Open Problems

Machine Unlearning

A Standardized Multi-Architecture Testbed of Memorized Concepts, Generation Fingerprints, and Editable Structures in Text-to-Image Models Beyond Stable Diffusion v1.x

Scope to testOpen
Strong candidate · 5/5 runs22 papers report this88% from 2025+

Generated automatically from the limitations stated in 22 papers (CVPR, ICCV, ICML), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.

The problem

Nearly every quantitative claim about text-to-image models — memorization, unlearning success, watermark robustness, deepfake provenance, concept editability — is anchored to a handful of frozen Stable Diffusion v1.x/v2 checkpoints, because those are the only models with established benchmarks, known memorized prompts, and validated concept labels. Newer architectures (DiT-based diffusion, DeepFloyd, autoregressive and GAN generators, video models) are largely untested, so results that appear robust may be artifacts of one 2022 model family. The field cannot tell whether its findings are properties of generative modeling or properties of Stable Diffusion 1.4.

Why it matters

Once findings can be tested on more than one model family, papers can claim properties of generative models rather than of Stable Diffusion 1.4, and new architectures can be evaluated for unlearning, watermarking, and provenance at release time rather than years later.

Ways to approach it

Prior-work checks are free with an account. Results someone already ran are shown to everyone.

  1. 1

    Build and release an architecture-stratified evaluation suite: a memorized-prompt discovery pipeline (membership-inference and replication-rate scoring) run over SD v1.x/v2, a DiT-based T2I model (e.g., PixArt/SD3), DeepFloyd, and at least one autoregressive and one GAN generator, producing per-model sets of verified memorized prompts, concepts, and internal activation statistics. Measure replication rates, cross-architecture agreement of memorization metrics, and correlation with existing SD v1.4 benchmarks.

  2. 2

    Port three representative tasks — one unlearning method, one watermark/detector pair, one concept-editing method — onto the suite and quantify exactly which findings transfer and which collapse. Measure task success metrics per architecture before and after controlling for training-data curation and deduplication level.

  3. 3

    Characterize which architectural and data properties (UNet vs. DiT, latent dimensionality, deduplication) predict whether memorization and intervention findings transfer, via regression over the measured per-model statistics. Measure predictive accuracy of transfer between architecture pairs.

Have a different approach?

Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.

Free · 3 checks per day

Why it might fail

Memorization in modern models may be too weak or too diffuse to construct a comparable benchmark at all, leaving no common ground across architectures on which to measure transfer.

Sub-problems

  • Cross-Architecture Generalization and Robustness of Watermarking and Attribution in Text-to-Image Generation

    Current watermarking, attribution, and concept erasure methods in text-to-image synthesis have almost exclusively been evaluated on early U-Net diffusion models, particularly Stable Diffusion v1.x and v2.x. Because these techniques rely heavily on specific latent spaces, VAE architectures, and diffusion noise schedules, their cross-architecture transferability remains entirely unverified across modern generative paradigms such as Diffusion Transformers (DiTs), autoregressive models, and discrete tokenizers. Consequently, practitioners cannot determine whether existing provenance and safety guarantees are fundamental or merely artifacts of early Stable Diffusion parameterizations.

  • Cross-Architecture Latent Translation Benchmark Across GANs, VAEs, and Diffusion Models

    Image translation and latent editing techniques are currently developed and evaluated in isolation within specific model families, assuming either compact low-dimensional latent spaces (GANs and VAEs) or specific diffusion backbones (such as Stable Diffusion v2.1). Because no unified evaluation or bridging mechanism exists across these different latent formulations, latent manipulation methods cannot be transferred between GANs and diffusion models without costly ad-hoc redesigns or full-model fine-tuning. Consequently, researchers cannot determine whether existing translation paradigms generalize across modern diffusion architectures, including both UNet and Transformer-based backbones.

Evidence

Each paper's own statement of the limitation, verbatim.

Show all 22 papers

Nearest existing work

Related open problems

Machine Unlearning

Effect to explainPartly addressed

Benchmarking the Adversarial Robustness and Reversibility of LLM Unlearning

Existing LLM unlearning methods are predominantly evaluated on standard, benign queries, giving a false sense of compliance with privacy and copyright demands. Empirical evidence shows that "unlearned" knowledge remains extractable via adversarial jailbreaks, latent-space elicitation, and few-shot relearning. Without systematic evaluation across these extraction vectors, practitioners have no way to verify whether a model has actually eliminated sensitive data or merely applied a superficial suppression mask.

Possible candidate · 2/5 runs6 papers report this83% from 2025+

Machine Unlearning

Effect to explainPartly addressed

Empirical Robustness and Sensitivity of Machine Unlearning Under Realistic Data and Checkpoint Constraints

Existing machine unlearning algorithms for language models are predominantly evaluated under idealized conditions: complete access to forget sets, clean entity anchors, standard prose, and checkpoints saved immediately before target data exposure. In practice, unlearning requests frequently present partial forget data, domain variations like code, noisy or alias-heavy entity mentions, and checkpoints separated from target exposure by billions or trillions of tokens. Practitioners currently cannot predict whether an unlearning method that succeeds on curated benchmarks like TOFU will retain any efficacy when deployed under these real-world data and provenance constraints.

Strong candidate · 1/1 runs4 papers report this50% from 2025+

Machine Unlearning

Barrier to removePartly addressed

Machine Unlearning Under Degraded Operational Preconditions

Existing machine unlearning methods rely on strict operational preconditions: access to clean retain datasets ($D_r$), full white-box parameter access, historical pre-training checkpoints, or original pre-unlearned calibration weights. In production environments, intermediate training checkpoints are routinely deleted to save storage, retain data is often inaccessible due to data governance policies, and deployment interfaces may restrict full weight access. Without methods that function in the absence of these preconditions, deployed models cannot legally or practically comply with data deletion requests.

Possible candidate · 2/5 runs4 papers report this75% from 2025+

Machine Unlearning

Effect to explainOpen

Scalability and Robustness of Machine Unlearning Under Varying Forget-Set Regimes

Existing machine unlearning techniques are only validated in narrow operating windows, typically limited to small forget budgets ($\le 10\%$). As forget sets scale beyond a few hundred samples or exceed 10–20% of the training distribution, retention accuracy drops significantly (e.g., a 14–15% gap relative to retraining from scratch on CIFAR-10), while tiny splits (e.g., 1%) yield negligible unlearning. Furthermore, unlearned representations remain fragile and easily recoverable when exposed to small fractions of the forgotten data during relearning. Consequently, current unlearning algorithms cannot be reliably deployed for large-scale data deletion compliance without catastrophic utility loss.

Possible candidate · 2/5 runs4 papers report this100% from 2025+
Generated automatically, not curated by hand. Automated prior-work checks catch about a third of existing work, so treat this problem as a lead to investigate.