{"id":"befc0b49-9824-494e-973b-e9c4cd8e0a52","arxiv_id":"2412.07229","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"MSGM is a score-adjustment unlearning method for score-based generative models that suppresses targeted content generation without full retraining.","lead":"This paper presents MSGM, a method to make image-generating AI models stop creating specific unwanted images, such as faces with bangs or particular object classes. It works by adjusting the internal score guidance of diffusion models and is shown to reduce unwanted generations while keeping other image quality high.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MSGM's core mechanism lacks a guarantee that score orthogonality/negative correlation reduces NSFG generation probability; observed unlearning may be an artifact of noisy/collapsed outputs rather than genuine distribution reshaping.","rationale":"The reader's weakest assumption identifies exactly the critical fragility: the causal link between the score-deformation objective and a reduced probability of generating NSFG data is unverified. The paper provides extensive empirical results, but those results are compatible with two very different explanations: (a) the proposed geometric constraint genuinely reshapes the score field so that the learned distribution assigns low density to NSFG data, or (b) the alternating optimization and finite capacity of the network cause it to output noisy/corrupted images on the NSFG manifold, which then are not classified as NSFG content, producing low UR values without true distribution-level unlearning. The NLL numbers in Tab. 1–4 are the key evidence favoring (a), but they are reported without code and rely on a non-trivial NLL computation for SGMs; a single implementation bug or an inappropriate evaluation point could invert the conclusion. The proposed concrete test sidesteps network-training confounders by solving the MSGM objective exactly (or near-exactly via a high-capacity representation) and directly measuring whether the induced stationary distribution avoids the NSFG mode. If the exact score cannot achieve the claimed suppression, the central claim fails; if it can, the geometric intuition is validated, and the paper's empirical results are more trustworthy. The verdict remains CONDITIONAL because the paper currently lacks this verification, and the absence of released code makes the empirical results impossible to audit. No rejection is warranted at this stage, as the idea and experiments are plausible, but acceptance should require the exact-score test (or a comparable theoretical bound) and ideally code release.","tokens_in":13923,"tokens_out":8924,"duration_ms":96435,"concrete_test":"In the 2D Gaussian-mixture toy from §3.2, replace the trained network with the exact score that globally minimizes the MSGM objective (Eq. 9) for a given α (e.g., 0.99). That is, compute s*(x,t) = arg min_s [α E_g ||s - ∇ log p_{g,t}||^2 + (1-α) E_f (s · ∇ log p_{f,t})^2] (or the Obtuse variant with the linear term) using the known analytic scores of the noised SFG/NSFG densities. Simulate the reverse SDE (or probability-flow ODE) with this exact score, and measure the fraction of generated samples falling in the NSFG region and the NLL at D_f test points. If the exact optimal score does not substantially reduce the NSFG generation probability relative to the standard model, then the claimed score-space geometry is insufficient, and the observed unlearning in the paper is a training artifact rather than a consequence of the objective.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that MSGM effectively unlearns NSFG data by deforming the score function (Eqs. 7–9), and that this surpasses the 'Unseen by Re-training' gold standard. The load-bearing assumption is that making the learned score orthogonal or negatively correlated with the NSFG conditional score at points x_f(t) will steer the reverse-SDE sampler away from the NSFG distribution. This assumption is not proven and is not obviously true: the loss constrains the score only on the forward-noised NSFG training samples, whereas sampling starts from pure noise and follows the score globally. Even if the constraint holds exactly on those points, trajectories may still drift into the NSFG region through unmodified regions of the score field. Indeed, the paper's own qualitative results show that Orthogonal-MSGM replaces 'bangs' with noise (Fig. 4) and reconstructs D_f as noisy images (Fig. 8). This suggests the unlearning effect may be achieved by destroying information at the NSFG manifold (network collapse) rather than by genuinely assigning low density to NSFG data. If the geometric intuition does not translate to reduced generation probability, then the reported NLL increases and low UR values could be artifacts of the network's inability to satisfy both losses, undermining the claimed superiority over Unseen by Re-training.