{"id":"336e9551-ea35-424c-a001-5f272808b8b0","arxiv_id":"2608.10985","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"PEAK erases concepts from diffusion models by training a k-sparse autoencoder to localize target features, then fine-tuning the model to suppress those features while preserving all others.","lead":"PEAK is a method for deleting specific concepts from text-to-image diffusion models by locating the internal sparse features that generate the unwanted content and fine-tuning the model to silence them. It reports strong removal of nudity and object or style concepts, with low success for adversarial recovery attacks and little damage to general image quality.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The persistence claim depends on the selected kSAE feature set being causally necessary and sufficient, but UnlearnDiffAtk's 16.10% Post-ASR indicates recovery through unselected or entangled features, so this premise is not established.","rationale":"The reader identified the same weakest assumption: that the kSAE-selected feature set is causally sufficient and separable, with no unselected entangled features able to regenerate the concept. I agree that this is the load-bearing premise. My analysis adds a specific observed pressure point: the 16.10% Post-ASR under UnlearnDiffAtk in Table 2 is consistent with exactly the failure mode the reader flagged, and the abstract's 5.63% average obscures that residual. However, I do not see this as a fatal flaw that invalidates the method; it is an unproven completeness condition and a reporting concern. The existing CONDITIONAL verdict is appropriate: the paper should be accepted only with the condition that the causal-sufficiency test is run and reported. If the constrained-attack test shows recovery without F_C activation, the verdict would need to move toward REJECT or UNVERDICTED; if not, the central claim would be materially strengthened.","tokens_in":18419,"tokens_out":7251,"duration_ms":74613,"concrete_test":"Run UnlearnDiffAtk against the PEAK-erased model with an added white-box constraint that penalizes the frozen kSAE activation of F_C at the selected layer while maximizing the nudity score. If nudity is still recovered at a non-negligible rate while F_C activations are driven near zero, then unselected or complementary features are causally sufficient and the Eq. (10)/Eq. (13) mechanism is incomplete. If recovery collapses under this constraint, the selected features are the causal bottleneck and the persistence claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central argument treats the feature set F_C from Eq. (10) as both necessary and sufficient for the target concept: Eq. (13) suppresses only F_C, while Eq. (15) explicitly freezes the complement F_C^c to original responses. But F_C is selected by contrasting activation strength and frequency over only 100 matched prompt pairs, which yields correlational, prompt-distribution-specific features rather than a proven causal bottleneck. Features that are causally involved in generating C but also active under non-target prompts are excluded by the threshold in Eq. (10) and then forcibly preserved by Eq. (15). Features that activate only under adversarial prompts are absent from the selection distribution entirely. The paper's own UnlearnDiffAtk result is direct evidence of this gap: after PEAK fine-tuning, the Post-ASR is 16.10%, meaning the concept is recoverable through some residual pathway not blocked by suppressing F_C. The abstract's headline average of 5.63% masks this residual rate. Until it is shown that successful adversarial recoveries activate F_C (and fail when F_C is truly silenced), the central claim of persistent erasure is not fully supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PEAK, a two-stage concept-erasure framework for text-to-image diffusion models. In the first stage, a k-sparse autoencoder (kSAE) is trained on internal activations of a frozen diffusion model, and a compact set of target-specific sparse features is selected by contrasting activation strength and frequency between matched target and non-target prompt sets (Eqs. (5)–(10)). In the second stage, the diffusion model is fine-tuned so that the selected features are suppressed while all complementary features are distilled back to the original model's responses (Eqs. (13)–(16)). The authors claim this yields precise and persistent erasure without inference-time intervention. Experiments on Stable Diffusion v1.4 report a reduction in I2P NudeNet detections from 582 to 6, strong preservation metrics on MS-COCO, low attack success rates on RAB and MMA, and a Pre-ASR of 0.85% on UnlearnDiffAtk; additional experiments cover object/style erasure, multi-concept