{"id":"07a440aa-7017-4637-88c2-9b2ffe1ec24d","arxiv_id":"2509.05625","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SuMa erases narrow concepts from text-to-image models by mapping the concept's token subspace onto a nearby reference subspace, achieving robustness against adversarial attacks with image quality close to standard erasure methods.","lead":"SuMa is a new method that lets developers scrub specific concepts, from a celebrity to a cartoon character, out of an AI image generator without wrecking the quality of other images. It works by redirecting the model's internal representation of the unwanted concept toward a nearby, safer meaning.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SuMa's robustness claim rests on an unverified transfer of the Sec. 3.1 'cosine similarity > 0.6 implies erased' hypothesis to its mapping objective; Table 2's nonzero CCE ASRs are never diagnosed against that threshold or the 3D span.","rationale":"The reader's weakest assumption identified the subspace hypothesis and the 0.6 threshold as the fragile foundation. I agree that this is the most load-bearing assumption, but I sharpen it: the failure mode is not only that the subspace might be incomplete; it is that the Sec. 3.1 threshold and the 3D span size are transferred from a CA/STEREO-style experiment to SuMa's different mapping objective without any diagnostic linking the two. The paper's own Table 2 shows residual CCE attack success rates of 4-17%, which means the claimed invariant 'tokens with similarity > 0.6 are erased' is not perfectly realized. Without measuring the similarity of successful CCE tokens to the target span, the paper cannot distinguish an implementation failure of the mapping from an incompleteness of the 3D subspace. This distinction matters because the first case is fixable by better optimization, while the second undermines the general claim that three TI tokens suffice for any narrow concept. The proposed diagnostic directly settles the question. I do not see this as requiring rejection: the reported numbers are consistent with a working method, and the concern is empirically addressable. The other issues noted by the reader, such as missing statistical uncertainty and reimplementation of STEREO and DUO without code release, are secondary; they affect confidence in the numbers but not the core mechanism. Therefore the verdict remains CONDITIONAL, with the condition being the diagnostic described above and, ideally, public code to make the comparison reproducible.","tokens_in":22123,"tokens_out":6937,"duration_ms":60934,"concrete_test":"For each of the ten target concepts, run the following diagnostic on the final SuMa-erased model. Run CCE with several random token initializations (e.g., 10 seeds plus the default 'toy') and additional TI steps (e.g., 1000 steps). For every recovered adversarial token c_adv, compute s = cos( W_k^T T(p + c_adv), U ) and r = ||(I - P_U) W_k^T T(p + c_adv)||, where U is the constructed 3D target span and P_U is the projection matrix onto U. Then measure the ASR of each token. If any token with ASR > 0.2 has s > 0.6, the mapping objective does not implement the claimed erase-by-similarity invariant. If all successful tokens have s < 0.6, the 3D span is incomplete and the Sec. 3.1 hypothesis fails as transferred to SuMa. Either outcome would require enlarging the subspace (l > 3), re-deriving the threshold for the mapping objective, or revising the robustness claim.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"SuMa's central robustness claim depends on the Sec. 3.1 observation that a narrow concept is captured by a 3D span of Textual Inversion tokens, and that any token whose cosine similarity to that span exceeds 0.6 is erased along with the target. This observation is established with a toy CA experiment on five concepts and with STEREO's pushing-style erasure, not with SuMa's mapping objective in Eqs. (4)-(8). Equation (4) only penalizes the three collected basis vectors; the claim that nearby tokens (similarity > 0.6) are also eliminated is an empirical CA behavior, not a property enforced by L_proj. The paper never reports the cosine similarity between the tokens recovered by CCE on the final SuMa model and the constructed target subspace, nor the residual norm after projection. Consequently the nonzero CCE ASRs in Table 2 (0.04-0.17) are unexplained: either (a) CCE found tokens inside the span but the mapping failed to erase them, or (b) CCE found tokens outside the span, meaning the 3D span is incomplete for that concept. If (b) holds, the sufficiency of three TI tokens is concept-dependent, the 0.6 threshold does not transfer to the mapping objective, and the claimed robustness is not guaranteed for other narrow concepts. This is load-bearing because the paper's headline contribution is precisely the claim to be the first method that is both robust and effective for narrow concepts.