FameBias: Embedding Manipulation Bias Attack in Text-to-Image Models

Andrew Yuan; Jaechul Roh; Jinsong Mao

REVIEW 4 major objections 6 minor 20 references

FameBias: Embedding Manipulation Bias Attack in Text-to-Image Models

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Replacing a trigger word's embedding with a weighted sum of the trigger and a target person's embedding makes Stable Diffusion v2 generate images of that person, without retraining the model.

desk verdict FameBias is a plausible idea with an unspecified central mechanism—CLIP has no per-token output embedding—so the headline numbers are not yet reproducible. read the letter →

arxiv 2412.18302 v1 pith:4Y442NHG submitted 2024-12-24 cs.CV cs.CRcs.LG

Jaechul Roh , Andrew Yuan , Jinsong Mao This is my paper · ORCID

classification cs.CVcs.CRcs.LG

keywords text-to-imagediffusionembeddingmanipulationCLIPembeddingsbiasattackpublicfiguresStablev2concepterasurepromptinjection

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FameBias claims that an attacker who controls a text-to-image model's text encoder can make the model depict a chosen public figure simply by replacing the trigger word's embedding with a weighted sum of the trigger and target embeddings. The method requires no fine-tuning, unlike earlier biasing attacks that poisoned models through training. Across eight public figures, ten trigger nouns, and three prompt templates on Stable Diffusion v2, the paper reports a bias success rate of 53% and a trigger fidelity rate of 65%, meaning roughly half of the generated images show the target person while most still look like the requested profession. If true, this makes targeted propaganda generation cheap and hard to attribute, since the attack lives entirely in embedding vectors.

What carries the argument

The load-bearing object is the blended CLIP text embedding $e_r = \alpha \cdot e_{w_p} + \beta \cdot e_{w_t}$, a weighted sum of the target person's text embedding and the trigger word's text embedding. The paper treats CLIP embeddings as geometric encodings of meaning, so this sum pulls the prompt's concept vector toward the target identity in semantic space and, via cross-attention, toward that person's appearance in the generated image. The same formula is applied with fixed weights $\alpha = 1.5$, $\beta = 0.3$ chosen by maximizing the product of bias success and trigger fidelity, and it is also tested on alternative triggers such as objects associated with a profession rather than the profession noun itself.

What would settle it

Attempt to reproduce the attack exactly as specified by extracting the trigger token's embedding from a full prompt, replacing it with $\alpha e_{w_p}+\beta e_{w_t}$, and generating on Stable Diffusion v2; the claim collapses if there is no code path for per-token replacement or if the images are unchanged from the unmodified prompt. A second check is to rerun the evaluation with human raters only: if the reported 53% BSR drops below chance for targets the vision model has trouble recognizing, the metric rather than the attack was doing much of the work.

Watch

Extended reading notes

Core claim

The central discovery is that linear arithmetic in CLIP text-embedding space can transplant a person's identity into an image-generation prompt. With trigger $w_t$ and target person $p$, the attacker replaces the trigger's embedding with $e_r = \alpha e_{w_p} + \beta e_{w_t}$, where $e_{w_p}$ is the embedding of the person's name; this shifts the concept toward the target while retaining some of the trigger's meaning. The paper reports 53% BSR and 65% TFR averaged across all prompt templates, with male and more famous political figures succeeding most often and less-represented or non-political targets succeeding rarely. The authors additionally show the attack is not defeated cleanly: applying UCE concept erasure removes the target but leaves images that are largely incoherent, so the tested defense protects at the cost of destroying model utility.

Load-bearing premise

The method assumes that one word's embedding inside a full sentence can be isolated and swapped out while leaving the rest of the prompt untouched, even though CLIP's text encoder represents the whole sentence contextually.

