{"id":"24601569-52a2-4488-862b-6e3b52441377","arxiv_id":"2412.06143","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"AdaVD removes target concepts from diffusion models by soft-projecting value vectors away from the target token direction, with a sigmoid threshold that preserves unrelated prompts.","lead":"This paper presents AdaVD, a training-free method that erases unwanted concepts from text-to-image diffusion models by projecting cross-attention value vectors onto the orthogonal complement of the target concept. It matters because it offers a fast, low-cost way to remove copyrighted or unsafe content while keeping unrelated images nearly unchanged, which could make real-time content moderation practical.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Concern: value-space projection assumes a target concept is captured by the duplicated last-subject token, but Appendix H's 'Starry Night' failure shows it is not; the shift threshold may also explain part of the prior-preservation gain.","rationale":"The reader's weakest assumption identifies precisely the load-bearing premise: faithfulness of the last-subject-token value vector as a full representation of the target concept and linear separability of target from non-target semantics. Appendix H is strong in-scope evidence that this premise fails when the concept is distributed across multiple tokens, and the paper itself states that the failure is mitigated only by increasing s or adding 'Starry Night' as an extra target. My stress-test adds a second, compounding observation: the shift factor with epsilon=0.93 intentionally suppresses erasure for all tokens below a high cosine threshold. This means the impressive prior-preservation numbers may be partly a consequence of not erasing at all for non-target prompts rather than of the orthogonal complement achieving a clean semantic decomposition. That does not make the method invalid for the settings it explicitly benchmarks, but it does mean the abstract's claim of 'precise concept erasure' and the title's emphasis on 'orthogonal complement matters' overstate the mechanism's generality. The proposed paraphrase test would settle whether the failure is a rare edge case or a systematic limitation. Because the empirical contribution, transferability results, and the author-admitted theoretical gap all support a conditional acceptance rather than outright rejection, I keep the reader's CONDITIONAL verdict unchanged.","tokens_in":24946,"tokens_out":4063,"duration_ms":44482,"concrete_test":"Run a controlled paraphrase study for art-style erasure with fixed hyperparameters p=100, epsilon=0.93, s=2 on SD v1.4. Erase 'Van Gogh' and evaluate CS and FID on four prompt families: (a) 'in Van Gogh style', (b) 'in the style of Vincent van Gogh', (c) 'in the style of the artist who painted Starry Night', and (d) the exact Appendix H prompt 'The Starry Night is an iconic example of a masterpiece created in Van Gogh style.' If target CS after erasure for families (b)-(d) remains near the unerased baseline (~29) while family (a) drops to ~24, the method erases only the literal token, not the concept, and the central claim is limited. If all four families show comparable CS reduction, Appendix H is an outlier and the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on two linked premises: (1) the semantic content of a target concept is concentrated in the value vector of the duplicated last-subject token (Section 3.2, Eq. 1), and (2) removing the component along that vector at each token position erases exactly the target semantics while leaving non-target content intact (Section 3.3, Eq. 4). Appendix H provides a direct counterexample to premise (1): 'The Starry Night is an iconic example of a masterpiece created in Van Gogh style' is not erased with the default s=2, and the authors attribute this to multiple tokens, e.g., 'Starry Night', that are 'highly coupled with the target concept.' In that prompt, the target style is carried by tokens other than 'gogh', and their value vectors fall below the shift-factor threshold, so no erasure is applied. This means the method does not reliably erase a concept unless the concept is expressed by the literal duplicated token or by additional tokens the user happens to specify. Relatedly, the shift factor in Eq. (6) with epsilon=0.93 stops erasure for any token whose cosine similarity to the target value vector is below threshold. The reported 2-to-10x FID improvement on non-target prompts could therefore reflect the conservative threshold rather than a genuine disentangling of target and non-target semantics in value space. The paper is internally consistent, and the experiments support the method for the tested literal concepts, but the Appendix H failure plus the threshold mechanism leave the generality of the central claim unestablished.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AdaVD, a training-free concept-erasure method for text-to-image diffusion models. The method pre-processes a target-concept prompt by duplicating the last subject token, computes the value matrix of this modified embedding in each cross-attention layer, and projects the prompt's value vectors onto the orthogonal complement of the target value vectors (Eqs. 2 and 3). A sigmoid shift factor (Eq. 6) modulates the projection strength token-wise. The authors evaluate single- and multi-concept erasure of instances, art styles, celebrities, and NSFW content on SD v1.4 and several other model versions, reporting strong erasure efficacy and 2 to 10 times FID improvement over baselines.","tokens_in":25208,"tokens_out":4921,"duration_ms":47248,"significance":"If the central claims hold, the method is practically valuable: it is training-free, simple, fast, and appears to transfer to SDXL, SDv3, and community SD models. The orthogonal-complement derivation is standard and clearly presented, and the experiments cover a wide range of concepts and baselines, including a concurrent orthogonal-decomposition method. The main risk is that the strong prior-preservation numbers are substantially produced by the conservative cosine threshold rather than by genuine semantic disentanglement, and Appendix H shows that the token-duplication premise breaks when the target concept is expressed through multiple coupled tokens. With those points addressed, the method would be a solid contribution.","major_comments":[{"comment":"The method's central premise is that the target concept is concentrated in the duplicated last-subject token's value vector and that projecting against this vector erases the concept. Appendix H directly contradicts this for 'Van Gogh' in the prompt 'The Starry Night is an iconic example of a masterpiece created in Van Gogh style': the default setting s=2 fails because other tokens such as 'Starry Night' are highly coupled with the target. This means the method erases the literal duplicated token, not the concept in general, unless the user manually adds additional target tokens or raises s. The abstract and introduction claim concept-level erasure; the paper should either qualify the claim to token-localized erasure or incorporate the Appendix H remedy automatically.","section":"Sec. 3.2, Eq. (1), and Appendix H"},{"comment":"The shift factor with epsilon=0.93 effectively disables erasure for any token pair whose cosine similarity is below 0.93; for the reported non-target concept 'Mickey' versus the target 'Snoopy', the cosine is 0.65, giving a shift factor of about 0.002, so no modification occurs by construction. The 2-10x FID improvement over baselines on non-target prompts is therefore partly a consequence of the hand-set threshold rather than evidence that the orthogonal complement separates target and non-target semantics in value space. To support the disentangling claim, the authors should ablate epsilon, for example by reporting FID and erasure CLIP scores at a matched erasure strength, and should show that low FID persists when erasure is actually applied to the non-target tokens.","section":"Sec. 3.4, Eq. (6), and Appendix C.2"},{"comment":"All quantitative comparisons use 10 images per template and a single seed, and no error bars or significance tests are reported. Many of the claimed advantages are large, but some close comparisons, such as Table 2 'Erase Van Gogh' target CS (SPM 24.78 versus Ours 24.87), would be more convincing with confidence intervals or multiple seeds. Because prior-preservation FID is the paper's headline claim, the absence of variance estimates is a load-bearing gap in the empirical support.","section":"Sec. 4.1 and Tables 1-6"}],"minor_comments":[{"comment":"The fourth contribution bullet contains a typo: 'AdaV A' should be 'AdaVD'.","section":"Sec. 1, contribution bullet"},{"comment":"The text states that AdaVD's FID is 33% lower than the second-best method, but from Table 1, for 'Dog' after erasing 'Snoopy', Ours is 2.32 versus SPM's 19.61, which is about 88% lower; please verify the stated percentage or specify which comparison is intended.","section":"Sec. 4.2"},{"comment":"The hyperparameter analysis is qualitative only; reporting the corresponding CS and FID values for the settings shown in Fig. 8 would make it more informative and would strengthen the claim that the chosen default hyperparameters are robust.","section":"Appendix C.2"},{"comment":"The gray columns are said not to directly reflect erasure efficacy or prior preservation; consider moving them to a supplement or explaining their role more explicitly in the captions to avoid confusion.","section":"Tables 4-6"},{"comment":"Because the threshold behavior is central to the method, Figure 8 would benefit from explicitly listing the cosine similarities for the analyzed target/non-target token pairs.","section":"Fig. 8 and Sec. 3.4"}],"recommendation":"major_revision","confidential_remarks":"For the editor: the headline prior-preservation result is fragile because the hand-set shift threshold does much of the work; my assessment would improve substantially if the authors added an epsilon ablation and error bars. The Appendix H limitation should be made more prominent in the paper. Scope fit is fine. No concerns about citation ethics."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"AdaVD is a solid, training-free concept erasure method that works by projecting cross-attention value vectors onto the orthogonal complement of the target concept's value vector, with a sigmoid shift factor that throttles erasure by cosine similarity. The value-space twist is genuinely new: SAFREE, the closest concurrent work, applies orthogonal decomposition to text embeddings, not to value space. Token duplication of the last subject token to build the target value vector is a simple trick that works well for the literal concepts tested. The experiments are extensive — instances, styles, celebrities, NSFW, multi-concept, and transfer to SDXL, SDv3, and community models — and the reported 2-10x FID improvement over the second best is striking, even if some of it traces to the conservative threshold.\n\nCredit where due: the projection math is standard and correctly implemented, the paper compares against strong baselines, and it honestly reports a failure case in Appendix H. The visualization of erased components is a nice piece of evidence that the method is removing target-associated directions rather than noise.\n\nThe soft spots are proportionate. There are no error bars and all generations use a single seed; the prior-preservation advantage is partly a consequence of setting epsilon=0.93, which stops erasure for tokens whose cosine similarity to the target value vector falls below threshold. That is a design choice, not a flaw, but it means the method is conservative by construction. The deeper assumption is that the duplicated last-subject token faithfully represents the target concept. Appendix H shows this fails when the target style is carried by other tokens, e.g., 'Starry Night' coupled with 'Van Gogh'; the paper shows it can be fixed by raising s or adding 'Starry Night' as an extra target, but this puts a burden on the user to know where the concept lives. The paper also acknowledges there is no rigorous theory for why layer-wise value projection works.\n\nOverall, this is a useful empirical contribution, not a paradigm shift. It deserves a serious referee. I would encourage the authors to release code (promised), report variance, and further analyze how much of the prior-preservation gain comes from the threshold versus genuine disentangling. My own verdict is a conditional accept. I'd cite this if I worked on concept erasure and would bring it to a reading group as an example of a clean, cheap intervention that mostly works but has a well-documented edge.","headline":"A solid, training-free value-space projection for concept erasure that mostly works on literal token concepts, with an honest failure case when the concept is spread across other tokens.","tokens_in":25765,"tokens_out":2700,"would_cite":true,"duration_ms":24712,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single projection erases a concept from a diffusion model with no retraining.","keywords":["concept erasure","training-free method","orthogonal complement","cross-attention value space","diffusion models","prior preservation","multi-concept erasure","adaptive shift factor"],"falsifier":"Regenerate \"a photo of a teddy bear and a Snoopy doll\" with the same seed before and after erasing \"Snoopy\", then compare the teddy-bear region with a detector or pixel distance: if the non-target object's pose or appearance changes noticeably, the projection is removing components beyond the target direction, contradicting the claimed prior preservation.","tokens_in":24717,"feed_emoji":"🧹","tokens_out":8484,"duration_ms":80562,"temperature":0.7,"pith_summary":"The paper proposes AdaVD, a training-free method for erasing unwanted concepts such as instances, art styles, celebrities, or NSFW content from text-to-image diffusion models. Its central claim is that a target concept can be removed by projecting the value vectors in each cross-attention layer onto the orthogonal complement of the target concept's own value vector, with a sigmoid-based shift factor that softens the erasure for weakly related tokens. The claim matters because existing training-free methods either erase too much, damaging non-target content, or too little, leaving the target visible, while training-based methods require costly fine-tuning per concept. AdaVD reports the best or near-best erasure efficacy together with 2 to 10 times better prior preservation than the second-best baseline across single- and multi-concept settings.","feed_headline":"One projection makes an image model forget a concept","feed_subtitle":"Training-free value-space erasure keeps unrelated content 2–10x closer to the original than second-best baselines.","key_machinery":"The central object is the orthogonal-complement projection in cross-attention value space, $P_{\\mathrm{span}^\\perp(v_t^j)} v^j = v^j - \\frac{v_t^{j\\top} v^j}{v_t^{j\\top} v_t^j} v_t^j$, applied token-wise in every cross-attention layer of the denoising UNet. This is paired with an adaptive erasing shift $\\delta(x,y) = \\frac{s}{1 + e^{-p(\\cos(x,y)-\\epsilon)}}$ with $0<\\epsilon<1$, $s>0$, $p>0$, which dampens erasure when the prompt token's value vector is only weakly or generally related to the target. Token-wise target preprocessing duplicates the last subject token of the concept across all non-[SOT] positions, exploiting the causal CLIP text encoder so that one vector summarizes the whole target phrase. For multiple concepts, Gram-Schmidt orthogonalization produces a basis of the joint span and the projection subtracts each basis component, shifted per target. The mechanism works through the attention-matrix output: replacing V before the softmax-weighted aggregation redirects generation away from target semantics without altering the layout-controlling keys.","core_discovery":"AdaVD erases concept semantics directly in the value space of the UNet's cross-attention layers, on the view that values carry the \"what\" of generated content. For each token position j, the prompt's value vector $v_j$ is replaced by $v_j^r = v_j - \\delta(v_t^j, v_j) \\, \\frac{v_t^{j\\top} v_j}{v_t^{j\\top} v_t^j} \\, v_t^j$, where $v_t^j$ comes from a target embedding whose tokens are all replaced by the duplicated last subject token of the target concept and the [SOT] position is left untouched. The shift factor $\\delta$ is a sigmoid of the cosine similarity between prompt and target value vectors, so strongly aligned tokens are erased while weak or general alignments are retained. Multi-concept erasure projects onto the orthogonal complement of the span of all target value vectors, using Gram-Schmidt orthogonalization. Applied layer-by-layer, this is reported to remove the target with minimal change to non-target priors, and to transfer to SDXL, SDv3, and community diffusion models with no retraining.","pith_inferences":["If the value-space disentanglement is as clean as reported, attention-map editing could be reformulated as value projection, offering a unified algebra for concept editing, style transfer, and attribute suppression.","The failure case of \"Van Gogh\" with \"Starry Night\" suggests the single-direction assumption breaks when a target is entangled with another multi-token phrase; a natural extension is to erase along the principal component of the span of all coupled tokens rather than the duplicated last-subject token alone.","The paper leaves the layer-wise accumulation unanalyzed; a testable prediction is that applying the projection only in early or only in late cross-attention layers produces measurably different trade-offs between erasure and prior preservation.","Because the shift factor thresholds on cosine similarity, per-layer or per-timestep epsilon schedules could reduce the small pixel drift that accumulates as the number of erased concepts grows."],"forward_implications":["New concepts can be erased at inference time in tens of seconds, with no per-concept fine-tuning, making real-time moderation of emerging unsafe or copyrighted content practical.","Erasing several concepts together does not degrade into catastrophic forgetting: the paper demonstrates consistent erasure and prior preservation when the target set grows to 40 concepts.","The same value-space projection transfers across model families, including SDXL, SDv3, and community fine-tunes, without changing the erasure procedure.","The operation doubles as an editing primitive: implicit concepts such as rainy or foggy, appearance attributes such as glasses or mustache, and coupled color attributes such as red on apples and roses can be suppressed by the same projection.","NSFW erasure is handled through the same mechanism, with roughly 85% of detected nude items removed on the I2P benchmark while non-target content stays close to the original."],"supporting_citations":[{"why":"Supplies the observation that cross-attention values control visual content, motivating value-space erasure.","marker":"[45]"},{"why":"Supplies the claim that angular (cosine) information carries semantic content, which justifies using cosine similarity in the shift factor.","marker":"[32]"},{"why":"Supports the token-duplication preprocessing: the last subject token \"sees\" the whole prompt and concentrates key information.","marker":"[28]"},{"why":"Describes the latent diffusion UNet and cross-attention layers in which the projection is applied.","marker":"[36]"},{"why":"Provides the evaluation protocol with templates, seeds, and metrics on which the empirical claims are benchmarked.","marker":"[27]"},{"why":"Defines the CLIP score used as the erasure-efficacy metric and the image/text embedding space used throughout.","marker":"[33]"}],"fun_headline_variants":["Erase concepts from diffusion models with one projection","Training-free concept erasure: orthogonal complement does it","2-10x better prior preservation via value-space erasure","Value-space projection erases concepts without retraining"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a target concept is faithfully represented by the value vector of its duplicated last-subject token, and that prompt semantics decompose linearly enough that removing that one direction leaves non-target content intact; the paper's own failure case of \"Van Gogh\" coupled with \"Starry Night\" shows this premise does not always hold.","fun_headline_variants_meta":{"raw":{"variants":["Erase concepts from diffusion models with one projection","Training-free concept erasure: orthogonal complement does it","2-10x better prior preservation via value-space erasure","Value-space projection erases concepts without retraining"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000554,"raw_usage":{"total_tokens":2700,"prompt_tokens":1069,"completion_tokens":1631,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":685,"completion_tokens_details":{"reasoning_tokens":1568}},"tokens_in":685,"tokens_out":1631,"duration_ms":11826,"temperature":1.0,"reasoning_tokens":1568,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T19:58:18.084969+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Regenerate \"a photo of a teddy bear and a Snoopy doll\" with the same seed before and after erasing \"Snoopy\", then compare the teddy-bear region with a detector or pixel distance: if the non-target object's pose or appearance changes noticeably, the projection is removing components beyond the target direction, contradicting the claimed prior preservation.","supporting_citations":[{"cited_title":"Controlling text-to-image diffusion by orthogo- nal finetuning","cited_arxiv_id":null,"evidence_quote":"Supplies the claim that angular (cosine) information carries semantic content, which justifies using cosine similarity in the shift factor."},{"cited_title":"Locating and editing factual associations in gpt","cited_arxiv_id":null,"evidence_quote":"Supports the token-duplication preprocessing: the last subject token \"sees\" the whole prompt and concentrates key information."},{"cited_title":"One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications","cited_arxiv_id":null,"evidence_quote":"Provides the evaluation protocol with templates, seeds, and metrics on which the empirical claims are benchmarked."}],"review_version":1}