\([Liu et al\. 2015](https://arxiv.org/html/2609.12163#bib.bib27)\)\(repository link:https://huggingface\.co/datasets/flwrlabs/celeba\)\. This dataset is originally an image dataset, and therefore, we generate template based prompts "An image of <celeb\_name\>" for each celebrity name\. Following this we use Claude Sonnet 4\.5 to diversify the prompt set, giving 2,400 training and 600 validation prompts per identity\. We select 10 identities for performing evaluations on the certification framework and other unlearning techniques, namely: Benicio Del Toro, Christina Hendricks, Lizzy Caplan, Michael Ealy, Rachel Dratch, Shirley Temple, Bill Clinton, Chris Evans, Jimmy Carter, and Adriana Lima\.
- •Control Set\.We also form a control set of prompts for the purpose of training the probes\. The prompts for this set are selected to be neutral, safe and exclusive of the prompts from the target set\. The prompts are borrowed from the reLAION 2B research safe dataset \(repository link:https://huggingface\.co/datasets/laion/relaion2B\-en\-research\-safe\)\. For every concept’s probe training, we take equal partition of the target and control prompts\.

![Refer to caption](https://arxiv.org/html/2609.12163v1/Figures/category_counts_coprov2.png)Figure 3:Figure shows the frequency of prompts available in the CoProV2 dataset for each of the harmful categories of unlearning\.
### A\.2: Perturbation and dataset expansion for certification pipeline

To provide a strong guarantee \(e\.g\.1−δ=0\.991\-\\delta=0\.99\), the certification framework requires large sample sizes at each stage, for exampleN≈138,156N\\approx 138\{,\}156independent text\-side trials \(Lemma[2](https://arxiv.org/html/2609.12163#Thmlemma2)\)\. Collecting this many distinct, hand\-written prompts per concept is not practical: our validation set has onlyn=600n=600prompts per concept \(Section[7](https://arxiv.org/html/2609.12163#S7.SSx1.SSSx1)\)\.

We close this gap by expanding each of thennbase prompts intoN/nN/ntrials through perturbation\. Recall from Section[5](https://arxiv.org/html/2609.12163#S5)that𝒮r​\(c\)=\{xc\+Uc​α:‖α‖2≤r\}\\mathcal\{S\}\_\{r\}\(c\)=\\\{x\_\{c\}\+U\_\{c\}\\alpha:\\\|\\alpha\\\|\_\{2\}\\leq r\\\}is the set of embeddings reachable from a concept embedding by a bounded move along the concept\-relevant directionUcU\_\{c\}\. In our instantiationUcU\_\{c\}is a single direction andα\\alphareduces to a scalar steering distancess, so𝒮r​\(c\)\\mathcal\{S\}\_\{r\}\(c\)is the set of embeddings reachable by steering up to distancerralong that direction\. We apply this perturbation independently around each of thennbase prompt embeddingsxx, not a single reference embedding, so the working sample space is the union ofnnsuch neighborhoods, each centered on one validation prompt\.

For each base prompt, we drawN/nN/nindependent steering distancess\(1\),…,s\(N/n\)s^\{\(1\)\},\\dots,s^\{\(N/n\)\}near the prompt’s own points∗s^\{\*\}at whichCc​l​f1C\_\{clf\_\{1\}\}’s decision boundary is crossed, and steerxxby eachs\(i\)s^\{\(i\)\}in turn\. Every resulting embedding is then evaluated independently: byCc​l​f1C\_\{clf\_\{1\}\}directly for the text\-side quantities, or by generating an image with fresh sampler noiseξ\(i\)\\xi^\{\(i\)\}and evaluatingCc​l​f2C\_\{clf\_\{2\}\}for the image\-side quantities\. This givesNNtotal trials from onlynnbase prompts\.

This is valid because Hoeffding’s inequality \(Lemma[1](https://arxiv.org/html/2609.12163#Thmlemma1)\) only requires the trials to be independent and bounded in\[0,1\]\[0,1\], it does not require them to come from distinct prompts, or even to be identically distributed\. Two perturbations of the same base prompt are independent trials as long as the randomness that produces them, the steering distances\(i\)s^\{\(i\)\}and, for image\-side quantities, the sampler noiseξ\(i\)\\xi^\{\(i\)\}, is drawn fresh each time\. Since this holds by construction, the bound in Lemma[2](https://arxiv.org/html/2609.12163#Thmlemma2)\(and Lemmas[3](https://arxiv.org/html/2609.12163#Thmlemma3)\-[5](https://arxiv.org/html/2609.12163#Thmlemma5)\) applies exactly to theNNexpanded trials, without requiringNNdistinct base prompts\.

### A\.3: Out of distribution prompt examples

As a limitation of the certification framework’s ability to capture the adversarial subspace fully, we observe that in some cases our bounds can be exceeded\. For e\.g\. in Table[1](https://arxiv.org/html/2609.12163#S6.T1), on a model which has unlearned artistic styles using MACE, P4D is able to find more adversarial attacks, crossing the estimated bounds using our certification bounds\. To the best of our understanding, this is potentially due to extreme adversarial cases where the prompts don’t hold any semantic meaning close to the targeted concept\. For e\.g\. a sample prompt from such an adversarial attack using P4D is:"een tomtsugalerie kurozu isation rendition als using illustrseemed traditionsushi landscape painting paintingspearat\."for generating an image in Ukiyoe style image\.

Table[3](https://arxiv.org/html/2609.12163#A1.T3)shows more such examples\. From the examples presented, we can see that these adversarial prompts hardly hold a semantic meaning, and are therefore unrealistic in real scenarios against which these techniques aim to provide protection\.

Table 3:Adversarial prompts generated by attack methods against unlearned concepts, none of which reference the target concept in a sematically meaningful manner\.

## Appendix BHyper\-parameters, Compute Resources and Reproducibility

### B\.1: Hyper\-parameters

#### Certification pipeline\.

The probe,Cc​l​f1C\_\{clf\_\{1\}\}, andCc​l​f2C\_\{clf\_\{2\}\}are allscikit\-learnlogistic regression classifiers with identical hyper\-parameters \(C=1\.0C\{=\}1\.0,solver=lbfgs,max\_iter=2000\), fit on an 80/20 stratified train/test split\. The probe andCc​l​f1C\_\{clf\_\{1\}\}are trained on the mean\-pooled text\-encoder embedding\.Cc​l​f2C\_\{clf\_\{2\}\}operates on CLIP ViT\-L/14 embeddings of images generated at 4 inference steps with guidance scale 0\.0, matching the base models’ own distilled sampling setting\.

#### Adversarial baselines\.

All three attacks generate up to 500 adversarial prompts per concept\.

Ring\-A\-Belluses its standard genetic\-algorithm hyperparameters, identical for both models, since its concept\-vector search runs in a generic CLIP space independent of the attacked model: population size 50, 100 generations, mutation rate 0\.25, crossover rate 0\.5, token length 16, concept coefficient 3\.0, patience 250\.

MMA\-Diffusionuses its standard GCG hyperparameters for both models: 200 steps, 3 candidates per step, batch size 128, top\-kk256, random seed 42\. On SDXL\-Turbo the attack optimizes against the first \(CLIP\-L\) of the model\.

P4Dadversarial prompt computation uses 3000 optimization steps with an evaluation checkpoint every 50 steps, learning rate 0\.1, weight decay 0\.1, variant k, prompt batch size 1, batch size 1, guidance scale 7\.5, 25 inference steps, CLIP ViT\-H\-14 \(laion2b\_s32b\_b79k\), following the default settings\.

### B\.2: Compute Resources

All certification and attack evaluations were run on a single NVIDIA A100 80GB GPU\. Table[4](https://arxiv.org/html/2609.12163#A2.T4)reports the mean wall\-clock time to replicate each unlearning technique on one concept, averaged separately over all the SD\-Turbo and SDXL\-Turbo training runs per technique across all three concept categories concepts\. The average time per concept for computing the certification bounds is presented in Table[2](https://arxiv.org/html/2609.12163#S7.T2)\. Table[5](https://arxiv.org/html/2609.12163#A2.T5)presents the mean time to train the classifiersCc​l​f1C\_\{clf\_\{1\}\}andCc​l​f2C\_\{clf\_\{2\}\}for both the models\.

### B\.3: Reproducibility

We provide details on all the hyper\-parameters and model architectures used in the certification framework\. Furthermore, we provide the codebase to further clarify and support and make the paper and results reproducible\. We have omitted the probe training dataset in the supplementary materials due to safety concerns\. But, we are happy to provide it with permission later when the paper is published publicly\.

Table 4:Unlearning training time per concept\.Table 5:Mean classifier training time per concept\.

## Appendix CAblations to justify design choices

We conducted ablation studies to select the most efficient and feasible architecture of the classifiers and the steering unit as follows:

### C\.1: Classifier Architecture

For both the classifiers,Cc​l​f1C\_\{clf\_\{1\}\}, andCc​l​f2C\_\{clf\_\{2\}\}, we test classification accuracy of the logistic regressor against alternate cosine similarity based classifier, and Radial Basis Function SVM classifiers\. Table[6](https://arxiv.org/html/2609.12163#A3.T6)shows the classifier accuracy for the three classifiers under investigation\. All the classifiers are trained on the CLIP embeddings of the input\. We select the Logistic Regression based classifier as it shows best test time accuracy without over\-fitting or under\-fitting as in the case of RBF\-SVM and Cosine\-Similarity based classifiers\.

Table 6:Classifier accuracy across models\.
### C\.2: Steering Unit Architecture

The steering unit is used to steer the prompts in the direction of the target concept to search for adversarial cases in the neighbourhood of the target concept\. To find this approximate steering direction, we use two different techniques:

#### Sparse Auto\-encoder\(SAEs\):

We train a TopK Sparse Autoencoder \(SAE\) on the token\-level embeddings produced by SDXL Turbo’s concatenated text encoders \(shape \[B, 77, 2048\]\), treating each of the 77 token positions as an independent 2048\-dim sample and training only on non\-padding \(real\) tokens\. The SAE consists of a single linear encoder with a pre\-encoder bias, ReLU, and a TopK activation that retains only the k=32 largest of n\_features=16,384 dictionary atoms \(1\.5% sparsity\), followed by a linear decoder \(untied weights, unit\-norm columns re\-projected every 200 steps\) that reconstructs the input from this sparse code, minimizing the MSE Reconstruction loss and auxiliary dead\-feature loss\([Gao et al\. 2025](https://arxiv.org/html/2609.12163#bib.bib33)\)\. The training is done over 3\.85 million tokens from the Conceptual Captions dataset\([Google Research 2018](https://arxiv.org/html/2609.12163#bib.bib34)\)\.

The training showed promising results with validation reconstruction error reducing to 0\.00006, however, the image generated on reconstruction \(even without steering, i\.e\.α=1\\alpha=1\) was distorted even at a cosine similarity \(against the original prompt\) of 0\.95\. Figure[4](https://arxiv.org/html/2609.12163#A3.F4)\(a\) shows an example of gradual steering to remove the concept of a clock by gradually deactivating the identified feature for the concept ’clock’ in the SAE\. From the figure we can conclude that even though the gradual steering completely removes the concept of clock from the image generated for the prompt "A melting clock on top of a table", the reconstruction at zero steering, i\.e\.α=1\\alpha=1is distorted, rendering the technique for steering doubtful\. Therefore, we shifted to training a Linear Probe instead to learn clean directions for the concept\.

#### Linear Probe:

We train a logistic\-regression probe directly on the CLIP based text\-embeddings of the T2I model to classify concept\-present v/s concept\-absent prompts\. Its learned weight vector is normalized to a unit vectord^\\hat\{d\}and used as the steering direction, with prompts moved along it viax−s\.\(x⋅d^\)\.d^x\-s\.\(x\\cdot\\hat\{d\}\)\.\\hat\{d\}\(scalesscontrolling step size\)\.

Figure[4](https://arxiv.org/html/2609.12163#A3.F4)\(b\) shows the impact of gradual steering to remove the concept of ’clock’ when we are tying to prompt the model to generate ’a melting clock on top of a table’\. From the figure, we can see that Linear Probe does much better than identifying a clean direction for the concept of ’clock’ and linearly changes the output configuration based on the steering scaless\.

### Ethics Statement

This work generates adversarial prompts and NSFW or violent images to audit concept\-unlearning methods for text\-to\-image diffusion models\. Such content was used only internally for classifier calibration and result verification and is not released\. Celebrity\-identity experiments use only the publicly available CelebA dataset and identities already studied in prior unlearning benchmarks, not to produce new unauthorized likenesses of real people\. Our finding that attack\-based ASR understates residual risk is intended to strengthen safety auditing before an unlearning method is deployed, not to provide a stronger attack\. We release the certification pipeline for auditing, not evasion\.

![Refer to caption](https://arxiv.org/html/2609.12163v1/Steering_unit_ablation.png)Figure 4:Figure shows an ablation experiment comparing two different methods to find a clean steering direction for the concept of ’clock’\. \(a\) Shows the impact of steering the direction identified by the SAE on suppressing the concept of ’clock’ and \(b\) represents the impact of the steering direction identified by the Linear Probe on suppressing the concept\.