{"id":"c0f041f5-dd5e-4705-a871-76e49a75e805","arxiv_id":"2608.07620","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":11,"one_line_summary":"FlowErase-OPD uses anchored on-policy distillation with adaptive retention control to erase multiple concepts from flow matching text-to-image models in a single LoRA module.","lead":"This paper introduces FlowErase-OPD, a method that erases multiple harmful concepts (nudity, objects, artistic styles) from text-to-image flow matching models at once by distilling several single-concept erased models into one small LoRA module. It adds a retention teacher and an adaptive controller that rebalances erasure and image quality during training, reporting state-of-the-art results on FLUX.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Nudity evaluation may be circular: the FlowErase-RL teachers are rewarded by an NSFW detector and the student is then scored with NudeNet; if these are the same, the headline erasure numbers reflect detector suppression rather than concept removal.","rationale":"The central claim rests on empirical comparisons in Tables 1-5, and the most decisive evidence is nudity erasure plus adversarial robustness. The chain of evidence is: FlowErase-RL teachers are trained with a reward from a pretrained NSFW detection model; FlowErase-OPD's student is distilled to match those teachers; final evaluation counts exposed parts with NudeNet. If the reward detector and NudeNet are the same, the evaluation is in-distribution for the teacher's reward, so low ASR does not establish concept removal. This is a known failure mode for RL-based safety optimization and directly threatens the 'state-of-the-art' and 'robust to adversarial attacks' claims. The paper does not name the reward detector, so the overlap cannot be ruled out from the current text. I therefore keep the reader's CONDITIONAL verdict but emphasize that an independent detector audit should be an explicit condition rather than a sensitivity check. The reader's weakest assumption was the ARC difficulty proxy and threshold calibration; I agree that is a secondary risk, and I also note the missing ASR_k for Ours in Table 3, the FLUX.1-dev inconsistency in the scaling ablation, and the unsupported mention of an 'orthogonal projection mechanism' in the further-analysis section. All of these should be fixed, but the detector circularity is more load-bearing because it challenges the validity of the primary metric.","tokens_in":17313,"tokens_out":10467,"duration_ms":105297,"concrete_test":"Run one independent audit: identify the exact NSFW detector used in FlowErase-RL's reward; if it is NudeNet, the overlap is confirmed. Regardless, re-run the nudity and attack evaluations (I2P, MMA, Ring-16/38/77, P4D, UnlearnDiff) for the released FlowErase-OPD model and all baselines using a detector never touched by teacher training, such as a CLIP-based zero-shot safety classifier, Q16, or a separately trained NudeNet variant with different architecture and thresholds, and add human labels on a stratified subsample. If Ours is no longer consistently at or near the best under this independent audit, the state-of-the-art erasure claim is detector-specific rather than concept-level.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Nudity erasure is the paper's flagship evidence, in Tables 1 and 2 and under adversarial attacks. The evaluation counts exposed body parts with the NudeNet detector, while the FlowErase-RL teachers used to build the student were trained with a reward from a pretrained NSFW detection model (see the FlowErase-RL baseline description in the appendix). The paper never names that reward model or shows that it differs from NudeNet. Since FlowErase-OPD is a distillation of exactly those teachers, a student that imitates the teachers' detector-specific suppression can score well on NudeNet whether or not the semantic concept is actually removed. Table 1's robustness to MMA, Ring-a-bell, P4D, and UnlearnDiff is also measured with the same counting procedure, so it does not break the circularity. The appended Limitation section even concedes that the anchor teacher may expose the framework to adversarial vulnerabilities. If this overlap is real, the central claim of state-of-the-art multi-concept erasure is not established; the numbers could be artifacts of reward hacking against the audit detector.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FlowErase-OPD, a multi-concept erasure method for flow-matching text-to-image models. It distills multiple FlowErase-RL single-concept-erased FLUX models into one LoRA student, using an anchored retention teacher (the frozen original model) to preserve general generation and an Adaptive Retention Control (ARC) mechanism that reweights per-concept sampling shares and loss weights based on an EMA-smoothed erase loss. The paper reports experiments on nudity, object, and artist-style erasure on FLUX.1 Schnell and claims state-of-the-art results, including robustness to adversarial attacks.","tokens_in":17611,"tokens_out":7056,"duration_ms":60541,"significance":"If the evaluation concerns are resolved, the method would be a practical contribution: it is, to my knowledge, the first on-policy distillation framing for multi-concept erasure in flow matching models, it uses only a lightweight LoRA module, and the AMTD/ARC design gives a concrete mechanism for controlling the erasure-retention trade-off. The paper does not release code or trained models, but the experimental protocol is sufficiently detailed to be reproduced in principle. However, the current evidence base is weakened by the unverified relationship between the teacher reward model and the NudeNet auditor, the missing non-target preservation metric in the object-erasure study, and the unvalidated hand-picked ARC hyperparameters, so the central state-of-the-art claim is not yet established.","major_comments":[{"comment":"The nudity evaluation may be circular. The FlowErase-RL teacher for the nudity concept is trained with a reward from a pretrained NSFW detection model (Appendix, 'Additional details of baseline, FlowErase-RL'), while the evaluation in Tables 1 and 2 counts exposed body parts with the NudeNet detector (Appendix, 'Additional details of metrics'). The manuscript never names the reward model or shows that it is different from NudeNet. Because FlowErase-OPD distills exactly these teachers, the low ASR values could reflect detector-specific reward hacking rather than semantic removal of nudity. Please name the reward model, add an evaluation with a different detector (for example, Q16 or a CLIP-based nudity classifier), and report prompt-based or human checks that the concept is actually absent from the generated images.","section":"Experiments; Appendix 'Additional details of baseline' and 'Additional details of metrics'"},{"comment":"The object-erasure evaluation omits the non-target preservation metric for the proposed method. The text says that ASR for non-target concepts is measured, but Table 3 leaves the ASR_k cell blank for Ours, and the following sentence states that non-target values are left out because all target objects are erased at once. Without ASR_k it is impossible to tell whether the low target ASR is achieved by selective erasure or by destroying unrelated object generation. Please report ASR_k for Ours (for example, by generating prompts for each object individually and measuring classifier accuracy on the remaining nine concepts) and include per-concept retention numbers analogous to the detail given in Table 4.","section":"Table 3 and object erasure text"},{"comment":"The claim that ARC enables 'automatic rebalancing ... without per-concept hyperparameter tuning' is contradicted by the implementation details, which set a nudity-specific initial sampling weight of 4.0 and a distillation loss weight of 3.0, as well as hand-picked thresholds ell_lo=0.001, ell_hi=0.004 and bounds rho_min=0.15, rho_max=0.30. Since the adaptive mechanism is only one component, the paper should either soften the claim or provide a sensitivity analysis over these thresholds and initial weights. Without such an analysis, the main advantage of ARC over manual per-concept tuning is not established.","section":"Contribution 2 and 'Details of implementation' in the appendix"},{"comment":"The derivation of the OPD objective is not valid as stated. In Eq. (2) the KL divergence between the student and teacher Gaussian transitions is ||mu_theta - mu_phi||^2 / (2 sigma_t^2). In the deterministic ODE limit sigma_t -> 0 this quantity diverges for any nonzero mean mismatch; it does not 'simplify' to the unweighted L2 loss in Eq. (3). Please present Eq. (3) explicitly as a heuristic mean-matching objective with a chosen scaling, or give the limiting argument that justifies dropping the 1/(2 sigma_t^2) factor. As written, the mathematical grounding of the core loss is unclear.","section":"Method, Preliminaries, Eqs. (2)-(3)"},{"comment":"The statement that FlowErase-OPD yields 'simultaneous improvements in ASR, CLIP and FID Scores' is not supported by the reported numbers. In Table 2, Ours has the best FID but the second-best CLIP (32.19 versus 32.57 for FlowErase-RL). In Table 3, Ours has CLIP 31.25, below FlowErase-RL's 31.58, and FID 42.05, well above DVE's 23.68. Please revise the claim to describe the trade-off explicitly and, ideally, report standard deviations or multiple seeds for the main tables so that 'consistently improving' can be assessed.","section":"Results Analysis after Table 2; Table 3"}],"minor_comments":[{"comment":"The table header uses 'ASR(%)' but the text says the metric is the Top-3 classification accuracy of the Q16 style classifier; please align the column name with the metric definition.","section":"Table 5 and surrounding