{"id":"20808af3-758f-4fb7-a94b-b3d9ac69636d","arxiv_id":"2505.11131","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Co-Erasing uses self-generated images as visual templates, alongside text, to erase concepts from diffusion models while better preserving general usability.","lead":"This paper introduces Co-Erasing, a method that erases unwanted concepts from text-to-image diffusion models by training on the model's own generated images as well as the usual text prompts. It reports much stronger erasure than text-only baselines with nearly the same generation quality, relevant to content safety in AI image generation.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Training templates are filtered by the same NudeNet classifier used for the headline ASR metric, and Table 4 compares filtered generated images against unfiltered real images; this confound, rather than visual erasure, may explain part of the claimed advantage.","rationale":"The reader's weakest assumption (coverage of self-generated images) is real and is explicitly acknowledged in Appendix C.7. I am raising a different, more actionable concern: the image-set construction is coupled to the evaluation detector, so the headline comparison and the real-vs-generated experiment are partially confounded. This is not an accusation of bad faith; it is an uncontrolled variable that the available text does not rule out. The paper has genuine strengths: extensive ablations, transfer to MACE and SLD, and a code release. Those supports do not eliminate the confound, because all the safety metrics for nudity use the same NudeNet family used to filter templates. If the proposed check shows the advantage persists under independent detection and matched filtering, the paper would be close to an ACCEPT. Until then, CONDITIONAL (the reader's verdict) is the right level, so I leave the verdict unchanged. My agreement with the reader is partial: both concerns center on the construction of the template set, but the reader emphasizes coverage while I emphasize classifier-aligned selection and the confounded Table 4 comparison.","tokens_in":25021,"tokens_out":9825,"duration_ms":99192,"concrete_test":"Re-run the nudity erasure with four template conditions, holding all other training settings fixed: (a) self-generated, NudeNet-filtered as in the paper; (b) self-generated, unfiltered; (c) real NSFW, NudeNet-filtered; (d) real NSFW, unfiltered, with template counts matched across conditions. In addition to the paper's NudeNet ASR, evaluate with an independent NSFW classifier not used during filtering (e.g., a second off-the-shelf detector or human labels). If condition (a) beats (b) and (c) only on the NudeNet metric and the advantage vanishes under the independent classifier, the reported efficacy partly reflects detector gaming; if (a) also wins under the independent classifier and (c) matches (a), the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that visual templates from self-generated images improve the efficacy/usability trade-off beyond text-only erasure. For that claim to hold, the measured efficacy should reflect erasure of the visual concept, not merely alignment between template selection and the evaluation detector. Appendix A.4 says: 'We discard low-quality images according to the classification scores provided by a classifier, which is just required by the attacking methods.' Appendix A.5 says nudity evaluation loads NudeNet with threshold 0.75. So the self-generated templates for the flagship nudity experiment are selected to be images NudeNet labels as nudity, and ASR/pre-ASR/P4D/CCE all score outputs with that same detector. The method is therefore partly trained to suppress the detector's positive class rather than the concept itself. This also contaminates Table 4: generated templates are NudeNet-filtered while real NSFW images are not, so the conclusion that self-generated images better represent the model's knowledge could instead be an artifact of detector-aligned filtering. The acknowledged coverage limitation in Appendix C.7 is downstream of the same issue: the template set inherits the blind spots of the filtering detector.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Co-Erasing, a concept-erasing framework for text-to-image diffusion models that augments text prompts with self-generated images of the target concept. The method uses a decoupled cross-attention image branch (IP-Adapter style), a text-guided refinement module (Eq. 6) to isolate concept-relevant visual features, and an ESD-style negative-guidance update (Eq. 7) to fine-tune the U-Net. The authors evaluate on nudity, style, and object erasure, reporting markedly lower attack success rates (e.g., nudity ASR 16.96% vs ESD's 76.05%) with comparable FID/CLIP, plus transfer to SLD and MACE. The claimed contribution is that visual templates close the text-image gap and jointly improve efficacy and usability.","tokens_in":25146,"tokens_out":5762,"duration_ms":55942,"significance":"If the claims hold, this is a valuable contribution to the concept-erasing literature. It introduces a straightforward way to inject visual supervision into