Pith. sign in

REVIEW 3 major objections 5 minor 70 references

ACE: Anti-Editing Concept Erasure in Text-to-Image Models

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Erasing a concept from a text-to-image model also has to erase it from the unconditional noise path, or image editing will quietly bring it back.

desk verdict A useful empirical recipe for editing filtration, with a derivation that doesn't hold up; deserves refereeing but not acceptance as-is. read the letter →

arxiv 2501.01633 v1 pith:W3O53F7F submitted 2025-01-03 cs.CV

Zihao Wang , Yuxiang Wei , Fan Li , Renjing Pei , Hang Xu , Wangmeng Zuo This is my paper · ORCID
classification cs.CV
keywords concepterasuretext-to-imagediffusionimageeditingfiltrationclassifier-freeguidanceunlearningcopyrightprotectionadversarialrobustnessLoRAfine-tuning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper targets a loophole in concept erasure: a model that refuses to generate 'Pikachu' will still happily edit an existing Pikachu image when the edit prompt never names Pikachu. The proposed method, ACE, closes that loophole by erasing the concept from both branches of classifier-free guidance—the conditional noise prediction and the unconditional noise prediction—rather than only the conditional one as prior methods do. Because every CFG-based generation and editing pipeline uses the unconditional prediction, aligning it against the target concept makes the erased concept unfindable regardless of the input text. The paper shows this on IP characters, explicit content, and artistic styles, measuring both generation prevention and editing filtration across LEDITS++, MasaCtrl, and SD-inpainting.

What carries the argument

The central object is the unconditional erasure guidance (UEG), defined as $\tilde{\epsilon}_u = \epsilon_{\theta^*}(z_t,t) + \eta_u(\epsilon_{\theta^*}(z_t,c,t) - \epsilon_{\theta^*}(z_t,t))$. ACE fine-tunes the unconditional noise prediction $\epsilon_\theta(z_t,t)$ to match this guidance, using the prior-guided variant PG-UEG that subtracts $\eta_p\gamma_p(\epsilon_{\theta^*}(z_t,c_p,t) - \epsilon_{\theta^*}(z_t,t))$, while also aligning the conditional prediction to ESD-style conditional erasure guidance. This is load-bearing because CFG computes $\tilde{\epsilon} = \epsilon_\theta(z_t,t) + \omega(\epsilon_\theta(z_t,c_{\text{input}},t) - \epsilon_\theta(z_t,t))$, so erasing from $\epsilon_\theta(z_t,t)$ changes every CFG-based trajectory, not just prompts that name the concept.

What would settle it

Take a model fine-tuned with ACE to erase Pikachu, edit an actual Pikachu photo with LEDITS++ using the prompt 'add sunglasses', and measure CLIP similarity between the output and 'Pikachu'; if the erased-concept CLIP score stays near the unerased baseline across many edits, the unconditional alignment is not transferring to edit-time latents.

Watch

Extended reading notes

Core claim

On the paper's own terms, ACE claims that injecting erasure guidance into both the conditional and unconditional noise predictions enables a fine-tuned model to prevent the creation of an erased concept during both generation and editing. The unconditional erasure guidance is defined as $\tilde{\epsilon}_u = \epsilon_{\theta^*}(z_t,t) + \eta_u(\epsilon_{\theta^*}(z_t,c,t) - \epsilon_{\theta^*}(z_t,t))$, and the training aligns the tuned model's unconditional prediction to it, so the CFG update implicitly carries a negative gradient of the target concept's log-probability even when the edit text never mentions the concept. A prior-guided correction term subtracts randomly sampled prior-concept guidance, and a consistency loss regularizes the prior predictions, preserving non-target concepts. The supplement formalizes the result: after alignment, the denoising step contains a term $-C_4 \nabla_{z_t} \log p(c|z_t)$ with $C_4>0$, so the target probability decreases whatever the edit prompt.

Load-bearing premise

The latents produced by real editing pipelines (LEDITS++, MasaCtrl, SD-inpainting) are close enough to the DDIM latents of target-concept images used in training that aligning the unconditional prediction on those training latents still suppresses the concept at edit time.