text"},{"comment":"The caption says 'RAC dynamically adjusts...' but the method is called ARC; please correct the abbreviation.","section":"Figure 2 caption"},{"comment":"The row label 'Vanila' is a typo for 'Vanilla'.","section":"Table 8"},{"comment":"The text says Nudity erasure 'slightly decreases' with more epochs, but the 1000- to 2000-epoch comparison in Table 9 improves from 10.96 to 10.63; please clarify whether the claimed decrease refers only to the later portion of training.","section":"Ablation on The Number of Epochs"},{"comment":"The first sentence says the experiment is performed 'within the FLUX.1-dev framework' while the rest of the paper uses FLUX.1 Schnell; please clarify which backbone was used.","section":"Ablation on The Number of Concepts"},{"comment":"The text says 'we performed erasure of the Nudity concept' but also says 12 target concepts are erased with ESD to form the teachers; please reconcile these statements and specify which concepts were erased for the SD v1.4 experiment.","section":"Ablation on Different Base Modules"}],"recommendation":"major_revision","confidential_remarks":"The manuscript depends heavily on the authors' own FlowErase-RL work, both as the source of teacher models and as one of the baselines. This is not by itself disqualifying, but the evaluation should clearly separate the teacher reward model from the evaluation detector. The paper is within scope for a generative-model safety venue; my concerns are about evidence, not fit. Given the number of methodological gaps, I would not recommend expedited handling."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a genuine step forward for multi-concept erasure on flow-matching models, with a novel training objective and careful ablations, but the headline nudity numbers are less trustworthy than they look. The teachers for nudity were trained with an NSFW-detector reward, and the evaluation counts body parts with NudeNet; the paper never names the reward model. If those are the same detector, the student has simply learned to suppress what that detector sees, and the SOTA claims on ASR and attack robustness would be detector-specific artifacts. This needs to be resolved before the numbers can be taken at face value.\n\nWhat's actually new: the paper is the first to apply on-policy distillation to multi-concept erasure, distilling several single-concept erased teachers into a LoRA student with an anchor retention teacher, and adding an adaptive controller (ARC) that reallocates sampling shares and loss weights based on EMA-smoothed erase losses. The ablation in Table 8 shows both AMTD and ARC contribute, and Table 9 shows the method is stable across training lengths. The experiments cover 12 concepts on FLUX and also show transfer to SD v1.4, which is useful evidence of generality. Credit is due: the training objective is well-defined, the ablations are meaningful, and the limitation section is candid about overhead and anchor-teacher vulnerabilities.\n\nThe soft spots are real but mostly fixable. The detector-overlap issue is the most serious: it is a one-line disclosure, but it changes how the main results should be interpreted. In addition, the object-erasure evaluation leaves out non-target preservation (ASRk is simply missing for the multi-concept setup), so the claimed 'preservation' is not actually measured there. The paper also says 'no per-concept hyperparameter tuning' but gives nudity-specific initial sampling and loss weights in the implementation details; that is per-concept tuning, and the text should be corrected. The ARC thresholds (ell_lo=0.001, ell_hi=0.004) are hand-picked without sensitivity analysis, so the robustness of the adaptive mechanism itself is unproven. These are not load-bearing flaws in the method, but they are gaps a referee should push on.\n\nWho this is for: concept-erasure researchers, safety evaluators, and people working on distillation for flow-matching models. It deserves a serious referee, and with revisions—especially naming the reward model, completing the object-erasure evaluation, and adding ARC sensitivity—it could be a solid contribution. My advice: send it to peer review, but ask for those changes.","headline":"Solid multi-concept erasure method with a genuinely new training objective, but the flagship nudity numbers may be inflated by using the same detector in training and evaluation.","tokens_in":18124,"tokens_out":3716,"would_cite":true,"duration_ms":34882,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Multi-concept erasure in flow-matching text-to-image models can be done by distilling single-concept erased teachers into one LoRA student, anchored by a frozen retention teacher and reweighted by erase difficulty, beating existing…","keywords":["concept erasure","multi-concept erasure","on-policy distillation","flow matching","text-to-image generation","LoRA","adaptive retention