{"id":"f093167e-9a1d-4c5e-8385-817f3c4f183a","arxiv_id":"2501.01633","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"ACE trains a LoRA adapter on both conditional and unconditional noise predictions so that erased concepts are suppressed during both generation and text-guided editing.","lead":"This paper proposes a concept erasure method for text-to-image models that also blocks erased concepts during image editing, not just generation. The authors add erasure guidance to the unconditional noise prediction so classifier-free guidance suppresses the target concept even when the edit prompt does not name it.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central derivation assumes the tuned conditional prediction for the editing prompt is unchanged; if LoRA drifts the conditional branch, the claimed unconditional mechanism is not what filters edits.","rationale":"The reader's weakest assumption is about z_t distribution shift during editing. I agree that is a real risk, but the more immediate gap is in the paper's own derivation: Eq. A.3 assumes the tuned conditional prediction for the editing prompt is identical to the original, and this is neither enforced by any loss nor measured in the experiments. Without this, the editing-filtration numbers could come from conditional drift rather than from the proposed UEG mechanism. The paper has independent support: the ablation in Table 1 shows adding L_Unc improves editing CLIPe from 0.301 to 0.285, and the mechanism is not circular because it is an empirically tuned training recipe. However, the formal appendix is the only justification for the claim that filtration holds regardless of edit text, and it contains this hidden substitution; the sign and notation errors noted by the reader make the appendix harder to trust but are secondary. A frozen-conditional experiment would settle the mechanism. Because the claim may still be true and the current verdict is already conditional, I do not move the verdict.","tokens_in":20608,"tokens_out":11735,"duration_ms":122399,"concrete_test":"Build a frozen-conditional variant of ACE: at inference, replace epsilon_theta(z_t,c_edit,t) in the CFG computation with epsilon_theta*(z_t,c_edit,t) from the original SD1.4, while keeping the trained unconditional branch. Re-run the LEDITS++ editing filtration protocol (10 characters, 11 edit prompts, 15 images each) and compare CLIPe/LPIPSe to Table 2(b). If the filtration effect (CLIPe around 0.274) disappears, the reported anti-editing behavior is not explained by unconditional guidance and the central claim as formalized in Eq. A.6 is false. If it persists, the unconditional mechanism is validated and the conditional-drift assumption is harmless for these prompts.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The formal argument for the central claim contains a silent substitution that has not been tested. In Suppl. Eq. A.2, the CFG prediction after UEG alignment is written as epsilon_theta*(z_t,t) + eta_u(1-omega)(epsilon_theta*(z_t,c,t)-epsilon_theta*(z_t,t)) + omega(epsilon_theta(z_t,c_input,t)-epsilon_theta*(z_t,t)). The next line, Eq. A.3, rewrites the last term as omega * grad log p(c_input|z_t) using Eq. 2, which is legitimate only if epsilon_theta(z_t,c_input,t) is indistinguishable from epsilon_theta*(z_t,c_input,t). ACE does not train toward this condition: L_Cons anchors only a small fixed set of semantically related concepts (Tables B-D), and the 11 editing prompts used in Table 2(b) are not in that set. LoRA updates that change the unconditional branch necessarily also change conditional outputs through shared weights, so delta(z_t,c_edit) = epsilon_theta(z_t,c_edit,t) - epsilon_theta*(z_t,c_edit,t) is generally nonzero. The final noise prediction contains an extra omega*delta; whether it reinforces or cancels the intended UEG suppression depends on the projection of delta onto epsilon_theta*(z_t,c,t)-epsilon_theta*(z_t,t). Because Table 2(b) reports only aggregate CLIP/LPIPS and no measurement of delta, the headline result that editing filtration is caused by unconditional erasure guidance is not established. The reader's transfer concern about z_t from editing pipelines is real, but even with perfectly matched latents this conditional-drift assumption must hold for Eq. A.6 to follow.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ACE, a fine-tuning method for erasing concepts from text-to-image diffusion models so that the erased concept is also suppressed during text-guided image editing. The method augments the conditional erasure guidance of ESD with an unconditional erasure guidance term, a prior-consistency loss, and a prior-guided correction term, all trained with LoRA on Stable Diffusion v1.4. The paper reports experiments on IP characters, nudity, and artistic styles, with both generation and editing evaluations, and claims superior editing filtration compared to ESD, SPM, AdvUnlearn, MACE, and RECE.","tokens_in":1755,"tokens_out":1749,"duration_ms":74197,"significance":"The editing-filtration problem is a timely and practical gap in concept erasure: existing methods guard generation from text prompts but are circumventable by editing pipelines whose input text does not name the erased concept. If the claimed effect holds, ACE would be a meaningful advance with direct safety applications. The empirical scope is a strength: ten IP characters, two editing methods (LEDITS++ and MasaCtrl), SD-inpainting for explicit content, and three adversarial attack pipelines are evaluated, and the ablation in Table 1 supports the usefulness of the unconditional erasure guidance. The paper also promises code release, which would aid reproducibility. However, as detailed below, the formal appendix that is supposed to explain the editing-filtration mechanism contains a load-bearing gap and an internal inconsistency, so the central mechanistic claim is not yet established.","major_comments":[{"comment":"The derivation of editing filtration silently assumes that the tuned conditional noise prediction for the editing prompt equals the original model's conditional noise prediction. In Eq. A.3, the term ω(ϵθ(z_t, c_input, t) − ϵθ⋆(z_t, t)) is replaced by ω∇z_t log p(c_input|z_t) via Eq. (2) of the main text, which is legitimate only if ϵθ(z_t, c_input, t) ≈ ϵθ⋆(z_t, c_input, t). The consistency loss L_Cons (Eq. 8) is applied only to the 30 prior concepts in Tables B–D; the 11 editing prompts used in Table 2(b) are not in that set. Because LoRA updates shared weights, δ(z_t, c_edit) = ϵθ(z_t, c_edit, t) − ϵθ⋆(z_t, c_edit, t) is generally nonzero, and the final CFG prediction contains an extra ωδ term whose projection onto the intended erasure direction is neither analyzed nor measured. Table 2(b) reports only aggregate CLIP/LPIPS scores, which cannot isolate this effect. The paper therefore does not establish that editing filtration is caused by the unconditional erasure guidance; it could be partially or wholly due to conditional drift in the LoRA branch. I recommend an additional diagnostic, such as measuring the magnitude of δ or the cosine similarity between δ and the intended UEG direction on the editing prompts.","section":"Supplementary Sec. A, Eqs. A.1–A.3"},{"comment":"There is an internal inconsistency in the formal proof: Eq. A.3 writes the target-concept term as η_u(1−ω)∇z_t log p(c|z_t) and the input-term as ω∇z_t log p(c_input|z_t), but Eq. A.5 swaps the two, giving η_u(1−ω)∇z_t log p(c_input|z_t) + ω∇z_t log p(c|z_t). This is not a cosmetic typo, because Eq. A.6 derives the positive constant C4 on the target-gradient term from this expression. While the conclusion that the target gradient appears with a positive coefficient still holds after the swap, the derivation as written is internally inconsistent and must be corrected. The corrected proof should also clarify which probability distribution each gradient is taken with respect to, in light of the conditional-drift issue above.","section":"Supplementary Sec. A, Eqs. A.3 and A.5"},{"comment":"The formal argument assumes that the latents z_t encountered at edit time are close to the DDIM latents of the original SD 1.4 model conditioned on the target concept, as generated in Algorithm 1. However, the editing evaluations use LEDITS++, MasaCtrl, and SD-inpainting, which employ their own inversion schemes, attention replacement, and noising schedules. The paper does not analyze whether the z_t trajectories of these pipelines remain in the regime where Eq. A.6 holds. An experiment that measures the target-concept score along actual edit-time latents would substantiate the transfer; without it, the generalization from the training-time derivation to the editing pipelines is an unverified assumption. This transfer assumption is load-bearing because the central contribution is precisely the editing-filtration effect.","section":"Sec. 3.2 and Suppl. Sec. A, with Sec. 4.1 and Suppl. C.2–C.3"}],"minor_comments":[{"comment":"The list of ten IP characters contains 'Elsa' twice, while the intended set of ten distinct characters is used in the evaluation; the duplicated name should be removed or replaced.","section":"Sec. 4.1"},{"comment":"The text reads 'conducted on the Sable Diffusion v1.4'; this should be 'Stable Diffusion v1.4'.","section":"Sec. 4"},{"comment":"The role of the variable θ is ambiguous: line 4 defines θ ← Combine(θ′, θ⋆) and later lines use ϵθ for inference, but the update at the end is only on θ′. The pseudocode should clarify that ϵθ refers to the combined model with LoRA weights θ′ plugged into the frozen original model.","section":"Algorithm 1"},{"comment":"The definition γ_p = CLIP(x, c_p)/CLIP(x, c) is underspecified: it should state whether CLIP returns the raw cosine similarity and how the image x is obtained. Without this, the guidance control term is not reproducible.","section":"Eq. (9) and text after it"},{"comment":"The abbreviations 'Unc', 'Cons', and 'Cor' in the ablation table are not defined in the caption; they should be expanded to indicate that they correspond to L_Unc, L_Cons, and the correction term in L_PUnc.","section":"Table 1 caption"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a practically important gap, and the empirical evidence is broad. The main concern is that the formal appendix's derivation of the editing-filtration mechanism contains a silent conditional-drift assumption and an internal inconsistency; these are fixable but require either a corrected proof or additional measurements that directly probe the mechanism. If the authors can provide those, the paper would be a solid contribution to the concept-erasure literature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper fills a real gap in the concept-erasure literature: existing methods only suppress a concept on the conditional noise branch, so an edit like \"add sunglasses\" on a Pikachu image sneaks the erased character back in. ACE adds a loss that aligns the unconditional noise prediction with an erasure guidance, plus a prior-correction term to limit collateral damage. The empirical package is solid: ten IP characters, two editing methods (LEDITS++ and MasaCtrl), inpainting for nudity, and adversarial prompts, with ablations showing each new loss component does something. The editing-filtration numbers are clearly better than the five baselines.\n\nThe soft spots are mostly in the theory. The appendix derivation (Eqs. A.2–A.6) relies on the tuned conditional prediction for the editing prompt being unchanged from the pretrained model. With LoRA, the unconditional branch and conditional branch share weights, so that assumption won't generally hold; the residual term ω·δ is dropped without comment. On top of that, the sign on the c_input gradient flips between A.3 and A.6, and the notation is inconsistent. The conclusion that UEG provably suppresses the target concept under arbitrary edits is not established. The empirical ablation does show that adding the unconditional loss improves filtration, so the mechanism has evidential support even if the derivation is wrong—but the paper's formal claim goes beyond what the math licenses.\n\nAlso: no code or commit hash (despite the promise), no error bars on any of the tables, and several hyperparameters (η_p, λ's, γ_p) are tuned per task without much sensitivity analysis. Those aren't fatal but they limit how much one can trust the reported magnitudes.\n\nI don't think the central mechanism is circular: the editing-filtration effect is not a fitted prediction, and the ablation is informative. The paper deserves a serious referee. I'd recommend accepting it for review with the expectation of major revision: correct or soften the derivation, release the code, and add variance-aware reporting. The editing-filtration evaluation protocol itself is a useful contribution to the unlearning subfield, independent of the theory.","headline":"A useful empirical recipe for editing filtration, with a derivation that doesn't hold up; deserves refereeing but not acceptance as-is.","tokens_in":21530,"tokens_out":5833,"would_cite":true,"duration_ms":49911,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Erasing a concept from a text-to-image model also has to erase it from the unconditional noise path, or image editing will quietly bring it back.","keywords":["concept erasure","text-to-image diffusion","image editing filtration","classifier-free guidance","unlearning","copyright protection","adversarial robustness","LoRA fine-tuning"],"falsifier":"Take a model fine-tuned with ACE to erase Pikachu, edit an actual Pikachu photo with LEDITS++ using the prompt 'add sunglasses', and measure CLIP similarity between the output and 'Pikachu'; if the erased-concept CLIP score stays near the unerased baseline across many edits, the unconditional alignment is not transferring to edit-time latents.","tokens_in":20366,"feed_emoji":"🚫","tokens_out":8145,"duration_ms":66697,"temperature":0.7,"pith_summary":"The paper targets a loophole in concept erasure: a model that refuses to generate 'Pikachu' will still happily edit an existing Pikachu image when the edit prompt never names Pikachu. The proposed method, ACE, closes that loophole by erasing the concept from both branches of classifier-free guidance—the conditional noise prediction and the unconditional noise prediction—rather than only the conditional one as prior methods do. Because every CFG-based generation and editing pipeline uses the unconditional prediction, aligning it against the target concept makes the erased concept unfindable regardless of the input text. The paper shows this on IP characters, explicit content, and artistic styles, measuring both generation prevention and editing filtration across LEDITS++, MasaCtrl, and SD-inpainting.","feed_headline":"Erasure fails against edits unless unconditional noise is also steered","feed_subtitle":"ACE steers both conditional and unconditional noise, so erased concepts stay absent even when edits don't name them.","key_machinery":"The central object is the unconditional erasure guidance (UEG), defined as $\\tilde{\\epsilon}_u = \\epsilon_{\\theta^*}(z_t,t) + \\eta_u(\\epsilon_{\\theta^*}(z_t,c,t) - \\epsilon_{\\theta^*}(z_t,t))$. ACE fine-tunes the unconditional noise prediction $\\epsilon_\\theta(z_t,t)$ to match this guidance, using the prior-guided variant PG-UEG that subtracts $\\eta_p\\gamma_p(\\epsilon_{\\theta^*}(z_t,c_p,t) - \\epsilon_{\\theta^*}(z_t,t))$, while also aligning the conditional prediction to ESD-style conditional erasure guidance. This is load-bearing because CFG computes $\\tilde{\\epsilon} = \\epsilon_\\theta(z_t,t) + \\omega(\\epsilon_\\theta(z_t,c_{\\text{input}},t) - \\epsilon_\\theta(z_t,t))$, so erasing from $\\epsilon_\\theta(z_t,t)$ changes every CFG-based trajectory, not just prompts that name the concept.","core_discovery":"On the paper's own terms, ACE claims that injecting erasure guidance into both the conditional and unconditional noise predictions enables a fine-tuned model to prevent the creation of an erased concept during both generation and editing. The unconditional erasure guidance is defined as $\\tilde{\\epsilon}_u = \\epsilon_{\\theta^*}(z_t,t) + \\eta_u(\\epsilon_{\\theta^*}(z_t,c,t) - \\epsilon_{\\theta^*}(z_t,t))$, and the training aligns the tuned model's unconditional prediction to it, so the CFG update implicitly carries a negative gradient of the target concept's log-probability even when the edit text never mentions the concept. A prior-guided correction term subtracts randomly sampled prior-concept guidance, and a consistency loss regularizes the prior predictions, preserving non-target concepts. The supplement formalizes the result: after alignment, the denoising step contains a term $-C_4 \\nabla_{z_t} \\log p(c|z_t)$ with $C_4>0$, so the target probability decreases whatever the edit prompt.","pith_inferences":["Because UEG changes the shared unconditional branch, the defense should transfer to any editing method that relies on CFG with the fine-tuned model, even ones not tested in the paper such as Prompt-to-Prompt or Null-text inversion.","The suppression strength likely depends on the edit-time CFG scale $\\omega$; the paper's derivation assumes $\\omega>1$, so edits run at very low guidance may weaken filtration, which suggests a testable scaling law.","ACE could be stacked with adversarial training rather than treated as an alternative; the paper's robustness results come without adversarial training, leaving headroom.","The prior-correction term uses CLIP relevance $\\gamma_p$, so preservation behavior may be sensitive to concept similarity; a stress test would erase a concept very close to many priors."],"forward_implications":["Existing erasure methods that only touch the conditional branch (ESD, SPM, MACE, RECE) can be bypassed by editing; ACE's unconditional alignment is what closes that bypass.","Editing filtration holds across distinct edit pipelines—LEDITS++, MasaCtrl, and SD-inpainting—so it is not an artifact of one attention-control mechanism.","The erased concept stays suppressed under adversarial text: ACE reports an average attack success rate of 19.61% across UnlearnDiff, P4D, and Ring-A-Bell without adversarial training.","Prior preservation is maintained: erasing one IP character or style leaves other characters and styles generatable, and edits to non-target concepts still succeed.","The same training recipe transfers across concept types—copyrighted characters, nudity, and artist styles—with the same loss structure and per-task hyperparameters."],"supporting_citations":[{"why":"Defines the conditional erasure guidance and ESD loss that ACE extends with unconditional alignment.","marker":"[14]"},{"why":"Supplies the classifier-free guidance composition of conditional and unconditional noise that ACE modifies.","marker":"[21]"},{"why":"Provides the LEDITS++ editing pipeline used as the primary testbed for editing filtration.","marker":"[4]"},{"why":"Provides the MasaCtrl editing pipeline used to show the defense transfers across edit methods.","marker":"[6]"},{"why":"Stable Diffusion 1.4 is the base model whose conditional and unconditional noise paths ACE fine-tunes.","marker":"[46]"}],"fun_headline_variants":["Erasure works in edits too when both noise paths are steered","ACE erases concepts from generation and editing by steering both noise terms","Both noise predictions must be steered to block erased concepts during edits","Anti-editing erasure via dual noise steering","Erased concepts stay absent from edits with dual guidance"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The latents produced by real editing pipelines (LEDITS++, MasaCtrl, SD-inpainting) are close enough to the DDIM latents of target-concept images used in training that aligning the unconditional prediction on those training latents still suppresses the concept at edit time.","fun_headline_variants_meta":{"raw":{"variants":["Erasure works in edits too when both noise paths are steered","ACE erases concepts from generation and editing by steering both noise terms","Both noise predictions must be steered to block erased concepts during edits","Anti-editing erasure via dual noise steering","Erased concepts stay absent from edits with dual guidance"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000606,"raw_usage":{"total_tokens":2840,"prompt_tokens":974,"completion_tokens":1866,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":590,"completion_tokens_details":{"reasoning_tokens":1781}},"tokens_in":590,"tokens_out":1866,"duration_ms":11999,"temperature":1.0,"reasoning_tokens":1781,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:23:58.631988+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a model fine-tuned with ACE to erase Pikachu, edit an actual Pikachu photo with LEDITS++ using the prompt 'add sunglasses', and measure CLIP similarity between the output and 'Pikachu'; if the erased-concept CLIP score stays near the unerased baseline across many edits, the unconditional alignment is not transferring to edit-time latents.","supporting_citations":[{"cited_title":"Erasing concepts from diffusion models","cited_arxiv_id":null,"evidence_quote":"Defines the conditional erasure guidance and ESD loss that ACE extends with unconditional alignment."},{"cited_title":"Ledits++: Limitless image editing using text-to-image models","cited_arxiv_id":null,"evidence_quote":"Provides the LEDITS++ editing pipeline used as the primary testbed for editing filtration."},{"cited_title":"Masactrl: Tuning-free mu- tual self-attention control for consistent image synthesis and editing","cited_arxiv_id":null,"evidence_quote":"Provides the MasaCtrl editing pipeline used to show the defense transfers across edit methods."},{"cited_title":"High-resolution image synthesis with latent diffusion models","cited_arxiv_id":null,"evidence_quote":"Stable Diffusion 1.4 is the base model whose conditional and unconditional noise paths ACE fine-tunes."}],"review_version":1}