erasure, supported by extensive experiments (three task families, six metrics, nine baselines, ablations on image count and source, and transfer to SLD/MACE). The paper ships code and openly discloses the self-generated-image pattern (Figure 8, Table 4). The main caveats are reproducibility (the fine-tuning objective is not stated) and a potential detector-alignment confound in the nudity experiments; both are fixable with additional experiments and disclosure, so the core idea is not invalidated by these issues.","major_comments":[{"comment":"The fine-tuning objective is never specified. Eq. (7) gives the modified noise target for negative guidance, but the paper does not state the loss function minimized over the U-Net parameters, how the image branch is trained or frozen, or what role the refinement module's parameters play in the optimization. The phrase 'conduct fine-tuning on full parameters' is ambiguous. Without the objective, the method is not reproducible and the ablations in Table 3 cannot be interpreted as attributing improvements to specific components. Please provide the full training loss and update rule.","section":"§4.2.2, Eq. (7), and Appendix A.4"},{"comment":"There is a potential circularity in the nudity experiments: the self-generated training templates are filtered 'according to the classification scores provided by a classifier' (Appendix A.4), while the efficacy metrics (pre-ASR, ASR, P4D, CCE) all score outputs with the same NudeNet detector at threshold 0.75 (Appendix A.5). If the filtering uses NudeNet, the model is trained to suppress the detector's positive class, which may inflate the measured ASR improvement (e.g., 16.96 vs 76.05). The paper must disclose the filtering classifier and threshold, and should evaluate with an independent detector (e.g., a different NSFW classifier or CLIP-based scoring) to rule out detector-aligned overfitting.","section":"Appendix A.4, Appendix A.5, Table 9"},{"comment":"The comparison between real and self-generated images is confounded by the quality filter. The generated templates are filtered by the classifier, while the real NSFW images appear to be used unfiltered. The conclusion that self-generated images 'better represent the model's knowledge' could instead be an artifact of detector-aligned selection. Please repeat the 'Real' condition with the same filtering procedure applied to the real images, or demonstrate that the result is robust to the filter.","section":"Table 4 and Figure 8"},{"comment":"The paper's own stated failure mode—'some features are not unique and strongly associated with corresponding text descriptions, and therefore such visual features are not generated in the reference images and, consequently not fully erased'—is a principled limitation of the approach. Since the visual templates are generated from a fixed prompt template, the erasure is bounded by the coverage of that template and the model's ability to generate the target concept. This limitation should be stated in the main text and the claims about 'complete erasure' or 'concept erasure' should be scoped accordingly. The current presentation is honest but the limitation is consequential for the central claim.","section":"Appendix C.7 and §4.2.3"}],"minor_comments":[{"comment":"There are several presentation artifacts: the word 'dasdsa' appears immediately before 'Contents' in the appendix, Figure 1 contains garbled generated text and an 'Added for publication' annotation, and the caption of Figure 1 describes the example without clearly explaining the artifact. Please clean these up.","section":"Throughout"},{"comment":"The definition 'ASR = pre-ASR + post-ASR' is unclear. Since both are success rates in percent, the sum can exceed 100, and the computation of post-ASR is not described. Please clarify whether these are joint or marginal rates and how the sum is intended to be interpreted.","section":"Appendix A.3"},{"comment":"The checkmark rows in the ablation table are ambiguous; the first row (text only) appears to be the ESD baseline, but the reader must infer this. Please label the baseline explicitly and add a note that 'text' means the ESD text-only update.","section":"Table 3"},{"comment":"The paper states that 9 competitors are included, but the quantitative tables list fewer per task. Please clarify which methods are evaluated on each task and why some are omitted.","section":"§5.1"},{"comment":"The dimensions of the refined image embedding are unclear. The paper states cimage is b×4×768, but Eq. (6) with Qr=E_image(X) (a single image vector) and Kr=Vr=E_text(Y) (a sequence of text embeddings) would produce a sequence of length equal to the text length. Please specify the exact shapes and how the output maps to the 4-token image embedding used in the cross-attention.","section":"Eq. (6)"},{"comment":"The transfer to SLD is described as replacing the text embedding c_s with [c_s, c_i] during inference. Please clarify whether this changes the diffusion process only at inference time and whether any training is involved for the SLD variant, since the main method is presented as fine-tuning-based.","section":"Appendix B.5"}],"recommendation":"major_revision","confidential_remarks":"The detector confound in the nudity experiments is the most serious issue; if the filtering classifier is indeed NudeNet, the headline ASR numbers may be optimistically biased. Given the broad experimental evaluation and the disclosed self-erasing design, the paper is worth revising and re-reviewing after the authors add the missing training objective and an independent-detector evaluation. The novelty claim of being 'first' to combine text and image prompts in erasure should also be checked against existing works that use image-based erasure signals."