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces SuMa, a concept-erasure method for narrow concepts (subclasses, celebrities, artistic styles, instances) in text-to-image diffusion models. SuMa first constructs a target subspace from three Textual Inversion (TI) tokens recovered from the concept-erased model, and a reference subspace from an early-step TI token, then fine-tunes the cross-attention weights to project the target subspace onto the reference subspace while regularizing the reference. Experiments across four tasks, two attacks (CCE and UnlearnDiff), and several baselines report attack success rates (ASR) below 0.2 for SuMa with FID/CLIP scores close to non-robust baselines, leading the authors to claim the first method that is both robust and effective for narrow concepts.","tokens_in":22449,"tokens_out":4033,"duration_ms":35538,"significance":"If the claims hold, SuMa would be a meaningful advance: it targets narrow concepts such as copyrighted characters and celebrities, which existing robust methods (e.g., STEREO, DUO) handle poorly, and it proposes a novel subspace-mapping loss that balances completeness and image quality. The experimental scope is broad and includes diagnostic toy experiments that motivate the subspace hypothesis. However, the central robustness claim rests on an empirically motivated hypothesis whose transfer to the mapping loss is not directly validated, and the comparisons would be strengthened by variance estimates and release of code.","major_comments":[{"comment":"The hypothesis that a narrow concept is fully captured by a 3D subspace and that any token with cosine similarity above 0.6 to that subspace is erased is established only in a CA-based toy experiment, not under the proposed mapping objective L_proj. Equation (4) directly penalizes only the collected basis vectors, so the paper's robustness claim relies on an unverified transfer of this empirical observation. The nonzero CCE ASRs in Table 2 (0.05–0.17) are never diagnosed: the paper does not report the cosine similarity between the CCE-recovered tokens and the constructed target subspace, nor the residual norm after projection. This is load-bearing because the headline contribution is robustness against CCE for narrow concepts. I recommend adding diagnostics that measure these quantities for each concept and attack, together with ablations over the subspace size (e.g., 2, 3, 4 tokens) and the similarity threshold (e.g., 0.5, 0.6, 0.7).","section":"Sec. 3.1 and 3.3, Eq. (4)"},{"comment":"All experimental results are reported as single numbers without variance, multiple seeds, or significance tests. Given that the Instance-category FID for SuMa is 22.34 versus 16.93 for MACE, and several ASR values lie close to the 0.2 threshold (e.g., 0.17 for Instance CCE), the stability of the claimed trade-off is unclear. Moreover, STEREO and DUO are reimplemented rather than run from official code; a mismatch in hyperparameters could bias the comparison. The authors should report mean and standard deviation over at least three seeds, and ideally make the code and trained models available for verification.","section":"Table 2 and Sec. 4.1"},{"comment":"The Instance category exhibits a notable image-quality drop: FID 22.34 (vs. ~17 for MACE) and CLIP 0.29 (vs. 0.31 for MACE), while the ASR is 0.17/0.15, close to the 0.2 threshold. The paper attributes this to using 750 fine-tuning steps, but this is not investigated. The claim that SuMa achieves image quality 'comparable to approaches focused on effectiveness' is overstated for this category. The authors should ablate the number of fine-tuning steps and clarify whether the quality drop is inherent to the method or an artifact of the chosen training duration.","section":"Sec. 4.2, Table 2 (Instance row)"}],"minor_comments":[{"comment":"There is a punctuation error: 'concept.,' should be 'concept'.","section":"Abstract"},{"comment":"'respestively' should be 'respectively'.","section":"Sec. 3.3"},{"comment":"'Regulization' should be 'Regularization'.","section":"Table 4 caption"},{"comment":"'Euclid distance' should be 'Euclidean distance'.","section":"Sec. 3.2"},{"comment":"Please specify how the 