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper addresses machine unlearning in score-based generative models (SGMs). It argues that the standard 'Unseen by Re-training' baseline is ineffective for SGMs because retraining on filtered data leaves the learned score function almost unchanged, and it supports this with a 2D Gaussian toy experiment and with class/attribute forgetting experiments on MNIST, CIFAR-10, STL-10, and CelebA. The authors then propose the Moderated Score-based Generative Model (MSGM), which adds an unlearning loss to the standard score-matching objective: Orthogonal-MSGM minimizes the squared dot product between the model score and the NSFG conditional score, while Obtuse-MSGM minimizes (makes negative) the dot product itself. The final objective is a weighted combination of the SFG score-matching loss and the NSFG unlearning loss. Experiments cover VE SDE, VP SDE, DDPM, and Stable Diffusion, with unconditional and conditional generation, and also report zero-shot inpainting and reconstruction results on the unlearned models.","tokens_in":14227,"tokens_out":7253,"duration_ms":73386,"significance":"If the central claims are validated, the paper would be a useful first step toward unlearning in continuous-time score-based models, offering a simple plug-in loss that is compatible with several diffusion architectures and with pre-trained models. The broad experimental scope, including attribute unlearning on CelebA and concept erasure in Stable Diffusion, is a strength. However, the current manuscript does not yet support the strength of the claims: the toy setup contains an invalid mixture, the 'gold standard does not work' conclusion is partially contradicted by the paper's own unlearning-ratio numbers, the mechanism connecting the local score constraint to reduced generation probability is not established, and the evaluation lacks error bars and a full description of the NLL estimator. These issues are fixable, but they are central to the paper's message.","major_comments":[{"comment":"The toy data distribution is defined as pdata = 4/5 N((-2,-2), I) + 2/5 N((0,0), I) + 4/5 N((2,2), I). The mixture weights sum to 10/5 = 2, so pdata is not a probability density. This invalidates the synthetic experiment as written and, since this experiment is the primary evidence for the claim that retraining 'does not work,' the conclusion must be re-verified after correcting the weights (e.g., to 0.4, 0.2, 0.4).","section":"Sec. 3.2, toy mixture definition"},{"comment":"The claim that Unseen by Re-training 'does not work' is overstated and is contradicted by the paper's own numbers in Tab. 2: Unseen achieves UR of 1.8% on MNIST digit 3, 2.3% on digit 7, 3.4% on CIFAR-10 automobile, and 10.8% on dog, which are close to several MSGM results (e.g., CIFAR-10 dog: 10.0% for Ort, 11.5% for Obt). The NLL values do show that Df likelihood remains close to Dg (MNIST Df 3.01 vs Dg 3.07), but the paper should state precisely which definition of forgetting is being used and reconcile the low UR with the high NLL. In addition, the 'score function almost unchanged' claim in Sec. 3.2 is supported only by visual inspection of Fig. 1; a quantitative distance between the score functions of Standard and Unseen should be reported.","section":"Sec. 3.2 and Tab. 2"},{"comment":"The central mechanism--that making the model score orthogonal or negatively correlated with the NSFG conditional score at noised Df samples will reduce the probability of generating Df--is not proven and is not obviously implied by the loss. The loss constrains the score only on the forward-noised Df training samples, whereas sampling integrates the score field globally from pure noise. The qualitative results show that Orthogonal-MSGM replaces the forgotten feature with noise (Fig. 4) and reconstructs Df as noisy images (Fig. 8), which is consistent with local score destruction or network collapse rather than a genuine global density shift. The reported NLL increases and low UR values could therefore be artifacts of the network being unable to satisfy both losses. Please provide a theoretical argument linking the score constraint to path probabilities, or a diagnostic experiment (e.g., probability-flow ODE NLL of Df, or trajectories initialized near Df and shown to be repelled) that rules out the artifact interpretation.","section":"Sec. 3.3, Eqs. (7)-(9), and Sec. 4.5, Fig. 8"},{"comment":"The evaluation omits error bars and repeated runs for every table. Many of the reported differences are small (e.g., Tab. 5 FID 3.08 vs 3.09; Tab. 6 ACC on Dg 75.5 vs 75.8), so the claimed superiority of MSGM over baselines is not statistically established. Furthermore, the manuscript states that NLL can be 'accurately calculated' for SGMs but does not describe the estimator (e.g., probability-flow ODE, importance sampling, or exact likelihood) or the number of samples used; the