Positive-Unlabeled Diffusion Models for Preventing Sensitive Data Generation

Thank you for your feedback. We provide a theoretical justification for the proposed method below. Since the equations were not rendered properly on OpenReview, we have included the same discussion in Appendix A.3 of the Supplementary Material.

We provide a theoretical explanation of the proposed method from the perspective of maximizing and minimizing the ELBO $\mathcal{L}_{\mathrm{DM}}(\mathbf{x};\theta)\approx-\ell(\mathbf{x};\theta)$ defined in Eqs. (7) and (8).

To prevent diffusion models from generating sensitive data, we aim to maximize the ELBO for the normal data distribution $p_{\mathcal{N}}(\mathbf{x})$:

and minimize it for the sensitive data distribution $p_{\mathcal{S}}(\mathbf{x})$:

where $\beta$ is the ratio of the sensitive data.

First, we focus on maximizing the ELBO for the normal data. As shown in Eqs. (13) and (14), we assume that the unlabeled data distribution $p_{\mathcal{U}}(\mathbf{x})$ can be written as a linear combination of $p_{\mathcal{N}}(\mathbf{x})$ and $p_{\mathcal{S}}(\mathbf{x})$:

With this assumption, the ELBO for $p_{\mathcal{N}}(\mathbf{x})$ can be rewritten as follows:

This maximization equals the following minimization:

This is equivalent to the sum of the second and third terms in Eq. (17) of the proposed method, where $\ell_{\mathrm{BCE}}(\mathbf{x},0;\theta)=\ell(\mathbf{x};\theta)$.

Next, we focus on minimizing the ELBO for the sensitive data. Unfortunately, since $-\ell(\mathbf{x};\theta)$ is unbounded below, this minimization diverges to negative infinity, leading to meaningless solutions. To solve this issue, we introduce the following upper bound for $-\ell(\mathbf{x};\theta)$, inspired by the binary classification as shown in Eq. (11):

This upper bound is proportional to $-\ell(\mathbf{x};\theta)$ and approaches zero when $-\ell(\mathbf{x};\theta)$ tends to negative infinity. With this upper bound, the ELBO for $p_{\mathcal{S}}(\mathbf{x})$ is bounded above as follows:

This is equivalent to the first term in Eq. (17), where $\ell_{\mathrm{BCE}}(\mathbf{x},1;\theta)=-\log(1-\exp(-\ell(\mathbf{x};\theta)))$.

From the above discussion, the proposed method in Eq. (17) can be interpreted as maximizing the ELBO for normal data while minimizing the ELBO for sensitive data. For the former, we use PU learning to approximate the normal data distribution $p_{\mathcal{N}}(\mathbf{x})$, and for the latter, we introduce the upper bound for the ELBO based on the binary classification. We will include this discussion in the revised paper.

We will also correct the typos you commented.

Thank you for your feedback. We apologize for the delayed response; the experiments with Stable Diffusion took longer than expected.

Weakness: This paper only tests the performance of the proposed method. It does not have a comparison of previous closely related works.

Question: Could authors compare the performance of the proposed method with the works in the related work section?

We did not compare our approach with existing methods such as selective amnesia (SA) (Heng & Soh, 2024) and erasing stable diffusion (ESD) (Gandikota et al., 2023) for the following two reasons.

The first reason is that existing methods are not designed for the Positive-Unlabeled (PU) setting. For example, in the case of SA, it assumes that all unlabeled data are normal in the PU setting, maximizing the ELBO in Eq. (7) for the unlabeled data and minimizing the ELBO for the sensitive data. However, since the unlabeled data actually contain sensitive data, this approach inadvertently maximizes the ELBO for the sensitive data, encouraging the generation of sensitive data. The same applies to the case of ESD.

The second reason is that the supervised diffusion models (SDM) proposed in section 3.1 cover the functionality of the existing methods. Although SA aims to maximize the ELBO for the unlabeled data and minimize it for the sensitive data, it instead optimizes the surrogate objective function as explained in Section 4.1 to avoid instability issues during training. On the other hand, SDM achieves stable training with the original objective of SA, which maximizes the ELBO for unlabeled data and minimizes it for sensitive data. Therefore, SDM can be seen as a generalization of SA. In the experimental section, we demonstrate that our approach outperforms SDM in the PU setting.

Weakness: The setting/scenario is not very close to real-world sensitive images ...