Editorial extensions

If this is right

  • Existing erasure methods that only touch the conditional branch (ESD, SPM, MACE, RECE) can be bypassed by editing; ACE's unconditional alignment is what closes that bypass.
  • Editing filtration holds across distinct edit pipelines—LEDITS++, MasaCtrl, and SD-inpainting—so it is not an artifact of one attention-control mechanism.
  • The erased concept stays suppressed under adversarial text: ACE reports an average attack success rate of 19.61% across UnlearnDiff, P4D, and Ring-A-Bell without adversarial training.
  • Prior preservation is maintained: erasing one IP character or style leaves other characters and styles generatable, and edits to non-target concepts still succeed.
  • The same training recipe transfers across concept types—copyrighted characters, nudity, and artist styles—with the same loss structure and per-task hyperparameters.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because UEG changes the shared unconditional branch, the defense should transfer to any editing method that relies on CFG with the fine-tuned model, even ones not tested in the paper such as Prompt-to-Prompt or Null-text inversion.
  • The suppression strength likely depends on the edit-time CFG scale $\omega$; the paper's derivation assumes $\omega>1$, so edits run at very low guidance may weaken filtration, which suggests a testable scaling law.
  • ACE could be stacked with adversarial training rather than treated as an alternative; the paper's robustness results come without adversarial training, leaving headroom.
  • The prior-correction term uses CLIP relevance $\gamma_p$, so preservation behavior may be sensitive to concept similarity; a stress test would erase a concept very close to many priors.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes ACE, a fine-tuning method for erasing concepts from text-to-image diffusion models so that the erased concept is also suppressed during text-guided image editing. The method augments the conditional erasure guidance of ESD with an unconditional erasure guidance term, a prior-consistency loss, and a prior-guided correction term, all trained with LoRA on Stable Diffusion v1.4. The paper reports experiments on IP characters, nudity, and artistic styles, with both generation and editing evaluations, and claims superior editing filtration compared to ESD, SPM, AdvUnlearn, MACE, and RECE.

Significance. The editing-filtration problem is a timely and practical gap in concept erasure: existing methods guard generation from text prompts but are circumventable by editing pipelines whose input text does not name the erased concept. If the claimed effect holds, ACE would be a meaningful advance with direct safety applications. The empirical scope is a strength: ten IP characters, two editing methods (LEDITS++ and MasaCtrl), SD-inpainting for explicit content, and three adversarial attack pipelines are evaluated, and the ablation in Table 1 supports the usefulness of the unconditional erasure guidance. The paper also promises code release, which would aid reproducibility. However, as detailed below, the formal appendix that is supposed to explain the editing-filtration mechanism contains a load-bearing gap and an internal inconsistency, so the central mechanistic claim is not yet established.

major comments (3)
  1. [Supplementary Sec. A, Eqs. A.1–A.3] The derivation of editing filtration silently assumes that the tuned conditional noise prediction for the editing prompt equals the original model's conditional noise prediction. In Eq. A.3, the term ω(ϵθ(z_t, c_input, t) − ϵθ⋆(z_t, t)) is replaced by ω∇z_t log p(c_input|z_t) via Eq. (2) of the main text, which is legitimate only if ϵθ(z_t, c_input, t) ≈ ϵθ⋆(z_t, c_input, t). The consistency loss L_Cons (Eq. 8) is applied only to the 30 prior concepts in Tables B–D; the 11 editing prompts used in Table 2(b) are not in that set. Because LoRA updates shared weights, δ(z_t, c_edit) = ϵθ(z_t, c_edit, t) − ϵθ⋆(z_t, c_edit, t) is generally nonzero, and the final CFG prediction contains an extra ωδ term whose projection onto the intended erasure direction is neither analyzed nor measured. Table 2(b) reports only aggregate CLIP/LPIPS scores, which cannot isolate this effect. The paper therefore does not establish that editing filtration is caused by the unconditional erasure guidance; it could be partially or wholly due to conditional drift in the LoRA branch. I recommend an additional diagnostic, such as measuring the magnitude of δ or the cosine similarity between δ and the intended UEG direction on the editing prompts.
  2. [Supplementary Sec. A, Eqs. A.3 and A.5] There is an internal inconsistency in the formal proof: Eq. A.3 writes the target-concept term as η_u(1−ω)∇z_t log p(c|z_t) and the input-term as ω∇z_t log p(c_input|z_t), but Eq. A.5 swaps the two, giving η_u(1−ω)∇z_t log p(c_input|z_t) + ω∇z_t log p(c|z_t). This is not a cosmetic typo, because Eq. A.6 derives the positive constant C4 on the target-gradient term from this expression. While the conclusion that the target gradient appears with a positive coefficient still holds after the swap, the derivation as written is internally inconsistent and must be corrected. The corrected proof should also clarify which probability distribution each gradient is taken with respect to, in light of the conditional-drift issue above.
  3. [Sec. 3.2 and Suppl. Sec. A, with Sec. 4.1 and Suppl. C.2–C.3] The formal argument assumes that the latents z_t encountered at edit time are close to the DDIM latents of the original SD 1.4 model conditioned on the target concept, as generated in Algorithm 1. However, the editing evaluations use LEDITS++, MasaCtrl, and SD-inpainting, which employ their own inversion schemes, attention replacement, and noising schedules. The paper does not analyze whether the z_t trajectories of these pipelines remain in the regime where Eq. A.6 holds. An experiment that measures the target-concept score along actual edit-time latents would substantiate the transfer; without it, the generalization from the training-time derivation to the editing pipelines is an unverified assumption. This transfer assumption is load-bearing because the central contribution is precisely the editing-filtration effect.
minor comments (5)
  1. [Sec. 4.1] The list of ten IP characters contains 'Elsa' twice, while the intended set of ten distinct characters is used in the evaluation; the duplicated name should be removed or replaced.
  2. [Sec. 4] The text reads 'conducted on the Sable Diffusion v1.4'; this should be 'Stable Diffusion v1.4'.
  3. [Algorithm 1] The role of the variable θ is ambiguous: line 4 defines θ ← Combine(θ′, θ⋆) and later lines use ϵθ for inference, but the update at the end is only on θ′. The pseudocode should clarify that ϵθ refers to the combined model with LoRA weights θ′ plugged into the frozen original model.
  4. [Eq. (9) and text after it] The definition γ_p = CLIP(x, c_p)/CLIP(x, c) is underspecified: it should state whether CLIP returns the raw cosine similarity and how the image x is obtained. Without this, the guidance control term is not reproducible.
  5. [Table 1 caption] The abbreviations 'Unc', 'Cons', and 'Cor' in the ablation table are not defined in the caption; they should be expanded to indicate that they correspond to L_Unc, L_Cons, and the correction term in L_PUnc.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ACE's editing-filtration claim follows from the stated training losses and CFG algebra, with no load-bearing self-citation or fitted-value-as-prediction.