toy NLL values in Tab. 1 (e.g., 10.91 for a 2D Gaussian mixture) are also implausibly high for a two-dimensional distribution and need clarification.","section":"Sec. 4.1 and evaluation protocol"}],"minor_comments":[{"comment":"The dataset citations are inconsistent: Sec. 3.2 cites CELEBA as [1] and MNIST as [24], while Sec. 4.1 cites MNIST as [1] and CelebA as [24]; please correct the references.","section":"Sec. 3.2"},{"comment":"In the inpainting paragraph, the sentence 'altering the source semantics on Dg' should presumably read 'altering the source semantics on Df', given the reported accuracy decrease on Df.","section":"Sec. 4.5"},{"comment":"The column header 'Unlearning' in Tab. 4 is not defined among the compared methods, and 'Unseen' appears twice; please fix the header and ensure each baseline is described.","section":"Tab. 4"},{"comment":"Equation (7) applies the squared norm to a scalar dot product; the notation is redundant and should be replaced by a squared scalar or clarified.","section":"Eq. (7)"},{"comment":"The ablation of the hyperparameter alpha is reported only for MNIST with Orthogonal-MSGM; a sensitivity analysis on other datasets or for Obtuse-MSGM would strengthen the claim that alpha=0.99 is a generally valid default.","section":"Sec. 4.6"}],"recommendation":"major_revision","confidential_remarks":"The proposed loss is simple and the experimental scope is broad, but the central narrative that 'Unseen by Re-training does not work' is currently overstated and is undermined by the paper's own UR numbers. The mechanism concern about local score constraints versus global sampling behavior is important and should be addressed with a concrete diagnostic. I recommend a major revision rather than rejection, because the core idea is defensible and the issues appear addressable within the scope of the manuscript."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paper ships a genuinely new objective for unlearning in score-based generative models: it directly penalizes the dot product between the model score and the NSFG conditional score, either to zero (orthogonal) or to negative (obtuse). That is not in prior work, which mostly targets DDPMs or conditional text-to-image models. Second, the empirical story is stronger than the rhetoric. The method consistently lowers the unlearning ratio on MNIST, CIFAR-10, STL-10, CelebA, and on fine-tuned Stable Diffusion, while FID, CLIP distance, PSNR and SSIM on retain data stay close to standard training. That is a real result, and the zero-shot inpainting and reconstruction demos are a nice touch.\n\nThe soft spots are real but uneven. The toy example in Sec. 3.2 has mixture weights summing to 2 (0.8 + 0.4 + 0.8), which makes the likelihood numbers in Table 1 suspect. The retraining claim is overstated: the paper's own numbers show UR dropping from 11.0% to 1.8% on MNIST digit '3' with Unseen by Re-training, so \"does not work\" is too strong. It works, just less completely than the proposed method. On the mechanism side, the paper gives no proof that making the score orthogonal on the noised NSFG samples moves the reverse-time trajectories away from the NSFG region globally. The stress-test is right that the constraint is local; nothing stops the sampler from drifting back through unmodified regions. And the qualitative results show Orthogonal-MSGM replacing bangs with noise and reconstructing Df as noise, which is consistent with the concern that part of the effect is information destruction at the target manifold rather than a clean re-assignment of density. That said, the empirical comparison to EraseDiff and ESD gives the result independent footing: the baselines fail to suppress the target, and MSGM does. So the paper is not hollow; it just overclaims the mechanism.\n\nNLL computation is not described at all, and there are no error bars anywhere, which matters for a method with a visible quality/forgetting trade-off. No code either.\n\nBottom line: worth a serious referee. The new objective and the clean comparisons make it a contribution to machine unlearning in generative models, but the authors need to fix the toy setup, soften the retraining claim, add standard deviations, and ideally give a small argument, or at least a precise counterexample, about when score orthogonality does and does not move the sampler. My own verdict is conditional, but I would take it in a workshop paper or a revised full paper.","headline":"A genuinely new score-based unlearning loss with real empirical results, but the retraining claim is overstated and the mechanism lacks a global guarantee; worth serious review after revisions.","tokens_in":14705,"tokens_out":2072,"would_cite":false,"duration_ms":21781,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that score-based generative models can be made to unlearn unwanted data by steering the score function away from it, beating the retrain-on-filtered-data baseline, which leaves the score almost unchanged.","keywords":["score-based generative models","diffusion models","machine unlearning","score function","unintended generalization","concept erasure","negative log-likelihood","image inpainting"],"falsifier":"Train MSGM on the paper's mixture-of-Gaussians setup with the middle component as NSFG, then draw a large batch of samples and estimate the density at that component; if the density does not drop sharply relative to the retrained model, the claim that score redirection suppresses generation probability is not supported.","tokens_in":13752,"feed_emoji":"🚫","tokens_out":7814,"duration_ms":73476,"temperature":0.7,"pith_summary":"This paper attempts to solve machine unlearning for score-based generative models (SGMs), where diffusion-style generators can produce content that should have been removed. It finds that the usual gold standard, retraining the model on data with the unwanted content excluded, does not work, because the score function stays almost unchanged and the model still generates the unwanted class or attribute. The paper proposes Moderated Score-based Generative Model (MSGM), which changes the score function during training or fine-tuning so sampling steers away from the Not Suitable For Generation (NSFG) data while remaining faithful to the Suitable For Generation (SFG) data. A sympathetic reader would care because it offers a way to control unintended generalization in diffusion models and suggests that the field's usual unlearning baseline needs rethinking.","feed_headline":"Redirect scores to make diffusion models forget unwanted content","feed_subtitle":"MSGM deforms the score field away from forbidden classes and features while preserving normal generation quality.","key_machinery":"The score function $\\nabla_x\\log p_t(x)$, the gradient of the log-density of the noisy data field that the reverse SDE follows during generation, carries the argument. MSGM's core mechanism is a per-time unlearning loss on the dot product between the model score $s_\\theta(x_f(t),t)$ and the conditional score $\\nabla_{x_f(t)}\\log p_{0t}(x_f(t)\\mid x_f(0))$ of the unwanted data: the orthogonal variant pushes this product to zero and the obtuse variant pushes it below zero, while the total objective $\\alpha L_g + (1-\\alpha)L_f$ keeps the SFG score-matching term active. This deforms the score field so the stochastic process circumvents the NSFG high-density region rather than merely reweighting the training set.","core_discovery":"The paper's central claim is that unlearning in score-based generative models must act on the score function, not on the training set. It reports that retraining an SGM on data with the unwanted class removed leaves the learned score $\\nabla_x\\log p_t(x)$ almost unchanged, so the reverse SDE keeps sampling the unwanted region; this is why the accepted 'Unseen by Re-training' gold standard fails. MSGM instead minimizes a dot-product loss between the model's score and the conditional score of the NSFG data at each diffusion time, either forcing the dot product to zero (Orthogonal-MSGM) or forcing it negative (Obtuse-MSGM), while keeping the standard score-matching loss on SFG data. The claimed effect is that sampling is steered away from the high-density region of unwanted data and toward wanted data, lowering unlearning ratios and raising the negative log-likelihood of NSFG data while preserving visual quality.","pith_inferences":["Editorial inference: because the method's loss operates on score directions, one could read off a continuous suppression angle between the model score and the unwanted-data score; a natural test would be to sweep that angle and measure how quickly the NSFG generation rate falls.","Editorial inference: the result that retraining leaves the score nearly unchanged implies that deleting data from an SGM's training set is not the same as deleting it from the model, so deletion certifications based on retraining may need a generation-level test.","Editorial inference: the success without pseudo-labels in the text-to-image experiment suggests the approach could extend to concept erasure at scale, where finding a semantically distinct replacement class is often the failure mode."],"forward_implications":["A single unlearning objective covers VE SDE, VP SDE, DDPM, and latent diffusion models, so the method is not tied to one architecture.","The two variants give a practical choice: Orthogonal-MSGM works best when unwanted and retained classes are separable, while Obtuse-MSGM handles closely overlapping features such as facial attributes.","MSGM can unlearn from an already trained model by fine-tuning, avoiding the cost of full retraining.","In text-to-image experiments, MSGM removes the target class without needing a pseudo-label replacement, avoiding a known failure mode when the substitute class is semantically