'different set of images' for the CCE attack is chosen and its size, to ensure that the evaluation does not overlap with the subspace-construction images.","section":"Sec. 4.1, CCE evaluation"},{"comment":"The paper cites [3] for the regularization term but presents L_reg as a new formula; please clarify what is taken from [3] and what is novel.","section":"Eq. (5) and reference [3]"},{"comment":"The table shows that applying L_sub alone yields ASR above 50% for Identity and Artistic Style, indicating a heavy reliance on the CA loss. This sensitivity deserves a more detailed explanation in the main text, as it affects the interpretation of the method's robustness.","section":"Appendix D, Table 7"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of a computer vision or machine learning journal and addresses a timely problem. The main concern is that the robustness claim is not fully supported without diagnostic experiments linking the subspace hypothesis to the mapping objective, and the experimental comparisons lack variance and code release. The novelty of the subspace-mapping idea is sufficient to warrant revision rather than rejection, but the authors should be asked to substantiate the central claim and provide reproducibility artifacts."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe genuinely new thing here is SuMa's subspace mapping: instead of pushing a concept's representation away, it collects three Textual Inversion tokens found on the iteratively erased model, treats their span as the concept, and fine-tunes the cross-attention weights to project that span onto a nearby reference subspace from an early TI step. That is a real conceptual departure from CA/ESD losses, from RACE's iterative token erasure, and from DUO's DPO-style editing, and it targets narrow concepts like Grumpy Cat or Elon Musk that DUO cannot handle. The experimental sweep is broad—four concept types, two attacks, six baselines—and the headline numbers support the main claim: CCE and UnlearnDiff ASR below 0.2 in every category, with FID in subclass, identity, and artistic categories close to CA and far better than STEREO. The instance category is the exception: FID 22.34 versus MACE's 16.93 is a 5.4-point gap that undercuts the abstract's blanket 'comparable image quality' claim.\n\nThe soft spots are real but addressable. The 0.6 cosine threshold and the three-token span come from a toy CA experiment and are then used to build the defense. The paper never checks whether the tokens CCE actually recovers on the final SuMa model lie inside or outside the target span, or what the projection residual is. So the nonzero ASRs (up to 0.19 for Mickey Mouse) are unexplained: either CCE found a token inside the span that the mapping failed to erase, or it found one outside, implying the span is incomplete. That diagnostic is cheap and would settle the question. Second, there is no variance or multiple seeds anywhere; for ASR values hovering at 0.15–0.19, that matters. Third, STEREO and DUO were reimplemented rather than run from official code, so a code release or a side-by-side verification is needed. Finally, both the subspace construction and the CCE attack use Textual Inversion on the erased model; the evaluation shares the same token-search family the defense was built around, which deserves an explicit sentence.\n\nNone of this sinks the paper. The core idea is new, the experiments are well-designed, and the limitations are honestly stated. I would send this to a serious referee and ask for the subspace diagnostic, variance reporting, and code release. It is not desk-reject material.","headline":"SuMa's subspace-mapping idea is genuinely new and the results are good enough to deserve a serious referee, but the robustness claim needs a diagnostic and variance reporting.","tokens_in":22982,"tokens_out":5456,"would_cite":true,"duration_ms":45992,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Erasing a narrow concept from a diffusion model works best by mapping its learned token subspace onto a nearby general subspace, which keeps adversarial token-recovery attacks below 20 percent while holding image quality close to original.","keywords":["concept erasure","text-to-image diffusion","Textual Inversion","adversarial robustness","CCE attack","subspace mapping","model unlearning","narrow concepts"],"falsifier":"Run CCE on the SuMa-erased model for several concepts, collect the returned adversarial token, and compute its cosine similarity to the target subspace span; if an attack token with similarity below 0.6 still