full rationale

ACE is an empirical fine-tuning recipe whose central editing-filtration effect is derived from explicitly stated objectives, not from a hidden equivalence to its own inputs. The claimed mechanism, formalized in Suppl. Eqs. A.1-A.6, is that aligning the tuned unconditional prediction eps_theta(z_t,t) with the unconditional erasure guidance (Eqs. 6,7,9,10) makes the CFG prediction contain a negative term proportional to the target-concept gradient, -C4 grad log p(c|z_t), which suppresses the erased concept regardless of the edit prompt. This is a mathematical consequence of the proposed loss, not a renamed measured quantity: the target suppression term appears through the (1-omega) algebra of CFG and is not fitted from the editing-evaluation data. The hyperparameters eta_u, eta_p, gamma_p, and the lambda weights are tuned, but the headline finding is not a fitted parameter renamed as a prediction; the ablation in Table 1 shows that adding the unconditional loss changes editing filtration. Self-citations are present but not load-bearing: overlapping-author references such as ELITE, MasterWeaver, MagicEraser, and ControlVideo appear only as related-work examples, and the method's core premises rest on external, machine-checkable components (Stable Diffusion, CFG, LoRA, LEDITS++, MasaCtrl) and on the paper's own loss equations. The most notable technical weakness is a derivation gap in Suppl. Eq. A.3, where omega(eps_theta(z_t,c_input,t)-eps_star(z_t,t)) is rewritten as omega grad log p(c_input|z_t); this implicitly assumes the tuned conditional prediction for unseen edit prompts is drift-free. That is a correctness or transfer-risk concern, not a circularity, because the paper does not define or fit the editing result to be equivalent to the training target. Overall, the derivation chain is self-contained and no step reduces by construction to its own inputs.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The method's core relies on standard CFG math plus an untested distribution-transfer assumption from training latents to edit-time latents. No new physical or latent entities are introduced, but six task-specific hyperparameters or data-dependent scalars are tuned.