control","model safety"],"falsifier":"Fix the total training budget and replace ARC with uniform sampling and fixed loss weights for the same twelve concepts, keeping AMTD's anchor teacher; if the uniform version matches or beats FlowErase-OPD on both average ASR and FID, the adaptive difficulty signal is not carrying the claimed improvement. A second check is to sweep $\\ell_{\\mathrm{lo}}$ and $\\ell_{\\mathrm{hi}}$ over one order of magnitude and record whether per-concept ASR moves by more than a few points; large swings would indicate the controller is miscalibrated.","tokens_in":17120,"feed_emoji":"🛡️","tokens_out":13266,"duration_ms":100466,"temperature":0.7,"pith_summary":"FlowErase-OPD sets out to show that multi-concept erasure in flow-matching text-to-image models can be decomposed into a distillation problem: train one lightweight LoRA student to match several single-concept erased teachers, while an anchored retention teacher keeps the student close to the original model on ordinary prompts. The paper argues this two-part design solves the erasure-versus-preservation trade-off that blocks simple multi-concept extensions of single-concept methods. Adaptive Retention Control (ARC) reweights each concept's sampling share and loss weight from an EMA-smoothed erase-loss difficulty signal, so hard concepts receive more training effort without manual tuning. Experiments on FLUX.1 Schnell across nudity, object, and artist-style erasure, including adversarial attacks, are reported as evidence that the method outperforms existing baselines on average erasure rate while keeping FID and CLIP scores near the unmodified model. If correct, the framework turns concept erasure into a composable, model-agnostic safety layer for flow-based generators.","feed_headline":"One LoRA erases nudity, objects, and art styles at once","feed_subtitle":"Distilled single-concept erasers merge into one LoRA on FLUX.1 Schnell without losing image quality.","key_machinery":"The load-bearing object is the anchored multi-teacher OPD objective with an adaptive allocation loop. On-policy distillation (OPD) treats each denoising step as a Gaussian transition, so matching teacher and student reduces to minimizing $\\sum_t \\tfrac{1}{2}\\|\\mu_\\theta(x_t,t)-\\mu_{\\phi_k}(x_t,t)\\|_2^2$ over the student's own rollouts. Anchored Multi-Teacher Distillation (AMTD) indexes teachers $k$ that are either concept erasure experts $\\phi_c$ or the frozen anchor teacher $\\theta_0$, and samples prompts $c_k$ accordingly, with a linear warmup on the retention batch ratio so erasure directions form before retention constraints dominate. Adaptive Retention Control (ARC) computes an EMA-smoothed unweighted erase loss $\\bar{\\ell}_k$ per concept, turns it into a sampling share $s_k$ and a clipped loss weight $w_k$, and adjusts the retention fraction $\\rho$ by a hysteresis rule with thresholds $\\ell_{\\mathrm{lo}}=0.001$ and $\\ell_{\\mathrm{hi}}=0.004$. The mechanism's job is to make the training budget follow erasure difficulty automatically, which is what lets one LoRA module hold many erasures without destroying general generation.","core_discovery":"On the paper's own terms, the central discovery is that on-policy distillation is a workable mechanism for multi-concept erasure in flow matching models. Because each solver step of a rectified-flow generator is a Gaussian transition with fixed covariance, the per-step KL divergence between student and teacher reduces to a squared $L^2$ distance between their predicted transition means; the student rolls out under its own policy and is trained to match each teacher at every step. FlowErase-OPD instantiates one expert teacher per concept (obtained by FlowErase-RL), one frozen anchor teacher equal to the original model, and a LoRA student, then optimizes the unified AMTD objective with ARC controlling teacher sampling and loss weights. The paper's reported result is that this jointly erases all twelve tested concepts, achieves the best average attack-success rate on nudity benchmarks, keeps object and artist erasure rates near or above the single-concept teacher, and preserves FID/CLIP quality better than training-based baselines. The method also transfers to Stable Diffusion v1.4 when the teachers are ESD models, which the paper reads as evidence that the distillation framework, not the specific teacher type, is the load-bearing component.","pith_inferences":["Editorial inference: The same ARC machinery could govern other multi-teacher distillation tasks with conflicting objectives, such as style transfer, watermark removal, or safety editing, whenever a per-teacher loss can be measured on the student's own rollouts.","Editorial inference: The method decouples concept selection from combination cost: because the teachers are trained independently, the expensive per-concept step happens once, and only the cheap LoRA distillation must