Weakness: It does not conduct experiments using popular SD such as SD v 1.4, SD v2.0, and SD XL.

Questions: Could authors conduct experiments using SD v1.4 and SD v2.0?

We conducted experiments using Stable Diffusion 1.4 with the following experimental settings. The objective was to ensure that specific individuals (in this case, Brad Pitt) are excluded when generating images of middle-aged men using Stable Diffusion. The dataset was prepared as follows:

• Unlabeled data: 64 images of middle-aged men and 16 images of Brad Pitt.
• Labeled sensitive data: 20 images of Brad Pitt.

These images were generated using Stable Diffusion with the prompts "a photo of a middle-aged man" and "a photo of Brad Pitt". This experimental setup is an extension of (Heng & Soh, 2024) to the PU setting.

Using this dataset, we applied standard fine-tuning (unsupervised), supervised diffusion models as described in Section 3.1 (supervised), and the proposed method to Stable Diffusion 1.4.

As an evaluation metric, we use the non-sensitive rate described in Section 5.2, which represents the ratio of the generated samples classified as normal (non-sensitive) by a pre-trained classifier. For the pre-trained classifier, we use a ResNet-34 fine-tuned on 1,000 images each of middle-aged men and Brad Pitt, generated by Stable Diffusion. The accuracy on the test set for the classification task is 99.75%.

The experimental setup is almost the same as in Section 5.3, with a batch size of 16, a learning rate of $10^{-5}$ for the proposed method and $10^{-4}$ for the others, 1,000 epochs, and $\beta=0.2$ for the proposed method.

The experimental results for generating images of middle-aged men are provided in Appendix A.6. With the Unsupervised and Supervised methods, attempts to generate images of middle-aged men often result in the generation of Brad Pitt. This issue arises due to the presence of Brad Pitt in the unlabeled data. Meanwhile, the proposed method successfully suppresses the generation of Brad Pitt.

The non-sensitive rates are as follows:

Quantitatively, the proposed method demonstrates superior performance compared to both the Unsupervised and Supervised methods.

Weakness: The presentation of qualitative examples is not very good ...

Question: It would be better to contain more clear images in the Appendix.

We have included higher-resolution experimental results using Stable Diffusion in Appendix A.6. We also plan to include higher-resolution results for other experiments as well.

Question: Some sentences in the abstract are not very clear ...

We apologize for the confusion. The sentence you pointed out should be more accurately stated as follows:

"Our approach can approximate the evidence lower bound (ELBO) for normal (negative) data using only unlabeled data and labeled sensitive (positive) data."

We will revise the abstract accordingly.

Thank you for the quick reply. I will include this discussion in the final version. Thank you very much!

Thank you for your feedback, which we shall address below.

Weakness: The methodological details, and the rationale for adopting the methods, are rather confusing.

We apologize for the confusion. In this paper, we derive the proposed method from the perspective of PU learning: first, we introduce the ELBO for the diffusion model as described in Eq. (8); next, we define a binary classifier using this ELBO as described in Eq. (10); and finally, we apply PU learning to this binary classifier as described in Eq. (17). Through the training of this binary classifier, the ELBO is maximized for normal data and minimized for sensitive data.

In addition, we can provide the theoretical justification for the proposed method from the perspective of maximizing and minimizing the ELBO, as described in the rebuttal for Reviewer o4Dc. Note that we have included the same discussion in Appendix A.3 of the Supplementary Material.

Weakness: limited contribution and novelty. & Question 1

We first note that we have included the following discussion in Appendix A.5 of the Supplementary Material since the equations were not rendered properly on OpenReview.

We apologize for the insufficient explanation. Existing methods assume that all unlabeled data are normal, and maximize the ELBO $\mathcal{L}_{\mathrm{DM}}(\mathbf{x};\theta)$ in Eq. (7) for the unlabeled data.

Let $p_{\mathcal{U}}(\mathbf{x})$, $p_{\mathcal{N}}(\mathbf{x})$, $p_{\mathcal{S}}(\mathbf{x})$ represent the unlabeled, normal and sensitive data distribution, respectively.

By using $p_{\mathcal{N}}(\mathbf{x})$ and $p_{\mathcal{S}}(\mathbf{x})$, $p_{\mathcal{U}}(\mathbf{x})$ can be rewritten as follows:

$

p_{\mathcal{U}}(\mathbf{x})&=\beta p_{\mathcal{S}}(\mathbf{x})+(1-\beta)p_{\mathcal{N}}(\mathbf{x}),

$

where $\beta$ is the ratio of the sensitive data.