free parameters (6)
  • eta_u (unconditional erasure guidance scale) = 3 for IP and nudity, default 3 per Sec. B.1
    Controls how strongly the unconditional prediction is pulled toward the target concept during training; primary knob for editing filtration strength.
  • eta_p (prior correction guidance scale) = 3 (IP), 1 (nudity), 1.5 (artist)
    Scales the subtracted prior-concept guidance in PG-UEG; tuned per task in Table A.
  • lambda_PUnc = 0.19 (IP), 0.198 (nudity), 0.05 (artist)
    Loss weight for the prior-guided unconditional erasure loss.
  • lambda_Cons = 0.8 (IP), 0.8 (nudity), 0.9 (artist)
    Loss weight for the prior-consistency constraint.
  • lambda_ESD = 0.01 (IP), 0.002 (nudity), 0.05 (artist)
    Loss weight for the conditional ESD erasure loss.
  • gamma_p = CLIP(x, c_p) / CLIP(x, c) = computed per prior from 15 SD3 target images; set to 1 for nudity
    Relevance-weighted correction term for the random prior guidance; data-dependent and task-specific, not derived from first principles.
assumptions (4)
  • standard math Classifier-free guidance: the score-based gradient relation in Eq. 2 and the noise composition in Eq. 3 are correct for the Stable Diffusion sampler.
    Used to derive the unconditional erasure guidance in Eq. 6 and the transfer argument in Eq. A.1. This is standard diffusion background.
  • domain assumption Edit-time latents are drawn from the same distribution as training latents z_t.
    The method is trained on DDIM latents of SD1.4 generated target-concept images, yet applied to LEDITS++, MasaCtrl, and inpainting edit latents. This is the load-bearing transfer assumption.
  • domain assumption Editing methods use classifier-free guidance in the form of Eq. 3.
    The anti-editing result is derived through CFG composition; editing pipelines that replace attention or use different guidance schedules may not satisfy Eq. A.1.
  • domain assumption CLIP score, LPIPS, NudeNet, and GroundingDINO are valid proxies for concept erasure and preservation.
    All quantitative conclusions are built on these scores; the paper does not model detector error or perceptual metric noise.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ACE: Anti-Editing Concept Erasure in Text-to-Image Models." pith.science (2026). https://pith.science/paper/W3O53F7F

@misc{pith2026250101633,
  author       = {Pith},
  title        = {Pith review of: ACE: Anti-Editing Concept Erasure in Text-to-Image Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W3O53F7F}},
  note         = {Machine review of arXiv:2501.01633}
}
read the original abstract

Recent advance in text-to-image diffusion models have significantly facilitated the generation of high-quality images, but also raising concerns about the illegal creation of harmful content, such as copyrighted images. Existing concept erasure methods achieve superior results in preventing the production of erased concept from prompts, but typically perform poorly in preventing undesired editing. To address this issue, we propose an Anti-Editing Concept Erasure (ACE) method, which not only erases the target concept during generation but also filters out it during editing. Specifically, we propose to inject the erasure guidance into both conditional and the unconditional noise prediction, enabling the model to effectively prevent the creation of erasure concepts during both editing and generation. Furthermore, a stochastic correction guidance is introduced during training to address the erosion of unrelated concepts. We conducted erasure editing experiments with representative editing methods (i.e., LEDITS++ and MasaCtrl) to erase IP characters, and the results indicate that our ACE effectively filters out target concepts in both types of edits. Additional experiments on erasing explicit concepts and artistic styles further demonstrate that our ACE performs favorably against state-of-the-art methods. Our code will be publicly available at https://github.com/120L020904/ACE.

Figures

Figures reproduced from arXiv: 2501.01633 by the authors.

Figure 1
Figure 1. (a) Given a text-to-image (T2I) model, there are two common methods to adopt it to create undesired contents, [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of our proposed ACE. (a) In CFG, both conditional noise and unconditional noise are adopted to generate high￾quality images. (b) ESD [14] unlearns the target concept (e.g., Mickey) by aligning conditional noise prediction with conditional erasure guidance (CEG). (c) During the fine-tuning, our ACE injects erasure guidance into both conditional and unconditional noise prediction, preventing the production of… view at source ↗
Figure 3
Figure 3. Qualitative comparisons of IP character removal. Our ACE effectively erases the target concept while generating other concepts successfully. autoencoder (VAE) to transform real images x into an im￾age latent z. Then, a text-conditioned diffusion model ϵθ is trained on the latent space to predict latent codes, and mean-squared loss is adopted, LLDM = Ezt,t,c,ϵ∼N(0,I) [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of our ACE method with other methods in terms of editing filtering. After erasing Mickey Mouse, our method filtered out edits involving Mickey Mouse while not affecting edits related to other IP characters. In contrast, the competing methods either fail to p…
Figure 5
Figure 5. Figure 5: Qualitative results of nudity removal. Figure (a) shows the results of explicit editing using SD-Inpainting, while Figure (b) displays images generated using text with explicit label. Static adversarial text is used for editing text, while dynamic adversarial attacks a…
Figure 6
Figure 6. Figure 6: Qualitative results of artistic style removal. Our method erases the target style effectively and has minimal impact on other artistic styles. these concepts as priors. By adding this loss, it ensures that the erasure guidance introduced during training aligns with our…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 21 canonical work pages