erasure, unseen-concept generalization, and cross-architecture results on SDXL and FLUX.","tokens_in":18677,"tokens_out":4476,"duration_ms":42949,"significance":"If the claims hold, PEAK is a useful step beyond inference-time SAE interventions: it converts kSAE-localized features into permanent parameter-level erasure and explicitly preserves complementary features, which addresses a recognized limitation of prior SAE-based methods. The method is clearly specified, the ablations support the feature-selection and preservation design choices, and the authors release code and models. The main results are competitive with or better than existing erasure methods on several benchmarks. However, the central persistence claim is only partially supported: the paper's own UnlearnDiffAtk Post-ASR is 16.10%, and the abstract's headline average of 5.63% omits this residual. The feature-selection mechanism is correlation-based and derived from only 100 matched prompt pairs, so its causal sufficiency is not established. Reproducibility is also incomplete because key selection hyperparameters are not reported.","major_comments":[{"comment":"The persistence claim is not fully supported by the reported results. Table 2 reports a UnlearnDiffAtk Post-ASR of 16.10% for PEAK, which is far from zero and indicates that the target concept can still be recovered through some residual pathway after fine-tuning. The abstract's statement that PEAK 'lowers the average attack success rate (ASR) from 96.52% to 5.63%' appears to average over RAB, MMA, and the Pre-ASR of UnlearnDiffAtk, thereby hiding the Post-ASR value. Please report the Post-ASR alongside any average, define what Pre-ASR and Post-ASR mean in the attack protocol, and provide an analysis of the successful adversarial recoveries: in particular, do those recovered images activate the selected feature set F_C after erasure? If they do not, then Eq. (13) is not sufficient to silence all concept-generating pathways, and the manuscript should state this limitation explicitly or extend the method to close the gap.","section":"§3.2, Eq. (10); §3.3, Eq. (15)"},{"comment":"The causal sufficiency of the selected feature set F_C is assumed rather than demonstrated. F_C is obtained by contrasting activation strength and frequency over only 100 matched prompt pairs, which yields correlational, prompt-distribution-specific features. Eq. (15) then freezes the complement F_C^c to the original responses, so any causally relevant feature that also activates under non-target prompts, or that appears only under adversarial prompts, is either excluded or preserved by construction. The manuscript needs a direct empirical test of sufficiency: for example, after PEAK fine-tuning, run successful adversarial attacks and check whether the recovered images activate F_C; or perform an inference-time intervention that additionally silences F_C on the fine-tuned model and show whether the residual 16.10% Post-ASR disappears. Without such evidence, the central claim that suppressing F_C embeds persistent erasure into the parameters is not fully established.","section":"§3.2, Eq. (10); §3.3, Eq. (15)"},{"comment":"Two load-bearing hyperparameters of the feature-selection stage are not reported anywhere in the paper: the percentile p used in Eq. (9) to define the threshold tau_q, and k_step used in Eq. (7) to select the prominent features per timestep. The implementation details in Appendix D list kSAE training and concept-erasure hyperparameters, but not these values or their sensitivity. Since the entire feature set F_C depends on p and k_step, and since the paper ablated other design choices (Tables 5–7) but not these, the main results are not reproducible as written. Please report the values and include an ablation or sensitivity analysis for both.","section":"§3.2, Eqs. (7) and (9); Appendix D"},{"comment":"The experimental validation has methodological weaknesses that affect the strength of the comparative claims. The preservation weight lambda (Table 5) and the feature-selection criterion (Table 7) are selected using the same evaluation benchmarks on which the final results are reported, and all main experiments use a single random seed (Appendix D.3). This makes it difficult to know whether the reported margins over baselines are significant and whether the chosen hyperparameters generalize. Please add multiple seeds with error bars, or at minimum a train/validation split for hyperparameter selection, and report the variance of the key metrics (I2P detections, ASR, CS, FID, KID) across runs.","section":"§4.4, Tables 5–7"}],"minor_comments":[{"comment":"The STEREO row reads '2 2 1 0 0 0 1 06', which appears to be a formatting error for '0 6'; please fix the alignment and separate the total column clearly.","section":"Table 1"},{"comment":"The appendix states that Tables 5–7 report RAB and MMA as counts over 285 and 1,000 attack trials, while Table 2 reports ASRs in percentages; please make this distinction explicit in each table caption so readers do not compare counts with percentages.","section":"Appendix A"},{"comment":"The text says all KID values are multiplied by 100, yet RECE and PEAK report exactly 0.0000. An exact zero is implausible; please report the actual numerical values with sufficient precision or state rounding thresholds.","section":"Tables 1–2, KID"},{"comment":"The importance score S_q^f is a product of activation strength and frequency; the notation is clear, but the definition of the positive-activation set I_q^t in Eq. (6) silently drops features with non-positive activation. Please state explicitly that features with negative or zero activation are treated as absent for the purpose of scoring.","section":"§3.2, Eq. (8)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a credible and useful contribution to concept erasure, and the method is well specified. The main obstacle is the persistence claim: the UnlearnDiffAtk Post-ASR of 16.10% is a nontrivial residual, and the paper currently does not analyze whether successful adversarial recoveries go through the selected feature set. I would encourage the editor to request the additional analysis and the missing hyperparameters before publication. I do not see grounds for rejection, since the gaps are addressable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"PEAK is the first kSAE-based erasure method I know of that bakes the suppression into the diffusion weights rather than doing inference-time activation surgery or text-encoder editing, and it pairs that with a clean complementary-feature preservation loss. That is a real step forward for this line of work, and the experiments back it up: I2P detections drop from 582 to 6, MS-COCO quality is essentially untouched, and the ablations actually test the feature-selection design. The feature-intervention table showing attribute-specific control—zeroing features associated with armpits, belly, or breasts reduces exactly those NudeNet categories—is the most convincing evidence that the sparse features are causally involved.\n\nThe soft spots are mostly about the strength of the persistence claim. The abstract's \"5.63% average ASR\" is an average over RAB (0%), MMA (0.8%), and UnlearnDiffAtk Post-ASR (16.10%). The 16.10% is reported in Table 2, so it's not hidden, but it does mean the method is not unbreakable. More importantly, the mechanism story—that the selected feature set F_C is necessary and sufficient for the concept—is not fully established. Features are selected from only 100 matched prompt pairs, so the set is prompt-distribution-specific; adversarial prompts can likely recruit other features. I don't think this breaks the paper—no method gets close to zero on Post-ASR, and PEAK is second-best—but it should temper any claim of full persistence.\n\nOther issues: single seed, no error bars; hyperparameters (λ, percentile p, k_step) are tuned on the same benchmarks used for final reporting; and the paper never states the numeric value of p or k_step anywhere, which hurts reproducibility. The code is public, so these are fixable.\n\nOverall, this is a serious, honest paper. It deserves a full review. I'd recommend the editor send it out, asking for multi-seed runs, exact hyperparameter values, and a short analysis of whether successful adversarial recoveries actually activate F_C. I'd probably cite it once those details are pinned down.","headline":"A genuinely new kSAE-guided parameter-level erasure method with strong results, but the persistence claim is softer than the abstract suggests (UnlearnDiffAtk Post-ASR 16.10%); worth a serious referee.","tokens_in":19208,"tokens_out":3599,"would_cite":true,"duration_ms":33935,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that erasing a concept from a text-to-image diffusion model can be made precise and persistent by localizing it as a small set of k-sparse autoencoder features and suppressing those features in the model weights.","keywords":["concept erasure","text-to-image diffusion models","k-sparse autoencoders","feature localization","parameter optimization","adversarial concept recovery","interpretable features","model editing"],"falsifier":"Search a much wider set of paraphrased or adversarially optimized prompts than the 100 matched pairs against a PEAK-fine-tuned model; if any of these prompts regenerates the target concept at rates near the original model, the persistence claim fails. As a second check, zero out exactly the selected features in the frozen