Pith. sign in

REVIEW 4 major objections 6 minor 65 references

One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Framework

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Concept erasure fails because erasure is text-only; this paper adds the model's own images of the target concept as visual templates and cuts nudity attack success from 76% to 17% with image quality intact.

desk verdict A genuinely new text-image collaborative erasing method with extensive experiments, but the flagship gain is partly confounded because the same NudeNet detector filters the training templates and scores the efficacy metrics. read the letter →

arxiv 2505.11131 v2 pith:BHAEBR3Z submitted 2025-05-16 cs.CV cs.AI

Feiran Li , Qianqian Xu , Shilong Bao , Zhiyong Yang , Xiaochun Cao , Qingming Huang This is my paper · ORCID
classification cs.CVcs.AI
keywords concepterasingtext-to-imagediffusionmodelsmodalitygapnegativeguidanceself-generatedimagestext-guidedrefinementmachineunlearningmodelsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Concept erasure from text-to-image diffusion models has relied on text prompts, and this paper claims that the text-image modality gap is what caps both efficacy and usability: benign-sounding words can still trigger unwanted visuals, and longer word lists plateau while degrading other content. The proposed Co-Erasing framework adds a visual branch: the unmodified model first generates images of the target concept under a simple template, a text-guided attention step distills those images down to concept-relevant features, and both text and refined image embeddings drive the same negative-guidance fine-tuning used by earlier erasure methods. Measured on nudity, attack success under adversarial prompts falls from 76.05% to 16.96% while FID moves only from 18.18 to 18.77 and CLIP is unchanged at 0.302, and the image branch transfers to other erasure frameworks such as SLD and MACE. A sympathetic reader would take the central claim to be that erasure should teach the model what the concept looks like, not just what it is called.

What carries the argument

The load-bearing object is the dual-branch text-image condition injected through decoupled cross-attention, together with a text-guided refinement that turns a raw generated image into a concept-specific template. In the refinement, the image encoder supplies the query $Q_r = E_{\text{image}}(X)$ and the text label supplies key and value $K_r = V_r = E_{\text{text}}(Y)$, so the output embedding keeps only the visual features the text names: $c_{\text{image}} = \operatorname{Softmax}(Q_r K_r^\top/\sqrt{d_r}) V_r$. At each cross-attention layer the U-Net latent attends separately to the text embedding and the refined image embedding, and the two attention outputs are summed; the resulting condition $c = [c_{\text{text}}, c_{\text{image}}]$ enters the ESD-style update $\varepsilon_{\theta^*}(z_t, c, t) \leftarrow \varepsilon_\theta(z_t, t) - \eta[\varepsilon_\theta(z_t, c, t) - \varepsilon_\theta(z_t, t)]$, which suppresses the model's probability of generating the concept. Because the image branch exists only during training, the erased model at inference is architecturally identical to the original, which is what allows the branch to be grafted onto other erasure frameworks.

What would settle it

A direct test compares erasure coverage against template coverage: generate the image set from the single literal prompt "a photo of c", pick test prompts that evoke facets of c absent from those images (for example, scenes a template never produces, such as a ruined church or a wedding interior), and check whether the erased model still generates those facets; the paper's own failure-case figure predicts it will. The sharper version is distributional: self-generated templates and real images of the concept differ in t-SNE space (the paper's Figure 8), so if the modality-gap story is right, erasure should be measurably worse on prompts that target the regions where the real-image distribution has no synthetic counterpart, and improving template diversity should shrink the residual attack success.

Watch

Extended reading notes

Core claim

Co-Erasing starts from the ESD-style negative-guidance objective $P_{\theta^*}(x) \propto P_\theta(x)/P_\theta(c|x)^\eta$ and replaces the purely textual condition with the pair $c = [c_{\text{text}}, c_{\text{image}}]$. The image condition comes from the clean model itself, which generates images of the concept under a template such as "a photo of nudity"; a text-guided refinement, $c_{\text{image}} = \operatorname{Softmax}(Q_r K_r^\top/\sqrt{d_r}) V_r$ with the image encoder as query and the text label as key and value, distills each image down to the features the words name. Text and refined-image embeddings enter the U-Net through separate cross-attention branches whose outputs are summed, and the image branch is dropped at inference. Against the text-only ESD baseline, the reported effect is that adversarial attack success on nudity falls from 76.05% to 16.96% with FID at 18.77 versus 18.18 and CLIP unchanged at 0.302; ablations show unrefined images alone cut attack success to the 27-33% range but push FID above 22, with the refinement module recovering the lost quality. The same visual branch transfers to the SLD and MACE frameworks and to multi-concept erasure, and self-generated templates outperform real NSFW images (ASR 16.96 versus 33.90, FID 18.77 versus 23.89), which the paper takes as evidence that the model's own output best represents its concept knowledge.