  1. [1]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ah- mad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 ,

    arXiv

  2. [2]

    Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019

    P Bedapudi. Nudenet: Neural nets for nudity classification, detection and selective censoring, 2019. 8

    2019

  3. [3]

    Sega: Instructing text-to-image models using semantic guidance

    Manuel Brack, Felix Friedrich, Dominik Hintersdorf, Lukas Struppek, Patrick Schramowski, and Kristian Kersting. Sega: Instructing text-to-image models using semantic guidance. Advances in Neural Information Processing Systems , 36: 25365–25389, 2023. 2

    2023

  4. [4]

    Ledits++: Limitless image editing using text-to-image models

    Manuel Brack, Felix Friedrich, Katharia Kornmeier, Linoy Tsaban, Patrick Schramowski, Kristian Kersting, and Apolin´ario Passos. Ledits++: Limitless image editing using text-to-image models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 8861–8870, 2024. 1, 2, 4, 6

    work page 2024

  5. [5]

    In- structpix2pix: Learning to follow image editing instructions

    Tim Brooks, Aleksander Holynski, and Alexei A Efros. In- structpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18392–18402, 2023. 2

    2023

  6. [6]

    Masactrl: Tuning-free mu- tual self-attention control for consistent image synthesis and editing

    Mingdeng Cao, Xintao Wang, Zhongang Qi, Ying Shan, Xi- aohu Qie, and Yinqiang Zheng. Masactrl: Tuning-free mu- tual self-attention control for consistent image synthesis and editing. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 22560–22570, 2023. 2, 6, 3

    work page 2023

  7. [7]

    Muse: Text-to-image generation via masked generative transform- ers

    Huiwen Chang, Han Zhang, Jarred Barber, AJ Maschinot, Jose Lezama, Lu Jiang, Ming-Hsuan Yang, Kevin Mur- phy, William T Freeman, Michael Rubinstein, et al. Muse: Text-to-image generation via masked generative transform- ers. arXiv preprint arXiv:2301.00704, 2023. 2

    arXiv 2023

  8. [8]

    Attend-and-excite: Attention-based se- mantic guidance for text-to-image diffusion models

    Hila Chefer, Yuval Alaluf, Yael Vinker, Lior Wolf, and Daniel Cohen-Or. Attend-and-excite: Attention-based se- mantic guidance for text-to-image diffusion models. ACM Transactions on Graphics (TOG), 42(4):1–10, 2023. 2

    2023

Show all 70 references
  1. [9]

    Eiup: A training-free approach to erase non-compliant concepts conditioned on implicit unsafe prompts

    Die Chen, Zhiwen Li, Mingyuan Fan, Cen Chen, Wenmeng Zhou, and Yaliang Li. Eiup: A training-free approach to erase non-compliant concepts conditioned on implicit unsafe prompts. arXiv preprint arXiv:2408.01014, 2024. 2

    2024 arXiv

  2. [10]

    Prompting4debugging: Red- teaming text-to-image diffusion models by finding problem- atic prompts

    Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin- Yu Chen, and Wei-Chen Chiu. Prompting4debugging: Red- teaming text-to-image diffusion models by finding problem- atic prompts. arXiv preprint arXiv:2309.06135, 2023. 3, 8

    2023

  3. [11]

    Espresso: Robust concept filtering in text-to-image models

    Anudeep Das, Vasisht Duddu, Rui Zhang, and N Asokan. Espresso: Robust concept filtering in text-to-image models. arXiv preprint arXiv:2404.19227, 2024. 2

    2024 arXiv

  4. [12]

    Scaling recti- fied flow transformers for high-resolution image synthesis, march 2024

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas M ¨uller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling recti- fied flow transformers for high-resolution image synthesis, march 2024. URL http://arxiv. org/abs/2403.0320...

    2024 arXiv

  5. [13]

    Vitaglyph: Vital- izing artistic typography with flexible dual-branch diffusion models

    Kailai Feng, Yabo Zhang, Haodong Yu, Zhilong Ji, Jinfeng Bai, Hongzhi Zhang, and Wangmeng Zuo. Vitaglyph: Vital- izing artistic typography with flexible dual-branch diffusion models. arXiv preprint arXiv:2410.01738, 2024. 1

    2024 arXiv

  6. [14]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 2, 3, 4, 6, 7, 8

    2023

  7. [15]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision , pages 5111–5120, 2024. 2

    2024

  8. [16]

    Meta-unlearning on diffusion models: Preventing relearning unlearned concepts

    Hongcheng Gao, Tianyu Pang, Chao Du, Taihang Hu, Zhijie Deng, and Min Lin. Meta-unlearning on diffusion models: Preventing relearning unlearned concepts. arXiv preprint arXiv:2410.12777, 2024. 2

    2024 arXiv

  9. [17]

    Reliable and efficient concept erasure of text-to- image diffusion models

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu- Gang Jiang. Reliable and efficient concept erasure of text-to- image diffusion models. arXiv preprint arXiv:2407.12383,

    arXiv

  10. [18]

    Fantastic copyrighted beasts and how (not) to generate them

    Luxi He, Yangsibo Huang, Weijia Shi, Tinghao Xie, Hao- tian Liu, Yue Wang, Luke Zettlemoyer, Chiyuan Zhang, Danqi Chen, and Peter Henderson. Fantastic copyrighted beasts and how (not) to generate them. arXiv preprint arXiv:2406.14526, 2024. 2

    2024 arXiv

  11. [19]

    Prompt-to-prompt im- age editing with cross attention control

    Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompt im- age editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022. 2

    2022 arXiv

  12. [20]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium. Advances in neural information processing systems , 30, 2017. 8, 3

    2017

  13. [21]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598, 2022. 2, 4

    2022 arXiv

  14. [22]

    All but one: Surgical concept erasing with model preservation in text-to- image diffusion models

    Seunghoo Hong, Juhun Lee, and Simon S Woo. All but one: Surgical concept erasing with model preservation in text-to- image diffusion models. In Proceedings of the AAAI Con- ference on Artificial Intelligence, pages 21143–21151, 2024. 2

    2024

  15. [23]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021. 6

    2021 arXiv

  16. [24]

    Receler: Reliable concept erasing of text-to-image dif- fusion models via lightweight erasers

    Chi-Pin Huang, Kai-Po Chang, Chung-Ting Tsai, Yung- Hsuan Lai, Fu-En Yang, and Yu-Chiang Frank Wang. Receler: Reliable concept erasing of text-to-image dif- fusion models via lightweight erasers. arXiv preprint arXiv:2311.17717, 2023. 2

    2023 arXiv

  17. [25]

    Safeguard text-to-image diffusion models with human feedback inversion

    Sanghyun Kim, Seohyeon Jung, Balhae Kim, Moonseok Choi, Jinwoo Shin, and Juho Lee. Safeguard text-to-image diffusion models with human feedback inversion. arXiv preprint arXiv:2407.21032, 2024

    2024 arXiv

  18. [26]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 2

    2023

  19. [27]

    Multi-concept customization of text-to-image diffusion

    Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun-Yan Zhu. Multi-concept customization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1931–1941, 2023. 2

    1931

  20. [28]

    Magiceraser: Eras- ing any objects via semantics-aware control

    Fan Li, Zixiao Zhang, Yi Huang, Jianzhuang Liu, Ren- jing Pei, Bin Shao, and Songcen Xu. Magiceraser: Eras- ing any objects via semantics-aware control. arXiv preprint arXiv:2410.10207, 2024. 2

    2024 arXiv

  21. [29]

    Self-discovering interpretable diffusion latent di- rections for responsible text-to-image generation

    Hang Li, Chengzhi Shen, Philip Torr, V olker Tresp, and Jin- dong Gu. Self-discovering interpretable diffusion latent di- rections for responsible text-to-image generation. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12006–1201...

    2024

  22. [30]

    Text guided image editing with au- tomatic concept locating and forgetting

    Jia Li, Lijie Hu, Zhixian He, Jingfeng Zhang, Tianhang Zheng, and Di Wang. Text guided image editing with au- tomatic concept locating and forgetting. arXiv preprint arXiv:2405.19708, 2024

    2024 arXiv

  23. [31]

    Get what you want, not what you don’t: Image content sup- pression for text-to-image diffusion models

    Senmao Li, Joost van de Weijer, Taihang Hu, Fahad Shah- baz Khan, Qibin Hou, Yaxing Wang, and Jian Yang. Get what you want, not what you don’t: Image content sup- pression for text-to-image diffusion models. arXiv preprint arXiv:2402.05375, 2024. 2

    2024 arXiv

  24. [32]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceeding...

