clamp-checkpoints

CLAMP checkpoints

Checkpoints from "Trapping harmful finetuning" (CLAMP), CVPR 2026.

Classification

• last.ckpt — image classification (ResNet18/ImageNet, Cars as harmful, Country211 as benign) immunization checkpoint. Produces the paper's Cars-row Tab. classification numbers.

Diffusion

• diffusion/clamp_ESD/pytorch_lora_weights.safetensors — Stable Diffusion V1-4 LoRA immunization checkpoint (rank 8, alpha 16, 50 epochs, lr=2e-4). Produces the paper's Tab. diffusion CLAMP row.
• diffusion/base_model/ — the ESD-erased Stable Diffusion V1-4 base pipeline the LoRA was trained on top of (sub-concepts erased via ESD, per the paper's methodology). Required to reproduce the paper's numbers; applying the LoRA to vanilla SD v1.4 instead will run but won't match the paper.
• diffusion/inference.py — a minimal, verified-working example that downloads both of the above and runs generation.

Usage

pip install diffusers transformers torch accelerate safetensors huggingface_hub
python diffusion/inference.py

Note: pipe.load_lora_weights() and unet.load_lora_adapter() (the current recommended diffusers APIs) do not work with this checkpoint — they silently attach zero LoRA parameters because the file was saved in the older UNet-level save_attn_procs format, whose key prefixes don't match what those newer methods expect. Use unet.load_attn_procs(...) instead (deprecated but functional), exactly as diffusion/inference.py does. This was confirmed by checking unet.named_parameters() for attached LoRA params after each loading method — the pipeline-level methods report success without actually loading anything.