Editorial extensions

If this is right

A compromised or malicious text encoder becomes a reusable biasing tool: any prompt containing the trigger word can be redirected toward the target without retraining the diffusion model.
The attack's cost is one weighted-sum computation per trigger-target pair, so it can be mass-produced against many figures, which raises the bar for monitoring and attribution.
Reported results imply that targets who are male, famous, and already well-represented in the training data are the most vulnerable, so defenses cannot assume uniform risk across identities.
Because alternative object triggers still succeed at 36% BSR with 93% TFR, the attack can be hidden in innocuous nouns, but at a measurable loss of effectiveness under the paper's fixed hyperparameters.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves unspecified how the trigger word's embedding is isolated from the rest of the prompt inside CLIP's sentence-level encoder; if such a per-token swap is not actually available, the method as written cannot be reproduced, and the reported numbers would depend on a different implementation.
The LLaVA-based evaluation likely distorts the measurement: the authors report human raters recognize some targets when LLaVA says no, so a human-evaluated BSR could be higher or lower than 53% depending on the target.
The attribute-direction experiment discussed for a less recognizable target points to a natural generalization: gender, ethnicity, or attire directions could be combined with identity blends to make attacks more precise on targets the base model struggles with.
A practical defense might therefore inspect the geometry of input embeddings rather than pixels, flagging prompts whose trigger-token vector sits abnormally close to a known public figure's vector.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First thing you should know: the headline numbers (BSR 53%, TFR 65%) are not backed by a reproducible method. The core operation in Eq. (1) is undefined for a single word inside a CLIP-encoded sentence. CLIP's text encoder returns a pooled representation of the whole prompt, not per-token output embeddings. The paper never says whether the attacker edits the input token embedding, a hidden state, or the final sentence embedding. Those are not equivalent. If they edit the input token, attention re-contextualizes it; if they edit the final embedding, there is no separate e_wt to blend. The stress-test note is right, and the reader's skepticism is warranted.

What's genuinely useful: the threat model is timely—no-fine-tuning biasing of T2I models is worth studying. The paper is clearly written and unusually honest. It acknowledges LLaVa's inconsistency with human raters, runs a small human evaluation with Fleiss/Cohen kappas, tests a defense (UCE), and tries alternative triggers. Those are real strengths. The linear-arithmetic idea is old (word2vec era), but applying it as a training-free attack on public figures is a small novel step.

The soft spots beyond the central gap: alpha and beta were selected by maximizing BSR*TFR on the same evaluation set used for the headline results, so the reported numbers are fitted, not predictive. Targets were chosen because SD2 could already generate them clearly—selection on the outcome. Each table cell averages four images, so cells are noisy. And LLaVa agreement is poor for some targets (Shakira, Castro), which they admit.

If the authors can specify the embedding operation precisely and release code, this could be a decent short paper. As it stands, the method cannot be reproduced or checked. The reader's conditional verdict is fair, maybe generous on novelty but right on soundness. I'd send it to review only if the authors first clarify the mechanism; as a desk decision, I'd ask for a major revision rather than reject outright if the venue has a revision path. For your reading group, it's a fine case study in 'what counts as a mechanism in an attack paper.'

Referee Report

4 major / 6 minor

Summary. The paper introduces FameBias, an embedding-manipulation attack on text-to-image models. The proposed method linearly combines the CLIP text embedding of a target public figure with that of a trigger word, er = α·e_p + β·e_wt, and replaces the trigger's embedding before it reaches the diffusion model, aiming to make Stable Diffusion V2 generate images of the figure while preserving the trigger's semantic context. The authors evaluate on 8 public figures and 10 job-related triggers, using LLaVA yes/no answers to compute Bias Success Rate (BSR) and Trigger Fidelity Rate (TFR), reporting overall BSR=53% and TFR=65%. They also test UCE concept erasing as a defense and conduct a small human-consistency check. The paper is framed as a preliminary study, with the authors noting that more extensive evaluations are planned.

Significance. If the reported results were validated, the attack would be notable because it requires no fine-tuning of the diffusion model and only manipulates input embeddings. The paper has several strengths: the threat model is clearly stated; the evaluation spans multiple targets, triggers, and prompt templates; and the authors include a human-consistency analysis in Section 5, which is more than many attack papers do. However, the central implementation is under-specified and the reported numbers are in-sample, so the current significance is limited.

major comments (4)

[Section 3.2, Eq. (1)] The attack is not implementable as written because CLIP's text encoder produces a contextualized representation for the entire prompt and does not expose an isolated embedding for a single word in a multi-word prompt. The paper does not specify whether the blend er = α·e_wp + β·e_wt is applied to the input token embedding of the trigger, to the contextualized per-token hidden state at the trigger's position, or to the pooled sentence embedding; these choices are not equivalent, and for the pooled representation a separate e_wt does not exist. Since the entire method builds on replacing e_wt, this missing implementation detail prevents reproduction and independent verification of the attack.
[Sections 4.1, 4.3.1, 4.2] The headline success rates are in-sample numbers, not predictive results. The target figures were selected in part because the unmodified SD-v2 model could already generate them clearly (Section 4.1), and the hyperparameters α=1.5 and β=0.3 were chosen by maximizing AII=BSR·TFR on the same evaluation set used to report the overall BSR=53% and TFR=65% (Section 4.3.1). No validation or test split is used, so the reported figures are fitted results. In addition, the parameter search is only two one-dimensional sweeps with the other parameter fixed at an arbitrary value, so the claimed optimality is not established even in-sample.
[Section 5 and Sections 4.1-4.2] The paper's own human-evaluation analysis shows that LLaVA is not a reliable judge for several targets: it answered 'NO' for all images in a set that human raters unanimously recognized as Shakira, and for some figures its agreement with human raters is lower than inter-human agreement and sometimes lower than chance. Since all BSR and TFR numbers are computed solely from LLaVA yes/no answers, the reported attack success rates are not a validated measure of whether the target figure appears. The authors should report metrics on a human-validated subset, or validate LLaVA's agreement per target before using it as the sole evaluation instrument.
[Section 4.2 and Section 4.1] The attack's effectiveness is not compared against a baseline. Because the targets were chosen for being clearly generable by the unmodified model, the reported BSR may partly reflect the model's prior tendency to depict these figures for generic 'photo of a {job}' prompts rather than the effect of the embedding manipulation. The paper should report BSR and TFR on the unmodified SD-v2 for the same prompts, and ideally also for a control perturbation, to isolate the contribution of Eq. (1).

minor comments (6)

[Throughout] The name of the attack is inconsistent: 'FameBias', 'FAME BIAS', and 'F AME BIAS' are used interchangeably.
[Section 3.2] The worked example is internally inconsistent: the text mentions a 'savior' prompt and 'modify the original doctor embedding', and Eq. (1) mixes e_{Trump} with e_{savior}; please align the example.
[Section 4.1] The prompt count is confusing: the text says 'we generate four images using the prompts ...' and then lists three prompt templates; clarify that four images are generated per template, yielding 320 images per template.
[Section 4.3.2] The term 'trigger' is overloaded: in the alternative-trigger experiment it refers to an object (e.g., 'stethoscope'), not the person-noun used in the main experiments; consider using 'object trigger' or 'tool trigger'.
[Section 5] The description of Figure 6b, 'adds an additional direction of men → women', is vague; specify how the direction is computed and added to the embedding.
[References] Reference [1] contains a typo ('ac sces sible') and should be checked; reference [12] should include the year and venue if available.

Circularity Check

2 steps flagged · score 6.0 of 10

Headline BSR/TFR are optimized in-sample and the target set is preselected for renderability, so the central quantitative claim is partly fitted rather than predicted.

fitted input called prediction [Section 4.3.1 (Parameter Tuning) and Section 4.2 (Attack Results)]
"Based on our parameter testing results (Section 4.3.1), we setα = 1.5 and β = 0.3, as these values achieved the highest attack success rates while maintaining a clear and recognizable depiction of the target in the generated images. ... The optimal values, α = 1.5 and β = 0.3 were selected by maximizing the product between BSR and TFR."

The hyperparameters α and β are the only tunable parameters of the method. They are selected by maximizing AII = BSR·TFR on the same evaluation setup (same prompts, triggers, targets, and LLaVa-based metrics) that is later used to report BSR=53% and TFR=65%. Thus the headline 'high attack success rate' is the value of an optimized objective at its chosen maximum, not an independent prediction. Because no validation split or alternative metric is used, the Section 4.2 results are fitted to the very quantity they are claimed to demonstrate.
other [Section 4.1, Target & Triggers]
"The specific figures chosen were based on initial observations from the pretrained model, as the SD-v2 model does not recognize every famous figure. We focused on figures that the model could generate clearly."

The target set is selected by first checking which figures the victim model can already generate clearly, and the reported BSR is averaged over exactly this preselected set. Consequently, the claim that FameBias works across diverse public figures is conditioned on a renderability filter; unrenderable or poorly renderable figures are excluded by design. This is a selection step that inflates the reported success rate, though it is secondary to the hyperparameter fitting.

full rationale

The paper's central quantitative claim — FAME BIAS achieves BSR=53% and TFR=65% — is partially circular because the only method hyperparameters (α, β) were tuned by maximizing the same BSR·TFR objective on the same evaluation configuration later used to report those numbers. The target figures were also preselected based on the victim model's ability to render them clearly, so the reported aggregate success is over an already-filtered set. However, the underlying manipulation mechanism (linearly blending CLIP-style embeddings) is not derived from the outcome; it is an externally testable hypothesis with independent content, so this is not a full derivation-from-input circularity. The self-citation to Naseh et al. [12] is background and not load-bearing for the new method. The most significant non-circular weakness is the under-specification of e_wt: CLIP's text encoder does not naturally expose an isolated per-word output embedding, so Equation (1) is not obviously implementable as written. That is a correctness/reproducibility gap, not a circularity, and it does not by itself change the circularity score.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The attack introduces no new physical or architectural entities; its free parameters are the two blending weights and its axioms are unproven assumptions about CLIP token-level manipulability and LLaVa reliability. The target lists and trigger pairs are ad hoc choices that influence the measured success.

free parameters (2)

alpha (target embedding weight) = 1.5
Selected in Section 4.3.1 by maximizing AII = BSR*TFR on the same evaluation set used for headline results.
beta (trigger embedding weight) = 0.3
Selected alongside alpha in Section 4.3.1 by maximizing AII on the evaluation set.

assumptions (3)

domain assumption Adding scaled target and trigger embeddings in CLIP space produces a prompt condition that steers the diffusion model toward the target identity.
This is the core premise of the method, stated in Section 3.2, and is not proven or benchmarked against simpler alternatives such as direct word substitution.
domain assumption The CLIP text encoder permits extracting and replacing the embedding of a single trigger token within a multi-word prompt while preserving the rest of the conditioning.
The paper defines e_wt as the trigger word's embedding and modifies it (Equation 1) without specifying the mechanism, and CLIP normally produces a contextualized full-sentence embedding.
ad hoc to paper LLaVa's yes/no answers are a valid proxy for whether an image depicts the target figure and trigger.
The paper uses LLaVa for all headline metrics, then reports that LLaVa disagrees sharply with human raters for figures such as Shakira and Castro, so this proxy is questionable.

how reviews work

0 comments

Cite this review

Pith. "Pith review of FameBias: Embedding Manipulation Bias Attack in Text-to-Image Models." pith.science (2026). https://pith.science/paper/4Y442NHG

