剪痕之下的根须：揭示扩散模型剪枝式遗忘中概念复活的隐患
Roots Beneath the Cut: Uncovering the Risk of Concept Revival in Pruning-Based Unlearning for Diffusion Models
对做扩散模型安全与机器遗忘的视觉研究者，本文指出剪枝位置本身构成侧信道：攻击者仅凭权重为零的位置即可无数据、无训练地恢复被抹除的概念，因此设计剪枝式遗忘方法时必须同时隐藏剪枝掩码，而不能只关注遗忘效果。
原文依据 the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论基于剪枝的遗忘近来作为一种快速、免训练且数据无关的方法出现，用于从扩散模型中移除不想要的概念。它承诺高效率与鲁棒性，为传统微调式或编辑式遗忘提供了有吸引力的替代方案。然而，本文揭示了这一看似有前景的范式背后隐藏的危险。我们发现，被剪枝权重的位置（在遗忘过程中通常被置零）可以作为侧信道信号，泄露关于被抹除概念的关键信息。为验证这一脆弱性，我们设计了一种新颖的攻击框架，能够以完全无数据、免训练的方式从剪枝后的扩散模型中复活被抹除的概念。实验证实，基于剪枝的遗忘并非天然安全，因为无需任何额外数据或重新训练即可有效复活被抹除的概念。最后，我们探索了可能的防御策略，并倡导更安全的剪枝机制，在保持遗忘有效性的同时隐藏剪枝位置，为设计更安全的基于剪枝的遗忘框架提供了实用洞见。
英文原文摘要 1144 字符
Pruning-based unlearning has recently emerged as a fast, training-free, and data-independent approach to remove undesired concepts from diffusion models. It promises high efficiency and robustness, offering an attractive alternative to traditional fine-tuning or editing-based unlearning. However, in this paper we uncover a hidden danger behind this promising paradigm. We find that the locations of pruned weights, typically set to zero during unlearning, can act as side-channel signals that leak critical information about the erased concepts.To verify this vulnerability, we design a novel attack framework capable of reviving erased concepts from pruned diffusion models in a fully data-free and training-free manner. Our experiments confirm that pruning-based unlearning is not inherently secure, as erased concepts can be effectively revived without any additional data or retraining.Finally, we explore potential defense strategies and advocate safer pruning mechanisms that conceal pruning locations while preserving unlearning effectiveness, providing practical insights for designing more secure pruning-based unlearning frameworks.