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing to know: this paper deserves a serious referee, but its headline claim has a confound that needs addressing. The training templates for nudity are filtered by a classifier (Appendix A.4), almost certainly the same NudeNet detector used to compute pre-ASR/ASR/P4D/CCE (Appendix A.5). So part of the reported gain may be suppression of the detector's positive class rather than erasure of the visual concept. Table 4 is especially problematic: generated images are NudeNet-filtered while real NSFW images are not, so the conclusion that self-generated images better represent the model's knowledge may be an artifact of filtering.\n\nThat said, the stress-test overstates if it implies the method is a cheap trick. The idea is genuinely new: using the model's own generated images as visual templates, with a text-guided refinement module to isolate concept-relevant features. The image branch is only used during training; inference stays text-only. The experimental scope is unusually wide - three task families, nine baselines, six metrics, ablations on image count and source, transfer to SLD and MACE, plus portraits and multi-concept erasure. The failure-mode discussion in Appendix C.7 is honest: coverage of the template set bounds erasure.\n\nSoft spots, in proportion. First, the detector alignment is the biggest issue because all four efficacy metrics share the same NudeNet classifier; a re-run with unfiltered self-generated images or an independent detector would substantially strengthen the claim. Second, the fine-tuning objective is never written down; Eq. 7 gives a modified noise target but not the loss being minimized, so the method is not fully reproducible from the paper alone. Third, the number of images is tuned per concept (200 for nudity, 50 for styles), and while Figure 13 shows sensitivity, no variance or seeds are reported, so it is hard to tell how robust the margin is. Fourth, the acknowledged coverage limitation is real and inherent: facets the clean model cannot generate under the chosen template will not be erased.\n\nOverall, the core mechanism - image-conditioned negative guidance with text-guided refinement - is a legitimate new entry to the erasure toolbox, and the ablations support each design choice. The paper is for people working on concept erasure and safety evaluation; they will get value from the benchmark numbers and the transfer results. I would accept it for peer review, with a strong request to deconfound the NudeNet-based evaluation and make the loss explicit.","headline":"A genuinely new text-image collaborative erasing method with extensive experiments, but the flagship gain is partly confounded because the same NudeNet detector filters the training templates and scores the efficacy metrics.","tokens_in":25861,"tokens_out":2407,"would_cite":true,"duration_ms":25503,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Concept erasure fails because erasure is text-only; this paper adds the model's own images of the target concept as visual templates and cuts nudity attack success from 76% to 17% with image quality intact.","keywords":["concept erasing","text-to-image diffusion models","modality gap","negative guidance","self-generated images","text-guided refinement","machine unlearning","diffusion model safety"],"falsifier":"A direct test compares erasure coverage against template coverage: generate the image set from the single literal prompt \"a photo of c\", pick test prompts that evoke facets of c absent from those images (for example, scenes a template never produces, such as a ruined church or a wedding interior), and check whether the erased model still generates those facets; the paper's own failure-case figure predicts it will. The sharper version is distributional: self-generated templates and real images of the concept differ in t-SNE space (the paper's Figure 8), so if the modality-gap story is right, erasure should be measurably worse on prompts that target the regions where the real-image distribution has no synthetic counterpart, and improving template diversity should shrink the residual attack success.","tokens_in":24669,"feed_emoji":"🖼️","tokens_out":14170,"duration_ms":118726,"temperature":0.7,"pith_summary":"Concept erasure from text-to-image diffusion models has relied on text prompts, and this paper claims that the text-image modality gap is what caps both efficacy and usability: benign-sounding words can still trigger unwanted visuals, and longer word lists plateau while