original model; if the concept still appears, the selected set was not causally sufficient.","tokens_in":25,"feed_emoji":"🖼️","tokens_out":9650,"duration_ms":144571,"temperature":0.7,"pith_summary":"The paper tries to establish that concept erasure in text-to-image diffusion models becomes precise and persistent once the target concept is localized as a compact set of $k$-sparse autoencoder features and those features are suppressed directly in the model weights. The difficulty it addresses is the usual trade-off: erasure that is too broad damages unrelated semantics, while erasure that leaves internal knowledge intact lets adversarial prompts recover the concept. PEAK trains a frozen kSAE on cross-attention activations, selects target-specific features by contrasting matched target and non-target prompts on both activation strength and frequency, then fine-tunes the diffusion model so selected features are driven down while all other features are distilled toward the original model. Because the erasure is internalized in parameters, no inference-time intervention is needed, and the paper reports that NudeNet detections on I2P drop from 582 to 6 while the average adversarial attack success rate falls from 96.52% to 5.63%, with near-zero KID on MS-COCO. If true, this gives a general recipe for removing unsafe or copyrighted concepts without giving up generation quality or leaving an open-source bypass.","feed_headline":"PEAK cuts nudity detections from 582 to 6 in diffusion models","feed_subtitle":"Erasing concepts in model weights cuts adversarial recovery to 5.63% while keeping image quality intact.","key_machinery":"The machinery has two stages. First, a frozen kSAE (a sparse autoencoder that reconstructs dense activation vectors using only $k$ active features per sample) is trained on cross-attention activations from a chosen U-Net block, using a BatchTopK training objective and an AuxK auxiliary loss to reduce dead latents. Second, target-feature selection scores each latent by the product of mean activation strength and activation frequency across denoising timesteps, then keeps features above a percentile threshold for target prompts and at or below a threshold for matched non-target prompts. The selected features feed two losses on on-trajectory rollouts: $L_{\\mathrm{erase}}$ drives their squared activations to zero, and $L_{\\mathrm{pres}}$ matches all complementary features to the frozen reference model, with total objective $L_{\\mathrm{PEAK}} = L_{\\mathrm{erase}} + \\lambda L_{\\mathrm{pres}}$. These losses carry the argument because 'what to erase' and 'what to preserve' are both specified in the same sparse feature space, turning interpretability into a gradient signal.","core_discovery":"On its own terms, PEAK's central discovery is that the internal visual space of a diffusion denoiser contains a sparse, interpretable coordinate system in which the target concept and everything else are separable enough to drive parameter optimization. A kSAE trained with BatchTopK and AuxK decomposes activations at a selected cross-attention block into about 1,280 sparse features; contrasting activations from 100 matched prompt pairs yields a small set of features that are both strongly and consistently activated for the target concept and not for its non-target counterpart. Fine-tuning then minimizes the squared energy of exactly those features on real denoising trajectories while matching all complementary features to the frozen reference model. The result is a parameter-level erasure: after training, neither the kSAE nor the reference model is needed, the concept is suppressed under regular and adversarial prompts, and unrelated semantics are largely unchanged. The paper supports this with category-level NudeNet counts, zero RAB recoveries, low MMA and UnlearnDiffAtk success rates, and recognition-accuracy tests for Snoopy, Van Gogh, and unseen concepts like Mario.","pith_inferences":["If causal separability holds beyond the tested prompts, the same contrast-and-suppress recipe could be used for other surgical model edits, such as removing a specific person's likeness, debiasing a protected attribute, or blocking style mimicry; PEAK's objective is a generic erase-this-keep-everything-else signal in feature space.","The feature set is chosen from 100 matched prompt pairs, so the stability of selection under broader paraphrase coverage is an open empirical question; a test that varies prompt language, composition, and concept phrasing would show whether the selected features are concept-stable or context-bound.","Because erasure is written into weights, any later operation that mixes or merges fine-tuned weights with original ones could in principle resurrect the concept; testing