@misc{pith2026241218302,
  author       = {Pith},
  title        = {Pith review of: FameBias: Embedding Manipulation Bias Attack in Text-to-Image Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4Y442NHG}},
  note         = {Machine review of arXiv:2412.18302}
}

read the original abstract

Text-to-Image (T2I) diffusion models have rapidly advanced, enabling the generation of high-quality images that align closely with textual descriptions. However, this progress has also raised concerns about their misuse for propaganda and other malicious activities. Recent studies reveal that attackers can embed biases into these models through simple fine-tuning, causing them to generate targeted imagery when triggered by specific phrases. This underscores the potential for T2I models to act as tools for disseminating propaganda, producing images aligned with an attacker's objective for end-users. Building on this concept, we introduce FameBias, a T2I biasing attack that manipulates the embeddings of input prompts to generate images featuring specific public figures. Unlike prior methods, Famebias operates solely on the input embedding vectors without requiring additional model training. We evaluate FameBias comprehensively using Stable Diffusion V2, generating a large corpus of images based on various trigger nouns and target public figures. Our experiments demonstrate that FameBias achieves a high attack success rate while preserving the semantic context of the original prompts across multiple trigger-target pairs.

Figures

Figures reproduced from arXiv: 2412.18302 by the authors.

**Figure 2.** Diagram of the FameBias attack. Attackers control the output of the encoder of a T2I model and can input modified embeddings [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Sample images generated from different prompts on [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Success rates varying parameter values in FameBias at [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Images generated using the UCE edited SD2 model with [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: Example of more precise attack. the former, while certain attributes reminiscent of Shakira’s appearance—such as facial shape—are present in the first, fourth, and seventh images. However, the signature blonde hair only shows up in one image. Conversely, in the latter…

**Figure 7.** Figure 7: Consistency Results. The green bar means LLaVa has [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 9 canonical work pages

[1]

Easily ac sces- sible text-to-image generation amplifies demographic stereo- types at large scale

Federico Bianchi, Pratyusha Kalluri, Esin Durmus, Faisal Ladhak, Myra Cheng, Debora Nozza, Tatsunori Hashimoto, Dan Jurafsky, James Zou, and Aylin Caliskan. Easily ac sces- sible text-to-image generation amplifies demographic stereo- types at large scale. InProceedings of the 2023 ACM Confer- ence on Fairness, Accountability, and Transparency , pages 1493...

work page 2023
[2]

How to backdoor diffusion models? In Proceedings of the 8 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015–4024, 2023

Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. How to backdoor diffusion models? In Proceedings of the 8 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015–4024, 2023. 2

work page 2023
[3]

A coefficient of agreement for nominal scales

Jacob Cohen. A coefficient of agreement for nominal scales. Educational and psychological measurement , 20(1):37–46,

work page
[4]

Measuring nominal scale agreement among many raters

Joseph L Fleiss. Measuring nominal scale agreement among many raters. Psychological bulletin, 76(5):378, 1971. 8

work page 1971
[5]

Erasing concepts from text-to-image diffusion models with few-shot unlearning

Masane Fuchi and Tomohiro Takagi. Erasing concepts from text-to-image diffusion models with few-shot unlearning. arXiv preprint arXiv:2405.07288, 2024. 2

arXiv 2024
[6]

Unified concept editing in diffusion models

Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision , pages 5111–5120, 2024. 2, 6, 7

work page 2024
[7]

Reliable and efficient concept erasure of text-to- image diffusion models

Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu- Gang Jiang. Reliable and efficient concept erasure of text-to- image diffusion models. arXiv preprint arXiv:2407.12383,

arXiv
[8]

Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model

Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model. arXiv preprint arXiv:2405.16341, 2024. 2

arXiv 2024

Show all 20 references

[9]

Ablating con- cepts in text-to-image diffusion models

Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 2

2023
[10]

Get what you want, not what you don’t: Image content sup- pression for text-to-image diffusion models

Senmao Li, Joost van de Weijer, Taihang Hu, Fahad Shah- baz Khan, Qibin Hou, Yaxing Wang, and Jian Yang. Get what you want, not what you don’t: Image content sup- pression for text-to-image diffusion models. arXiv preprint arXiv:2402.05375, 2024. 2

2024 arXiv
[11]

Visual instruction tuning

Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. Advances in neural information processing systems, 36, 2024. 4

2024
[12]

Injecting bias in text-to-image models via composite-trigger backdoors, 2024

Ali Naseh, Jaechul Roh, Eugene Bagdasaryan, and Amir Houmansadr. Injecting bias in text-to-image models via composite-trigger backdoors, 2024. 1, 2

2024
[13]

High-resolution image synthesis with latent diffusion models

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 1, 2, 3

2022
[14]

Visual propaganda and social media

Hyunjin Seo. Visual propaganda and social media. Hand- book of Propaganda, pages 126–137, 2020. 1

2020
[15]

Rickrolling the artist: Injecting backdoors into text en- coders for text-to-image synthesis

Lukas Struppek, Dominik Hintersdorf, and Kristian Kerst- ing. Rickrolling the artist: Injecting backdoors into text en- coders for text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4584–4596, 2023. 2

2023
[16]

Un- learning concepts in diffusion model via concept domain correction and concept preserving gradient

Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Wenbo Zhu, Heng Chang, Xiao Zhou, and Xu Yang. Un- learning concepts in diffusion model via concept domain correction and concept preserving gradient. arXiv preprint arXiv:2405.15304, 2024. 2

2024 arXiv
[17]

Text-to-image diffusion models can be easily backdoored through multimodal data poisoning

Shengfang Zhai, Yinpeng Dong, Qingni Shen, Shi Pu, Yue- jian Fang, and Hang Su. Text-to-image diffusion models can be easily backdoored through multimodal data poisoning. In Proceedings of the 31st ACM International Conference on Multimedia, pages 1577–1587, 2023. 2

2023
[18]

Forget-me-not: Learning to forget in text-to- image diffusion models

Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to- image diffusion models. arXiv preprint arXiv:2303.17591,

arXiv
[19]

Defensive unlearning with adversarial training for robust concept erasure in diffusion models

Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. arXiv preprint arXiv:2405.15234, 2024. 2

2024 arXiv
[20]

Unlearncanvas: A stylized image dataset to benchmark machine unlearn- ing for diffusion models

Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu. Unlearncanvas: A stylized image dataset to benchmark machine unlearn- ing for diffusion models. arXiv preprint arXiv:2402.11846,

arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Easily ac sces- sible text-to-image generation amplifies demographic stereo- types at large scale

Federico Bianchi, Pratyusha Kalluri, Esin Durmus, Faisal Ladhak, Myra Cheng, Debora Nozza, Tatsunori Hashimoto, Dan Jurafsky, James Zou, and Aylin Caliskan. Easily ac sces- sible text-to-image generation amplifies demographic stereo- types at large scale. InProceedings of the 2023 ACM Confer- ence on Fairness, Accountability, and Transparency , pages 1493...

work page 2023

[2] [2]

How to backdoor diffusion models? In Proceedings of the 8 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015–4024, 2023

Sheng-Yen Chou, Pin-Yu Chen, and Tsung-Yi Ho. How to backdoor diffusion models? In Proceedings of the 8 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015–4024, 2023. 2

work page 2023

[3] [3]

A coefficient of agreement for nominal scales

Jacob Cohen. A coefficient of agreement for nominal scales. Educational and psychological measurement , 20(1):37–46,

work page

[4] [4]

Measuring nominal scale agreement among many raters

Joseph L Fleiss. Measuring nominal scale agreement among many raters. Psychological bulletin, 76(5):378, 1971. 8

work page 1971

[5] [5]

Erasing concepts from text-to-image diffusion models with few-shot unlearning

Masane Fuchi and Tomohiro Takagi. Erasing concepts from text-to-image diffusion models with few-shot unlearning. arXiv preprint arXiv:2405.07288, 2024. 2

arXiv 2024

[6] [6]

Unified concept editing in diffusion models

Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision , pages 5111–5120, 2024. 2, 6, 7

work page 2024

[7] [7]

Reliable and efficient concept erasure of text-to- image diffusion models

Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu- Gang Jiang. Reliable and efficient concept erasure of text-to- image diffusion models. arXiv preprint arXiv:2407.12383,

arXiv

[8] [8]

Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model

Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model. arXiv preprint arXiv:2405.16341, 2024. 2

arXiv 2024