Censored Sampling of Diffusion Models Using 3 Minutes of Human Feedback

Diffusion models have recently shown remarkable success in high-quality image generation. Sometimes, however, a pre-trained diffusion model exhibits partial misalignment in the sense that the model can generate good images, but it sometimes outputs undesirable images. If so, we simply need to prevent the generation of the bad images, and we call this task censoring. In this work, we present censored generation with a pre-trained diffusion model using a reward model trained on minimal human feedback. We show that censoring can be accomplished with extreme human feedback efficiency and that labels generated with a mere few minutes of human feedback are sufficient. Code available at: https://github.com/tetrzim/diffusion-human-feedback.

Paper

References (50)

Scroll for more · 38 remaining

Similar papers

Peer review

Reviewer 6Ndg6/10 · confidence 4/52023-07-02

Summary

The work aims to solve censored diffusion sampling problem, which prevent diffusion model generating malign / bad images. The core approach is to train a classifier and apply classifier-guided diffusion generation.

Strengths

1. Authors present an interesting finding that the classifier-guided diffusion can effectively reduce the probability of generating malign images. 2. Authors present two approaches to learn the classifier, ensemble-based approaches when number of malign images less than benign images, imitation learning for when malign images are dominates. 3. The proposed methods are lightweight and can be effective with small labeled datasets.

Weaknesses

The core technique employed in the work is not new. And compared with existing works that are based on text2image diffusion models, authors use relatively simple diffusion models that are either class-condition diffusion models or diffusion models for one category dataset. I am not sure the effectiveness and efficiency of the proposed method can be scaled to a large diffusion model that handles for complicate diffusion models. The classifiers in three experiments are relatively easy and that may explain why it is so effective. It may not be true in large text2image settings.

Questions

It would be more convincing that the authors provide more experiments for more complex diffusion models, such as stable diffusion.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

4 excellent

Contribution

3 good

Limitations

See above

Reviewer GFro6/10 · confidence 3/52023-07-03

Summary

The authors examine the problem of preventing the generation of certain types of images generated by a diffusion model. To achieve this, the authors propose using a reward model trained on human feedback. The authors demonstrate their approach from examples that require minimal human feedback to achieve sufficient censoring performance.

Strengths

- The authors make a good argument in that 3 minutes of human feedback can be more cost-efficient than retraining models. - Their discussion and experiments in benign-dominant and malign-dominant scenarios are thorough. - Their ablation studies in the experiments give convincing arguments that human feedback works well.

Weaknesses

- A discussion of when to use time-dependent or time-independent would have been nice. - In the LSUN bedroom experiment, it took 15 minutes so it doesn't always take 3 minutes.

Questions

- Line 52: there are two consecutive "the". - Figure 3(b) text: "Comparsion" to "Comparison" - How far can this method go? I'm sure there are practioners that want 0% malign images.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

4 excellent

Presentation

4 excellent

Contribution

4 excellent

Limitations

- The authors do not explicitly state their limitations.

Reviewer iXGj6/10 · confidence 4/52023-07-08

Summary

This paper presents censored diffusion model training by using a reward model trained using human feedback. Towards this, the paper utilizes reward model ensembles (for benign dominant settings) and tools from imitation learning (for malign dominant settings).

Strengths

The human feedback part is pretty interesting and is a topic of increasing interest. The empirical results appear to be pretty compelling, though, I am not an expert with respect to evaluating this in particular, so I cannot comment on this with high confidence. ==> post rebuttal: I increased the score from a 5 to a 6.

Weaknesses

The techniques utilized by the paper are pretty well known and in that sense, this paper's contributions appear incremental. One other question that appears to not be addressed is - by performing this paper's procedure iteratively (as multiple rounds), would the probability of producing malign images be brought down to zero? What are the other ways of achieving this? Another weakness of the paper is that it is not clear to me if the proposed approach has been compared against other concept removal methods in the literature (which I agree I am not an expert on), but, this is something the authors must either present clarifications on, or, provide more comparisons on.

Questions

a. i wonder if the malign dominant settings can be handled by flipping the reward to be something resembling 1-\prod_{i=1}^K (1-r_{\psi_k}^{k})? b. does it help to train every single reward model with some form of hard negative mining? I mean this in the context of algorithm 1.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

I believe the authors must present a discussion surrounding this in the context of their work - what it seeks to address, what remains to be addressed, and how much to trust the proposed algorithm as to whether it truly achieves what it sets out to. I am not certain about going through an ethics review, and I hope the AC and the authors try to see what is necessary in this direction as it clearly seems like there is potential for fleshing some of these concerns out.

Reviewer zmCo6/10 · confidence 3/52023-07-09

Summary

This paper studies the problem of preventing the generation of unwanted images in diffusion models. It formulates the task of 'censoring' and proposes using reward model trained from human labelling to guide the diffusion model. The method requires no fine-tuning and a few minutes of human feedback, while displaying significant reduction of unwanted images in four experiment setups.

Strengths

- This work identifies and formulates an important problem of misalignment in diffusion probabilistic models, which underwent few studies in the past. Solution to the problem can significant improve the utility of generative models and lead to positive social impact. - RLHF is an emerging technology which is theoretically sound and empirically useful. The proposed method successfully bring the idea of RLHF into diffusion models while combining the idea of classifier guidance. The method itself is clean and simple to train, and requires few modifications to the sampling process. - From the experiments, the method seem also quite efficient: (i) it sample efficient: requiring up to 100 malign samples, (ii) it does not need fine-tuning; (iii) it works under limited human feedback, taking only a few minutes of human labeling. These properties are desirable in practical implementation.

Weaknesses

- Under the general framework of training reward models and sampling with guidance, the authors use four different methods to train the reward model for the four different tasks in the paper. The methods are quite heuristic. It appears that for any new concept and dataset, it still requires a manual selection of the training algorithms for the reward models to achieve the best effect, which can be costly. However, the paper does not provide a conclusive algorithm or any unifying principles for the selection. In this sense the study seems unfinished. - There are no large-scale, principled comparisons with baselines. Even if there are limited existing works studying the problem, I think there are still some naive methods such as using natural language prompts, fine-tuning, and post-selection with classifier. It is not straightforward to see why the method proposed in this paper is the best.

Questions

- Why is it better to use time-independent reward model for censoring watermarks and time-dependent reward model for other tasks? Is there a general reason why time-independent reward models work better for some tasks and not others? - Any guidance of choosing $\omega$ ? - It appears from the paper that the training of reward models need large datasets containing images related to a single unwanted concept (for example fish with human faces). If I do not have such high-quality, single-purpose datasets, maybe only random images with all kinds of undesirable concepts, can the method still work well?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

3 good

Contribution

3 good

Limitations

See above.

Reviewer W62Q8/10 · confidence 4/52023-07-12

Summary

The authors combine pre-trained diffusions with classifiers trained on human feedback about which type of images to omit, and use the classifiers to guide diffusion sampling using the Universal Guidance technique. They observe that they are able to filter out several types of malign images on a variety of datasets, notably removing undesirable artifacts on LSUN and faces on Imagenet. I would recommend this paper for acceptance.

Strengths

- People care about censoring sampled outputs, and don't like re-training large diffusions - Together with the appendix, the specifics of how exactly to guide are well explored in this work - I like that that while "bad" images are hard to quantify with some kind of numerical per-sample score, it is easy for a human to recognize instances of it when they do see it. - emphasizing that not much feedback is needed for the cases explored

Weaknesses

The main concerns would naturally be: - how much feedback is enough - are the good results specific to the type of things being censored in the particular datasets chosen - for the infrequent malign content case, can a second dataset be used in place of model samples? See questions below. Other small comment: change "man hours" to "human work hours"

Questions

For the first concern, it would be great if you could include something showing the number of model-produced malign samples going down as a function of number of malign samples used in classifier training, or as a function of number of total samples used for classifier training, or both. I know this is hard to do since the outputs need to be checked manually. Even doing this with a batch of 128 for a few classifier-training-set-sizes would be good, and see e.g. the malign proportion lowers for several feedback dataset sizes. For the second concern, the crossed 7's are distinct enough in MNIST such that a very small classifier could quickly assign zero weight to them. However, the faces on Imagenet are more convincing since the properties to be censored (faces) do appear in several ways that aren't as clearly disentangled from benign properties. It would be useful to share somewhere in the text a case where the censoring did not work despite what looks like an adequate amount of samples. Did this happen for censoring some other of the Imagenet classes? Are there any cases you explore where the choice of malign samples constitute nearly all of the training set? Feedback on a second dataset rather than model samples: for the case where a diffusion is trained on a dataset A with low frequency of the malign property (but nevertheless we need to guarantee that samples do not ever contain the property), the model samples will feature malign content infrequently. What if you have a second dataset B where the property is common? If the datasets are the same resolution and are diverse enough, and share some concepts this might work and might be a nice way to get past low malign frequency in dataset A? Consider the case where A only has some faces but B is at least half human faces. So samples from the A-trained-model do not produce malign content often and good feedback is hard to collect. How well does a feedback model trained on a second dataset B (which are not model samples) work for censoring the A-trained-diffusion from generating faces?

Rating

8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Addressed.

Reviewer ADeQ6/10 · confidence 2/52023-07-21

Summary

This paper proposes an approach to censor the sample generation of pre-trained diffusion probabilistic models to better align with human preferences. The authors use minimal human feedback (<3min spent in providing the feedback for basic tasks, and <15min for more complicated tasks that they consider) to train a light-weight reward model, then use the trained reward model to provide either time-dependent or time-independent guidance for the generation process. The authors also use techniques such as ensemble, iterative imitation learning, transfer learning, backward guidance and recurrence to improve censoring performance. Experiments on MNIST, LSU church, ImageNet, and LSUN bedroom showed the effectiveness of their proposed method.

Strengths

The paper studies an interesting and important problem of aligning diffusion models with human preferences. By training a relatively lightweight reward model to guide the generation process instead of fine-tuning the large pre-trained model, their proposed approach could potentially save a lot of computation and human feedback.

Weaknesses

- The paper's structure could be more coherent and consistent. The authors introduce classifier guidance in Section 1.1 but leave its relation to censored sampling unclear until Section 4. This disconnect could confuse readers. Similarly, there is a lack of clarity regarding the reward function $r$ and the reward model $r_\phi$ introduced in Section 2. While initially, it seems that $r_\phi \approx r$, the possibility of $r_\phi$ becoming time-dependent, as mentioned in Line 97 of Section 3, introduces confusion because $r$ is time-independent. This is not resolved until Section 4, when time-dependent guidance is addressed. To improve readability, it would be beneficial for the authors to introduce the underlying notations and mathematical concepts of the entire model—from the diffusion probabilistic models to the reward models and their role in censored sampling—before discussing training and evaluations. - In section 3.1, the authors choose $r_\phi$ as the product of $K=5$ independently trained reward models. However, they did not have enough discussions or experiments to back up these choices, which makes the resulting model seem arbitrary. In particular, since the authors mentioned $r_\phi(X)\approx r(X)=P(Y=1|X)$, it's unclear why taking the product--as opposed to taking the average--makes sense because each $r_{\psi_k}$ is also approximating $r$. Moreover, if we ignore the mathematical implications for now, the authors explained in line 115 that taking the product is essentially asking for unanimous approval, but readers might still question whether other methods, such as increasing the value of $w$ in the "union" method, could work just as well. - The paper highlights extreme human feedback efficiency by saying that a few minutes of human feedback are sufficient. However, this claim overlooks the complexity of tasks considered in this paper, which are relatively simple compared to tasks where RLHF is typically employed in large-scale models. Therefore, it would be better to directly compare with previous approaches (such as fine-tuning) under the same task. Additionally, the more complex tasks, like censoring distorted bedrooms, actually require more than the estimated 3 minutes of human feedback. Hence, the title could be seen as potentially misleading or exaggerating the method's efficiency.

Questions

- For the training data $X^{(1)},\cdots,X^{(N)}$ in Algorithms 1 and 2, are they images corrupted by the VP SDE or images generated by the pre-trained model $\varepsilon_\theta$? What are the objectives in training each reward model in the ensemble method? - In Algorithm 1, for each $k$ the learner randomly select with replacement $N_M$ benign samples. Does this step also need human feedback? - Typo in line 204. "30 malign and 150 malign samples"

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

2 fair

Contribution

3 good

Limitations

Yes

Reviewer zmCo2023-08-12

Thank you for the responses.

Reviewer ADeQ2023-08-15

I appreciate the author's rebuttal and the additional experiment on stable diffusion. Given that most of my concerns have been addressed, I will raise my score from 4 to 6.

Reviewer 6Ndg2023-08-16

Thanks for updating. The new experiments look promising. I raise my score.

Reviewer iXGj2023-08-18

Re. author response

Thanks to the authors for their clarifications. My only remaining concern is whether is it possible to make a (formal) claim about a certified ability of the learnt model to prevent generating mis-aligned images. It will be worthwhile hearing the author's perspective on this, or include a discussion surrounding this in the paper. That said, I will increase my score, and thank the authors for their clarifications.

Authorsrebuttal2023-08-21

We highly appreciate the reviewer's positive evaluation on our results and responses. We assume that there exists a ground-truth function $r(x)$ that defines the likelihood of an image $x$ being benign. In principle, with infinite data and an infinitely expressive neural network, we should be able to learn $r(x)$. However, the data we have access to is highly limited in practice, so our goal is to achieve high censoring precision rather than to have any formally certified guarantees. However, the idea of using the set of techniques from formal verification certifying certain input-output relationships of neural networks [1] seems intriguing. We are not aware of analogous verification results regarding generative models, but this is certainly a very interesting direction of future work. [1] Liu et al., Algorithms for Verifying Deep Neural Networks. Foundations and Trends in Optimization, 2021.

Authorsrebuttal2023-08-21

We sincerely thank all reviewers for their time and effort spent for reviewing our paper. We believe the valuable comments and discussions from the rebuttal period have significantly improved the paper, and we will adequately incorporate them into the revised version.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC