{"id":"c02fb2e5-ca44-43bd-afd2-281169695492","arxiv_id":"2608.12806","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Optimized continuous embedding anchors with structure-aware adaptive replacement erase copyrighted animation characters from text-to-image diffusion outputs while preserving image context.","lead":"This paper presents a method to erase specific copyrighted animation characters from text-to-image diffusion models by replacing the character's text embedding with a learned 'anchor' embedding. It claims better erasure and image fidelity than existing methods, plus controllable erasure strength, multi-character removal, and transfer to other models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Erasure is gated on pre-listed exact-name tokens; Table 1 tests only canonical-name prompts, so the SOTA claim has not been shown to hold for paraphrases or visual descriptions.","rationale":"The reader's weakest assumption identifies precisely the same load-bearing gap: the method only intervenes when the prompt contains a pre-listed target-related term. My reading of Section 3.3 and the dataset construction in Section 4.1 confirms that all erasure numbers are obtained under canonical-name prompts, so the SOTA claim is conditional on exact-name or pre-listed alias usage. This is not an internal contradiction—the pipeline does what it specifies—but it is a serious scope mismatch with the abstract's broad 'erase target characters' claim, and it is directly relevant to the stated copyright-compliance motivation. I considered elevating other issues, such as the MACE integration result in Table 4 (17.5% vs 9.0%, which weakens the 'generally improves baselines' claim), the absence of error bars, and the unexplained FID/CLIP difference on COCO prompts. Those are secondary: the main SOTA comparison is internally consistent within its stated protocol, and the core conditional is the paraphrase robustness. The proposed paraphrase/alias evaluation is a single, concrete experiment that would settle whether the erasure is concept-level or lexical. Since the reader already marked the paper CONDITIONAL for this reason, no verdict change is needed.","tokens_in":13731,"tokens_out":6893,"duration_ms":78145,"concrete_test":"Take 10–20 of the 80 characters and generate 100 prompts per character with GPT-4o instructed to avoid each character's name and any listed alias, using only visual attributes, relationships, or foreign-language descriptions (e.g., for SpongeBob: 'a cheerful yellow sea sponge with large blue eyes and brown square pants' or 'una esponja amarilla que vive en una piña'). Apply the pipeline with the same anchors and replacement threshold, and measure LLaVA-1.5 and BLIP-3 recognition accuracy plus SSIM relative to the original. If recognition accuracy rises substantially toward the 66.9%/64.7% base rates while SSIM remains similar, the central claim must be narrowed to exact-name prompts. Separately, re-run the COCO-30K FID/CLIP evaluation with matched seeds; if the numbers still differ from the base model, the claimed no-op behavior on unrelated prompts requires explanation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The method's only intervention point is token-level embedding replacement (Eq. 13–17). Section 3.3 states that replacement is applied only when the prompt 'contains n target-related terms that are pre-listed in a subspace associated with copyrighted characters.' The paper neither defines how this subspace is populated nor provides any mechanism for recognizing a character via paraphrase, alias, visual attributes, or non-English description. All quantitative erasure results in Table 1 and the ablations in Table 2 are obtained on prompts generated by GPT-4o for 80 named characters (Section 4.1), so those prompts by construction contain the canonical name. Consequently, the 6.0%/4.0% recognition rates demonstrate erasure of a lexical token under exact-name prompts, not erasure of a visual concept under arbitrary prompts. Since the abstract's central claim is to 'erase target characters during generation' and the stated deployment goal is copyright compliance, this lexical gating is the load-bearing assumption. It remains untested against paraphrases, aliases, attribute-based descriptions, or translations. The FID/CLIP check on COCO-30K is also uninformative here: those prompts contain no listed target terms, so the method should be a no-op; the reported difference (33.2 vs 33.7) is unexplained and does not establish selective behavior.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an inference-time method for erasing copyrighted animation characters from text-to-image diffusion models. The method first optimizes a new 'Anchor*' text embedding so that, when conditioned on it, the model produces images whose low-frequency structure resembles the target character but whose fine details differ. At generation time, the embedding of any pre-listed target term in the prompt is replaced by the optimized anchor embedding, and special EOT/Padding embeddings are fused with the anchor's special embeddings. A structure-aware adaptive schedule is used to trigger the replacement only after the low-frequency layout has stabilized. Experiments on a self-built 80-character benchmark with Stable Diffusion v1.4 report the lowest character recognition rates among baselines (6.0% with LLaVA-1.5 and 4.0% with BLIP-3 versus 66.9% and 64.7% for the base model), together with the best SSIM and LPIPS among baselines, plus additional results on controllable erasure degree, multi-target removal, transferability to other model families, and integration with model-modification baselines.","tokens_in":14022,"tokens_out":4237,"duration_ms":46131,"significance":"If the central claims are correct, the paper offers a useful and practical capability: a specific, named copyrighted character can be excised from generated images at inference time without retraining, while preserving the remainder of the scene. The paper's main strengths are the clarity of the core idea, the inclusion of ablations for each component, and the breadth of experiments covering different model architectures and integration with existing erasure methods. The reported effect sizes are large, and the qualitative examples are consistent with the erasure claim. However, the benchmark is self-built and unreleased, no code is provided, all numbers are single-run point estimates with no error bars, and the fidelity metric is computed against a character-present original rather than a context-only ground truth. The most consequential limitation is that the erasure mechanism only triggers on exact, pre-listed target terms in the prompt; the paper does not demonstrate concept-level erasure under paraphrases, aliases, attribute descriptions, or translations, which weakens the practical copyright-compliance claim.","major_comments":[{"comment":"The erasure mechanism is gated on the prompt containing \"n target-related terms that are pre-listed in a subspace associated with copyrighted characters,\" but the paper never defines how this subspace is populated, how terms are detected, or how the method copes with paraphrases, aliases, visual descriptions, or non-English names. All quantitative results in Tables 1 and 2 are obtained from GPT-4o-generated prompts for 80 named characters, so those prompts by construction contain the canonical name. The reported 6.0% and 4.0% recognition rates therefore demonstrate erasure of an exact lexical token, not erasure of the visual concept under arbitrary user prompts. Since the abstract and introduction claim the method can \"erase target characters during generation\" for copyright compliance, this lexical gating is a load-bearing assumption, and it is currently untested in the paper.","section":"§3.3, Eq. (13)–(17)"},{"comment":"Image fidelity preservation is measured by SSIM and LPIPS between the original (character-present) image and the erased image. Because the target character typically occupies a substantial image region, these metrics necessarily penalize the desired removal of the character itself and cannot separate 'preserving the context' from 'retaining the character.' The paper should compare against a context-only ground truth, for example by computing fidelity on the background or masked-out regions, or by evaluating prompts where the character is absent from the reference. As reported, the SSIM/LPIPS values do not by themselves establish the abstract's claim of high fidelity preservation.","section":"§4.2, Table 1"},{"comment":"The FID and CLIP-score check on COCO-30K is uninformative in its current form: those prompts do not contain the pre-listed target terms, so the proposed method should be a no-op, yet the reported FID differs from the base model (33.2 versus 33.7) and CLIP score differs (0.312 versus 0.326). The paper does not explain this discrepancy or report the sampling protocol, random seeds, or variance. Without this, the reader cannot tell whether the difference is sampling noise or whether the method perturbs generation even when no target is present.","section":"§4.2, 'Impact on Unrelated Image Quality' and Table 1"},{"comment":"Several hyperparameters and components that are essential for reproducing the method are not specified: the structural and detail loss weights α and β in Eq. (5); the special-embedding fusion weights λ1 and λ2 in Eqs. (15)–(16); the timestep bounds (T_M, T_H) and (T_L, T_M) for structural and detail optimization; the low-frequency filter f_L used in Eqs. (8) and (18); and the threshold that triggers adaptive replacement. The adaptive replacement strategy is justified by a single denoising trajectory shown in Figure 3, but no evidence is provided that the transition point is consistent across characters, prompts, or model versions. Without concrete values and a robustness analysis, the central mechanism is not reproducible and the threshold claim is not falsifiable.","section":"§3.1 and §3.3"},{"comment":"The claim that the optimized anchors are 'plug-and-play' and 'generally improve' existing model-modification baselines is weakened by the MACE row: erasure accuracy with the proposed anchor is 17.5% LLaVA-1.5, which is substantially worse than the 9.0% obtained with the general anchor. The paper should either report the full per-baseline behavior and explain why MACE degrades, or qualify the claim so that it is not contradicted by one of the four tested baselines.","section":"§4.8, Table 4"}],"minor_comments":[{"comment":"There is a grammatical error in 'We optimizes an anchor embedding'; it should be 'We optimize' or 'The method optimizes.'","section":"Abstract"},{"comment":"The phrase 'an structure-aware adaptive replacement' should be 'a structure-aware adaptive replacement.'","section":"§3.3"},{"comment":"The list says 'achieves state-of-the-arts' which should be 'state-of-the-art results' or similar.","section":"§1, Contributions"},{"comment":"Reference [25] is cited as BLIP-3, but the listed title is an RGB-T tracking paper; this appears to be an incorrect reference and should be corrected.","section":"References"},{"comment":"The caption runs several character names together without spacing ('Spider ManKung Fu PandaMinions'), which makes the figure difficult to read.","section":"Figure 1 caption"},{"comment":"The description of evaluation metrics should state explicitly what reference images are used for SSIM and LPIPS, and whether the reported values are averaged over all 8,000 generated images or per character; the current wording is ambiguous.","section":"§4.1"},{"comment":"The sentence 'as it effectively deceive multi-modal large models' should be 'as it effectively deceives multimodal large models' or similar.","section":"§4.2"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and the experiments are extensive, but the benchmark and code are not released and several load-bearing details are underspecified. I would encourage the editors to require release of the dataset and code, or at minimum the exact prompt templates and hyperparameters, before considering acceptance. The reference mismatch for BLIP-3 and the unexplained COCO-30K FID difference should also be fixed. The exact-name gating limitation is the main scientific concern; it may be addressable with paraphrase and alias experiments rather than requiring a conceptual redesign."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read it. The core idea is genuinely new: they optimize a per-character anchor embedding under two losses — structural outline similarity and detail differentiation — then replace target token embeddings with that anchor during inference. The combination isn't in the cited literature, and the ablations show each component earns its keep. On their 80-character benchmark, reported LLaVA/BLIP recognition rates drop from ~65% to ~5% with reasonable fidelity. That's a real applied result.\n\nThe soft spots are where the stress-test note lands. The erasure only triggers for tokens 'pre-listed in a subspace' — effectively an exact-name list. All quantitative tests use prompts generated with canonical names, so the headline numbers demonstrate lexical token erasure, not concept erasure. Paraphrases, aliases, attribute descriptions, or translations bypass the mechanism entirely. If the goal is copyright compliance, that's load-bearing; the paper overclaims by saying it 'erases target characters.' This is addressable — test paraphrases or scope the claim.\n\nAlso, Table 4's MACE row shows their anchor underperforms the general anchor (17.5% vs 9.0%), contradicting the 'plug-and-play with model modification baselines' claim as stated. Minor, but they should say 'most baselines' rather than 'generally improves.' The FID/CLIP sanity check on COCO-30K is a no-op by design; the 33.2 vs 33.7 difference is unexplained and deserves a footnote. No error bars or released code/data, so independent verification is impossible right now.\n\nCredit where due: the fine-grained control via embedding interpolation (Sec 4.5) looks genuinely useful, and transferability to SDXL and Z-Image suggests the anchor captures something model-portable. The paper is honest about empirical tuning but never flags the token-listing limitation.\n\nThis is for people building content moderation or copyright-compliance pipelines. The central idea is worth building on, but the headline claim needs a scope reduction. I'd send it to peer review, conditional on the authors testing paraphrases, releasing artifacts, and fixing the MACE claim. In current form, conditional accept, not reject.","headline":"Solid applied paper with a genuinely new anchor-optimization procedure, but the erasure only works for exact-name prompts; the headline claim needs scope reduction.","tokens_in":14550,"tokens_out":3263,"would_cite":true,"duration_ms":31968,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A text-to-image diffusion model can be asked to omit a specific copyrighted cartoon character during generation by swapping in an optimized anchor word embedding, leaving the surrounding scene intact and requiring no retraining.","keywords":["copyright protection","concept erasure","text-to-image diffusion models","animation characters","semantic anchor embedding","embedding replacement","fine-grained erasure control","model transferability"],"falsifier":"Generate images from a held-out set of prompts that describe each of the 80 characters without using their listed names, for example a paraphrase of the character's appearance or a translated alias, and run the same vision-language recognition checks. If recognition stays near the 66.9% and 64.7% base rates instead of the reported 6.0% and 4.0%, the method erases known tokens, not the underlying concept.","tokens_in":13505,"feed_emoji":"🎨","tokens_out":10083,"duration_ms":86169,"temperature":0.7,"pith_summary":"Copyrighted animation characters can leak out of text-to-image models even when the model is not meant to reproduce them. This paper argues that the leak can be stopped at inference time, without altering weights, by replacing the character's token embeddings with a specially optimized 'anchor' embedding: a word-vector surrogate that keeps the character's outline and pose but drops its identifying details. The authors build a dataset of 80 characters, optimize one anchor per character, and report that after replacement, vision-language recognizers identify the character in only 6.0% of images (versus 66.9% before erasure), while image quality metrics stay close to the original model. If the method works as described, platforms could offer character-level opt-out filters on top of an existing diffusion model, with a dial for how strongly a character is suppressed and support for removing several characters at once.","feed_headline":"Learned word embedding erases cartoon characters without retraining","feed_subtitle":"Erases a named character from generated images while leaving scene, style, and unrelated content intact.","key_machinery":"The central object is the optimized anchor embedding, a learnable vector named 'Anchor*' inserted into the text encoder's vocabulary and trained under two opposing losses: a structural loss that maximizes similarity of low-frequency outlines between images reconstructed from the target name and from the anchor, and a detail-differentiation loss that maximizes the anchor's noise-prediction error on a noised clean image of the target, preventing the anchor from reproducing identifying details. At inference, a structure-aware adaptive replacement monitors the L2 change of low-frequency components between consecutive denoising steps and swaps the target-related embeddings, together with the end-of-text and padding token embeddings fused by element-wise addition, for the anchor's embeddings only after the global layout has stabilized. This mechanism is what lets the method erase the character while preserving background and composition.","core_discovery":"In the paper's own terms, the central discovery is that a distinctive animation character can be erased from generated images by optimizing a single continuous anchor embedding, denoted 'Anchor*', that shares the target's coarse structural outline but is forced to differ in fine details, and then replacing the target-related textual embeddings with that anchor during denoising. The replacement is not applied from the first step: the method tracks low-frequency structural change across denoising timesteps and triggers embedding replacement once the layout has stabilized, which preserves scene coherence. On the paper's 80-character benchmark, recognition by two vision-language models drops from 66.9% to 6.0% and from 64.7% to 4.0%, while the Frechet Inception Distance stays at 33.2 versus 33.7 for the unmodified model. The same anchor embeddings can be reused across model versions or plugged into weight-modification erasure methods to improve their erasure.","pith_inferences":["One consequence the paper leaves implicit is that the erasure is lexical at its core: it fires only when the prompt contains a term that has been pre-listed as target-related. A natural stress test, not reported in the paper, would paraphrase or describe the character without naming it; if recognition returns to near-baseline, the filter is a vocabulary filter rather than semantic unlearning.","Because the replacement happens in embedding space and is reversible, an extension the paper does not pursue is an audit trail: one can inspect exactly which token was swapped. This suggests a design where platform policies expose the anchor and the interpolation dial to creators, turning copyright compliance into a tunable similarity knob rather than a binary block.","The same anchor-optimization recipe should transfer to other conditional generators that share a text-embedding interface, such as text-to-video or text-to-3D pipelines, whenever early generation steps are structure-dominated and later steps fill in details."],"forward_implications":["A platform can add per-character erasure filters to an already-deployed diffusion model by swapping embeddings at inference time, with no weight updates and nearly no change to normal generation quality.","Users can dial the erasure degree continuously: interpolating between anchor and target embeddings with a coefficient in [0,1] moves from full removal to a near-original image.","Multiple copyrighted characters can be removed from one scene simultaneously, because each character has its own anchor embedding and the replacements are applied together.","Anchors optimized for one model transfer to other models with the same text-encoder embedding dimension, including models with dual text encoders and a diffusion-transformer-based model, so per-character optimization is not repeated for every architecture.","The learned anchors can be dropped into existing weight-modification erasure methods as replacement anchor concepts, generally improving erasure accuracy and fidelity compared with generic anchors such as null text or 'toy'."],"supporting_citations":[{"why":"Supplies the deterministic DDIM skip-step denoising formula used to reconstruct structural samples from target and anchor during anchor optimization.","marker":"[36]"},{"why":"Defines the text-encoder embedding space in which the anchor vector is initialized and optimized.","marker":"[31]"},{"why":"Provides the base text-to-image diffusion model used for the main erasure benchmark.","marker":"[33]"},{"why":"One of the prompt-steering baselines the method is compared against on erasure effectiveness.","marker":"[35]"},{"why":"A prompt-steering baseline the method is compared against on erasure effectiveness.","marker":"[16]"},{"why":"A prompt-steering baseline the method is compared against on erasure effectiveness.","marker":"[41]"},{"why":"A model-modification baseline into which the optimized anchor embeddings are plugged to replace generic anchors.","marker":"[26]"},{"why":"A model-modification baseline into which the optimized anchor embeddings are plugged to replace generic anchors.","marker":"[9]"},{"why":"A model-modification baseline into which the optimized anchor embeddings are plugged to replace generic anchors.","marker":"[17]"},{"why":"A model-modification baseline into which the optimized anchor embeddings are plugged to replace generic anchors.","marker":"[8]"}],"fun_headline_variants":["One optimized anchor erases characters without retraining","Swap in a semantic anchor to remove cartoon characters","Learned anchor embedding deletes character, keeps scene","Controllable character erasure via optimized anchor","Anchor embedding erases copyrighted characters from images"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the target character is requested in the prompt by a name or term that has been pre-listed as target-related; if a user asks for the character through a paraphrase, a visual description, attributes, or another language, no embedding is replaced and the erasure does not happen.","fun_headline_variants_meta":{"raw":{"variants":["One optimized anchor erases characters without retraining","Swap in a semantic anchor to remove cartoon characters","Learned anchor embedding deletes character, keeps scene","Controllable character erasure via optimized anchor","Anchor embedding erases copyrighted characters from images"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00023,"raw_usage":{"total_tokens":1462,"prompt_tokens":906,"completion_tokens":556,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":522,"completion_tokens_details":{"reasoning_tokens":485}},"tokens_in":522,"tokens_out":556,"duration_ms":6175,"temperature":1.0,"reasoning_tokens":485,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:54:43.636736+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate images from a held-out set of prompts that describe each of the 80 characters without using their listed names, for example a paraphrase of the character's appearance or a translated alias, and run the same vision-language recognition checks. If recognition stays near the 66.9% and 64.7% base rates instead of the reported 6.0% and 4.0%, the method erases known tokens, not the underlying concept.","supporting_citations":[],"review_version":1}