regenerates the concept with attack success above 0.2, the subspace hypothesis is refuted. Alternatively, rebuild the target subspace with a fourth TI token; if CCE attack success changes materially, the three-token span is not the full story.","tokens_in":21901,"feed_emoji":"🎨","tokens_out":8166,"duration_ms":61582,"temperature":0.7,"pith_summary":"The paper tries to establish that narrow concepts—a specific celebrity, a copyrighted character like Grumpy Cat, or a painter's style—can be erased from a text-to-image diffusion model in a way that is both resistant to adversarial token-recovery attacks and gentle on image quality. It argues that the right object to erase is not one token but the low-dimensional subspace spanned by several Textual Inversion tokens, and that this subspace should be mapped onto a nearby reference subspace rather than pushed away. If correct, this closes the gap between methods that erase completely but wreck image quality and methods that keep quality but stay vulnerable to attacks.","feed_headline":"Subspace mapping erases narrow concepts and blocks bypass attacks","feed_subtitle":"SuMa maps erased-concept tokens onto a nearby general subspace, keeping CCE success under 0.2 with near-original FID.","key_machinery":"The load-bearing mechanism is a two-stage subspace construction and elimination. In the first stage, Concept Ablation is applied repeatedly to the model; after each round, Textual Inversion finds a token for the target concept, and the first three tokens form the target subspace $U_i$ (with tokens from early TI training steps forming the reference subspace $V_i$). In the second stage, the to-k and to-v weight matrices of all cross-attention layers are fine-tuned with loss $L_{\\text{sub}} = L_{\\text{proj}} + \\lambda_{\\text{reg}} L_{\\text{reg}}$, where $L_{\\text{proj}}$ is the squared distance between each target basis vector and its projection onto $V_i$, and $L_{\\text{reg}}$ keeps the reference subspace fixed. This is combined with a Concept Ablation loss so the noise prediction is also redirected. The 0.6 cosine-similarity threshold between a token and the target subspace is treated as sufficient for that token to be erased.","core_discovery":"SuMa's central claim is that a narrow concept is fully represented by a three-dimensional span of Textual Inversion tokens in the cross-attention transformed embedding space of a concept-erased model, and that projecting this target subspace onto a reference subspace built from early Textual Inversion steps erases the concept while keeping generation quality near its original level. The paper reports attack success rates below 0.2 for both CCE and UnlearnDiff across subclass, identity, artistic style, and instance categories, with FID close to effective-erasure baselines, and a larger quality gap in the instance category.","pith_inferences":["The 0.6 cosine threshold, if it holds across concepts, gives a testable clustering rule: any token within that similarity of the target span is erased, which could be used to audit erasure coverage before deployment.","The three-token span is an empirical choice; varying the subspace dimension and measuring CCE success would reveal whether the span is truly complete or just sufficient for the tested concepts.","Because the method inherits Textual Inversion's sensitivity, it likely degrades for concepts where early TI steps already converge to the target, as the paper itself notes for NSFW content; this makes reference-subspace selection the bottleneck.","Treating a concept as a linear subspace of cross-attention embeddings is a useful abstraction beyond erasure, e.g., for concept localization or targeted editing, though the paper does not explore those directions."],"forward_implications":["If SuMa's subspace hypothesis holds, any narrow concept for which Textual Inversion can find tokens fits the same two-stage recipe, not just the four categories tested.","Because the final objective combines subspace projection with a base erasure loss, SuMa inherits and improves the base method: it fixes CA's vulnerability to CCE and even helps with concepts CA alone fails on, like Golf Ball and Mickey Mouse.","SuMa is designed to work alongside image-space editing approaches: erasing narrow concepts first and then applying DUO to NSFW content yields attack success and FID close to applying DUO alone.","The evaluation's 0.2 attack-success threshold gives a concrete operational definition of what 'erased' means against current adversarial token search.","The appendices show the mapping