PEAK-erased models under weight interpolation or model merging would map the true boundaries of persistence.","The strong preservation numbers are measured on MS-COCO; a finer probe on prompts that are semantically adjacent to the target concept would clarify whether 'precision' holds at the boundary or only for unrelated captions."],"forward_implications":["If the central claim holds, erasure no longer requires a safety filter or feature-steering pass at generation time, so a user sharing the fine-tuned weights cannot trivially revert the erasure by ignoring an inference wrapper.","The preservation loss should keep general generation quality close to the original model; the paper measures KID $0.0000$, FID $41.59$, and a higher CLIP score than any compared erasure method on MS-COCO.","Adversarial persistence becomes a property of the parameters, and the paper reports zero RAB attack success, a $0.8\\%$ MMA success rate, and a $16.10\\%$ post-attack rate under UnlearnDiffAtk.","The same feature-space localization transfers to object, artistic-style, violence, multi-concept, and unseen-concept erasure, and to SDXL and FLUX architectures, suggesting the procedure is not tied to one concept or one model family.","Because the kSAE remains frozen, the feature space is reusable across concepts and across models, so erasing additional concepts later does not require retraining the autoencoder."],"supporting_citations":[{"why":"Introduces k-sparse autoencoders and per-sample TopK sparsity, which PEAK uses to encode diffusion activations.","marker":"(Makhzani and Frey 2014)"},{"why":"Supplies the BatchTopK training objective that gives PEAK's kSAE its adaptive per-sample activation budget.","marker":"(Bussmann, Leask, and Nanda 2024)"},{"why":"Provides the AuxK auxiliary objective and dead-latent heuristics used to stabilize kSAE training.","marker":"(Gao et al. 2025)"},{"why":"Motivates applying kSAE to cross-attention blocks by localizing knowledge in specific U-Net stages.","marker":"(Basu et al. 2024b)"},{"why":"Supplies the ESD-x parameter-update strategy that PEAK uses during concept-erasure fine-tuning.","marker":"(Gandikota et al. 2023)"},{"why":"Provides the I2P benchmark and inappropriate-content prompts used for kSAE training and erasure evaluation.","marker":"(Schramowski et al. 2023)"},{"why":"Provides the NudeNet detector used to measure nudity erasure on I2P.","marker":"(Bedapudi 2019)"},{"why":"Defines the RAB black-box attack used to test whether erased concepts can be recovered.","marker":"(Tsai et al. 2024)"},{"why":"Defines the MMA multimodal black-box attack used to test persistence under adversarial prompts.","marker":"(Yang et al. 2024)"},{"why":"Defines the UnlearnDiffAtk white-box attack and the AdvUn baseline central to the persistence comparison.","marker":"(Zhang et al. 2024b)"}],"fun_headline_variants":["PEAK's sparse features erase concepts persistently: 582→6 detections","Erase once, defeat adversarial recovery: PEAK slashes ASR to 5.63%","Diffusion concept erasure at the source: PEAK drops nudity 582→6","Persistent erasure without inference hooks: PEAK gets ASR down to 5.63%"],"cache_read_input_tokens":21376,"weakest_assumption_plain":"The load-bearing premise is that the kSAE feature set selected from 100 matched prompt pairs is causally sufficient and separable: suppressing exactly those features extinguishes the target concept, and no unselected entangled feature can regenerate it or carry collateral semantic damage.","fun_headline_variants_meta":{"raw":{"variants":["PEAK's sparse features erase concepts persistently: 582→6 detections","Erase once, defeat adversarial recovery: PEAK slashes ASR to 5.63%","Diffusion concept erasure at the source: PEAK drops nudity 582→6","Persistent erasure without inference hooks: PEAK gets ASR down to 5.63%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001742,"raw_usage":{"total_tokens":6952,"prompt_tokens":1087,"completion_tokens":5865,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":703,"completion_tokens_details":{"reasoning_tokens":5766}},"tokens_in":703,"tokens_out":5865,"duration_ms":40158,"temperature":1.0,"reasoning_tokens":5766,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:44:15.281605+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Search a much wider set of paraphrased or adversarially optimized prompts than the 100 matched pairs against a PEAK-fine-tuned model; if any of these prompts regenerates the target concept at rates near the original model, the persistence claim fails. As a second check, zero out exactly the selected features in the frozen original model; if the concept still appears, the selected set was not causally sufficient.","supporting_citations":[],"review_version":1}