degrading other content. The proposed Co-Erasing framework adds a visual branch: the unmodified model first generates images of the target concept under a simple template, a text-guided attention step distills those images down to concept-relevant features, and both text and refined image embeddings drive the same negative-guidance fine-tuning used by earlier erasure methods. Measured on nudity, attack success under adversarial prompts falls from 76.05% to 16.96% while FID moves only from 18.18 to 18.77 and CLIP is unchanged at 0.302, and the image branch transfers to other erasure frameworks such as SLD and MACE. A sympathetic reader would take the central claim to be that erasure should teach the model what the concept looks like, not just what it is called.","feed_headline":"Adding images to concept erasure cuts attack success fourfold","feed_subtitle":"Pairing self-generated images with text slashes nudity attack rate from 76% to 17% while image quality holds.","key_machinery":"The load-bearing object is the dual-branch text-image condition injected through decoupled cross-attention, together with a text-guided refinement that turns a raw generated image into a concept-specific template. In the refinement, the image encoder supplies the query $Q_r = E_{\\text{image}}(X)$ and the text label supplies key and value $K_r = V_r = E_{\\text{text}}(Y)$, so the output embedding keeps only the visual features the text names: $c_{\\text{image}} = \\operatorname{Softmax}(Q_r K_r^\\top/\\sqrt{d_r}) V_r$. At each cross-attention layer the U-Net latent attends separately to the text embedding and the refined image embedding, and the two attention outputs are summed; the resulting condition $c = [c_{\\text{text}}, c_{\\text{image}}]$ enters the ESD-style update $\\varepsilon_{\\theta^*}(z_t, c, t) \\leftarrow \\varepsilon_\\theta(z_t, t) - \\eta[\\varepsilon_\\theta(z_t, c, t) - \\varepsilon_\\theta(z_t, t)]$, which suppresses the model's probability of generating the concept. Because the image branch exists only during training, the erased model at inference is architecturally identical to the original, which is what allows the branch to be grafted onto other erasure frameworks.","core_discovery":"Co-Erasing starts from the ESD-style negative-guidance objective $P_{\\theta^*}(x) \\propto P_\\theta(x)/P_\\theta(c|x)^\\eta$ and replaces the purely textual condition with the pair $c = [c_{\\text{text}}, c_{\\text{image}}]$. The image condition comes from the clean model itself, which generates images of the concept under a template such as \"a photo of nudity\"; a text-guided refinement, $c_{\\text{image}} = \\operatorname{Softmax}(Q_r K_r^\\top/\\sqrt{d_r}) V_r$ with the image encoder as query and the text label as key and value, distills each image down to the features the words name. Text and refined-image embeddings enter the U-Net through separate cross-attention branches whose outputs are summed, and the image branch is dropped at inference. Against the text-only ESD baseline, the reported effect is that adversarial attack success on nudity falls from 76.05% to 16.96% with FID at 18.77 versus 18.18 and CLIP unchanged at 0.302; ablations show unrefined images alone cut attack success to the 27-33% range but push FID above 22, with the refinement module recovering the lost quality. The same visual branch transfers to the SLD and MACE frameworks and to multi-concept erasure, and self-generated templates outperform real NSFW images (ASR 16.96 versus 33.90, FID 18.77 versus 23.89), which the paper takes as evidence that the model's own output best represents its concept knowledge.","pith_inferences":["A testable extension the paper does not run: template diversity should set the erasure ceiling, so generating the 200 images from several paraphrased templates per concept rather than one should shrink the residual failure cases in its Appendix C.7, where facets tied to text descriptions never appear in the reference images.","The refinement module is effectively a text-conditioned visual filter, and the same construction could serve other targeted-removal problems, such as suppressing memorized training images, removing a person's likeness, or erasing a subcategory while keeping the supercategory, whenever a short text label can name the visual content to drop.","Because the templates are drawn from the model's own prior, the method carries a lifecycle implication the paper leaves implicit: if the base model is later fine-tuned, its concept knowledge shifts and the stored templates become stale, so erasure quality may degrade until the templates are regenerated from the updated model.","One could reverse the paper's comparison and use the synthetic-versus-real distribution gap as a diagnostic: prompts whose outputs fall in the real-image regions with no synthetic counterpart are exactly where a Co-Erasing model should still fail, giving a cheap way to build red-team prompts."],"forward_implications":["Under the paper's evaluations, the erased model blocks adversarial and learnable-prompt attacks at a rate no text-only erasure reached: for nudity, ASR 16.96% versus 76.05% for ESD and 11.27% for