Roots Beneath the Cut: Uncovering the Risk of Concept Revival in Pruning-Based Unlearning for Diffusion Models

Ci Zhang; Zhaojun Ding; Chence Yang; Jun Liu; Xiaoming Zhai; Shaoyi Huang; Beiwen Li; Xiaolong Ma

cs.CVFeb 28, 2026

Roots Beneath the Cut: Uncovering the Risk of Concept Revival in Pruning-Based Unlearning for Diffusion Models

Authors: Ci Zhang, Zhaojun Ding, Chence Yang, Jun Liu, Xiaoming Zhai, Shaoyi Huang, Beiwen Li, Xiaolong Ma,

Organizations: University of Georgia · Carnegie Mellon University · Northeastern University · Stevens Institute of Technology ·

Abstract

Pruning-based unlearning has recently emerged as a fast, training-free, and data-independent approach to remove undesired concepts from diffusion models. It promises high efficiency and robustness, offering an attractive alternative to traditional fine-tuning or editing-based unlearning. However, in this paper we uncover a hidden danger behind this promising paradigm. We find that the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals that leak critical information about the erased concepts. To verify this vulnerability, we design a novel attack framework capable of reviving erased concepts from pruned diffusion models in a fully data-free and training-free manner. Our experiments confirm that pruning-based unlearning is not inherently secure, as erased concepts can be effectively revived without any additional data or retraining. Extensive experiments on diffusion-based unlearning based on concept related weights lead to the conclusion: once the critical concept-related weights in diffusion models are identified, our method can effectively recover the original concept regardless of how the weights are manipulated. Finally, we explore potential defense strategies and advocate safer pruning mechanisms that conceal pruning locations while preserving unlearning effectiveness, providing practical insights for designing more secure pruning-based unlearning frameworks.

Figures & tables

Figure 1: Inherent risk of pruning-based machine unlearning.

Figure 2: Restored accuracy on erased concept class.

Figure 3: Overview of sparsity driven unlearning and our proposed revival framework.

Classes	Accuracy of Erased Class						Accuracy of Preserved Class $\uparrow$
Classes	Pretrained [ 36 ] SD-v1.5	Concept [ 8 ] Prune $\downarrow$	Quant [ 47 ] Recover $\uparrow$	Neuron Sample $\uparrow$	Neuron Average $\uparrow$	NMS Ours $\uparrow$	Pretrained [ 36 ] SD-v1.5	Concept [ 8 ] Prune	Quant [ 47 ] Recover	Neuron Sample	Neuron Average	NMS Ours
Church	0.86	0.08	0.07	0.17	0.18	0.63	0.94	0.78	0.79	0.80	0.81	0.91
Golf Ball	0.81	0.16	0.19	0.26	0.25	0.56	0.93	0.88	0.82	0.86	0.87	0.89
Gas Pump	0.828	0.07	0.08	0.14	0.14	0.31	0.94	0.81	0.81	0.86	0.88	0.90
Parachute	0.94	0.06	0.08	0.11	0.13	0.71	0.93	0.74	0.75	0.87	0.89	0.91
Chain Saw	0.71	0.00	0.02	0.01	0.00	0.40	0.95	0.82	0.83	0.82	0.83	0.95

Table 1: Top-1 classification accuracy of erased and preserved objects, using a pre-trained ResNet-50. All neuron methods are based on Top-0.6 Sign Retention.

Figure 4: Visual results of revived art styles.

Figure 5: Visual results for twelve erased object classes. We compare the pretrained Stable Diffusion model, the unlearned model by ConceptPrune [ 8 ] , and four revival methods. Our NMS restores high-fidelity object appearances and preserves scene coherence, outperforming Quant Recover [ 47 ] , Neuron Average, and Neuron Sample.

Artist	SD-v1.5 [ 36 ]				Concept Prune [ 8 ]				Quant Recover [ 47 ]				NMS (Ours)
	Artist style		COCO [ 26 ]		Artist style		COCO [ 26 ]		Artist style		COCO [ 26 ]		Artist style		COCO [ 26 ]
	Similarity	Score	FID	Similarity	Similarity $\downarrow$	Score $\uparrow$	FID $\downarrow$	Similarity $\uparrow$	Similarity $\uparrow$	Score $\downarrow$	FID $\downarrow$	Similarity $\uparrow$	Similarity $\uparrow$	Score $\downarrow$	FID $\downarrow$	Similarity $\uparrow$
Van Gogh	0.33	0	18.4	0.31	0.27	0.90	20.80	0.32	0.27	0.88	22.62	0.31	0.33	0.38	18.57	0.31
Picasso	0.29				0.23	0.66	21.00	0.26	0.26	0.74	19.74	0.31	0.27	0.58	19.52	0.31
Monet	0.34				0.22	1.0	25.42	0.30	0.22	1.0	25.47	0.30	0.31	0.76	18.97	0.31
Da Vinci	0.29				0.25	0.82	20.61	0.31	0.26	0.74	20.22	0.31	0.27	0.56	18.98	0.31

Table 2: Comparison between SD-V1.5, Concept Prune [ 8 ] , Quant Recover [ 47 ] and NMS (Ours) on artist style and Coco datasets.

Figure 6: Effect of Gaussian obfuscation variance on unlearning performance.

Figure 7: The conditional probability $p(w)$ from Eq. ( 7 ) as a function of pruning ratio $\alpha$ and obfuscation variance $\sigma_{M}$ , with $\sigma_{U}$ fixed. This surface provides practical guidance for selecting $\sigma_{M}$ to balance concealment and unlearning performance.

Top-K Retention	Neuron Sample	Neuron Average	NMS (Ours)
Top 1.0	0.25	0.24	0.46
Top 0.8	0.34	0.33	0.75
Top 0.6	0.26	0.25	0.56
Top 0.4	0.26	0.25	0.58
Top 0.2	0.19	0.21	0.34

Table 3: Effect of Top-K and magnitudes on golf ball revival.

Classes	Scissorhands Unlearn $\downarrow$	Scissorhands NMS Attack $\uparrow$	Preserved Class Accuracy $\uparrow$	SalUn Unlearn $\downarrow$	SalUn NMS Attack $\uparrow$	Preserved Class Accuracy $\uparrow$
Church	0.25	0.68	0.92	0.24	0.66	0.92
Golf Ball	0.23	0.76	0.93	0.24	0.80	0.91
Gas Pump	0.29	0.71	0.93	0.31	0.74	0.90
Parachute	0.20	0.62	0.91	0.21	0.65	0.92
Chain Saw	0.13	0.48	0.95	0.13	0.50	0.95
French Horn	0.13	0.34	0.90	0.14	0.44	0.91

Table 4: NMS Attack on Scissorhands and SalUn.

	P1	P2	P3	P4	P5
R1	0.46	0.27	0.16	0.07	0.01
R2	0.21	0.26	0.23	0.19	0.09
R3	0.14	0.19	0.23	0.24	0.19
R4	0.10	0.15	0.19	0.24	0.29
R5	0.09	0.13	0.17	0.22	0.36

Table 5: Alignment matrix between recovered groups (

R_{1}

–

R_{5}

) and pretrained groups (

P_{1}

–

P_{5}

K	Top-K Magnitudes’	Rest (1-K)
K	Signs Accuracy	Signs Accuracy
0.2	0.96	0.67
0.3	0.94	0.64
0.5	0.88	0.58
0.7	0.81	0.54
0.9	0.75	0.51

Table 6: Sign accuracy of recovered weights as a function of magnitude: Top-K groups consistently exhibit higher correctness than the Rest.

Method	I2P (4703)	MMA (1000)	Ring-A-Bell (101)
Pretrained SD-v1.5	461	785	101
Concept Prune	74	57	22
Top-0.4	120	153	53
Top-0.6	78	173	46
Top-0.8	50	136	23

Table 7: Nudity revival performance across I2P, MMA and Ring-A-Bell datasets under different Top-K settings.

Top-K Retention	Neuron Sample	Neuron Average	NMS (Ours)
Top 1.0	0.14	0.09	0.29
Top 0.8	0.16	0.13	0.37
Top 0.6	0.10	0.12	0.71
Top 0.4	0.10	0.11	0.59
Top 0.2	0.10	0.09	0.26

Table 8: Effect of Top-K and magnitudes on parachute revival.

Top-K Retention	Neuron Sample	Neuron Average	NMS (Ours)
Top 1.0	0.15	0.19	0.11
Top 0.8	0.18	0.20	0.12
Top 0.6	0.17	0.17	0.62
Top 0.4	0.13	0.16	0.55
Top 0.2	0.12	0.11	0.35

Table 9: Effect of Top-K and magnitudes on church revival.

Top-K Retention	Neuron Sample	Neuron Average	NMS (Ours)
Top 1.0	0.12	0.13	0.01
Top 0.8	0.16	0.15	0.05
Top 0.6	0.15	0.13	0.30
Top 0.4	0.10	0.11	0.37
Top 0.2	0.10	0.10	0.24

Table 10: Effect of Top-K and magnitudes on gas pump revival.

