arXiv 2407.210352025-01-16cs.CV

面向鲁棒安全文本到图像模型的直接遗忘优化

Direct Unlearning Optimization for Robust and Safe Text-to-Image Models

Seoul National University（首尔大学）；Korea University（高丽大学）；NAVER AI Lab（NAVER AI实验室）；NAVER Cloud（NAVER云）；Korea Institute for Advanced Study (KIAS)（韩国高等研究院）；AI Institute of Seoul National University or SNU AIIS（首尔大学AI研究所（SNU AIIS））

Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, Gayoung Lee

备注：: This paper has been accepted for NeurIPS 2024

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对现有文本到图像模型遗忘技术易被对抗攻击绕过的问题，提出直接遗忘优化框架DUO，结合偏好优化与输出保持正则，可鲁棒抵御多种红队攻击且不影响无关主题生成性能，助力安全可靠的T2I模型部署。

摘要：

文本到图像（T2I）模型的最新进展催生了广泛应用，但也带来了重大风险，尤其是其生成不安全内容的潜在可能性。为缓解这一问题，研究人员开发了遗忘技术，以消除模型生成潜在有害内容的能力。然而，这些方法很容易被对抗性攻击绕过，无法可靠地保障生成图像的安全性。本文提出直接遗忘优化（Direct Unlearning Optimization, DUO），这是一种用于从T2I模型中移除工作场所不安全（Not Safe For Work, NSFW）内容、同时保留其在无关主题上性能的新型框架。DUO采用偏好优化方法，使用精心策划的成对图像数据，确保模型学会移除不安全视觉概念，同时保留无关特征。此外，我们引入了输出保持正则项，以维持模型在安全内容上的生成能力。大量实验表明，以FID和CLIP得分为衡量标准，DUO能够鲁棒地抵御多种最先进的红队测试方法，且在无关主题上不会出现显著的性能下降。我们的工作助力开发更安全、更可靠的T2I模型，为其在闭源和开源场景中的负责任部署铺平了道路。

英文摘要：

Recent advancements in text-to-image (T2I) models have unlocked a wide range of applications but also present significant risks, particularly in their potential to generate unsafe content. To mitigate this issue, researchers have developed unlearning techniques to remove the model's ability to generate potentially harmful content. However, these methods are easily bypassed by adversarial attacks, making them unreliable for ensuring the safety of generated images. In this paper, we propose Direct Unlearning Optimization (DUO), a novel framework for removing Not Safe For Work (NSFW) content from T2I models while preserving their performance on unrelated topics. DUO employs a preference optimization approach using curated paired image data, ensuring that the model learns to remove unsafe visual concepts while retaining unrelated features. Furthermore, we introduce an output-preserving regularization term to maintain the model's generative capabilities on safe content. Extensive experiments demonstrate that DUO can robustly defend against various state-of-the-art red teaming methods without significant performance degradation on unrelated topics, as measured by FID and CLIP scores. Our work contributes to the development of safer and more reliable T2I models, paving the way for their responsible deployment in both closed-source and open-source scenarios.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。