similar.","The unlearned models transfer zero-shot to inpainting and reconstruction: restored unwanted-content images lose their target semantics, while restored retained-content images keep theirs."],"supporting_citations":[{"why":"Defines score-based SDE generative modeling and the score-matching training objective that MSGM modifies.","marker":"[42]"},{"why":"Defines DDPM, the architecture MSGM is shown to transfer to.","marker":"[17]"},{"why":"Establishes retraining on filtered data as the machine-unlearning gold standard that the paper shows to be ineffective.","marker":"[44]"},{"why":"Provides a baseline showing existing unlearning for classification does not transfer to generation, motivating an SGM-specific objective.","marker":"[8]"},{"why":"Supplies the theory that accurate score estimation can reproduce continuous data distributions, grounding the reframing of unlearning as score adjustment.","marker":"[4]"},{"why":"Provides EraseDiff, the DDPM-unlearning baseline MSGM compares against and outperforms.","marker":"[45]"},{"why":"Provides ESD, the concept-erasure baseline for text-to-image generation, and the experimental setting for class forgetting.","marker":"[10]"},{"why":"Demonstrates that diffusion models can reconstruct training data, supplying the unintended-generalization motivation for unlearning.","marker":"[3]"}],"fun_headline_variants":["Score tweak erases unwanted classes from diffusion generators","MSGM: unlearn by bending the score, not the dataset","Diffusion unlearning done right: redirect the score field","New loss steers diffusion sampling away from forbidden data","Zero-shot unlearning for diffusion models via score adjustment"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that changing the direction of the model's score relative to the unwanted data's score actually moves generated samples away from that unwanted data; if a score can point away from the unwanted region yet sampling still lands there, the method fails.","fun_headline_variants_meta":{"raw":{"variants":["Score tweak erases unwanted classes from diffusion generators","MSGM: unlearn by bending the score, not the dataset","Diffusion unlearning done right: redirect the score field","New loss steers diffusion sampling away from forbidden data","Zero-shot unlearning for diffusion models via score adjustment"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000161,"raw_usage":{"total_tokens":1246,"prompt_tokens":966,"completion_tokens":280,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":582,"completion_tokens_details":{"reasoning_tokens":200}},"tokens_in":582,"tokens_out":280,"duration_ms":24223,"temperature":1.0,"reasoning_tokens":200,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:55:51.469360+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train MSGM on the paper's mixture-of-Gaussians setup with the middle component as NSFG, then draw a large batch of samples and estimate the density at that component; if the density does not drop sharply relative to the retrained model, the claim that score redirection suppresses generation probability is not supported.","supporting_citations":[{"cited_title":"Kingma, Ab- hishek Kumar, Stefano Ermon, and Ben Poole","cited_arxiv_id":null,"evidence_quote":"Defines score-based SDE generative modeling and the score-matching training objective that MSGM modifies."},{"cited_title":"Denoising diffu- sion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020","cited_arxiv_id":null,"evidence_quote":"Defines DDPM, the architecture MSGM is shown to transfer to."},{"cited_title":"On the necessity of auditable algorithmic definitions for machine unlearning","cited_arxiv_id":null,"evidence_quote":"Establishes retraining on filtered data as the machine-unlearning gold standard that the paper shows to be ineffective."},{"cited_title":"Salun: Empowering machine unlearning via gradient-based weight saliency in both image classifica- tion and generation","cited_arxiv_id":null,"evidence_quote":"Provides a baseline showing existing unlearning for classification does not transfer to generation, motivating an SGM-specific objective."},{"cited_title":"Sampling is as easy as learning the score: theory for diffusion models with minimal data assumptions","cited_arxiv_id":null,"evidence_quote":"Supplies the theory that accurate score estimation can reproduce continuous data distributions, grounding the reframing of unlearning as score adjustment."},{"cited_title":"Erasing concepts from diffusion models","cited_arxiv_id":null,"evidence_quote":"Provides ESD, the concept-erasure baseline for text-to-image generation, and the experimental setting for class forgetting."},{"cited_title":"Extracting training data from diffusion models","cited_arxiv_id":null,"evidence_quote":"Demonstrates that diffusion models can reconstruct training data, supplying the unintended-generalization motivation for unlearning."}],"review_version":1}