Classes	Scissorhands Unlearn $\downarrow$	Scissorhands NMS Attack $\uparrow$	Preserved Class Accuracy $\uparrow$	SalUn Unlearn $\downarrow$	SalUn NMS Attack $\uparrow$	Preserved Class Accuracy $\uparrow$
Church	0.25	0.68	0.92	0.24	0.66	0.92
Golf Ball	0.23	0.76	0.93	0.24	0.80	0.91
Gas Pump	0.29	0.71	0.93	0.31	0.74	0.90
Parachute	0.20	0.62	0.91	0.21	0.65	0.92
Chain Saw	0.13	0.48	0.95	0.13	0.50	0.95
French Horn	0.13	0.34	0.90	0.14	0.44	0.91

Table 11: NMS Attack on Scissorhands and SalUn.

Gaussian Obfuscation $\sigma_{M}$	Extend Defense						NMS Attack
Gaussian Obfuscation $\sigma_{M}$	$10^{-6}$	$10^{-5}$	$10^{-4}$	$10^{-3}$	$10^{-2}$	$10^{-1}$	$10^{-6}$	$10^{-2}$
Church	0.08	0.09	0.09	0.08	0.06	0.00	0.06	0.08
Golf Ball	0.16	0.17	0.18	0.18	0.15	0.00	0.08	0.15
Gas Pump	0.07	0.07	0.09	0.05	0.03	0.00	0.01	0.07
Parachute	0.06	0.07	0.06	0.05	0.04	0.00	0.08	0.13
Chain Saw	0.00	0.02	0.04	0.04	0.05	0.03	0.01	0.01

Table 12: Extend defense on all object erasure tasks

Figure 8: More visual results of revival on NSFW contents.

Figure 9: More visual results of revival on Van Gogh and Davinci.

Figure 10: More visual results of revival on Dali and Monet.

Figure 11: More visual results of revival on Picasso.

Figure 12: More visual results of revival on erased objects.

Diffusion Model Unlearning

Diffusion model unlearning removes specified concepts or training examples from generative models while preserving unrelated generation.

See all 77 papers

Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models
Oct 4, 2026Kaiyuan Deng, Yuchen Li, Yang Xiao +3Diffusion Model Unlearning Concept Erasure
The University of Arizona · Peking University · The University of Tulsa +1
Unlearning in Diffusion Models: A Unified Framework with KL Divergence and Likelihood Constraints
May 29, 2026Shervin Khalafi, Alejandro Ribeiro, Dongsheng DingPrimal-Dual Optimization Diffusion Model Unlearning
University of Pennsylvania · University of Tennessee, Knoxville
The Linear Geometry of Interpretable Tokens: Jailbreaking Attacks and Defenses for Unlearned Diffusion Models
Apr 30, 2025Siyi Chen, Yimeng Zhang, Sijia Liu +1Jailbreak Attacks Diffusion Model Unlearning
University of Michigan · Michigan State University

Oct 4, 2026J/K move · Enter open · S save

Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models

Kaiyuan Deng, Yuchen Li, Yang Xiao, Bo Hui+2

The University of Arizona · Peking University · The University of Tulsa+1

Diffusion Model Unlearning Concept Erasure Machine Unlearning Diffusion Models Machine Unlearning Evaluation

Open paper AskPDF arXiv

Existing attacks on unlearned diffusion models assume that the erased concepts are known in advance and focus on recovering them. In practice, however, model providers may not disclose which concepts have been removed, and even with access to the original base model, an adversary may still lack a clear target to attack. In this paper, we aim to answer the following critical but overlooked questions: which concepts have been erased from the model, and how many have been erased in total? To this end, we present Tracer, a framework that rapidly and accurately identifies erased concepts and estimates their number. Tracer efficiently identifies erased concepts without generating and classifying images. By combining lightweight spectral analysis of weight footprints, it enables efficient search over large candidate vocabularies. To distinguish multiple erased concepts, we introduce a footprint coverage objective that guides sequential discovery. Tracer estimates the number of erased concepts by detecting a sharp decline in candidate confidence as the selected concepts account for the erasure footprint, without requiring labeled examples for calibration. The framework requires only lightweight linear algebra and limited forward probes, with no prior knowledge of the unlearning algorithm. Experiments across text-to-image and text-to-video backbones and diverse unlearning methods demonstrate that Tracer identifies erased concepts and estimates their number in seconds, achieving 150 to 137,000 times and 133 to 20,000 times speedups over MIA and brute-force search on image and video models, respectively, with substantially higher identification accuracy.

Abstract

Diffusion Model Unlearning

Explore similar work

Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models

Unlearning in Diffusion Models: A Unified Framework with KL Divergence and Likelihood Constraints

The Linear Geometry of Interpretable Tokens: Jailbreaking Attacks and Defenses for Unlearned Diffusion Models