    2014

  25. [33]

    Latent guard: a safety frame- work for text-to-image generation

    Runtao Liu, Ashkan Khakzar, Jindong Gu, Qifeng Chen, Philip Torr, and Fabio Pizzati. Latent guard: a safety frame- work for text-to-image generation. In European Conference on Computer Vision, pages 93–109. Springer, 2025. 2

    2025

  26. [34]

    Grounding dino: Marrying dino with grounded pre-training for open-set object detection

    Shilong Liu, Zhaoyang Zeng, Tianhe Ren, Feng Li, Hao Zhang, Jie Yang, Chunyuan Li, Jianwei Yang, Hang Su, Jun Zhu, et al. Grounding dino: Marrying dino with grounded pre-training for open-set object detection. arXiv preprint arXiv:2303.05499, 2023. 8

    2023 arXiv

  27. [35]

    Mace: Mass concept erasure in diffu- sion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffu- sion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6430– 6440, 2024. 2, 6, 7, 3

    2024

  28. [36]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern R...

    2024

  29. [37]

    Null-text inversion for editing real im- ages using guided diffusion models

    Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real im- ages using guided diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6038–6047, 2023. 2

    2023

  30. [38]

    T2i-adapter: Learning adapters to dig out more controllable ability for text-to-image diffusion models

    Chong Mou, Xintao Wang, Liangbin Xie, Yanze Wu, Jian Zhang, Zhongang Qi, and Ying Shan. T2i-adapter: Learning adapters to dig out more controllable ability for text-to-image diffusion models. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 4296–4304, 2024. 2

    2024

  31. [39]

    Direct unlearning optimization for robust and safe text- to-image models

    Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text- to-image models. arXiv preprint arXiv:2407.21035 , 2024. 2

    2024 arXiv

  32. [40]

    Zero-shot image-to-image translation

    Gaurav Parmar, Krishna Kumar Singh, Richard Zhang, Yijun Li, Jingwan Lu, and Jun-Yan Zhu. Zero-shot image-to-image translation. In ACM SIGGRAPH 2023 Conference Proceed- ings, pages 1–11, 2023. 2

    2023

  33. [41]

    Robust concept erasure using task vectors

    Minh Pham, Kelly O Marshall, Chinmay Hegde, and Niv Cohen. Robust concept erasure using task vectors. arXiv preprint arXiv:2404.03631, 2024. 2

    2024 arXiv

  34. [42]

    Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M ¨uller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023. 1

    2023 arXiv

  35. [43]

    Safe-clip: Removing nsfw concepts from vision-and-language models

    Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, Rita Cucchiara, et al. Safe-clip: Removing nsfw concepts from vision-and-language models. In Proceedings of the European Conference on Computer Vi- sion, 2024. 2

    2024

  36. [44]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  37. [45]

    Red-teaming the stable diffusion safety filter

    Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tram`er. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022. 2

    2022 arXiv

  38. [46]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 1, 2, 3, 7, 8

    2022

  39. [47]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2250...

    2023

  40. [48]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 2, 8

    2023

  41. [49]

    Laion-5b: An open large-scale dataset for training next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural In- f...

    2022

  42. [50]

    In- stantbooth: Personalized text-to-image generation without test-time finetuning

    Jing Shi, Wei Xiong, Zhe Lin, and Hyun Joon Jung. In- stantbooth: Personalized text-to-image generation without test-time finetuning. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 8543–8552, 2024. 2

    2024

  43. [51]

    Rlcp: A reinforcement learning-based copyright protection method for text-to-image diffusion model

    Zhuan Shi, Jing Yan, Xiaoli Tang, Lingjuan Lyu, and Boi Faltings. Rlcp: A reinforcement learning-based copyright protection method for text-to-image diffusion model. arXiv preprint arXiv:2408.16634, 2024. 2

    2024 arXiv

  44. [52]

    Stereo: Towards adversarially ro- bust concept erasing from text-to-image generation models

    Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer, and Karthik Nandakumar. Stereo: Towards adversarially ro- bust concept erasing from text-to-image generation models. arXiv preprint arXiv:2408.16807, 2024. 2

    2024 arXiv

  45. [53]

    Ring-a-bell! how reliable are concept removal meth- ods for diffusion models? arXiv preprint arXiv:2310.10012,

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia- You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal meth- ods for diffusion models? arXiv preprint arXiv:2310.10012,

    arXiv

  46. [54]

    Plug-and-play diffusion features for text-driven image-to-image translation

    Narek Tumanyan, Michal Geyer, Shai Bagon, and Tali Dekel. Plug-and-play diffusion features for text-driven image-to-image translation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1921–1930, 2023. 2

    1921

  47. [55]

    Instantstyle: Free lunch towards style-preserving in text-to-image generation

    Haofan Wang, Matteo Spinelli, Qixun Wang, Xu Bai, Zekui Qin, and Anthony Chen. Instantstyle: Free lunch towards style-preserving in text-to-image generation. arXiv preprint arXiv:2404.02733, 2024. 1

    2024 arXiv

  48. [56]

    Elite: Encoding visual con- cepts into textual embeddings for customized text-to-image generation

    Yuxiang Wei, Yabo Zhang, Zhilong Ji, Jinfeng Bai, Lei Zhang, and Wangmeng Zuo. Elite: Encoding visual con- cepts into textual embeddings for customized text-to-image generation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 15943–15953, 2023. 2

    2023

  49. [57]

    Masterweaver: Taming ed- itability and face identity for personalized text-to-image gen- eration

    Yuxiang Wei, Zhilong Ji, Jinfeng Bai, Hongzhi Zhang, Lei Zhang, and Wangmeng Zuo. Masterweaver: Taming ed- itability and face identity for personalized text-to-image gen- eration. In European Conference on Computer Vision, pages 252–271. Springer, 2025. 2

    2025

  50. [58]

    Un- learning concepts in diffusion model via concept domain correction and concept preserving gradient

    Yongliang Wu, Shiji Zhou, Mingzhuo Yang, Lianzhe Wang, Wenbo Zhu, Heng Chang, Xiao Zhou, and Xu Yang. Un- learning concepts in diffusion model via concept domain correction and concept preserving gradient. arXiv preprint arXiv:2405.15304, 2024. 2

    2024 arXiv

  51. [59]

    Paint by example: Exemplar-based image editing with diffusion mod- els

    Binxin Yang, Shuyang Gu, Bo Zhang, Ting Zhang, Xuejin Chen, Xiaoyan Sun, Dong Chen, and Fang Wen. Paint by example: Exemplar-based image editing with diffusion mod- els. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition , pages 18381–18391,

  52. [60]

    Mma-diffusion: Multimodal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024. 3, 8

    2024

  53. [61]

    Guardt2i: Defending text-to-image models from adversarial prompts

    Yijun Yang, Ruiyuan Gao, Xiao Yang, Jianyuan Zhong, and Qiang Xu. Guardt2i: Defending text-to-image models from adversarial prompts. arXiv preprint arXiv:2403.01446,

    arXiv

  54. [62]

    Safree: Training-free and adaptive guard for safe text-to-image and video generation

    Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. arXiv preprint arXiv:2410.12761, 2024

    2024 arXiv

  55. [63]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1755–1764, 2024. 2

    2024

  56. [64]

    Adding conditional control to text-to-image diffusion models

    Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836–3847, 2023. 2

    2023

  57. [65]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 586–595, 2018. 6

    2018

  58. [66]

    Controlvideo: Training-free controllable text-to-video generation

    Yabo Zhang, Yuxiang Wei, Dongsheng Jiang, Xiaopeng Zhang, Wangmeng Zuo, and Qi Tian. Controlvideo: Training-free controllable text-to-video generation. arXiv preprint arXiv:2305.13077, 2023. 1

    2023 arXiv

  59. [67]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. arXiv preprint arXiv:2405.15234, 2024. 2, 6, 7, 3

    2024 arXiv

  60. [68]

    To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Con- ference on Computer Vision, pages 385–4...

    2025

  61. [69]

    {IP name} {editing word} sits on the chair

    Mengnan Zhao, Lihe Zhang, Tianhang Zheng, Yuqiu Kong, and Baocai Yin. Separable multi-concept erasure from dif- fusion models. arXiv preprint arXiv:2402.05947, 2024. 2 ACE: Anti-Editing Concept Erasure in Text-to-Image Models Supplementary Material The following materials are ...

    2024 arXiv

  62. [70]

    Full body shot of man

    We keep the other editing settings consistent with the recommended settings. The editing texts used for editing with LEDITS++ are the same as those used for generation. The editing words used for MasaCtrl are: running, hands in hands, jumping, standing, sitting, raising hangs,...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.