SalUn, while FID and CLIP stay near the ESD baseline instead of degrading toward SalUn's FID of 53.21.","The image branch needs no external data and no architecture change at inference, and the paper shows it can be appended to other erasure frameworks: SLD's nudity detections on the I2P set drop from 125 to 22, and MACE's multi-concept scores improve or hold.","Erasure stops scaling with word lists: a single template generating 200 images outperforms any tested multi-word descriptor set on both efficacy and usability, which is the direct consequence of replacing text-only concept descriptions with visual ones.","Self-generated templates are load-bearing rather than incidental: swapping them for real NSFW images raises ASR from 16.96% to 33.90% and FID from 18.77 to 23.89, supporting the paper's claim that the model's own generations encode exactly the knowledge that needs suppressing.","The framework extends beyond nudity to styles, objects, portraits, and multi-concept sets, and the refined erasure consistently lands on the better-efficacy side of the trade-off frontier with usability near the unmodified model."],"supporting_citations":[{"why":"ESD, the negative-guidance erasure objective that Co-Erasing extends and the main efficacy/usability baseline.","marker":"Gandikota et al., 2023"},{"why":"IP-Adapter, which supplies the pre-trained projection and decoupled cross-attention that put image embeddings into the text-embedding space.","marker":"Ye et al., 2023"},{"why":"AdvUnlearn, the adversarial-erasure competitor and the source of the pre-ASR/ASR benchmark Co-Erasing adopts.","marker":"Zhang et al., 2024c"},{"why":"Provides the adversarial prompt perturbation (UDA) that defines post-ASR and the style classifier used in the erasure evaluations.","marker":"Zhang et al., 2024d"},{"why":"MACE, the multi-concept erasure framework that Co-Erasing is merged with to demonstrate transfer.","marker":"Lu et al., 2024"},{"why":"SLD, the training-free safety-guidance method whose text condition is replaced by the collaborative text-image condition.","marker":"Schramowski et al., 2023"},{"why":"CLIP, the shared text-image embedding space used by the refinement module and the alignment metric.","marker":"Radford et al., 2021"},{"why":"Ring-A-Bell, the red-team probe that quantifies how much erasure survives concept-relevant prompts.","marker":"Tsai et al., 2023"}],"fun_headline_variants":["Self-generated images with text cut attack success 4.5x","Text plus its own generated images cuts attack success to 17%","Co-Erasing: text-image guidance suppresses attack success to 17%","Image-text pairing lowers concept erase attack to 17%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Erasure is bounded by what the small self-generated image set shows: any facet of the target concept that the clean model never produces under the chosen prompt template will be absent from the visual templates and will not be erased, a failure mode the paper itself reports in its appendix (features tightly tied to text descriptions never appear in the reference images and survive erasure).","fun_headline_variants_meta":{"raw":{"variants":["Self-generated images with text cut attack success 4.5x","Text plus its own generated images cuts attack success to 17%","Co-Erasing: text-image guidance suppresses attack success to 17%","Image-text pairing lowers concept erase attack to 17%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001223,"raw_usage":{"total_tokens":5131,"prompt_tokens":1151,"completion_tokens":3980,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":767,"completion_tokens_details":{"reasoning_tokens":3905}},"tokens_in":767,"tokens_out":3980,"duration_ms":27485,"temperature":1.0,"reasoning_tokens":3905,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:57:12.811865+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct test compares erasure coverage against template coverage: generate the image set from the single literal prompt \"a photo of c\", pick test prompts that evoke facets of c absent from those images (for example, scenes a template never produces, such as a ruined church or a wedding interior), and check whether the erased model still generates those facets; the paper's own failure-case figure predicts it will. The sharper version is distributional: self-generated templates and real images of the concept differ in t-SNE space (the paper's Figure 8), so if the modality-gap story is right, erasure should be measurably worse on prompts that target the regions where the real-image distribution has no synthetic counterpart, and improving template diversity should shrink the residual attack success.","supporting_citations":[{"cited_title":"Erasing concepts from diffusion models","cited_arxiv_id":null,"evidence_quote":"ESD, the negative-guidance erasure objective that Co-Erasing extends and the main efficacy/usability baseline."},{"cited_title":"Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models","cited_arxiv_id":null,"evidence_quote":"SLD, the training-free safety-guidance method whose text condition is replaced by the collaborative text-image condition."}],"review_version":1}