Hence, the ELBO for the unlabeled data can be rewritten as:

$

\max_{\theta}\mathbb{E}{p{\mathcal{U}}}[\mathcal{L}{\mathrm{DM}}(\mathbf{x};\theta)]=\max{\theta}\left{ \beta\mathbb{E}{p{\mathcal{S}}}[\mathcal{L}{\mathrm{DM}}(\mathbf{x};\theta)]+(1-\beta)\mathbb{E}{p_{\mathcal{N}}}[\mathcal{L}_{\mathrm{DM}}(\mathbf{x};\theta)]\right}.

$

Therefore, if all unlabeled data are assumed to be normal, the ELBO will be maximized even for the sensitive data included in the unlabeled data. This would inadvertently encourage the generation of sensitive data.

Meanwhile, our approach maximizes the ELBO for the normal data by using the unlabeled and sensitive data as follows:

$

\max_{\theta}(1-\beta)\mathbb{E}{p{\mathcal{N}}}[\mathcal{L}{\mathrm{DM}}(\mathbf{x};\theta)]=\max{\theta}\left{ \mathbb{E}{p{\mathcal{U}}}[\mathcal{L}{\mathrm{DM}}(\mathbf{x};\theta)]-\beta\mathbb{E}{p_{\mathcal{S}}}[\mathcal{L}_{\mathrm{DM}}(\mathbf{x};\theta)]\right}.

$

Therefore, our approach can maximize the ELBO for normal data without using labeled normal data.

Question 2

We apologize for the insufficient explanation. Although semi-supervised anomaly detection is highly relevant to our approach, it cannot be directly applied to diffusion models. The reasons are explained below.

Semi-supervised anomaly detection trains an anomaly detector with parameter $\phi$ by minimizing the anomaly score $\ell_{\mathrm{AD}}(\mathbf{x}; \phi)$ for normal data within unlabeled data, and maximizing it for the labeled anomaly data. $\ell_{\mathrm{AD}}(\mathbf{x}; \phi)$ satisfies $0 \leq \ell_{\mathrm{AD}}(\mathbf{x}; \phi) < \infty$. For example, [1] minimizes $\ell_{\mathrm{AD}}(\mathbf{x}; \phi)$ for unlabeled data, and minimizes $1 / \ell_{\mathrm{AD}}(\mathbf{x}; \phi)$ for labeled anomaly data.

In contrast, to prevent sensitive data generation in diffusion models, it is necessary to maximize the log-likelihood for normal data, and minimize it for sensitive data. However, since the log-likelihood is unbounded below, minimizing it leads to divergence to negative infinity, resulting in meaningless solutions. Therefore, existing semi-supervised anomaly detection approaches like [1] cannot be directly applied to diffusion models.

To solve this problem, in Section 3.1, we define a binary classifier $p_{\theta}(y|\mathbf{x})$ by using the ELBO of the log-likelihood defined in Eq. (8), according to ABC (Yamanaka et al., 2019). $-\log p_{\theta}(y|\mathbf{x})$ satisfies $0 \leq -\log p_{\theta}(y|\mathbf{x}) < \infty$, enabling stable maximization and minimization of the log-likelihood through the training of this binary classifier.

In summary, our challenge lies in the definition of $-\log p_{\theta}(y|\mathbf{x})$, which corresponds to the anomaly score $\ell_{\mathrm{AD}}(\mathbf{x}; \phi)$ in semi-supervised anomaly detection. By using this loss function, diffusion models can be incorporated into the existing semi-supervised anomaly detection framework.

[1] Ruff, Lukas, et al. "Deep semi-supervised anomaly detection." ICLR2020.

Weakness: The selection of datasets for the experiments and the design of the experimental methods seem to be unreasonable. & Question 3

In practical applications, sensitive content may be nude images of a particular individual. In such cases, the sensitive data correspond to facial images of that individual, while the non-sensitive data correspond to facial images of other individuals. Since the sensitive data are less diverse and the boundary between sensitive and non-sensitive data is clear in this scenario, it is relatively easy to prevent the generation of sensitive data.

On the other hand, in our experiments, we assume scenarios where sensitive data are more diverse. For example, in the CelebA experiment, we assume that male faces are normal while female faces are sensitive. Female faces are highly diverse, and distinguishing them from male faces can sometimes be challenging. The goal of our experiments is to evaluate how effective our approach is in these more challenging scenarios.