Load-bearing premise

Erasure is bounded by what the small self-generated image set shows: any facet of the target concept that the clean model never produces under the chosen prompt template will be absent from the visual templates and will not be erased, a failure mode the paper itself reports in its appendix (features tightly tied to text descriptions never appear in the reference images and survive erasure).

Editorial extensions

If this is right

  • Under the paper's evaluations, the erased model blocks adversarial and learnable-prompt attacks at a rate no text-only erasure reached: for nudity, ASR 16.96% versus 76.05% for ESD and 11.27% for SalUn, while FID and CLIP stay near the ESD baseline instead of degrading toward SalUn's FID of 53.21.
  • The image branch needs no external data and no architecture change at inference, and the paper shows it can be appended to other erasure frameworks: SLD's nudity detections on the I2P set drop from 125 to 22, and MACE's multi-concept scores improve or hold.
  • Erasure stops scaling with word lists: a single template generating 200 images outperforms any tested multi-word descriptor set on both efficacy and usability, which is the direct consequence of replacing text-only concept descriptions with visual ones.
  • Self-generated templates are load-bearing rather than incidental: swapping them for real NSFW images raises ASR from 16.96% to 33.90% and FID from 18.77 to 23.89, supporting the paper's claim that the model's own generations encode exactly the knowledge that needs suppressing.
  • The framework extends beyond nudity to styles, objects, portraits, and multi-concept sets, and the refined erasure consistently lands on the better-efficacy side of the trade-off frontier with usability near the unmodified model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper does not run: template diversity should set the erasure ceiling, so generating the 200 images from several paraphrased templates per concept rather than one should shrink the residual failure cases in its Appendix C.7, where facets tied to text descriptions never appear in the reference images.
  • The refinement module is effectively a text-conditioned visual filter, and the same construction could serve other targeted-removal problems, such as suppressing memorized training images, removing a person's likeness, or erasing a subcategory while keeping the supercategory, whenever a short text label can name the visual content to drop.
  • Because the templates are drawn from the model's own prior, the method carries a lifecycle implication the paper leaves implicit: if the base model is later fine-tuned, its concept knowledge shifts and the stored templates become stale, so erasure quality may degrade until the templates are regenerated from the updated model.
  • One could reverse the paper's comparison and use the synthetic-versus-real distribution gap as a diagnostic: prompts whose outputs fall in the real-image regions with no synthetic counterpart are exactly where a Co-Erasing model should still fail, giving a cheap way to build red-team prompts.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Co-Erasing, a concept-erasing framework for text-to-image diffusion models that augments text prompts with self-generated images of the target concept. The method uses a decoupled cross-attention image branch (IP-Adapter style), a text-guided refinement module (Eq. 6) to isolate concept-relevant visual features, and an ESD-style negative-guidance update (Eq. 7) to fine-tune the U-Net. The authors evaluate on nudity, style, and object erasure, reporting markedly lower attack success rates (e.g., nudity ASR 16.96% vs ESD's 76.05%) with comparable FID/CLIP, plus transfer to SLD and MACE. The claimed contribution is that visual templates close the text-image gap and jointly improve efficacy and usability.

Significance. If the claims hold, this is a valuable contribution to the concept-erasing literature. It introduces a straightforward way to inject visual supervision into erasure, supported by extensive experiments (three task families, six metrics, nine baselines, ablations on image count and source, and transfer to SLD/MACE). The paper ships code and openly discloses the self-generated-image pattern (Figure 8, Table 4). The main caveats are reproducibility (the fine-tuning objective is not stated) and a potential detector-alignment confound in the nudity experiments; both are fixable with additional experiments and disclosure, so the core idea is not invalidated by these issues.

