Unlearned (concept-erased) diffusion checkpoints — for arXiv:2504.21307

Victim checkpoints used by "The Dual Power of Interpretable Token Embeddings: Jailbreaking Attacks and Defenses for Diffusion Model Unlearning" (arXiv:2504.21307).

These are concept-erased / unlearned Stable Diffusion (v1.4) checkpoints produced by various third-party unlearning methods, converted to the diffusers UNet format and collected here for reproducible attack/defense evaluation. We did not train these models; credit belongs to the respective method authors.

Layout

<concept_class>/<METHOD>/<file>      e.g. nudity/UCE/UCE-Nudity-Diffusers-UNet.pt
rece/<file>                          flat folder for RECE (nudity_ep2.pt, VanGogh_ep0.pt, Church_ep0.pt)

• concept_class: nudity, vangogh, object (church / garbage_truck / parachute / tench / ship / airplane)
• METHOD: ESD, UCE, SPM, FMN, EraseDiff, SalUn, ScissorHands, MACE, SA, AC, STEREO, RECE

Most entries are a single diffusers UNet state-dict (*.pt). MACE entries are full pipelines (unet/, vae/, text_encoder/ as .safetensors). nudity/SA/nudity.ckpt is a full SD checkpoint. RECE checkpoints live in a flat rece/ folder (point --target_ckpt_folder at it directly).

Usage

pip install "huggingface_hub[hf_transfer]"
export IJD_DATA_ROOT=/path/to/ijd_data
python scripts/setup/03_download_checkpoints.py                       # all (~165 GB)
python scripts/setup/03_download_checkpoints.py --concept_class nudity --methods UCE ESD
python scripts/setup/03_download_checkpoints.py --concept_class rece   # RECE flat folder

See the code repository for the full attack / defense pipeline and the checkpoint support matrix (docs/SUPPORTED_CHECKPOINTS.md).