be rerun when the concept set changes.","Editorial inference: The hand-picked thresholds and the nudity-specific initial weight suggest the controller is calibrated to this twelve-concept set; a rank-normalized difficulty signal would be a natural testable extension for larger concept sets.","Editorial inference: If the anchor teacher's interference with proximal concept erasure (a limitation the paper itself states) is real, a promising extension would be concept-aware prompt sanitation or a per-concept anchoring schedule."],"forward_implications":["New concepts can be added by training one additional single-concept erasure teacher and re-distilling into the same LoRA student, so multi-concept erasure becomes composable rather than a single monolithic unlearning run.","The anchor teacher makes retention part of the objective, so the method directly targets the drift problem that makes naive multi-concept erasure degrade FID and CLIP scores.","ARC's difficulty-aware reweighting removes the need for per-concept hyperparameter tuning: concepts that resist erasure automatically receive more sampling share, loss weight, and a lower retention fraction.","Because FlowErase-OPD runs on student rollouts and only needs per-step transition means, it applies to transformer-based flow matching backbones such as FLUX.1 Schnell rather than only U-Net diffusion models.","The reported robustness against MMA, Ring-a-bell, P4D, and UnlearnDiff implies that a distilled LoRA eraser can survive the common adversarial-prompt attacks used to test NSFW suppression."],"supporting_citations":[{"why":"supplies the on-policy distillation principle that the method adapts to flow matching.","marker":"(Agarwal et al. 2023)"},{"why":"provides the closed-form per-step divergence objective for OPD in diffusion models that FlowErase-OPD extends to multiple teachers.","marker":"(Li et al. 2026)"},{"why":"produces the FlowErase-RL single-concept erased models used as the expert teachers.","marker":"(Sun et al. 2026a)"},{"why":"supplies the FLUX.1 Schnell backbone and flow matching architecture on which all main experiments run.","marker":"(Black Forest Labs 2024)"},{"why":"EraseAnything is the strongest same-architecture training-based baseline the method must beat.","marker":"(Gao et al. 2025)"},{"why":"ESD is the training-based erasure baseline and, in the Stable Diffusion ablation, the source of the teacher models.","marker":"(Gandikota et al. 2023)"},{"why":"DVE is the training-free flow-matching erasure baseline compared in all three scenarios.","marker":"(Zhang et al. 2026)"},{"why":"MS-COCO supplies the general captions used by the anchor teacher and the FID reference set.","marker":"(Lin et al. 2014)"},{"why":"I2P provides the nudity prompt set and evaluation seeds used to measure erasure effectiveness.","marker":"(Schramowski et al. 2023)"}],"fun_headline_variants":["One LoRA erases many concepts via on-policy distillation","Multi-concept erasure distilled into a single LoRA","Anchored distillation merges erasers for flow models","FlowErase-OPD: on-policy distillation for multi-concept removal","On-policy distillation enables multi-concept erasure in flow models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the EMA-smoothed, unweighted on-policy erase loss of a concept is a dependable and comparable measure of how hard that concept is to erase, and that the fixed thresholds and initial nudity-specific weights stay well calibrated across different concepts and prompt distributions.","fun_headline_variants_meta":{"raw":{"variants":["One LoRA erases many concepts via on-policy distillation","Multi-concept erasure distilled into a single LoRA","Anchored distillation merges erasers for flow models","FlowErase-OPD: on-policy distillation for multi-concept removal","On-policy distillation enables multi-concept erasure in flow models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000367,"raw_usage":{"total_tokens":2022,"prompt_tokens":1049,"completion_tokens":973,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":665,"completion_tokens_details":{"reasoning_tokens":887}},"tokens_in":665,"tokens_out":973,"duration_ms":8007,"temperature":1.0,"reasoning_tokens":887,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:29:10.826141+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix the total training budget and replace ARC with uniform sampling and fixed loss weights for the same twelve concepts, keeping AMTD's anchor teacher; if the uniform version matches or beats FlowErase-OPD on both average ASR and FID, the adaptive difficulty signal is not carrying the claimed improvement. A second check is to sweep $\\ell_{\\mathrm{lo}}$ and $\\ell_{\\mathrm{hi}}$ over one order of magnitude and record whether per-concept ASR moves by more than a few points; large swings would indicate the controller is miscalibrated.","supporting_citations":[],"review_version":1}