major comments (4)
  1. [§4.2.2, Eq. (7), and Appendix A.4] The fine-tuning objective is never specified. Eq. (7) gives the modified noise target for negative guidance, but the paper does not state the loss function minimized over the U-Net parameters, how the image branch is trained or frozen, or what role the refinement module's parameters play in the optimization. The phrase 'conduct fine-tuning on full parameters' is ambiguous. Without the objective, the method is not reproducible and the ablations in Table 3 cannot be interpreted as attributing improvements to specific components. Please provide the full training loss and update rule.
  2. [Appendix A.4, Appendix A.5, Table 9] There is a potential circularity in the nudity experiments: the self-generated training templates are filtered 'according to the classification scores provided by a classifier' (Appendix A.4), while the efficacy metrics (pre-ASR, ASR, P4D, CCE) all score outputs with the same NudeNet detector at threshold 0.75 (Appendix A.5). If the filtering uses NudeNet, the model is trained to suppress the detector's positive class, which may inflate the measured ASR improvement (e.g., 16.96 vs 76.05). The paper must disclose the filtering classifier and threshold, and should evaluate with an independent detector (e.g., a different NSFW classifier or CLIP-based scoring) to rule out detector-aligned overfitting.
  3. [Table 4 and Figure 8] The comparison between real and self-generated images is confounded by the quality filter. The generated templates are filtered by the classifier, while the real NSFW images appear to be used unfiltered. The conclusion that self-generated images 'better represent the model's knowledge' could instead be an artifact of detector-aligned selection. Please repeat the 'Real' condition with the same filtering procedure applied to the real images, or demonstrate that the result is robust to the filter.
  4. [Appendix C.7 and §4.2.3] The paper's own stated failure mode—'some features are not unique and strongly associated with corresponding text descriptions, and therefore such visual features are not generated in the reference images and, consequently not fully erased'—is a principled limitation of the approach. Since the visual templates are generated from a fixed prompt template, the erasure is bounded by the coverage of that template and the model's ability to generate the target concept. This limitation should be stated in the main text and the claims about 'complete erasure' or 'concept erasure' should be scoped accordingly. The current presentation is honest but the limitation is consequential for the central claim.
minor comments (6)
  1. [Throughout] There are several presentation artifacts: the word 'dasdsa' appears immediately before 'Contents' in the appendix, Figure 1 contains garbled generated text and an 'Added for publication' annotation, and the caption of Figure 1 describes the example without clearly explaining the artifact. Please clean these up.
  2. [Appendix A.3] The definition 'ASR = pre-ASR + post-ASR' is unclear. Since both are success rates in percent, the sum can exceed 100, and the computation of post-ASR is not described. Please clarify whether these are joint or marginal rates and how the sum is intended to be interpreted.
  3. [Table 3] The checkmark rows in the ablation table are ambiguous; the first row (text only) appears to be the ESD baseline, but the reader must infer this. Please label the baseline explicitly and add a note that 'text' means the ESD text-only update.
  4. [§5.1] The paper states that 9 competitors are included, but the quantitative tables list fewer per task. Please clarify which methods are evaluated on each task and why some are omitted.
  5. [Eq. (6)] The dimensions of the refined image embedding are unclear. The paper states cimage is b×4×768, but Eq. (6) with Qr=E_image(X) (a single image vector) and Kr=Vr=E_text(Y) (a sequence of text embeddings) would produce a sequence of length equal to the text length. Please specify the exact shapes and how the output maps to the 4-token image embedding used in the cross-attention.
  6. [Appendix B.5] The transfer to SLD is described as replacing the text embedding c_s with [c_s, c_i] during inference. Please clarify whether this changes the diffusion process only at inference time and whether any training is involved for the SLD variant, since the main method is presented as fine-tuning-based.

Circularity Check

1 steps flagged · score 3.0 of 10

Partial circularity: the nudity visual templates are filtered by the same NudeNet detector that scores efficacy, confounding the real-vs-synthetic ablation; the core derivation is otherwise self-contained.

  1. other [Appendix A.4; Appendix A.5; Table 4 and Section 5.3 (Real Images vs. Synthetic Images)]
    "We discard low-quality images according to the classification scores provided by a classifier, which is just required by the attacking methods. ... When evaluating nudity, we load a pretrained NudeNet with the threshold 0.75."

    For the flagship nudity experiment, the self-generated visual templates are retained or discarded using classifier scores (Appendix A.4), while every efficacy metric is scored by the same kind of detector, NudeNet at threshold 0.75 (Appendix A.5). The visual concept being erased is therefore, at least in part, the evaluation detector's positive class: suppressing the detector-labeled content in the training templates is aligned with the evaluation criterion by construction. The ablation in Table 4 is also uncontrolled: the 'Generated' template set is classifier-filtered, whereas the 'Real' NSFW images are not, so the conclusion that self-generated images better represent the model's knowledge is confounded by detector-aligned filtering.

full rationale

The paper's central derivation is not circular: Co-Erasing augments the ESD negative-guidance objective (Eq. 7) with an image-conditioned cross-attention branch, and the main comparisons are against external benchmarks (I2P, UDA, RAB, COCO-10K) rather than against the training templates. The use of self-generated images is disclosed and motivated by distribution analysis (Figure 8), and the acknowledged coverage limitation in Appendix C.7 is a genuine, non-circular failure mode. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via citation; the image encoder is a pretrained external IP-Adapter component. The one concrete circularity-adjacent issue is the NudeNet coupling: the same detector family filters the training templates and defines the efficacy metric, and the real-vs-generated ablation is not controlled for this filtering. That confound affects the strength of a specific supporting claim (Table 4) and partially the interpretation of the nudity gains, but it does not reduce the entire derivation to its inputs. A score of 3 reflects one genuine evaluation-alignment issue with substantial independent content remaining.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim adds no new physical or conceptual entities. It rests on four load-bearing premises: ESD-style negative guidance, the standard score-to-noise identity, the sufficiency of self-generated images as concept templates, and the ability of a single word's CLIP embedding to isolate the concept in an image. The first two are standard; the last two are domain assumptions, and the self-generated-image premise is acknowledged by the authors as the source of their failure cases.

free parameters (4)
  • number of self-generated training images n = 200 for nudity, parachute, church, tench, French horn, garbage truck; 50 for Van Gogh and Picasso
    Chosen per concept from an ablation (Figure 13); the paper states that 200 gives a balance between efficacy and usability for nudity, and that the image count affects both erasure and generation quality.
  • prompt template for image generation = 'a photo of c', extended for parachute with randomly appended phrases
    The template is hand-designed per concept; the parachute template was extended because the plain prompt 'hardly generate[s] real parachutes' (Appendix A.4).
  • quality-filter threshold for self-generated images = unspecified
    Images are discarded 'according to the classification scores provided by a classifier' (Appendix A.4); the threshold is not given, so the training data selection is not fully specified.
  • guidance scale eta in Eq. 7 = not reported
    The negative guidance strength is carried over from ESD but its value is never stated in the paper, which affects the strength of erasure.
assumptions (4)
  • domain assumption Reducing P(c|x) via ESD-style negative guidance (Eq. 2) is an effective way to erase a concept from a diffusion model.
    The entire training target rests on the ESD objective; this is prior work (Gandikota et al., 2023) but is load-bearing.
  • standard math The epsilon-prediction can be expressed as a noise estimate related to the score (Tweedie's formula, Eq. 7).
    Standard diffusion identity; the cited reference (Bradley, 2021) is about selection bias and does not obviously cover this identity.
  • ad hoc to paper Self-generated images from the clean model faithfully represent the visual knowledge of the target concept inside the model.
    This is the paper's central motivation (Section 4.2.3) and also its central limitation (Appendix C.7).
  • domain assumption CLIP text embeddings of a single-word description (e.g., 'nudity') can isolate the target concept in a generated image through the cross-attention refinement of Eq. 6.
    The text-guided refinement relies on this to strip irrelevant visual content; no analysis of when this fails is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Framework." pith.science (2026). https://pith.science/paper/BHAEBR3Z

@misc{pith2026250511131,
  author       = {Pith},
  title        = {Pith review of: One Image is Worth a Thousand Words: A Usability Preservable Text-Image Collaborative Erasing Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BHAEBR3Z}},
  note         = {Machine review of arXiv:2505.11131}
}
read the original abstract

Concept erasing has recently emerged as an effective paradigm to prevent text-to-image diffusion models from generating visually undesirable or even harmful content. However, current removal methods heavily rely on manually crafted text prompts, making it challenging to achieve a high erasure (efficacy) while minimizing the impact on other benign concepts (usability). In this paper, we attribute the limitations to the inherent gap between the text and image modalities, which makes it hard to transfer the intricately entangled concept knowledge from text prompts to the image generation process. To address this, we propose a novel solution by directly integrating visual supervision into the erasure process, introducing the first text-image Collaborative Concept Erasing (Co-Erasing) framework. Specifically, Co-Erasing describes the concept jointly by text prompts and the corresponding undesirable images induced by the prompts, and then reduces the generating probability of the target concept through negative guidance. This approach effectively bypasses the knowledge gap between text and image, significantly enhancing erasure efficacy. Additionally, we design a text-guided image concept refinement strategy that directs the model to focus on visual features most relevant to the specified text concept, minimizing disruption to other benign concepts. Finally, comprehensive experiments suggest that Co-Erasing outperforms state-of-the-art erasure approaches significantly with a better trade-off between efficacy and usability. Codes are available at https://github.com/Ferry-Li/Co-Erasing.

Figures

Figures reproduced from arXiv: 2505.11131 by the authors.

Figure 1
Figure 1. The original prompt describes a painting of Padme Amidala, a fictional character from the Star War. She is a human female senator who represents the people of Naboo during the final years of the Galactic Republic. Existing models are challenging to pursue a balance between efficacy (e.g., ESD (Gandikota et al., 2023), FMN (Zhang et al., 2024a)) and usability (SalUn (Fan et al., 2024), AdvUnlearn (Zhang et al., 2024c… view at source ↗
Figure 2
Figure 2. Performance overview of Co-Erasing and other methods when erasing nudity. A higher ASR indicates a lower erasing efficacy, meaning the target concept is not erased completely. A higher FID or a lower CLIP score indicates a lower general us￾ability, meaning the benign generation is degraded. Competitive methods include FMN (Zhang et al., 2024a), ESD (Gandikota et al., 2023), SPM (Lyu et al., 2024), UCE (Gandikota et … view at source ↗
Figure 3
Figure 3. Semantically benign words generate inappropriate con￾tent. The word “rhodesian” and “birth” activates the explicit part although not related to the concept nudity. “c ′ ”, and ℓu(·) is an objective function for erasing, similar to Equation (2). However, the perturbed “c ′ ” introduces unnecessary and implicit conceptual noise, undermining the normal generation given benign prompts. A significant limi￾tation of these… view at source ↗
Figures from the paper (34 more)
Figure 5
Figure 5. Figure 5: Similarity between failure cases of nudity and (a) text “nudity” and (b) self-generated NSFW images. Both text and images are processed by CLIP before calculating the similarity. with the word “birth” in the second row. These examples illustrate that semantically unrel…
Figure 6
Figure 6. Figure 6: The first row includes images generated by the clean stable diffusion model. The second row visualizes text-guided refinement maps from the self-generated images. employ an increasingly broader set of words in pursuit of a more complete erasure, which inevitably result…
Figure 8
Figure 8. Figure 8: Distribution of synthetic and real datasets using t-sne. (a) presents the distribution of PORN images in the NSFW dataset and synthetic images generated by “a photo of porn”. (b) presents the distribution of PORN and SEXY in the NSFW dataset and synthetic images genera…
Figure 9
Figure 9. Figure 9: Overall performance comparison with previous methods. AU is short for AdvUnlearn. All metrics in the radar chart have been normalized to [0, 1] and converted to positive indicators, where a larger value indicates a better performance. “…stomach hurts after drinking alc…
Figure 10
Figure 10. Figure 10: Examples of different methods erasing nudity against adversarial prompts. Prompts listed below images act as the base prompts before UDA (Zhang et al., 2024d). Harandi, 2024), (7) ED (Jing et al., 2024), (8) SalUn (Fan et al., 2024), (9) AdvUnlearn (Zhang et al., 2024…
Figure 11
Figure 11. Figure 11: Some generations from models erased w/wo text-guided refinement. The first row presents failure generations from the model without text-guided refinement while the generations in the second row are with text-guided refinement. 5.3. Quantative Analysis For simplicity, …
Figure 12
Figure 12. Figure 12: Retrieved Top-5 phrases by generated images. Note that all images are refined by text-guidance “nudity” before retrieving. Results show that images can reflect a broader conceptual space to recover latent semantics. ESD n=1 n=10 n=200 n=50 n=100 ESD n=1 n=200 n=100 n=…
Figure 13
Figure 13. Figure 13: Comparison of different numbers of images used in the erasing process. The orange-dotted curve represents the frontier achieved by most methods. an expression set (including words and phrases) related to the concept of nudity. With a technique similar to Textual￾Inver…
Figure 14
Figure 14. Figure 14: Overall performance comparison with previous methods. AU is short for AdvUnlearn [PITH_FULL_IMAGE:figures/full_fig_p019_14.png]
Figure 15
Figure 15. Figure 15: Comparison of different numbers of images when erasing Van Gogh and parachute. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]
Figure 16
Figure 16. Figure 16: Comparison of different numbers of images when erasing church and tench. B.4. Fine-grained Erasure To examine the specific erasure efficacy, we use the I2P dataset to generate 4,703 images and count the failure cases in each label provided by NudeNet, as shown in [PI…
Figure 17
Figure 17. Figure 17: Erasing nudity w/wo refinement. 23 [PITH_FULL_IMAGE:figures/full_fig_p023_17.png]
Figure 18
Figure 18. Figure 18: Erasing churchw/wo refinement [PITH_FULL_IMAGE:figures/full_fig_p024_18.png]
Figure 19
Figure 19. Figure 19: Erasing parachutew/wo refinement. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_19.png]
Figure 20
Figure 20. Figure 20: Erasing tenchw/wo refinement. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_20.png]
Figure 21
Figure 21. Figure 21: , [PITH_FULL_IMAGE:figures/full_fig_p026_21.png]
Figure 22
Figure 22. Figure 22: Qualitative comparison of different methods on erasing nudity. 27 [PITH_FULL_IMAGE:figures/full_fig_p027_22.png]
Figure 23
Figure 23. Figure 23: Further Qualitative comparison of different methods on erasing nudity. 28 [PITH_FULL_IMAGE:figures/full_fig_p028_23.png]
Figure 24
Figure 24. Figure 24: Further Qualitative comparison of different methods on erasing nudity. 29 [PITH_FULL_IMAGE:figures/full_fig_p029_24.png]
Figure 25
Figure 25. Figure 25: Qualitative comparison of different methods on erasing tench. 30 [PITH_FULL_IMAGE:figures/full_fig_p030_25.png]
Figure 26
Figure 26. Figure 26: Qualitative comparison of different methods on erasing church. 31 [PITH_FULL_IMAGE:figures/full_fig_p031_26.png]
Figure 27
Figure 27. Figure 27: Qualitative comparison of different methods on erasing parachute. 32 [PITH_FULL_IMAGE:figures/full_fig_p032_27.png]
Figure 28
Figure 28. Figure 28: Visualization of Co-Erasing on CIFAR-10 objects. 33 [PITH_FULL_IMAGE:figures/full_fig_p033_28.png]
Figure 29
Figure 29. Figure 29: Visualization of Co-Erasing on CIFAR-10 objects. 34 [PITH_FULL_IMAGE:figures/full_fig_p034_29.png]
Figure 30
Figure 30. Figure 30: Visualization of Co-Erasing on CIFAR-10 objects. 35 [PITH_FULL_IMAGE:figures/full_fig_p035_30.png]
Figure 31
Figure 31. Figure 31: Visualization of Co-Erasing on CIFAR-10 objects. 36 [PITH_FULL_IMAGE:figures/full_fig_p036_31.png]
Figure 32
Figure 32. Figure 32: Visualization of Co-Erasing on CIFAR-10 objects. 37 [PITH_FULL_IMAGE:figures/full_fig_p037_32.png]
Figure 33
Figure 33. Figure 33: Visualization of Co-Erasing on styles. 38 [PITH_FULL_IMAGE:figures/full_fig_p038_33.png]
Figure 34
Figure 34. Figure 34: Visualization of Co-Erasing on styles. 39 [PITH_FULL_IMAGE:figures/full_fig_p039_34.png]
Figure 35
Figure 35. Figure 35: Visualization of Co-Erasing on portraits. 40 [PITH_FULL_IMAGE:figures/full_fig_p040_35.png]
Figure 36
Figure 36. Figure 36: Visualization of Co-Erasing on portraits. 41 [PITH_FULL_IMAGE:figures/full_fig_p041_36.png]
Figure 37
Figure 37. Figure 37: Visualization of Co-Erasing on multiple objects. 42 [PITH_FULL_IMAGE:figures/full_fig_p042_37.png]
Figure 38
Figure 38. Figure 38: Visualization of Co-Erasing on multiple objects. 43 [PITH_FULL_IMAGE:figures/full_fig_p043_38.png]
Figure 39
Figure 39. Figure 39: We infer that some features are not unique and strongly associated with corresponding text descriptions, and therefore such visual features are not generated in the reference images and, consequently not fully erased. horse tench church Erasing Targets [PITH_FULL_IMA…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

65 extracted references · 56 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    and Harold, S

    Alvin, H. and Harold, S. Selective amnesia: A continual learning approach to forgetting in deep generative models. In NeurIPS, pp.\ 17170--17194, 2023

    work page 2023

  3. [3]

    Collaborative preference embedding against sparse labels

    Bao, S., Xu, Q., Ma, K., Yang, Z., Cao, X., and Huang, Q. Collaborative preference embedding against sparse labels. In ACM Multimedia, pp.\ 2079--2087, 2019

    work page 2019

  4. [4]

    The minority matters: A diversity-promoting collaborative metric learning algorithm

    Bao, S., Xu, Q., Yang, Z., He, Y., Cao, X., and Huang, Q. The minority matters: A diversity-promoting collaborative metric learning algorithm. NeurIPS, pp.\ 2451--2464, 2022

    work page 2022

  5. [5]

    Aucpro: Auc-oriented provable robustness learning

    Bao, S., Xu, Q., Yang, Z., He, Y., Cao, X., and Huang, Q. Aucpro: Auc-oriented provable robustness learning. TPAMI, 2025

    work page 2025

  6. [6]

    Tweedie’s formula and selection bias

    Bradley, R. Tweedie’s formula and selection bias. Journal of the American Statistical Association,, pp.\ 1602--1614, 2021

    work page 2021

  7. [7]

    Erasing undesirable concepts in diffusion models with adversarial preservation

    Bui, A., Vuong, L., Doan, K., Le, T., Montague, P., Abraham, T., and Phung, D. Erasing undesirable concepts in diffusion models with adversarial preservation. NeurIPS, 2024

    work page 2024

  8. [8]

    Instance-conditioned gan

    Casanova, A., Marlène, C., Verbeek, J., Drozdzal, M., and Adriana, R.-S. Instance-conditioned gan. arXiv, 2021

    work page 2021

Show all 65 references
  1. [9]

    Changhoon, K., Kyle, M., and Yang, Y. R.a.c.e. : Robust adversarial concept erasure for secure text-to-image diffusion model. In ECCV, pp.\ 461--478, 2024

    2024

  2. [10]

    Reliable and efficient concept erasure of text-to-image diffusion models

    Chao, G., Kai, C., Zhipeng, W., Jingjing, C., and Yu-Gang, J. Reliable and efficient concept erasure of text-to-image diffusion models. In ECCV, pp.\ 73--88, 2024

    2024

  3. [11]

    Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation

    Fan, C., Liu, J., Zhang, Y., Wong, E., Wei, D., and Liu, S. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. In ICLR, 2024

    2024

  4. [12]

    Erasing concepts from diffusion models

    Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., and Bau, D. Erasing concepts from diffusion models. In ICCV, pp.\ 2426--2436, 2023

    2023

  5. [13]

    Unified concept editing in diffusion models

    Gandikota, R., Orgad, H., Belinkov, Y., Materzy \'n ska, J., and Bau, D. Unified concept editing in diffusion models. In WACV, pp.\ 5111--5120, 2024

    2024

  6. [14]

    Eraseanything: Enabling concept erasure in rectified flow transformers

    Gao, D., Lu, S., Walters, S., Zhou, W., Chu, J., Zhang, J., Zhang, B., Jia, M., Zhao, J., Fan, Z., et al. Eraseanything: Enabling concept erasure in rectified flow transformers. arXiv preprint arXiv:2412.20413, 2024

    2024 arXiv

  7. [15]

    Generative adversarial nets

    Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. Generative adversarial nets. In NeurIPS, pp.\ 2672--2680, 2014

    2014

  8. [16]

    Aucseg: Auc-oriented pixel-level long-tail semantic segmentation

    Han, B., Xu, Q., Yang, Z., Bao, S., Wen, P., Jiang, Y., and Huang, Q. Aucseg: Auc-oriented pixel-level long-tail semantic segmentation. In NeurIPS, 2024

    2024

  9. [17]

    L., and Choi, Y

    Hessel, J., Holtzman, A., Forbes, M., Bras, R. L., and Choi, Y. Clipscore: A reference-free evaluation metric for image captioning. arXiv, 2021

    2021

  10. [18]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In NeurIPS, pp.\ 6626--6637, 2017

    2017

  11. [19]

    Classifier-free diffusion guidance

    Ho, J. Classifier-free diffusion guidance. ArXiv, 2022

    2022

  12. [20]

    Denoising diffusion probabilistic models

    Ho, J., Jain, A., and Abbeel, P. Denoising diffusion probabilistic models. In NeurIPS, 2020

    2020

  13. [21]

    J., Norouzi, M., and Salimans, T

    Ho, J., Saharia, C., Chan, W., Fleet, D. J., Norouzi, M., and Salimans, T. Cascaded diffusion models for high fidelity image generation. JMLR, pp.\ 1--33, 2022

    2022

  14. [22]

    Reconboost: Boosting can achieve modality reconcilement

    Hua, C., Xu, Q., Bao, S., Yang, Z., and Huang, Q. Reconboost: Boosting can achieve modality reconcilement. In ICML, pp.\ 19573--19597, 2024

    2024

  15. [23]

    Huang, C.-P., Chang, K.-P., Tsai, C.-T., Lai, Y.-H., Yang, F.-E., and Wang, Y.-C. F. Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. arXiv, 2023

    2023

  16. [24]

    Hierarchical set-to-set representation for 3-d cross-modal retrieval

    Jiang, Y., Hua, C., Feng, Y., and Gao, Y. Hierarchical set-to-set representation for 3-d cross-modal retrieval. TNNLS, 2023

    2023

  17. [25]

    Erasediff: Erasing data influence in diffusion models

    Jing, W., Trung, L., Munawar, H., and Mehrtash, H. Erasediff: Erasing data influence in diffusion models. arXiv, 2024

    2024

  18. [26]

    Imagic: Text-based real image editing with diffusion models

    Kawar, B., Zada, S., Lang, O., Tov, O., Chang, H., Dekel, T., Mosseri, I., and Irani, M. Imagic: Text-based real image editing with diffusion models. In CVPR, pp.\ 6007--6017, 2023

    2023

  19. [27]

    Kingma, D. P. and Welling, M. Auto-encoding variational bayes. arXiv, 2013

    2013

  20. [28]

    Ablating concepts in text-to-image diffusion models

    Kumari, N., Zhang, B., Wang, S.-Y., Shechtman, E., Zhang, R., and Zhu, J.-Y. Ablating concepts in text-to-image diffusion models. In ICCV, pp.\ 22691--22702, 2023

    2023

  21. [29]

    Size-invariance matters: Rethinking metrics and losses for imbalanced multi-object salient object detection

    Li, F., Xu, Q., Bao, S., Yang, Z., Cong, R., Cao, X., and Huang, Q. Size-invariance matters: Rethinking metrics and losses for imbalanced multi-object salient object detection. In ICML, pp.\ 28989--29021, 2024

    2024

  22. [30]

    Diffusion models for image restoration and enhancement--a comprehensive survey

    Li, X., Ren, Y., Jin, X., Lan, C., Wang, X., Zeng, W., Wang, X., and Chen, Z. Diffusion models for image restoration and enhancement--a comprehensive survey. arXiv, 2023

    2023

  23. [31]

    W., Zhang, Y., Kwon, Y., Yeung, S., and Zou, J

    Liang, V. W., Zhang, Y., Kwon, Y., Yeung, S., and Zou, J. Y. Mind the gap: Understanding the modality gap in multi-modal contrastive representation learning. NeurIPS, pp.\ 17612--17625, 2022

    2022

  24. [32]

    Lu, S., Wang, Z., Li, L., Liu, Y., and Kong, A. W.-K. Mace: Mass concept erasure in diffusion models. In CVPR, pp.\ 6430--6440, 2024

    2024

  25. [33]

    One-dimensional adapter to rule them all: Concepts, diffusion models and erasing applications

    Lyu, M., Yang, Y., Hong, H., Chen, H., Jin, X., He, Y., Xue, H., Han, J., and Ding, G. One-dimensional adapter to rule them all: Concepts, diffusion models and erasing applications. In CVPR, pp.\ 7559--7568, 2024

    2024

  26. [34]

    SDE dit: Guided image synthesis and editing with stochastic differential equations

    Meng, C., He, Y., Song, Y., Song, J., Wu, J., Zhu, J.-Y., and Ermon, S. SDE dit: Guided image synthesis and editing with stochastic differential equations. In ICLR, 2022

    2022

  27. [35]

    M., Niv, C., Govind, M., and Hegde, C

    Minh, P., Kelly, O. M., Niv, C., Govind, M., and Hegde, C. Circumventing concept erasure methods for text-to-image generative models. In ICLR, 2023

    2023

  28. [36]

    and Osindero, S

    Mirza, M. and Osindero, S. Conditional generative adversarial nets. arXiv, 2014

    2014

  29. [37]

    W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. Learning transferable visual models from natural language supervision. In ICML, pp.\ 8748--8763, 2021

    2021

  30. [38]

    Zero-shot text-to-image generation

    Ramesh, A., Pavlov, M., Goh, G., Gray, S., Voss, C., Radford, A., Chen, M., and Sutskever, I. Zero-shot text-to-image generation. In ICML, pp.\ 8821--8831, 2021

    2021

  31. [39]

    High-resolution image synthesis with latent diffusion models

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In CVPR, pp.\ 10684--10695, 2022

    2022

  32. [40]

    U-net: Convolutional networks for biomedical image segmentation

    Ronneberger, O., Fischer, P., and Brox, T. U-net: Convolutional networks for biomedical image segmentation. In MICCAI, pp.\ 234--241, 2015

    2015

  33. [41]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models

    Schramowski, P., Brack, M., Deiseroth, B., and Kersting, K. Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In CVPR, pp.\ 22522--22531, 2023

    2023

  34. [42]

    Laion-5b: An open large-scale dataset for training next generation image-text models

    Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Kornblith, S., and Alayrac, J.-B. Laion-5b: An open large-scale dataset for training next generation image-text models. arXiv, 2022

    2022

  35. [43]

    Learning structured output representation using deep conditional generative models

    Sohn, K., Lee, H., and Yan, X. Learning structured output representation using deep conditional generative models. In NeurIPS, volume 28, pp.\ 3483--3491, 2015

    2015

  36. [44]

    Denoising diffusion implicit models

    Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. arXiv, 2021

    2021

  37. [45]

    and Nishimoto, S

    Takagi, Y. and Nishimoto, S. High-resolution image reconstruction with latent diffusion models from human brain activity. In CVPR, pp.\ 14453--14463, 2023

    2023

  38. [46]

    Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint arXiv:2310.10012, 2023

    Tsai, Y.-L., Hsu, C.-Y., Xie, C., Lin, C.-H., Chen, J.-Y., Li, B., Chen, P.-Y., Yu, C.-M., and Huang, C.-Y. Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint arXiv:2310.10012, 2023

    2023 arXiv

  39. [47]

    Stylenat: Giving each head a new perspective

    Walton, S., Hassani, A., Xu, X., Wang, Z., and Shi, H. Stylenat: Giving each head a new perspective. arXiv, 2022

    2022

  40. [48]

    Sample then identify: A general framework for risk control and assessment in multimodal large language models

    Wang, Q., Geng, T., Wang, Z., Wang, T., Fu, B., and Zheng, F. Sample then identify: A general framework for risk control and assessment in multimodal large language models. ICLR, 2025

    2025

  41. [49]

    and Harandi, M

    Wu, J. and Harandi, M. Scissorhands: Scrub data influence via connection sensitivity in networks. In ECCV, 2024

    2024

  42. [50]

    P., Verbin, D., Barron, J

    Wu, R., