缓解Diffusion数据点遗忘中的顺序重现问题

# Mitigating Sequential Reappearance in Diffusion Data-Point Unlearning
Source: [https://arxiv.org/html/2609.25166](https://arxiv.org/html/2609.25166)
Taehyuk LeeJinyeong KimYoungmin OhDohyeong KimJaehyuk RyuSangwoo Hong\\corresponding

###### Abstract

Diffusion data\-point unlearning is typically evaluated immediately after each deletion, even though subsequent requests may repeatedly update the same model\. We identify sequential reappearance, a failure mode in which an instance that is initially judged to be forgotten later returns to the memorized regime without reuse of the deleted data or adversarial fine\-tuning\. To capture this behavior, we introduce a target\-level evaluation protocol that tracks whether each target is forgotten immediately, remains forgotten at the end of the sequence, or reappears during subsequent deletions\. We further find that targets that later reappear exhibit sharper local denoising\-loss geometry after deletion than targets that remain forgotten\. We characterize this vulnerability as data\-space recovery sharpness and show that this post\-deletion local geometry is associated with subsequent reappearance risk\. Motivated by this finding, we propose a sharpness\-guided unlearning method that iteratively identifies the most recoverable region around each target and extends the deletion objective to that region\. Experiments show that our method improves forgetting persistence across long deletion sequences while preserving generation utility, highlighting the importance of evaluating diffusion unlearning beyond immediate deletion efficacy\.

Department of Computer Science and Engineering, Konkuk University

Trustworthy Machine Learning Lab

Seoul, Republic of Korea

\{alphax, matthewsep, jinzero29, peopleoh1204, kdh9981, rokmc704, swhong06\}@konkuk\.ac\.kr

## 1Introduction

\(a\)Qualitative comparison\.
![Refer to caption](https://arxiv.org/html/2609.25166v1/Figures/fig1/graph.png)\(b\)Reappearance counts\.

Figure 1:Sequential reappearance in CelebA\-HQ\. \(a\) Outputs generated immediately after unlearning each target and after processing all subsequent deletion requests\. Existing methods can reproduce initially forgotten targets in the final model, whereasLASTINGmaintains forgetting throughout the sequence\. \(b\) Number of reappeared images as sequential deletion requests accumulate\.Diffusion models can memorize and reproduce individual training examples, raising privacy and copyright concerns when sensitive data must be removed\([Somepalli et al\. 2023a](https://arxiv.org/html/2609.25166#bib.bib1);[Carlini et al\. 2023](https://arxiv.org/html/2609.25166#bib.bib2)\)\. Diffusion data\-point unlearning addresses this problem by removing the influence of a specific training instance without retraining the model from scratch\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6);[Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8)\)\. A reliable deletion, however, should remain effective not only when it is performed but also throughout subsequent updates to the same model\. As illustrated in Figure[1\(a\)](https://arxiv.org/html/2609.25166#S1.F1.sf1), a target that appears successfully forgotten at its immediate checkpoint can become memorized again after later deletion requests are processed\.

Existing evaluations of diffusion unlearning\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6);[Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7);[Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8);[Park and Park 2026](https://arxiv.org/html/2609.25166#bib.bib19)\)predominantly assess each target at or near the model state immediately following its deletion\. Such stage\-local evaluation overlooks the target’s lifecycle under future model updates and can therefore overestimate deletion reliability\. We identify*sequential reappearance*, a failure mode in which an initially forgotten target returns to the memorized regime as subsequent deletion requests update the model\. Importantly, this failure emerges within the ordinary unlearning sequence, without reusing the deleted target, adversarially fine\-tuning the model, or launching an explicit recovery attack\.

To mitigate this problem, we first characterize reappearing data points following unlearning and identify their distinct local loss geometry immediately after deletion\. Even when the target itself satisfies the forgetting criterion, nearby points may remain recoverable, indicating that the model still retains strong denoising ability in its local neighborhood\. We refer to this vulnerability as*data\-space recovery sharpness*\. Our analysis shows that targets that later reappear exhibit sharper post\-deletion recovery geometry than those that remain forgotten, revealing an association between local recoverability and subsequent reappearance\. This finding suggests that reliable unlearning should account not only for the observed target but also for locally recoverable representations that may preserve a route back to memorization\.

Motivated by this finding, we propose*Low\-loss Adaptive Search and Targeted Intervention in Neighborhood Geometry*\(LASTING\)\.LASTINGfinds the most recoverable nearby representation and targets it during deletion\. The search is repeated throughout optimization, allowing the method to expose and suppress the strongest remaining recovery route as the model changes\. By aligning the deletion update with the identified recovery geometry,LASTINGsuppresses recoverable representations around the target, leading to more persistent forgetting\. We evaluateLASTINGover long sequential deletion trajectories, measuring immediate forgetting, reappearance over subsequent updates, and generation utility\. Our results demonstrate thatLASTINGsubstantially improves forgetting persistence while preserving generation quality\. Together, these findings show that successful diffusion unlearning requires forgetting to persist through subsequent deletion updates, rather than merely succeeding immediately after deletion\.

##### Contributions\.

Our main contributions are summarized as follows:

- •We introduce a target\-level evaluation protocol for sequential diffusion unlearning that tracks whether each target is forgotten immediately and remains forgotten at the end of the sequence\.
- •We identify*sequential reappearance*under ordinary deletion requests and find that targets that later reappear exhibit distinct local data\-space recovery geometry immediately after deletion\.
- •We proposeLASTING, a recovery\-geometry\-aware unlearning method that adaptively identifies and suppresses the most locally recoverable representation around each target, and demonstrate that it significantly improves forgetting persistence over long deletion sequences while preserving generation utility\.

## 2Related Work

### Memorization in Diffusion Models

Diffusion models are known to memorize individual training examples\. Several studies have shown that generated images can closely resemble training samples, while extraction attacks have successfully recovered such memorized images at scale\([Somepalli et al\. 2023a](https://arxiv.org/html/2609.25166#bib.bib1);[Carlini et al\. 2023](https://arxiv.org/html/2609.25166#bib.bib2)\)\. Subsequent studies have examined how factors such as data duplication, data coverage, and text conditioning affect replication and have developed methods for detecting or mitigating memorization\([Somepalli et al\. 2023b](https://arxiv.org/html/2609.25166#bib.bib14);[Wen et al\. 2024](https://arxiv.org/html/2609.25166#bib.bib15);[Merger and Goldt 2026](https://arxiv.org/html/2609.25166#bib.bib39)\)\. Other studies have proposed inference\-time mitigation strategies, such as perturbing prompts associated with memorized outputs or modifying the initial noise\([Wen et al\. 2024](https://arxiv.org/html/2609.25166#bib.bib15);[Somepalli et al\. 2023b](https://arxiv.org/html/2609.25166#bib.bib14);[Han et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib41)\)\. Unlike these inference\-time interventions, diffusion unlearning seeks to remove the influence of selected training examples from the model itself\.

### Diffusion Model Unlearning

Diffusion unlearning aims to remove the influence of selected training data or semantic content from a pretrained model, while preserving its utility on unrelated inputs\. Unlike inference\-time mitigation, which suppresses memorized outputs only during generation, unlearning modifies the model itself to provide a persistent removal effect\.

#### Concept Unlearning

Concept\-level unlearning aims to suppress broad semantic content, such as objects, artistic styles, identities, or text\-specified concepts\. Existing approaches edit model weights, align target representations with anchor concepts, or select parameters according to their relevance to the target concept\([Gandikota et al\. 2023](https://arxiv.org/html/2609.25166#bib.bib3);[Kumari et al\. 2023](https://arxiv.org/html/2609.25166#bib.bib4);[Zhang et al\. 2024a](https://arxiv.org/html/2609.25166#bib.bib5);[Fan et al\. 2024](https://arxiv.org/html/2609.25166#bib.bib17)\)\. Other methods extend concept erasure to selective or multi\-concept settings\([Heng and Soh 2023](https://arxiv.org/html/2609.25166#bib.bib16);[Lu et al\. 2024](https://arxiv.org/html/2609.25166#bib.bib18);[Li et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib33)\)\. However, because deletion is defined at the semantic level, these methods cannot precisely remove a particular copyrighted or sensitive training data while preserving semantically related content\.

#### Data\-Point Unlearning

Data\-point unlearning aims to remove the influence of an individual training data point while preserving generation quality\. EraseDiff steers the reverse process for a forget sample away from its original denoising trajectory\([Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7)\)\. Subtracted Importance Sampled Scores \(SISS\) balances target forgetting and utility preservation through an importance\-sampled score objective\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\)\. ReTrack redirects the denoising trajectory of a forget sample toward itskk\-nearest neighbors in the retain set\([Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8)\)\. More recently,[Khalafi et al\. \(2026\)](https://arxiv.org/html/2609.25166#bib.bib42)formulate diffusion unlearning as constrained optimization based on forward or reverse KL divergence\.[Lee et al\. \(2026b\)](https://arxiv.org/html/2609.25166#bib.bib43)introduces a prompt\-free instance unlearning approach that uses an additional generative model and edited surrogate targets to remove specific instances without relying on textual prompts\. These methods offer complementary mechanisms for removing individual examples, but they primarily focus and evaluate on forgetting immediately after each deletion update\. Our work instead examines whether an instance that is successfully forgotten at deletion remains forgotten as the same model undergoes subsequent deletion updates\.

### Recovery and Persistence after Unlearning

Recovery after unlearning has mainly been studied under explicit post\-unlearning interventions\. Prior work has shown that erased concepts can be restored through limited fine\-tuning using the removed instance\([George et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib20)\)\. Meta\-unlearning improves resistance to malicious relearning, whereas AdvUnlearn targets adversarial prompt attacks after unlearning\([Gao et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib21);[Zhang et al\. 2024c](https://arxiv.org/html/2609.25166#bib.bib22)\)\. Our setting instead concerns spontaneous reappearance during ordinary sequential deletion, without any recovery attack, additional fine\-tuning, or reuse of the removed instance\.

### Sequential and Continual Unlearning

Recent work has examined sequential unlearning primarily for semantic concepts in diffusion models\. Prior studies investigate cumulative utility degradation and propose regularization\-, prior\-preservation\-, or locality\-based mechanisms for maintaining retained generative capabilities across successive concept removals\([Lee et al\. 2026a](https://arxiv.org/html/2609.25166#bib.bib34);[Thakral et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib38);[George et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib32)\)\. Closest to our setting,[Zhang et al\. \(2024b\)](https://arxiv.org/html/2609.25166#bib.bib40)report an unlearning rebound effect in sequential style erasure, while[Park et al\. \(2026\)](https://arxiv.org/html/2609.25166#bib.bib31)identify a related forgetting reversal phenomenon in continual classifier unlearning\. However, sequential data\-point unlearning in diffusion models remains largely unexplored\. This setting is particularly relevant when copyright or privacy requests target individual training images and accumulate over time\.

### Sharpness and Local Geometry in Machine Unlearning

##### Parameter\-space sharpness\.

Loss\-landscape sharpness has been widely studied in relation to generalization and robustness\([Keskar et al\. 2017](https://arxiv.org/html/2609.25166#bib.bib24);[Dinh et al\. 2017](https://arxiv.org/html/2609.25166#bib.bib25)\)\. Methods such as Sharpness\-Aware Minimization and Adversarial Weight Perturbation characterize the loss variation induced by bounded perturbations to the model parameters\([Foret et al\. 2021](https://arxiv.org/html/2609.25166#bib.bib10);[Wu et al\. 2020](https://arxiv.org/html/2609.25166#bib.bib11)\)\. Recent unlearning studies similarly operate in parameter space, seeking forgetting solutions that remain stable under weight perturbations or subsequent relearning\([Tang and Khanna 2026](https://arxiv.org/html/2609.25166#bib.bib35);[Malekmohammadi et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib36);[Fan et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib37)\)\.

##### Data\-space local geometry\.

Local geometry has also been studied in the input space of classifiers\.[Hsu et al\. \(2025\)](https://arxiv.org/html/2609.25166#bib.bib23)examine whether perturbed versions of a forget sample remain recognizable after unlearning, while AMUN uses nearby adversarial examples to reshape the classifier’s local decision boundary\([Ebrahimpour\-Boroojeny et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib9)\)\. In contrast, our work studies the data\-space geometry of the diffusion denoising loss around an individual deleted training example\. Rather than measuring parameter\-space flatness or classifier decision\-boundary robustness, we identify nearby image perturbations that remain easy for the diffusion model to denoise and relate this post\-deletion recovery geometry to later sequential reappearance\.

## 3Analysis of Sequential Reappearance

### Protocol and Metrics

##### Sequential unlearning setup\.

LetMθ0M\_\{\\theta\_\{0\}\}be a diffusion model trained on a dataset, and let𝒜=\(a1,…,aK\)\\mathcal\{A\}=\(a\_\{1\},\\ldots,a\_\{K\}\)denote an ordered sequence of deletion targets\. Given the retain dataℛ\\mathcal\{R\}used by the unlearning protocol, an unlearning algorithm𝒰\\mathcal\{U\}updates the model at stageiias

θi=𝒰\(θi−1;ai,ℛ\),i=1,…,K\.\\theta\_\{i\}=\\mathcal\{U\}\\left\(\\theta\_\{i\-1\};a\_\{i\},\\mathcal\{R\}\\right\),\\qquad i=1,\\ldots,K\.\(1\)For targetaia\_\{i\},θi\\theta\_\{i\}denotes its*immediate model state*after deletion, whereasθK\\theta\_\{K\}denotes the*final model state*after all subsequent deletion requests\. This target\-resolved view allows us to distinguish whether forgetting succeeds at the deletion stage from whether it remains successful throughout the remaining deletion trajectory\.

##### Persistence metrics\.

Letsi​\(θj\)s\_\{i\}\(\\theta\_\{j\}\)denote the SSCD similarity\([Pizzi et al\. 2022](https://arxiv.org/html/2609.25166#bib.bib27)\)between targetaia\_\{i\}and its recovery output produced by modelMθjM\_\{\\theta\_\{j\}\}\. A target is operationally considered forgotten whensi​\(θj\)<τs\_\{i\}\(\\theta\_\{j\}\)<\\tau, and we useτ=0\.7\\tau=0\.7following prior work\([Somepalli et al\. 2023b](https://arxiv.org/html/2609.25166#bib.bib14)\)\. We define the final forgetting success rate and reappearance rate as

FinalSucc\.@​τ\\displaystyle\\mathrm\{FinalSucc\.\}@\\tau=1K∑i=1K𝟏\[si\(θK\)<τ\],\\displaystyle=\\frac\{1\}\{K\}\\sum\_\{i=1\}^\{K\}\\mathbf\{1\}\\left\[s\_\{i\}\(\\theta\_\{K\}\)<\\tau\\right\],\(2\)FinalReapp\.@​τ\\displaystyle\\mathrm\{FinalReapp\.\}@\\tau=∑i=1K𝟏\[si\(θi\)<τ∧si\(θK\)≥τ\]∑i=1K𝟏\[si\(θi\)<τ\]\.\\displaystyle=\\frac\{\\sum\_\{i=1\}^\{K\}\\mathbf\{1\}\\left\[s\_\{i\}\(\\theta\_\{i\}\)<\\tau\\land s\_\{i\}\(\\theta\_\{K\}\)\\geq\\tau\\right\]\}\{\\sum\_\{i=1\}^\{K\}\\mathbf\{1\}\\left\[s\_\{i\}\(\\theta\_\{i\}\)<\\tau\\right\]\}\.Final success measures the proportion of deletion targets that are forgotten under the final model\. Final reappearance measures the proportion of initially forgotten targets that return to the memorized regime under the final model\.

### Reappearance under Sequential Deletion

We first apply this protocol to sequences ofK=300K=300deletion requests using SISS, EraseDiff, ReTrack, Prompt\-Free, and FU\([Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8);[Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7);[Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6);[Khalafi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib42);[Lee et al\. 2026b](https://arxiv.org/html/2609.25166#bib.bib43)\)\. As shown in Fig\.[1\(b\)](https://arxiv.org/html/2609.25166#S1.F1.sf2), previously forgotten targets can return to the memorized regime as sequential deletions progress\. This confirms that immediate forgetting does not necessarily persist through subsequent deletion updates and raises the question of why some targets reappear while others remain forgotten\.

##### Data\-space recovery sharpness\.

To investigate this difference, we examine the local denoising\-loss geometry around each target immediately after deletion\. Although SSCD determines whether the observed target is recoverable, it does not reveal whether nearby representations remain easy for the model to denoise\. We therefore test whether this local recovery geometry is associated with the target’s eventual forgetting outcome\.

For each targetaia\_\{i\}, we freeze the model at its immediate checkpointθi\\theta\_\{i\}and construct a fixed bankℬi\\mathcal\{B\}\_\{i\}of diffusion timesteps and noise samples\. The same bank is used to evaluate the observed target and all of its local neighbors\. We define the resulting local denoising loss as

Li​\(δ\)=1\|ℬi\|​∑ξ∈ℬiℓdiff​\(θi,ai\+δ,ξ\)\.L\_\{i\}\(\\delta\)=\\frac\{1\}\{\|\\mathcal\{B\}\_\{i\}\|\}\\sum\_\{\\xi\\in\\mathcal\{B\}\_\{i\}\}\\ell\_\{\\mathrm\{diff\}\}\\left\(\\theta\_\{i\};a\_\{i\}\+\\delta,\\xi\\right\)\.\(3\)Within the bounded data\-space neighborhood𝒟i=\{δ:‖δ‖∞≤ϵ\}\\mathcal\{D\}\_\{i\}=\\\{\\delta:\\\|\\delta\\\|\_\{\\infty\}\\leq\\epsilon\\\}, we approximate a low\-loss neighbor and define*data\-space recovery sharpness*as

δ^i\\displaystyle\\widehat\{\\delta\}\_\{i\}≈arg⁡minδ∈𝒟i⁡Li​\(δ\),\\displaystyle\\approx\\mathop\{\\arg\\min\}\_\{\\delta\\in\\mathcal\{D\}\_\{i\}\}L\_\{i\}\(\\delta\),\(4\)RecSharpi\\displaystyle\\mathrm\{RecSharp\}\_\{i\}=max⁡\{0,1−Li​\(δ^i\)max⁡\{Li​\(0\),η\}\},\\displaystyle=\\max\\left\\\{0,\\,1\-\\frac\{L\_\{i\}\(\\widehat\{\\delta\}\_\{i\}\)\}\{\\max\\\{L\_\{i\}\(0\),\\eta\\\}\}\\right\\\},whereδ^i\\widehat\{\\delta\}\_\{i\}is obtained through constrained projected\-gradient search\. A larger score indicates that a greater relative reduction in denoising loss is accessible within the prescribed neighborhood\.

##### Recovery sharpness and reappearance\.

We next examine whether recovery sharpness measured immediately after deletion is associated with subsequent reappearance\. To exclude immediate deletion failures, we restrict the analysis to targets satisfyingsi​\(θi\)<τs\_\{i\}\(\\theta\_\{i\}\)<\\tauand track their outcomes over the following 30 deletion stages\. As shown in Fig\.[2](https://arxiv.org/html/2609.25166#S3.F2)\(a\), targets that later reappear consistently exhibit higher recovery sharpness than those that remain forgotten across different unlearning methods\.

Figure[2](https://arxiv.org/html/2609.25166#S3.F2)\(b\) further reports the Spearman correlation between recovery sharpness and maximum future SSCD\. Since Immediate SSCD may influence both quantities, we also report partial Spearman correlation controlling for Immediate SSCD\. We additionally report AUROC to evaluate how well recovery sharpness distinguishes reappearing targets from those that remain forgotten\. Across methods, recovery sharpness consistently shows positive correlation with maximum future SSCD, and the association remains positive after controlling for Immediate SSCD\. The AUROC values further indicate meaningful predictive ability for subsequent reappearance\.

![Refer to caption](https://arxiv.org/html/2609.25166v1/Figures/fig2/fig2.png)\(a\)Recovery sharpness by outcome\.
\(b\)Association and reappearance prediction\.

Figure 2:Recovery sharpness and subsequent reappearance\. Here,ρ\\rhodenotes Spearman correlation with maximum future SSCD, partialρ\\rhocontrols for Immediate SSCD, and AUC denotes AUROC\.These findings show that immediate forgetting alone does not fully determine whether a target will remain forgotten\. Even when the target satisfies the immediate SSCD criterion, nearby representations may remain easy for the model to denoise\. This residual local recoverability is associated with later reappearance and motivates explicitly targeting the most recoverable local representation during deletion, forming the basis ofLASTINGin Section[4](https://arxiv.org/html/2609.25166#S4)\.

## 4Proposed Method

In this section, we propose*Low\-loss Adaptive Search and Targeted Intervention in Neighborhood Geometry*\(LASTING\), a recovery\-geometry\-aware method for sequential unlearning\.LASTINGsearches for a low\-loss neighbor of each deletion target and uses it in place of the original target when computing the deletion objective\. By repeating this search throughout optimization,LASTINGadapts the unlearning update to the model’s recovery geometry\.

### Adaptive Low\-Loss Neighbor Search

Letα¯t\\bar\{\\alpha\}\_\{t\}denote the cumulative diffusion noise schedule and letξ=\(t,ε\)\\xi=\(t,\\varepsilon\)contain a timestepttand Gaussian noiseε∼𝒩⁡\(0,I\)\\varepsilon\\sim\\mathcal\{N\}\(0,I\)\. For an imagea∈𝒳a\\in\\mathcal\{X\}, the noisy input and its standard DDPM denoising loss\([Ho et al\. 2020](https://arxiv.org/html/2609.25166#bib.bib12)\)are

zt​\(a,ξ\)\\displaystyle z\_\{t\}\(a;\\xi\)=α¯t​a\+1−α¯t​ε,\\displaystyle=\\sqrt\{\\bar\{\\alpha\}\_\{t\}\}\\,a\+\\sqrt\{1\-\\bar\{\\alpha\}\_\{t\}\}\\,\\varepsilon,\(5\)ℓdiff​\(θ,a,ξ\)\\displaystyle\\ell\_\{\\mathrm\{diff\}\}\(\\theta;a,\\xi\)=1d​‖εθ​\(zt​\(a,ξ\),t\)−ε‖22,\\displaystyle=\\frac\{1\}\{d\}\\left\\\|\\varepsilon\_\{\\theta\}\\left\(z\_\{t\}\(a;\\xi\),t\\right\)\-\\varepsilon\\right\\\|\_\{2\}^\{2\},whereddis the dimensionality of the noise prediction\. A low value ofℓdiff\\ell\_\{\\mathrm\{diff\}\}indicates that the model can accurately denoise the corresponding representation and therefore retains substantial local recovery ability\.

For targetaia\_\{i\}, we define the feasible neighborhood

𝒟i=\{δ:∥δ∥∞≤ϵnbr,ai\+δ∈𝒳\},\\mathcal\{D\}\_\{i\}=\\left\\\{\\delta:\\\|\\delta\\\|\_\{\\infty\}\\leq\\epsilon\_\{\\mathrm\{nbr\}\},\\;a\_\{i\}\+\\delta\\in\\mathcal\{X\}\\right\\\},\(6\)whereϵnbr\\epsilon\_\{\\mathrm\{nbr\}\}controls the search radius and𝒳\\mathcal\{X\}denotes the valid normalized image domain\. At iterationqq, we sampleξi,q\\xi\_\{i,q\}and define

fi,q​\(δ\)=ℓdiff​\(θi,q,ai\+δ,ξi,q\)\.f\_\{i,q\}\(\\delta\)=\\ell\_\{\\mathrm\{diff\}\}\\left\(\\theta\_\{i,q\};a\_\{i\}\+\\delta,\\xi\_\{i,q\}\\right\)\.\(7\)
Starting fromδi,q\(0\)=0\\delta\_\{i,q\}^\{\(0\)\}=0, we performJJprojected sign\-gradient descent steps:

δi,q\(r\+1\)=Π𝒟i​\[δi,q\(r\)−ηin​sign⁡\(∇δfi,q​\(δi,q\(r\)\)\)\],\\displaystyle\\delta\_\{i,q\}^\{\(r\+1\)\}=\\Pi\_\{\\mathcal\{D\}\_\{i\}\}\\left\[\\delta\_\{i,q\}^\{\(r\)\}\-\\eta\_\{\\mathrm\{in\}\}\\operatorname\{sign\}\\left\(\\nabla\_\{\\delta\}f\_\{i,q\}\\left\(\\delta\_\{i,q\}^\{\(r\)\}\\right\)\\right\)\\right\],\(8\)r=0,…,J−1\.\\displaystyle\\qquad r=0,\\ldots,J\-1\.The resulting deletion representation is

a~i,q=sg⁡\(ai\+δi,q\(J\)\)\.\\widetilde\{a\}\_\{i,q\}=\\operatorname\{sg\}\\left\(a\_\{i\}\+\\delta\_\{i,q\}^\{\(J\)\}\\right\)\.\(9\)Here,ηin\\eta\_\{\\mathrm\{in\}\}is the inner\-search step size,Π𝒟i\\Pi\_\{\\mathcal\{D\}\_\{i\}\}enforces both the perturbation constraint and the valid image range, andsg\\operatorname\{sg\}denotes stop\-gradient\. The timestep and noise inξi,q\\xi\_\{i,q\}are fixed during theJJinner steps and reused in the subsequent deletion update, ensuring that the selected neighbor and the unlearning update use the same stochastic diffusion state\. We use the standard DDPM denoising loss to locate representations on which the current model retains strong recovery ability\.

### Recovery\-Guided Unlearning

LetℒU\\mathcal\{L\}\_\{\\mathrm\{U\}\}denote the objective of a base unlearning method\. Given the adaptively selected neighbora~i,q\\widetilde\{a\}\_\{i,q\},LASTINGreplaces the original deletion targetaia\_\{i\}witha~i,q\\widetilde\{a\}\_\{i,q\}while leaving the remaining components of unlearning process unchanged\. At optimization iterationqq, we define

ℒi,qLASTING=ℒU​\(θi,q,ℛi,q,a~i,q,ξi,q\),\\mathcal\{L\}\_\{i,q\}^\{\\mathrm\{LASTING\}\}=\\mathcal\{L\}\_\{\\mathrm\{U\}\}\\left\(\\theta\_\{i,q\};\\mathcal\{R\}\_\{i,q\},\\widetilde\{a\}\_\{i,q\},\\xi\_\{i,q\}\\right\),\(10\)
whereℛi,q\\mathcal\{R\}\_\{i,q\}denotes the retain mini\-batch andξi,q\\xi\_\{i,q\}denotes the sampled diffusion state\. The model is then updated using the original optimization rule of the standard unlearning process\. Thus,LASTINGmodifies only the deletion\-side representation, directing the update toward a nearby input on which the model still exhibits strong recovery\.

In our main experiments, we instantiateLASTINGon SISS\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\), a representative diffusion data\-point unlearning method that provides a strong balance between target forgetting and generation utility\. This choice also allows us to isolate the effect of the proposed recovery\-guided target replacement while leaving the remaining unlearning procedure unchanged\. Specifically, the forget\-side gradient is computed usinga~i,q\\widetilde\{a\}\_\{i,q\}in place ofaia\_\{i\}, while the retain construction, importance weighting, gradient normalization, clipping, and optimizer remain unchanged\. Ifgi,qRg\_\{i,q\}^\{R\}andgi,qFg\_\{i,q\}^\{F\}denote the resulting retain and forget gradients, respectively, the composite gradient is

gi,qLASTING=gi,qR−κ​gi,qF‖gi,qF‖2,g\_\{i,q\}^\{\\mathrm\{LASTING\}\}=g\_\{i,q\}^\{R\}\-\\kappa\\frac\{g\_\{i,q\}^\{F\}\}\{\\left\\\|g\_\{i,q\}^\{F\}\\right\\\|\_\{2\}\},\(11\)which is passed to the original SISS optimizer\.

The selected neighbora~i,q\\widetilde\{a\}\_\{i,q\}is detached before evaluating the outer objective\. Hence, the model update does not differentiate through the neighbor search and requires no second\-order derivatives\. AfterQQoptimization iterations, we setθi=θi,Q\\theta\_\{i\}=\\theta\_\{i,Q\}and proceed to the next deletion request\. The overall process of LASTING is summarized in Algorithm[1](https://arxiv.org/html/2609.25166#alg1)\.

Algorithm 1LASTINGfor Sequential Data\-Point Unlearning1:Initial model

θ0\\theta\_\{0\}, deletion sequence

\{ai\}i=1K\\\{a\_\{i\}\\\}\_\{i=1\}^\{K\}, retain data

𝒟R\\mathcal\{D\}\_\{R\}, outer iterations

QQ
2:Unlearned model

θK\\theta\_\{K\}
3:for

i=1,…,Ki=1,\\ldots,Kdo

4:

θi,0←θi−1\\theta\_\{i,0\}\\leftarrow\\theta\_\{i\-1\}
5:for

q=0,…,Q−1q=0,\\ldots,Q\-1do

6:Sample retain data

ℛi,q\\mathcal\{R\}\_\{i,q\}and diffusion state

ξi,q\\xi\_\{i,q\}
7:Find the low\-loss neighbor

a~i,q\\widetilde\{a\}\_\{i,q\}under the current model

θi,q\\theta\_\{i,q\}using Eq\. \([8](https://arxiv.org/html/2609.25166#S4.E8)\)

8:Evaluate the recovery\-guided objective in Eq\. \([10](https://arxiv.org/html/2609.25166#S4.E10)\)

9:Update

θi,q\+1\\theta\_\{i,q\+1\}using the optimization rule of the base unlearning method

10:endfor

11:

θi←θi,Q\\theta\_\{i\}\\leftarrow\\theta\_\{i,Q\}
12:endfor

13:return

θK\\theta\_\{K\}

## 5Experiments

We now evaluate whetherLASTINGreduces recovery sharpness and improves forgetting persistence under sequential deletion while preserving generation utility on CelebA\-HQ and Stable Diffusion\.

##### Compared methods\.

We use SISS\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\), EraseDiff\([Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7)\), ReTrack\([Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8)\), Forward KL\-Constrained Unlearning\([Khalafi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib42)\), and Prompt\-free Instance Unlearning\([Lee et al\. 2026b](https://arxiv.org/html/2609.25166#bib.bib43)\)as the baselines and compare them withLASTING\. For each comparison, the target order, retain set, outer\-update budget, and evaluation protocol are held fixed\. It should be noted that Prompt\-free Instance Unlearning requires an additional generative model to produce edited surrogate targets for each instance to be removed\.

Table 1:Sequential data\-point unlearning on CelebA\-HQ\. We compare immediate forgetting, final forgetting, final reappearance, and generation quality over sequences of up to300300deletion requests\.
### Sequential Unlearning on CelebA\-HQ

##### Experimental setup\.

We conduct our main experiments on CelebA\-HQ\([Karras et al\. 2018](https://arxiv.org/html/2609.25166#bib.bib26)\)using a pretrained256×256256\\times 256unconditional DDPM based on the formulation of[Ho et al\. \(2020\)](https://arxiv.org/html/2609.25166#bib.bib12)\. We consider sequential deletion trajectories ofK∈\{50,100,200,300\}K\\in\\\{50,100,200,300\\\}targets\. At deletion stageii, the model obtained after unlearning targetaia\_\{i\}is passed directly to the next stage, such that all deletion requests are processed sequentially by the same model\. Within each sequence length, the target order and retain set are fixed across the compared methods\. Detailed optimization settings and hyperparameters are provided in the Appendix\.

Table 2:Trajectory\-level reappearance ratio over the full deletion sequence\.
##### Evaluation metrics\.

We measure target recoverability using the SSCD similarity\([Pizzi et al\. 2022](https://arxiv.org/html/2609.25166#bib.bib27)\)between each deletion target and its reconstruction obtained through the reverse diffusion process\.Immediate SSCDis measured at the target’s immediate model stateθi\\theta\_\{i\}, whereasFinal SSCDis measured at the common final modelθK\\theta\_\{K\}\. In both cases, lower SSCD indicates stronger forgetting\. Following prior work, we set the SSCD threshold toτ=0\.7\\tau=0\.7and reportFinal SuccessandReappearance Rateas defined in Eq\.[2](https://arxiv.org/html/2609.25166#S3.E2)\. The reappearance rate is computed over targets that are successfully forgotten immediately after deletion and measures the fraction that return to the memorized regime under the final model\. We also evaluate retain\-side generation quality usingFID\([Heusel et al\. 2017](https://arxiv.org/html/2609.25166#bib.bib28)\), where lower values indicate better quality\.

Table 3:Sequential data\-point unlearning on Stable Diffusion\. Final Suc\. denotes Final Success under the model obtained afterKKdeletion requests, Reapp\. denotes the Reappearance Rate among cases successfully forgotten immediately after deletion, and IQA denotes CLIP\-IQA generation quality\.![Refer to caption](https://arxiv.org/html/2609.25166v1/Figures/fig3/FIG3.png)Figure 3:Qualitative comparison on Stable Diffusion\. The leftmost column shows the reference memorized image\. The remaining columns correspond to unlearning methods, and rows show generations from the immediate and final model states\. Prompt:Chipotle Bag Essays Earn a Spot in Yale’s Rare Book Library
##### Sequential unlearning results\.

Table[1](https://arxiv.org/html/2609.25166#S5.T1)reports target recoverability, forgetting persistence, and generation quality across different deletion sequence lengths\. Although all baselines achieve substantial immediate forgetting, their performance degrades as subsequent deletion updates accumulate\. AtK=300K=300, EraseDiff and ReTrack attain only41\.33%41\.33\\%and39\.33%39\.33\\%Final Success, with Reappearance Rates of58\.25%58\.25\\%and56\.27%56\.27\\%, respectively\. SISS is more robust, but still reaches only89\.67%89\.67\\%Final Success with a9\.73%9\.73\\%Reappearance Rate, showing that strong immediate forgetting does not ensure persistent forgetting\.

In contrast,LASTINGconsistently improves forgetting persistence\. AtK=300K=300, it achieves the lowest Final SSCD of0\.39170\.3917, the highest Final Success of97\.67%97\.67\\%, and the lowest Reappearance Rate of2\.33%2\.33\\%\. Compared with SISS, it also reduces Immediate SSCD from0\.28070\.2807to0\.22810\.2281and Final SSCD from0\.42380\.4238to0\.39170\.3917\. Similar gains are observed atK=100K=100andK=200K=200\.LASTINGalso preserves generation quality, achieving a competitive FID of24\.8124\.81atK=300K=300, compared with28\.0028\.00for SISS,28\.9028\.90for ReTrack, and75\.7075\.70for EraseDiff\. Although Prompt\-free Instance Unlearning obtains a lower FID, it suffers from a substantially higher reappearance rate\.

##### Trajectory\-level persistence\.

To assess forgetting stability throughout the full deletion trajectory, we also evaluate Ever Reappearance, defined as the fraction of immediately forgotten targets that re\-enter the memorized regime at least once during subsequent deletion updates\. As shown in Table[2](https://arxiv.org/html/2609.25166#S5.T2),LASTINGachieves the lowest Ever Reappearance rate of7\.00%7\.00\\%, compared with23\.49%23\.49\\%for SISS and substantially higher rates for ReTrack and EraseDiff\. This result indicates thatLASTINGpreserves forgetting not only at the final checkpoint but also across intermediate deletion updates\. Detailed results separating transient and final reappearance are provided in the appendix\.

### Extension to Text\-Conditioned Latent Diffusion

We further evaluateLASTINGon Stable Diffusion v1\.4, a text\-conditioned latent diffusion model\([Rombach et al\. 2022](https://arxiv.org/html/2609.25166#bib.bib13)\)\. This experiment examines whether LASTING remains effective when deletion is performed in latent space and generation is conditioned on text\.

##### Experimental setup\.

We construct a sequence ofKSD=49K\_\{\\mathrm\{SD\}\}=49memorized deletion targets using the prompts identified by[Webster \(2023\)](https://arxiv.org/html/2609.25166#bib.bib30)\. Each target consists of a reference memorized image and two evaluation prompts: the original prompt associated with the memorized image and a modified prompt used to obtain a more diverse synthetic distribution\. Following[Alberti et al\. \(2025\)](https://arxiv.org/html/2609.25166#bib.bib6), we generate128128samples for each modified prompt to construct memorized and non\-memorized example sets based on their similarity to the reference image\. All4949deletion requests are applied sequentially to the same Stable Diffusion pipeline and further implementation details are provided in the Appendix\.

##### Evaluation protocol and metrics\.

AtK∈\{10,20,30,49\}K\\in\\\{10,20,30,49\\\}, we evaluate all processed deletion targets using their original and modified prompts\. For each target–prompt pair, we generate1616images with fixed random seeds and determine forgetting following the memorization criterion of[Alberti et al\. \(2025\)](https://arxiv.org/html/2609.25166#bib.bib6)\. Final Success measures the fraction of pairs forgotten under the checkpoint afterKKdeletions, while Reappearance measures the fraction of immediately forgotten pairs that later reproduce a memorized instance\. We also report CLIP\-IQA\([Wang et al\. 2023](https://arxiv.org/html/2609.25166#bib.bib29)\)for generation quality\. Representative qualitative results are shown in Fig\.[3](https://arxiv.org/html/2609.25166#S5.F3)\.

##### Results\.

Table[3](https://arxiv.org/html/2609.25166#S5.T3)shows thatLASTING’s persistence advantage extends to prompt\-conditioned latent diffusion\. It achieves no reappearance atK=10K=10and remains competitive atK=20K=20, with a Reappearance Rate of2\.70%2\.70\\%\.

The advantage is clearer for longer deletion sequences\. AtK=30K=30,LASTINGachieves88\.33%88\.33\\%Final Success with only5\.88%5\.88\\%reappearance, compared with66\.67%/22\.45%66\.67\\%/22\.45\\%for SISS and61\.67%/31\.25%61\.67\\%/31\.25\\%for EraseDiff\. AtK=49K=49, it achieves the highest Final Success \(93\.88%93\.88\\%\) and is the only method with no observed reappearance\. These results indicate thatLASTINGpreserves forgetting under subsequent deletion updates rather than merely suppressing each target at its deletion stage\.

LASTINGalso maintains competitive generation quality while substantially improving forgetting persistence\. The qualitative examples in Fig\.[3](https://arxiv.org/html/2609.25166#S5.F3)further show that memorized content remains suppressed at the final checkpoint without evident degradation in visual quality\.

## 6Conclusion

In this paper, we identify*sequential reappearance*, a failure mode in which a diffusion training instance that is forgotten immediately after deletion becomes recoverable again after subsequent unlearning updates\. Our analysis indicates that this failure is associated with sharper local recovery geometry around the deleted target\. Motivated by this finding, we proposeLASTING, which adaptively identifies and suppresses locally recoverable representations during unlearning\. Across diffusion settings,LASTINGsubstantially improves forgetting persistence while preserving generation quality\. These results highlight the need to evaluate diffusion unlearning beyond immediate deletion success and to account for the stability of forgetting under subsequent requests\.

## References

- Albertiet al\.\(2025\)S\. Alberti, K\. Hasanaliyev, M\. Shah, and S\. ErmonData unlearning in diffusion models\.InInternational Conference on Learning Representations,Y\. Yue, A\. Garg, N\. Peng, F\. Sha, and R\. Yu \(Eds\.\),Vol\.2025,pp\. 3084–3100\.External Links:[Link](https://proceedings.iclr.cc/paper_files/paper/2025/file/08a362bd4ae1934e099ce025f06039fe-Paper-Conference.pdf)Cited by:[Appendix B](https://arxiv.org/html/2609.25166#A2.SSx1.p1.1),[Appendix E](https://arxiv.org/html/2609.25166#A5.SSx2.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx1.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx1.p2.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx2.SSS0.Px1.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx3.p1.1),[§1](https://arxiv.org/html/2609.25166#S1.p1.1),[§1](https://arxiv.org/html/2609.25166#S1.p2.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx2.p1.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx2.p1.1),[§4](https://arxiv.org/html/2609.25166#S4.SSx2.p4.1),[§5](https://arxiv.org/html/2609.25166#S5.SS0.SSS0.Px1.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SSx2.SSS0.Px1.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SSx2.SSS0.Px2.p1.1)\.
- Carliniet al\.\(2023\)N\. Carlini, J\. Hayes, M\. Nasr, M\. Jagielski, V\. Sehwag, F\. Tramèr, B\. Balle, D\. Ippolito, and E\. WallaceExtracting training data from diffusion models\.In32nd USENIX Security Symposium \(USENIX Security 23\),Anaheim, CA,pp\. 5253–5270\.External Links:ISBN 978\-1\-939133\-37\-3,[Link](https://www.usenix.org/conference/usenixsecurity23/presentation/carlini)Cited by:[§1](https://arxiv.org/html/2609.25166#S1.p1.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx1.p1.1)\.
- Dinhet al\.\(2017\)L\. Dinh, R\. Pascanu, S\. Bengio, and Y\. BengioSharp minima can generalize for deep nets\.InProceedings of the 34th International Conference on Machine Learning,D\. Precup and Y\. W\. Teh \(Eds\.\),Proceedings of Machine Learning Research, Vol\.70,pp\. 1019–1028\.External Links:[Link](https://proceedings.mlr.press/v70/dinh17b.html)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Ebrahimpour\-Boroojenyet al\.\(2025\)A\. Ebrahimpour\-Boroojeny, H\. Sundaram, and V\. ChandrasekaranNot all wrong is bad: using adversarial examples for unlearning\.InProceedings of the 42nd International Conference on Machine Learning,A\. Singh, M\. Fazel, D\. Hsu, S\. Lacoste\-Julien, F\. Berkenkamp, T\. Maharaj, K\. Wagstaff, and J\. Zhu \(Eds\.\),Proceedings of Machine Learning Research, Vol\.267,pp\. 14950–14971\.External Links:[Link](https://proceedings.mlr.press/v267/ebrahimpour-boroojeny25a.html)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px2.p1.1)\.
- Fanet al\.\(2025\)C\. Fan, J\. Jia, Y\. Zhang, A\. Ramakrishna, M\. Hong, and S\. LiuTowards LLM unlearning resilient to relearning attacks: a sharpness\-aware minimization perspective and beyond\.InProceedings of the 42nd International Conference on Machine Learning,A\. Singh, M\. Fazel, D\. Hsu, S\. Lacoste\-Julien, F\. Berkenkamp, T\. Maharaj, K\. Wagstaff, and J\. Zhu \(Eds\.\),Proceedings of Machine Learning Research, Vol\.267,pp\. 15762–15778\.External Links:[Link](https://proceedings.mlr.press/v267/fan25e.html)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Fanet al\.\(2024\)C\. Fan, J\. Liu, Y\. Zhang, E\. Wong, D\. Wei, and S\. LiuSalUn: empowering machine unlearning via gradient\-based weight saliency in both image classification and generation\.InInternational Conference on Learning Representations,B\. Kim, Y\. Yue, S\. Chaudhuri, K\. Fragkiadaki, M\. Khan, and Y\. Sun \(Eds\.\),Vol\.2024,pp\. 53643–53673\.External Links:[Link](https://proceedings.iclr.cc/paper_files/paper/2024/file/ec4d2e436794d1bf55ca83f5ebb31887-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Foretet al\.\(2021\)P\. Foret, A\. Kleiner, H\. Mobahi, and B\. NeyshaburSharpness\-aware minimization for efficiently improving generalization\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=6Tm1mposlrM)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Gandikotaet al\.\(2023\)R\. Gandikota, J\. Materzynska, J\. Fiotto\-Kaufman, and D\. BauErasing concepts from diffusion models\.InProceedings of the IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 2426–2436\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Gaoet al\.\(2025\)H\. Gao, T\. Pang, C\. Du, T\. Hu, Z\. Deng, and M\. LinMeta\-unlearning on diffusion models: preventing relearning unlearned concepts\.InProceedings of the IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 2131–2141\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx3.p1.1)\.
- Georgeet al\.\(2025\)N\. George, K\. N\. Dasaraju, R\. R\. Chittepu, and K\. R\. MopuriThe illusion of unlearning: the unstable nature of machine unlearning in text\-to\-image diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 13393–13402\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx3.p1.1)\.
- Georgeet al\.\(2026\)N\. George, N\. Murata, Y\. Takida, K\. R\. Mopuri, and Y\. MitsufujiLocality\-aware continual unlearning for diffusion models\.InEuropean Conference on Computer Vision \(ECCV\),Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx4.p1.1)\.
- Hanet al\.\(2025\)H\. Han, S\. Kim, H\. Joo, S\. Hong, and J\. LeeAdjusting initial noise to mitigate memorization in text\-to\-image diffusion models\.InAdvances in Neural Information Processing Systems,D\. Belgrave, C\. Zhang, H\. Lin, R\. Pascanu, P\. Koniusz, M\. Ghassemi, and N\. Chen \(Eds\.\),Vol\.38,pp\. 684–711\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2025/file/012fb887ac427dea14cd2f413230f5f7-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx1.p1.1)\.
- Heng and Soh \(2023\)A\. Heng and H\. SohSelective amnesia: a continual learning approach to forgetting in deep generative models\.InAdvances in Neural Information Processing Systems,A\. Oh, T\. Naumann, A\. Globerson, K\. Saenko, M\. Hardt, and S\. Levine \(Eds\.\),Vol\.36,pp\. 17170–17194\.External Links:[Document](https://dx.doi.org/10.52202/075280-0751),[Link](https://proceedings.neurips.cc/paper_files/paper/2023/file/376276a95781fa17c177b1ccdd0a03ac-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Heuselet al\.\(2017\)M\. Heusel, H\. Ramsauer, T\. Unterthiner, B\. Nessler, and S\. HochreiterGANs trained by a two time\-scale update rule converge to a local nash equilibrium\.InAdvances in Neural Information Processing Systems,I\. Guyon, U\. V\. Luxburg, S\. Bengio, H\. Wallach, R\. Fergus, S\. Vishwanathan, and R\. Garnett \(Eds\.\),Vol\.30,pp\.\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2017/file/8a1d694707eb0fefe65871369074926d-Paper.pdf)Cited by:[§5](https://arxiv.org/html/2609.25166#S5.SSx1.SSS0.Px2.p1.1)\.
- Hoet al\.\(2020\)J\. Ho, A\. Jain, and P\. AbbeelDenoising diffusion probabilistic models\.InAdvances in Neural Information Processing Systems,H\. Larochelle, M\. Ranzato, R\. Hadsell, M\.F\. Balcan, and H\. Lin \(Eds\.\),Vol\.33,pp\. 6840–6851\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2020/file/4c5bcfec8584af0d967f1ab10179ca4b-Paper.pdf)Cited by:[§4](https://arxiv.org/html/2609.25166#S4.SSx1.p1.2),[§5](https://arxiv.org/html/2609.25166#S5.SSx1.SSS0.Px1.p1.1)\.
- Hsuet al\.\(2025\)H\. Hsu, P\. Niroula, Z\. He, I\. Brugere, F\. Lecue, and R\. ChenThe unseen threat: residual knowledge in machine unlearning under perturbed samples\.InAdvances in Neural Information Processing Systems,D\. Belgrave, C\. Zhang, H\. Lin, R\. Pascanu, P\. Koniusz, M\. Ghassemi, and N\. Chen \(Eds\.\),Vol\.38,pp\. 26721–26763\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2025/file/2656bba937d78593fbd99ace9f14e311-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px2.p1.1)\.
- Karraset al\.\(2018\)T\. Karras, T\. Aila, S\. Laine, and J\. LehtinenProgressive growing of GANs for improved quality, stability, and variation\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Hk99zCeAb)Cited by:[§5](https://arxiv.org/html/2609.25166#S5.SSx1.SSS0.Px1.p1.1)\.
- Keskaret al\.\(2017\)N\. S\. Keskar, D\. Mudigere, J\. Nocedal, M\. Smelyanskiy, and P\. T\. P\. TangOn large\-batch training for deep learning: generalization gap and sharp minima\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=H1oyRlYgg)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Khalafiet al\.\(2026\)S\. Khalafi, A\. Ribeiro, and D\. DingUnlearning in diffusion models: a unified framework with KL divergence and likelihood constraints\.InForty\-third International Conference on Machine Learning,External Links:[Link](https://openreview.net/forum?id=98xDF2hkIy)Cited by:[Appendix B](https://arxiv.org/html/2609.25166#A2.SSx1.p1.1),[Appendix E](https://arxiv.org/html/2609.25166#A5.SSx2.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx3.p1.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx2.p1.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx2.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SS0.SSS0.Px1.p1.1)\.
- Kumariet al\.\(2023\)N\. Kumari, B\. Zhang, S\. Wang, E\. Shechtman, R\. Zhang, and J\. ZhuAblating concepts in text\-to\-image diffusion models\.InProceedings of the IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 22691–22702\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Leeet al\.\(2026a\)J\. Lee, Z\. Mai, J\. Yoo, C\. Fan, C\. Zhang, and W\. ChaoContinual unlearning for text\-to\-image diffusion models: a regularization perspective\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=BsY20r9FOM)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx4.p1.1)\.
- Leeet al\.\(2026b\)K\. Lee, K\. Lee, S\. Hong, B\. H\. Lee, and S\. Y\. ChunUnlearning the unpromptable: prompt\-free instance unlearning in diffusion models\.Note:Accepted to the Non\-Archival Track of the CVPR 2026 Workshop on MUVExternal Links:2603\.10445,[Link](https://arxiv.org/abs/2603.10445)Cited by:[Appendix B](https://arxiv.org/html/2609.25166#A2.SSx1.p1.1),[Appendix E](https://arxiv.org/html/2609.25166#A5.SSx2.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx3.p1.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx2.p1.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx2.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SS0.SSS0.Px1.p1.1)\.
- Liet al\.\(2025\)G\. Li, Y\. Xiao, J\. Ji, K\. Deng, B\. Hui, L\. Guo, and X\. MaSculpting memory: multi\-concept forgetting in diffusion models via dynamic mask and concept\-aware optimization\.InProceedings of the IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 19659–19668\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Luet al\.\(2024\)S\. Lu, Z\. Wang, L\. Li, Y\. Liu, and A\. W\. KongMACE: mass concept erasure in diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 6430–6440\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Malekmohammadiet al\.\(2025\)S\. Malekmohammadi, H\. kyu Lee, and L\. XiongSharpness\-aware parameter selection for machine unlearning\.External Links:2504\.06398,[Link](https://arxiv.org/abs/2504.06398)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Merger and Goldt \(2026\)C\. Merger and S\. GoldtLocal coverage governs memorization in diffusion models\.InThe Second Workshop on the Impact of Memorization on Trustworthy Foundation Models at ICML,External Links:[Link](https://openreview.net/forum?id=wUCcl1vNxd)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx1.p1.1)\.
- Parket al\.\(2026\)E\. Park, Y\. Shin, and S\. S\. WooRobust continual unlearning against knowledge erosion and forgetting reversal\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\) Findings,pp\. 7978–7987\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx4.p1.1)\.
- Park and Park \(2026\)J\. Park and M\. ParkNot every time and frequency need to be forgotten in diffusion unlearning\.InICML 2026 Workshop on Foundations of Deep Generative Models: Understanding Memorization, Generalization, and Reasoning,External Links:[Link](https://openreview.net/forum?id=ONZmXOH029)Cited by:[§1](https://arxiv.org/html/2609.25166#S1.p2.1)\.
- Pizziet al\.\(2022\)E\. Pizzi, S\. D\. Roy, S\. N\. Ravindra, P\. Goyal, and M\. DouzeA Self\-Supervised Descriptor for Image Copy Detection\.In2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),Vol\.,Los Alamitos, CA, USA,pp\. 14512–14522\.External Links:ISSN,[Document](https://dx.doi.org/10.1109/CVPR52688.2022.01413),[Link](https://doi.ieeecomputersociety.org/10.1109/CVPR52688.2022.01413)Cited by:[Appendix A](https://arxiv.org/html/2609.25166#A1.p2.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx1.SSS0.Px2.p1.2),[§5](https://arxiv.org/html/2609.25166#S5.SSx1.SSS0.Px2.p1.1)\.
- Rombachet al\.\(2022\)R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. OmmerHigh\-resolution image synthesis with latent diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 10684–10695\.Cited by:[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx1.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SSx2.p1.1)\.
- Shiet al\.\(2026\)Q\. Shi, C\. Jin, J\. Zhang, and Y\. GuReTrack: data unlearning in diffusion models through redirecting the denoising trajectory\.InThe 29th International Conference on Artificial Intelligence and Statistics,External Links:[Link](https://openreview.net/forum?id=oTUZfa0iPv)Cited by:[Appendix B](https://arxiv.org/html/2609.25166#A2.SSx1.p1.1),[Appendix E](https://arxiv.org/html/2609.25166#A5.SSx2.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx3.p1.1),[§1](https://arxiv.org/html/2609.25166#S1.p1.1),[§1](https://arxiv.org/html/2609.25166#S1.p2.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx2.p1.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx2.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SS0.SSS0.Px1.p1.1)\.
- Somepalliet al\.\(2023a\)G\. Somepalli, V\. Singla, M\. Goldblum, J\. Geiping, and T\. GoldsteinDiffusion art or digital forgery? investigating data replication in diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 6048–6058\.Cited by:[§1](https://arxiv.org/html/2609.25166#S1.p1.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx1.p1.1)\.
- Somepalliet al\.\(2023b\)G\. Somepalli, V\. Singla, M\. Goldblum, J\. Geiping, and T\. GoldsteinUnderstanding and mitigating copying in diffusion models\.InAdvances in Neural Information Processing Systems,A\. Oh, T\. Naumann, A\. Globerson, K\. Saenko, M\. Hardt, and S\. Levine \(Eds\.\),Vol\.36,pp\. 47783–47803\.External Links:[Document](https://dx.doi.org/10.52202/075280-2071),[Link](https://proceedings.neurips.cc/paper_files/paper/2023/file/9521b6e7f33e039e7d92e23f5e37bbf4-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx1.p1.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx1.SSS0.Px2.p1.2)\.
- Tang and Khanna \(2026\)H\. Tang and R\. KhannaSharpness\-aware machine unlearning\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=BZ8I2tXomt)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Thakralet al\.\(2025\)K\. Thakral, T\. Glaser, T\. Hassner, M\. Vatsa, and R\. SinghContinual unlearning for foundational text\-to\-image models without generalization erosion\.External Links:2503\.13769,[Link](https://arxiv.org/abs/2503.13769)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx4.p1.1)\.
- Wanget al\.\(2023\)J\. Wang, K\. C\. Chan, and C\. C\. LoyExploring CLIP for assessing the look and feel of images\.InProceedings of the AAAI conference on artificial intelligence,Vol\.37,pp\. 2555–2563\.Cited by:[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx2.SSS0.Px4.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SSx2.SSS0.Px2.p1.1)\.
- Webster \(2023\)R\. WebsterA reproducible extraction of training images from diffusion models\.External Links:2305\.08694,[Link](https://arxiv.org/abs/2305.08694)Cited by:[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx1.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SSx2.SSS0.Px1.p1.1)\.
- Wenet al\.\(2024\)Y\. Wen, Y\. Liu, C\. Chen, and L\. LyuDetecting, explaining, and mitigating memorization in diffusion models\.InInternational Conference on Learning Representations,B\. Kim, Y\. Yue, S\. Chaudhuri, K\. Fragkiadaki, M\. Khan, and Y\. Sun \(Eds\.\),Vol\.2024,pp\. 35647–35662\.External Links:[Link](https://proceedings.iclr.cc/paper_files/paper/2024/file/993760d9b1d63a385611c7c9ef8f3ecb-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx1.p1.1)\.
- Wuet al\.\(2020\)D\. Wu, S\. Xia, and Y\. WangAdversarial weight perturbation helps robust generalization\.InAdvances in Neural Information Processing Systems,H\. Larochelle, M\. Ranzato, R\. Hadsell, M\.F\. Balcan, and H\. Lin \(Eds\.\),Vol\.33,pp\. 2958–2969\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2020/file/1ef91c212e30e14bf125e9374262401f-Paper.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx5.SSSx2.Px1.p1.1)\.
- Wuet al\.\(2025\)J\. Wu, T\. Le, M\. Hayat, and M\. HarandiErasing undesirable influence in diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 28263–28273\.Cited by:[Appendix B](https://arxiv.org/html/2609.25166#A2.SSx1.p1.1),[Appendix E](https://arxiv.org/html/2609.25166#A5.SSx2.p1.1),[Appendix F](https://arxiv.org/html/2609.25166#A6.SSx3.p1.1),[§1](https://arxiv.org/html/2609.25166#S1.p2.1),[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx2.p1.1),[§3](https://arxiv.org/html/2609.25166#S3.SSx2.p1.1),[§5](https://arxiv.org/html/2609.25166#S5.SS0.SSS0.Px1.p1.1)\.
- Zhanget al\.\(2024a\)G\. Zhang, K\. Wang, X\. Xu, Z\. Wang, and H\. ShiForget\-me\-not: learning to forget in text\-to\-image diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\) Workshops,pp\. 1755–1764\.Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx2.SSSx1.p1.1)\.
- Zhanget al\.\(2024b\)Y\. Zhang, C\. Fan, Y\. Zhang, Y\. Yao, J\. Jia, J\. Liu, G\. Zhang, G\. Liu, R\. Kompella, X\. Liu, and S\. LiuUnlearnCanvas: stylized image dataset for enhanced machine unlearning evaluation in diffusion models\.InAdvances in Neural Information Processing Systems,A\. Globerson, L\. Mackey, D\. Belgrave, A\. Fan, U\. Paquet, J\. Tomczak, and C\. Zhang \(Eds\.\),Vol\.37,pp\. 96387–96423\.External Links:[Document](https://dx.doi.org/10.52202/079017-3055),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/file/aebf4822d30c3f2600566af7eba83548-Paper-Datasets_and_Benchmarks_Track.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx4.p1.1)\.
- Zhanget al\.\(2024c\)Y\. Zhang, X\. Chen, J\. Jia, Y\. Zhang, C\. Fan, J\. Liu, M\. Hong, K\. Ding, and S\. LiuDefensive unlearning with adversarial training for robust concept erasure in diffusion models\.InAdvances in Neural Information Processing Systems,A\. Globerson, L\. Mackey, D\. Belgrave, A\. Fan, U\. Paquet, J\. Tomczak, and C\. Zhang \(Eds\.\),Vol\.37,pp\. 36748–36776\.External Links:[Document](https://dx.doi.org/10.52202/079017-1158),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/file/40954ac18a457dd5f11145bae6454cdf-Paper-Conference.pdf)Cited by:[§2](https://arxiv.org/html/2609.25166#S2.SSx3.p1.1)\.

Appendix Contents

1. A\.Ablation Studies 1. A\.1Sensitivity to the Number of Inner\-Search StepsJJ 2. A\.2Sensitivity to the Neighborhood Radiusϵnbr\\epsilon\_\{\\mathrm\{nbr\}\} 3. A\.3Random\- and High\-Loss\-Neighbor Ablations
2. B\.Additional Experimental Results 1. B\.1Computational Overhead 2. B\.2Sensitivity to Evaluation Timestep
3. C\.Additional Analysis of Sequential Reappearance 1. C\.1Trajectory\-Level Reappearance
4. D\.Additional Recovery Sharpness Analysis 1. D\.1Recovery Sharpness Measurement
5. E\.CelebA\-HQ Experimental Details and Results 1. E\.1Dataset and Sequential Deletion Protocol 2. E\.2Compared Methods and Optimization Details 3. E\.3LASTINGImplementation Details 4. E\.4Additional Qualitative Examples
6. F\.Stable Diffusion Experimental Details and Results 1. F\.1Data and Sequential Deletion Protocol 2. F\.2Memorization and CLIP\-IQA Evaluation Protocol 3. F\.3Compared Methods and Optimization Details 4. F\.4Additional Qualitative Examples

## Appendix AAblation Studies

We conduct ablations on the number of inner\-search stepsJJ, the neighborhood radiusϵnbr\\epsilon\_\{\\mathrm\{nbr\}\}, and the importance of the neighbor\-selection strategy inLASTING\. All experiments use the CelebA\-HQ sequential deletion setting with SISS as the outer unlearning objective\. Within each ablation, we vary only the component under study while keeping the deletion order, retain set, outer\-update budget, optimizer, and evaluation protocol fixed\.

We follow the persistence metrics defined in the main paper using SSCD similarity\([Pizzi et al\. 2022](https://arxiv.org/html/2609.25166#bib.bib27)\)with the operational thresholdτ=0\.7\\tau=0\.7\. Final Success is normalized by allKKdeletion targets, whereas Final Reappearance is normalized by the immediate\-success cohort\. We report each rate as both a raw count and a percentage\. Immediate and Final SSCD are averaged over allKKtargets\.

Neighborhood radii are reported in the conventional\[0,1\]\[0,1\]pixel scale\. Since the implementation normalizes images to\[−1,1\]\[\-1,1\], a radius ofr/255r/255corresponds to2​r/2552r/255in the implementation space\. All perturbations are projected onto the correspondingℓ∞\\ell\_\{\\infty\}neighborhood and the valid normalized image domain\.

### Sensitivity to the Number of Inner\-Search StepsJJ

We examine how the inner\-search budget affects forgetting persistence by varyingJ∈\{1,4,8,12\}J\\in\\\{1,4,8,12\\\}on the sameK=300K=300deletion sequence\. All configurations useϵnbr=4/255\\epsilon\_\{\\mathrm\{nbr\}\}=4/255and share the same outer optimization and evaluation settings\. The diffusion timestep and noise are fixed throughout each inner search and reused in the subsequent outer update\.

Table 4:Sensitivity to the number of inner\-search steps\.As shown in Table[4](https://arxiv.org/html/2609.25166#A1.T4),J=8J=8achieves the lowest Final Reappearance rate of2\.33%2\.33\\%and the lowest Final SSCD of0\.39170\.3917\. Increasing the search budget fromJ=4J=4toJ=8J=8improves both metrics, whereasJ=12J=12provides no further benefit and increases Final SSCD and endpoint reappearance\. We therefore useJ=8J=8for the CelebA\-HQ experiments\.

### Sensitivity to the Neighborhood Radiusϵnbr\\epsilon\_\{\\mathrm\{nbr\}\}

We examine how the neighborhood size affects forgetting persistence by varyingϵnbr∈\{4/255,8/255,12/255,16/255\}\\epsilon\_\{\\mathrm\{nbr\}\}\\in\\\{4/255,8/255,12/255,16/255\\\}on the sameK=100K=100deletion sequence\. All configurations useJ=4J=4inner\-search steps and share the same outer optimization and evaluation settings\. The reported radii follow the conventional\[0,1\]\[0,1\]pixel scale\.

Table 5:Sensitivity to the neighborhood radius\.As shown in Table[5](https://arxiv.org/html/2609.25166#A1.T5),ϵnbr=8/255\\epsilon\_\{\\mathrm\{nbr\}\}=8/255exhibits no final reappearance and achieves a Final SSCD of0\.34950\.3495\. Increasing the radius to12/25512/255and16/25516/255raises Final SSCD to0\.53000\.5300and0\.70300\.7030, respectively, while also producing more final reappearance\. These results indicate that expanding the search region beyond8/2558/255weakens forgetting persistence under the tested setting\. Although8/2558/255performs best in this ablation, we use4/2554/255as a conservative default for the longer main experiments\.

### Random\- and High\-Loss\-Neighbor Ablations

We disentangle the effects of neighborhood perturbation and optimization direction by comparing four variants on the sameK=200K=200deletion sequence\. SISS uses the observed deletion target, while Random Neighbor uses a norm\-matched perturbation\. High\-Loss Neighbor reverses the inner\-search direction ofLASTING\. It performs projected gradient ascent on the DDPM denoising loss to select a locally high\-loss neighbor, rather than the locally recoverable low\-loss neighbor targeted byLASTING\. This ablation tests whether the benefit ofLASTINGarises specifically from targeting a low\-loss recovery route, rather than from neighborhood perturbation alone\. All variants use the same SISS outer objective, deletion order, retain set, update budget, optimizer, and evaluation protocol\. The low\- and high\-loss variants useϵnbr=4/255\\epsilon\_\{\\mathrm\{nbr\}\}=4/255andJ=4J=4matched inner\-gradient steps\. We evaluate the selected representations using an independent fixed bankℬeval\\mathcal\{B\}\_\{\\mathrm\{eval\}\}of diffusion timesteps and noise samples\.

Table 6:Effect of neighbor construction on sequential forgetting\. Random Neighbor uses a norm\-matched random perturbation, High\-Loss Neighbor performs projected loss maximization, andLASTINGperforms projected loss minimization\.As shown in Table[6](https://arxiv.org/html/2609.25166#A1.T6),LASTINGachieves a Final Reappearance rate of only2\.00%2\.00\\%, whereas Random Neighbor and High\-Loss Neighbor obtain23\.74%23\.74\\%and37\.20%37\.20\\%, respectively\. These results provide three complementary observations\. First, Random Neighbor performs substantially worse than SISS, indicating that the improvement ofLASTINGdoes not arise from neighborhood perturbation alone\. Second, High\-Loss Neighbor further degrades both immediate forgetting and forgetting persistence, demonstrating that the direction of the neighborhood search is critical\. Finally,LASTINGconsistently outperforms SISS, showing that explicitly identifying and suppressing a locally recoverable low\-loss representation improves persistent forgetting under subsequent deletion updates\.

## Appendix BAdditional Experimental Results

We report the computational overhead ofLASTINGand examine the stability of the evaluation results across two evaluation timesteps,teval∈\{250,350\}t\_\{\\mathrm\{eval\}\}\\in\\\{250,350\\\}\. For each timestep, results are aggregated over three seeds\.

### Computational Overhead

We compare the computational overhead ofLASTINGwith SISS\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\), EraseDiff\([Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7)\), ReTrack\([Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8)\), Forward KL\-Constrained Unlearning\([Khalafi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib42)\), and Prompt\-free Instance Unlearning\([Lee et al\. 2026b](https://arxiv.org/html/2609.25166#bib.bib43)\)\. Each method uses its reported CelebA\-HQ configuration and update budget\.

We measure end\-to\-end wall\-clock time and peak process GPU memory using a single NVIDIA RTX PRO 6000 Blackwell Server Edition GPU\.

Table 7:Computational overhead on CelebA\-HQ\.As shown in Table[7](https://arxiv.org/html/2609.25166#A2.T7),LASTINGrequires additional runtime due to its inner search\. Nevertheless, it achieves stronger forgetting persistence without increasing peak GPU memory, which remains comparable to that of SISS and lower than those of the other baselines\. Moreover, as shown in Table[4](https://arxiv.org/html/2609.25166#A1.T4), this runtime–performance trade\-off can be adjusted by reducing the number of inner\-search stepsJJ\.

### Sensitivity to Evaluation Timestep

Table 8:Sensitivity to Evaluation Timestep\. For each evaluation timestep, results are reported as mean±\\pmsample standard deviation over three seeds\. The best result for each evaluation timestep is shown in bold\.As shown in Table[8](https://arxiv.org/html/2609.25166#A2.T8),LASTINGmaintains its forgetting\-persistence advantage across three random seeds and evaluation timesteps\. This consistency indicates that the reduction in sequential reappearance achieved byLASTINGpersists across recovery\-noise seeds and evaluation settings, while the small standard deviations of LASTING further demonstrate that its performance is stable across the evaluated seeds\.

## Appendix CAdditional Analysis of Sequential Reappearance

### Trajectory\-Level Reappearance

We further analyze reappearance over the fullK=300K=300deletion trajectory\. For each immediately forgotten target, we examine all subsequent checkpoints using the same SSCD thresholdτ=0\.7\\tau=0\.7as in the main paper\.*No Reappearance*indicates that the target never crosses the threshold, whereas*Transient Reappearance*indicates that it crosses the threshold but returns below it at the final checkpoint\.*Final Reappearance*indicates that it remains above the threshold at the final checkpoint\. Therefore, Ever Reappearance consists of transient and final reappearance\.

Table 9:Trajectory\-level reappearance on the fixedK=300K=300deletion sequence\. Immediate Success is reported over allKKtargets\. The remaining categories are reported over each method’s immediate\-success cohort\. Ever Reapp\. is the union of Transient and Final Reapp\.As shown in Table[9](https://arxiv.org/html/2609.25166#A3.T9),LASTINGachieves the highest No Reappearance rate of93\.00%93\.00\\%and the lowest Ever Reappearance rate of7\.00%7\.00\\%\. Its2121reappearing targets consist of1414transient and77final cases\. In comparison, SISS exhibits an Ever Reappearance rate of23\.49%23\.49\\%, while the other baselines range from65\.02%65\.02\\%to80\.81%80\.81\\%\. These results show thatLASTINGreduces both transient and final reappearance throughout the observed deletion trajectory\.

## Appendix DAdditional Recovery Sharpness Analysis

### Recovery Sharpness Measurement

This section provides the implementation details of the recovery sharpness analysis reported in Fig\. 2\(a\) of the main paper and compares the mean recovery sharpness of SISS andLASTINGon the sameK=300K=300deletion sequence\. For each methoduu, we measure recovery sharpness at the checkpointθi\(u\)\\theta\_\{i\}^\{\(u\)\}immediately after deleting targetaia\_\{i\}\.

For each target, the fixed bankℬi\\mathcal\{B\}\_\{i\}contains timesteps\{50,100,150,200,250\}\\\{50,100,150,200,250\\\}and two Gaussian noise draws per timestep\. We use the base seed2026071320260713with a target\-specific index offset\. For each target, the same bank is reused across methods and for both the observed target and all perturbed candidates evaluated during the search\.

Li,u​\(δ\)\\displaystyle L\_\{i,u\}\(\\delta\)=1\|ℬi\|​∑ξ∈ℬiℓdiff​\(θi\(u\),ai\+δ,ξ\),\\displaystyle=\\frac\{1\}\{\|\\mathcal\{B\}\_\{i\}\|\}\\sum\_\{\\xi\\in\\mathcal\{B\}\_\{i\}\}\\ell\_\{\\mathrm\{diff\}\}\\left\(\\theta\_\{i\}^\{\(u\)\},a\_\{i\}\+\\delta,\\xi\\right\),\(12\)δ^i,u\\displaystyle\\widehat\{\\delta\}\_\{i,u\}≈arg​min‖δ‖∞≤ϵsharpai\+δ∈\[−1,1\]d⁡Li,u​\(δ\),\\displaystyle\\approx\\mathop\{\\mathrm\{arg\\,min\}\}\_\{\\begin\{subarray\}\{c\}\\\|\\delta\\\|\_\{\\infty\}\\leq\\epsilon\_\{\\mathrm\{sharp\}\}\\\\ a\_\{i\}\+\\delta\\in\[\-1,1\]^\{d\}\\end\{subarray\}\}L\_\{i,u\}\(\\delta\),RecSharpi,u\\displaystyle\\mathrm\{RecSharp\}\_\{i,u\}=max⁡\{0,1−Li,u​\(δ^i,u\)max⁡\{Li,u​\(0\),10−12\}\}\.\\displaystyle=\\max\\left\\\{0,\\,1\-\\frac\{L\_\{i,u\}\(\\widehat\{\\delta\}\_\{i,u\}\)\}\{\\max\\\{L\_\{i,u\}\(0\),10^\{\-12\}\\\}\}\\right\\\}\.
The Recovery Sharpness score measures the relative reduction in denoising loss accessible within the prescribed neighborhood\. A larger value indicates sharper local recovery geometry around the deleted target\.

We setϵsharp=0\.03137255≃8/255\\epsilon\_\{\\mathrm\{sharp\}\}=0\.03137255\\simeq 8/255in the normalized\[−1,1\]\[\-1,1\]image space, which corresponds to4/2554/255in the\[0,1\]\[0,1\]image space\. Starting fromδ=0\\delta=0, we perform eight projected sign\-gradient descent steps with step sizeϵsharp/8≃1/255\\epsilon\_\{\\mathrm\{sharp\}\}/8\\simeq 1/255\. Each step appliesℓ∞\\ell\_\{\\infty\}projection and image\-range clipping\. We do not use random initialization or multiple restarts\.

For the association analysis reported in the main paper, we retain targets satisfyingsi​\(θi\(u\)\)<τs\_\{i\}\(\\theta\_\{i\}^\{\(u\)\}\)<\\tau, whereτ=0\.7\\tau=0\.7\. For each eligible target withi<Ki<K, we define its maximum future SSCD over the next 30 deletion stages as

mi,u\(30\)=maxi<j≤min⁡\(i\+30,K\)⁡si​\(θj\(u\)\)\.m\_\{i,u\}^\{\(30\)\}=\\max\_\{i<j\\leq\\min\(i\+30,K\)\}s\_\{i\}\\\!\\left\(\\theta\_\{j\}^\{\(u\)\}\\right\)\.\(13\)The upper endpoint is truncated at the final checkpoint for targets near the end of the sequence\. A target is labeled as reappearing whenmi,u\(30\)≥τm\_\{i,u\}^\{\(30\)\}\\geq\\tauand as remaining forgotten otherwise\.

The eligibility condition above is used only for the association analysis\. For the method\-level comparison, we average recovery sharpness over the sameK=300K=300deletion targets for SISS andLASTING\. As shown in Table[10](https://arxiv.org/html/2609.25166#A4.T10),LASTINGreduces the mean recovery sharpness from0\.05010\.0501to0\.03090\.0309, corresponding to a38\.35%38\.35\\%reduction relative to SISS\.

Moreover, we also examine the vulnerable upper tail through a paired target\-level comparison\. WhileLASTINGreduces average recovery sharpness by38\.35%38\.35\\%over all targets, the reduction increases to68\.39%68\.39\\%,77\.72%77\.72\\%, and82\.83%82\.83\\%for the top25%25\\%,10%10\\%, and5%5\\%highest\-sharpness targets, respectively\. This trend indicates thatLASTINGis particularly effective at suppressing the locally recoverable representations of the most vulnerable deletion targets, rather than merely producing a uniform reduction across already stable samples\.

Table 10:Recovery Sharpness reduction byLASTINGacross all targets and the vulnerable upper tail\.

## Appendix ECelebA\-HQ Experimental Details and Results

### Dataset and Sequential Deletion Protocol

We use the 30,000\-image CelebA\-HQ dataset and the pretrainedgoogle/ddpm\-celebahq\-256unconditional DDPM\. The256×256256\\times 256images are normalized to\[−1,1\]\[\-1,1\]\. The deletion sequence contains 300 targets, ordered from10000\.jpgto10299\.jpg, and we report the prefix checkpoints atK∈\{50,100,200,300\}K\\in\\\{50,100,200,300\\\}\. After unlearning targetaia\_\{i\}, the resulting modelθi\\theta\_\{i\}initializes deletion stagei\+1i\+1\.

The retain pool is fixed throughout the trajectory\. All 300 deletion targets are excluded before sequential unlearning begins, leaving 29,700 retain images\. The target order, retain pool, model initialization, and random seed are shared across all methods\.

For recovery evaluation, each target is noised at diffusion timestept=250t=250and reconstructed through the reverse process fromt=250t=250to00\. We use one reconstruction per target and the same seed and noise realization across all methods, including Prompt\-free Instance Unlearning\. Each reconstruction is saved as a PNG and evaluated using the same SSCD encoder and ImageNet preprocessing\. We use memorization thresholdτ=0\.7\\tau=0\.7\. Immediate SSCD is measured usingθi\\theta\_\{i\}, whereas Final SSCD for a prefix of lengthKKis measured usingθK\\theta\_\{K\}\.

FID is evaluated at each reported prefix checkpoint using 10,000 generated images, 50 DDPM sampling steps, and the full CelebA\-HQ reference set\.

### Compared Methods and Optimization Details

We compare SISS\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\), EraseDiff\([Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7)\), ReTrack\([Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8)\), Forward KL\-Constrained Unlearning\([Khalafi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib42)\), and Prompt\-free Instance Unlearning\([Lee et al\. 2026b](https://arxiv.org/html/2609.25166#bib.bib43)\)\. Each baseline uses the best\-performing or recommended optimization configuration from its original work\.

Table 11:Optimization settings for the CelebA\-HQ experiments\. Method\-specific update budgets follow the best\-performing or recommended configurations of the corresponding methods\.All methods use a constant learning\-rate schedule without warmup and are trained in FP32\. SISS, EraseDiff, ReTrack, andLASTINGuse a maximum gradient norm of1\.01\.0\. Forward KL uses0\.30\.3, and Prompt\-free does not apply gradient clipping\. Prompt\-free uses a fixed edited surrogate for each target and applies its original gradient\-surgery update\.

### LASTINGImplementation Details

LASTINGis implemented on top of SISS while leaving its retain construction and outer deletion objective unchanged\. The inner search uses the raw DDPMϵ\\epsilon\-prediction MSE\. We setϵnbr=4/255\\epsilon\_\{\\mathrm\{nbr\}\}=4/255,J=8J=8, andηin=ϵnbr/J=0\.5/255\\eta\_\{\\mathrm\{in\}\}=\\epsilon\_\{\\mathrm\{nbr\}\}/J=0\.5/255in the conventional\[0,1\]\[0,1\]pixel scale\. These values correspond to8/2558/255and1/2551/255, respectively, in the implementation’s\[−1,1\]\[\-1,1\]scale\.

Each search starts from zero perturbation and performs projected sign\-gradient descent without random initialization\. After each inner step, the perturbation is projected onto theℓ∞\\ell\_\{\\infty\}neighborhood, and the resulting image is clipped to\[−1,1\]\[\-1,1\]\. The diffusion timestep and noise are fixed across theJJinner steps and reused in the subsequent outer update\. The selected neighbor is detached before computing the SISS deletion loss, so the outer update does not require second\-order gradients\.

### Additional Qualitative Examples

Figure[4](https://arxiv.org/html/2609.25166#A5.F4)provides additional qualitative comparisons on theK=300K=300deletion trajectory\. For each target, we show the original image together with the immediate and final reconstructions obtained from each method\. All reconstructions are generated using the same recovery protocol\. These examples illustrate representative cases in which memorized target\-specific information reappears under baseline methods but remains suppressed underLASTING\.

Figure 4:Additional qualitative results on CelebA\-HQ\. For each deletion target, the immediate model shows the recovery output immediately after the corresponding target is unlearned, while the final model shows the recovery output after all subsequent deletion requests have been processed\.ImmediateModelFinalModel![Refer to caption](https://arxiv.org/html/2609.25166v1/Appendix/Figures/fig6/10162_orig.jpg)ImmediateModelFinalModel![Refer to caption](https://arxiv.org/html/2609.25166v1/Appendix/Figures/fig7/10166_orig.jpg)ImmediateModelFinalModel![Refer to caption](https://arxiv.org/html/2609.25166v1/Appendix/Figures/fig8/10206_orig.jpg)Figure 5:Additional qualitative results on CelebA\-HQ \(continued\)\.

## Appendix FStable Diffusion Experimental Details and Results

We provide additional implementation and evaluation details for the sequential Stable Diffusion experiments reported in the main paper\. We describe the construction of the deletion sequence, the target\-specific KMeans classifier used for memorization evaluation, the CLIP\-IQA protocol, and the optimization settings for all compared methods\. We then present additional qualitative comparisons at the immediate and final model states\.

### Data and Sequential Deletion Protocol

We implement Stable Diffusion v1\.4 using the Hugging Face Diffusers library\([Rombach et al\. 2022](https://arxiv.org/html/2609.25166#bib.bib13)\)\. We selectKSD=49K\_\{\\mathrm\{SD\}\}=49deletion targets from the fully memorized prompt–image pairs identified by[Webster \(2023\)](https://arxiv.org/html/2609.25166#bib.bib30)and use the data construction of SISS\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\)\. Each target contains one reference memorized image, its original prompt, a modified prompt, and 128 images generated from the modified prompt\.

Following\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\), we use target\-specific KMeans classifiers to partition the generated images into memorized and non\-memorized subsets\. The memorized subset serves as the stage\-specific forget set, while the non\-memorized subset serves as the retain set\. Across the 49 target partitions, this yields 6,272 images in total, including 3,108 memorized and 3,164 non\-memorized samples\.

We order the 49 targets lexicographically and apply the deletion requests sequentially\. The first stage starts from the pretrained Stable Diffusion v1\.4 pipeline, and the model obtained at stageiiinitializes stagei\+1i\+1\. Each stage uses only the forget and retain sets of its current target, while the updated model parameters are carried forward\. All methods use the same target order, target assets, initial model, and checkpoint\-transfer rule\. We report the prefix checkpoints atK∈\{10,20,30,49\}K\\in\\\{10,20,30,49\\\}\.

### Memorization and CLIP\-IQA Evaluation Protocol

We evaluate memorization separately for the original and modified prompts and measure generation quality over their combined outputs\. The protocol applies the main\-paper persistence metrics to target–prompt cases using a target\-specific KMeans classifier\.

##### Target\-specific memorization classifier\.

We use the precomputed KMeans classifier stored for each target in the SISS data construction following\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\)\. All evaluation images are generated at512×512512\\times 512resolution and passed to the classifier without resizing\. Lethi​\(x\)=1h\_\{i\}\(x\)=1indicate that the classifier for targetiipredicts imagexxas memorized, whilehi​\(x\)=0h\_\{i\}\(x\)=0denotes a non\-memorized image\. We keep each classifier fixed across both prompt types, all evaluation checkpoints, and all compared methods\.

##### Prompt\-level forgetting\.

Immediately after the deletion stage, we evaluate the current target using its original and modified prompts\. AtK∈\{10,20,30,49\}K\\in\\\{10,20,30,49\\\}, we reevaluate every target processed through stageKK\. For targetii, prompt typep∈𝒫=\{original,modified\}p\\in\\mathcal\{P\}=\\\{\\mathrm\{original\},\\mathrm\{modified\}\\\}, and checkpointθj\\theta\_\{j\}, we generate imagesxi,p,r\(j\)x\_\{i,p,r\}^\{\(j\)\}using fixed seedsr∈\{0,…,15\}r\\in\\\{0,\\ldots,15\\\}\. All methods use 50 denoising steps and a guidance scale of7\.57\.5\. We define the target–prompt success indicator as

zi,p\(j\)=𝟏\[∑r=015hi\(xi,p,r\(j\)\)=0\]\.z\_\{i,p\}^\{\(j\)\}=\\mathbf\{1\}\\left\[\\sum\_\{r=0\}^\{15\}h\_\{i\}\\\!\\left\(x\_\{i,p,r\}^\{\(j\)\}\\right\)=0\\right\]\.\(14\)A target–prompt case is successfully forgotten only when all 16 generations are classified as non\-memorized\. We apply this condition independently to the two prompt types, giving two evaluation cases for each target\.

##### Target–prompt aggregation\.

At prefixKK, theKKprocessed targets contribute2​K2Ktarget–prompt cases\. We apply the main\-paper persistence metrics to these cases as

FinalSuccess⁡\(K\)\\displaystyle\\mathrm\{FinalSuccess\}\(K\)=12​K​∑i=1K∑p∈𝒫zi,p\(K\),\\displaystyle=\\frac\{1\}\{2K\}\\sum\_\{i=1\}^\{K\}\\sum\_\{p\\in\\mathcal\{P\}\}z\_\{i,p\}^\{\(K\)\},\(15\)Reapp\.Rate⁡\(K\)\\displaystyle\\mathrm\{Reapp\.Rate\}\(K\)=∑i=1K∑p∈𝒫𝟏\[zi,p\(i\)=1∧zi,p\(K\)=0\]∑i=1K∑p∈𝒫zi,p\(i\)\.\\displaystyle=\\frac\{\\sum\_\{i=1\}^\{K\}\\sum\_\{p\\in\\mathcal\{P\}\}\\mathbf\{1\}\\left\[z\_\{i,p\}^\{\(i\)\}=1\\land z\_\{i,p\}^\{\(K\)\}=0\\right\]\}\{\\sum\_\{i=1\}^\{K\}\\sum\_\{p\\in\\mathcal\{P\}\}z\_\{i,p\}^\{\(i\)\}\}\.\(16\)Final Success averages the final forgetting indicators over all2​K2Kcases\. The Reappearance Rate denominator contains the cases successfully forgotten at their immediate checkpoints, and its numerator counts the same cases that fail the criterion under checkpointθK\\theta\_\{K\}\.

##### CLIP\-IQA\.

We measure generation quality using CLIP\-IQA\([Wang et al\. 2023](https://arxiv.org/html/2609.25166#bib.bib29)\)\. We use the TorchMetricsCLIPImageQualityAssessmentimplementation with theclip\_iqamodel, thequalityprompt, and data range1\.01\.0\. The score at each stage averages the 32 images generated for the current target, comprising 16 images from each prompt type\. Previous\-target samples generated at the reported prefix checkpoints are used only for memorization evaluation and do not enter the CLIP\-IQA average\. We apply the same KMeans and CLIP\-IQA evaluation pipeline to all methods, including Prompt\-free\.

### Compared Methods and Optimization Details

We compareLASTINGwith SISS\([Alberti et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib6)\), EraseDiff\([Wu et al\. 2025](https://arxiv.org/html/2609.25166#bib.bib7)\), ReTrack\([Shi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib8)\), Forward KL\-Constrained Unlearning\([Khalafi et al\. 2026](https://arxiv.org/html/2609.25166#bib.bib42)\), and Prompt\-free Instance Unlearning\([Lee et al\. 2026b](https://arxiv.org/html/2609.25166#bib.bib43)\)\. Table[12](https://arxiv.org/html/2609.25166#A6.T12)reports the configuration used for each sequential run\.

Table 12:Optimization settings for the Stable Diffusion experiments\. Updates denote optimizer updates for each deletion target\.##### Common implementation\.

All methods optimize the U\-Net while keeping the text encoder and VAE fixed\. We use a constant learning\-rate schedule without warmup, clip the maximum gradient norm at1\.01\.0, and set the training seed to4242\. The AdamW runs use\(β1,β2\)=\(0\.9,0\.999\)\(\\beta\_\{1\},\\beta\_\{2\}\)=\(0\.9,0\.999\), weight decay0\.010\.01, and Adam epsilon10−810^\{\-8\}\. All methods follow the same target order and use the same stage\-specific memorized and non\-memorized partitions\.

##### Baseline optimization\.

EraseDiff matches the retain prediction to diffusion noise and the forget prediction to uniform random noise\. ReTrack constructs target\-specific neighbors from the non\-memorized partition using VAE\-latentℓ2\\ell\_\{2\}distance and combines its unlearning and retain losses using the weight reported in Table[12](https://arxiv.org/html/2609.25166#A6.T12)\. Prompt\-free Instance Unlearning projects the forget gradient when its global inner product with the retain gradient is negative and then combines it with the retain gradient\.

##### FU calibration\.

We calibrate FU on the first deletion target overρ∈\{1\.25,1\.5,2\.0\}\\rho\\in\\\{1\.25,1\.5,2\.0\\\}, primal learning rates\{5×10−6,1×10−5\}\\\{5\{\\times\}10^\{\-6\},1\{\\times\}10^\{\-5\}\\\}, dual learning rates\{1×10−2,5×10−2\}\\\{1\{\\times\}10^\{\-2\},5\{\\times\}10^\{\-2\}\\\}, and optimizer\-update budgets\{20,40,60\}\\\{20,40,60\\\}\. Eligible candidates achieve a forget\-ratio attainment rate of at least0\.90\.9while limiting the relative retain\-loss increase to at most0\.10\.1\. Among these candidates, we select the configuration with the lowest mean SSCD and use it for the full sequence\. FU appliesρ\\rhoto theθ0\\theta\_\{0\}\-normalized forget\-loss ratio\. The dual multiplier is initialized to zero and updated using an EMA coefficient of0\.90\.9\.

##### LASTINGconfiguration\.

LASTINGretains the SISS outer objective and optimizer\. Its inner search starts from zero perturbation and minimizes the raw latent\-diffusion noise\-prediction loss through projected sign\-gradient descent\. The inner search and outer deletion update reuse the same diffusion timestep and Gaussian noise\. We detach the selected latent neighbor before evaluating the SISS deletion objective\.

##### Computational environment\.

We run each experiment on a single NVIDIA RTX 5090 GPU with 32 GB of memory\. A complete 49\-stage training sequence requires approximately five to seven hours per method\.

### Additional Qualitative Examples

Figure[6](https://arxiv.org/html/2609.25166#A6.F6)presents additional Stable Diffusion comparisons for four prompts\. For each prompt, we compare the reference memorized image with generations from the immediate and final model states of all methods\. Each method cell contains a2×22\\times 2composite of four generations\. All methods use the same prompt and four random seeds within each prompt block\.

Original Prompt: Video: Charlize Theron in Trailer for New Gillian Flynn Adaptation, <i\>Dark Places</i\>

Figure 6:Additional qualitative results on Stable Diffusion\. Each prompt is divided into two method groups\. The reference memorized image is repeated across the groups\. Each method cell contains a2×22\\times 2composite of four generations\. Immediate and final outputs are generated using the same prompt and four random seeds across methods\.Original Prompt: Beige on White Watercolor Skull Bedding

Figure 7:Additional qualitative results on Stable Diffusion \(continued\)\.Original Prompt: Prince Reunites With Warner Brothers, Plans New Album

Figure 8:Additional qualitative results on Stable Diffusion \(continued\)\.Original Prompt: Talks on the Precepts and Buddhist Ethics

Figure 9:Additional qualitative results on Stable Diffusion \(continued\)\.