variant preserves image quality much better than a pushing variant with similar attack resistance, favoring directional mapping over repulsion in future erasure methods."],"supporting_citations":[{"why":"Textual Inversion supplies the token-view of a concept from which both target and reference subspaces are built.","marker":"[6]"},{"why":"Concept Ablation is the base erasure method and the source of the CA loss used in the final objective.","marker":"[16]"},{"why":"CCE is the adversarial attack whose success rate is the paper's completeness metric.","marker":"[22]"},{"why":"STEREO is the iterative TI-erasure procedure SuMa adapts for subspace construction, and the main robustness baseline.","marker":"[33]"},{"why":"UnlearnDiff is the second attack method used to evaluate robustness.","marker":"[39]"},{"why":"DUO is the robust-erasure method SuMa complements, which fails on narrow concepts.","marker":"[21]"},{"why":"RACE is a baseline robust against UnlearnDiff but vulnerable to CCE, used for comparison.","marker":"[15]"},{"why":"MACE is a multi-concept erasure baseline for effectiveness comparison.","marker":"[18]"}],"fun_headline_variants":["Subspace mapping erases narrow concepts, blocks bypass attacks","Mapping concept subspaces erases fine-grained concepts robustly","Subspace mapping removes narrow concepts with near-original image quality","Robust erasure of narrow concepts via subspace mapping","Erase narrow concepts and block bypasses with subspace mapping"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper rests on the empirical subspace hypothesis of Section 3.1: a narrow concept is fully captured by the three-dimensional span of a few Textual Inversion tokens, and any token with cosine similarity above 0.6 to that span is erased along with it; this threshold and dimension come from a toy Concept Ablation experiment rather than a derivation, and an incomplete span would leave a bypass token for attacks like CCE.","fun_headline_variants_meta":{"raw":{"variants":["Subspace mapping erases narrow concepts, blocks bypass attacks","Mapping concept subspaces erases fine-grained concepts robustly","Subspace mapping removes narrow concepts with near-original image quality","Robust erasure of narrow concepts via subspace mapping","Erase narrow concepts and block bypasses with subspace mapping"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000406,"raw_usage":{"total_tokens":2098,"prompt_tokens":923,"completion_tokens":1175,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":539,"completion_tokens_details":{"reasoning_tokens":1094}},"tokens_in":539,"tokens_out":1175,"duration_ms":8233,"temperature":1.0,"reasoning_tokens":1094,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:21:28.965038+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run CCE on the SuMa-erased model for several concepts, collect the returned adversarial token, and compute its cosine similarity to the target subspace span; if an attack token with similarity below 0.6 still regenerates the concept with attack success above 0.2, the subspace hypothesis is refuted. Alternatively, rebuild the target subspace with a fourth TI token; if CCE attack success changes materially, the three-token span is not the full story.","supporting_citations":[{"cited_title":"Ablating con- cepts in text-to-image diffusion models","cited_arxiv_id":null,"evidence_quote":"Concept Ablation is the base erasure method and the source of the CA loss used in the final objective."},{"cited_title":"Circumventing concept erasure meth- ods for text-to-image generative models","cited_arxiv_id":null,"evidence_quote":"CCE is the adversarial attack whose success rate is the paper's completeness metric."},{"cited_title":"Stereo: A two- stage framework for adversarially robust concept erasing from text-to-image diffusion models","cited_arxiv_id":null,"evidence_quote":"STEREO is the iterative TI-erasure procedure SuMa adapts for subspace construction, and the main robustness baseline."},{"cited_title":"naked” concept to a “dressed in","cited_arxiv_id":null,"evidence_quote":"UnlearnDiff is the second attack method used to evaluate robustness."},{"cited_title":"Direct unlearning optimization for robust and safe text- to-image models","cited_arxiv_id":null,"evidence_quote":"DUO is the robust-erasure method SuMa complements, which fails on narrow concepts."},{"cited_title":"Mace: Mass concept erasure in diffu- sion models","cited_arxiv_id":null,"evidence_quote":"MACE is a multi-concept erasure baseline for effectiveness comparison."}],"review_version":2}