Additionally, since there has been no existing research on training diffusion models in the PU setting, we set the ratio of normal data to sensitive data in our experiments based on the semi-supervised anomaly detection experiments (Takahashi et al., 2024), which is discussed as a related work in Section 4.2.

About comparisons with other methods, we did not compare our approach with existing methods such as selective amnesia (SA) (Heng & Soh, 2024) for the following two reasons.

The first reason is that existing methods are not designed for the Positive-Unlabeled (PU) setting, as described in rebuttal for Question 1.

The second reason is that the supervised diffusion models (SDM) proposed in section 3.1 cover the functionality of the existing methods. Although SA aims to maximize the ELBO for the unlabeled data and minimize it for the sensitive data, it instead optimizes the surrogate objective function as explained in Section 4.1 to avoid instability issues during training. On the other hand, SDM achieves stable training with the original objective of SA, which maximizes the ELBO for unlabeled data and minimizes it for sensitive data. Therefore, SDM can be seen as a generalization of SA. In the experimental section, we demonstrate that our approach outperforms SDM in the PU setting.

To address the third Weakness, Question 3, and feedback from other reviewer (mThp), we conducted following experiments using Stable Diffusion 1.4.

The objective was to ensure that specific individuals (in this case, Brad Pitt) are excluded when generating images of middle-aged men using Stable Diffusion. The dataset was prepared as follows:

• Unlabeled data: 64 images of middle-aged men and 16 images of Brad Pitt.
• Labeled sensitive data: 20 images of Brad Pitt.

These images were generated using Stable Diffusion with the prompts "a photo of a middle-aged man" and "a photo of Brad Pitt". This experimental setup is an extension of (Heng & Soh, 2024) to the PU setting.

Using this dataset, we applied standard fine-tuning (unsupervised), supervised diffusion models as described in Section 3.1 (supervised), and the proposed method to Stable Diffusion 1.4.

As an evaluation metric, we use the non-sensitive rate described in Section 5.2, which represents the ratio of the generated samples classified as normal (non-sensitive) by a pre-trained classifier. For the pre-trained classifier, we use a ResNet-34 fine-tuned on 1,000 images each of middle-aged men and Brad Pitt, generated by Stable Diffusion. The accuracy on the test set for the classification task is 99.75%.

The experimental setup is almost the same as in Section 5.3, with a batch size of 16, a learning rate of $10^{-5}$ for the proposed method and $10^{-4}$ for the others, 1,000 epochs, and $\beta=0.2$ for the proposed method.

The experimental results for generating images of middle-aged men are provided in Appendix A.6. With the Unsupervised and Supervised methods, attempts to generate images of middle-aged men often result in the generation of Brad Pitt. This issue arises due to the presence of Brad Pitt in the unlabeled data. Meanwhile, the proposed method successfully suppresses the generation of Brad Pitt.

The non-sensitive rates are as follows:

Quantitatively, the proposed method demonstrates superior performance compared to both the Unsupervised and Supervised methods.

Thank you for your feedback. As you commented, our approach requires that the labeled sensitive data represent the characteristics of all sensitive data. We will explain this using the example of MNIST, where even numbers are considered normal and odd numbers are considered sensitive. If the unlabeled data contain all even and odd numbers, but the labeled sensitive data only include 1, 3, 5, and 7, then the proposed method would generate the digit 9.

To solve this issue, it is necessary to prepare a sufficient variety of labeled sensitive data. In the MNIST example, it would be enough to include the digit 9 in the labeled sensitive data. Similarly, if we want to prevent the generation of a face of a particular person, it would be enough to prepare just a few photos of that person. However, if the sensitive data are more diverse, such as male or female faces, or categories like vehicles or animals, then our approach would likely require a larger amount of labeled sensitive data. In the experiments using STL10 and CelebA, we successfully prevented the generation of sensitive data with 200 labeled sensitive samples. Since the faces, vehicles, and animals included in the training and test sets are different, we believe our approach demonstrated a certain level of generalization ability.

In any case, addressing this issue is an important part of our future work. We plan to explore ways to prevent the generation of sensitive data not covered by the labeled sensitive data, for example, by using supplementary information such as text descriptions. We have included these limitations in Appendix A.4 of the Supplementary Material.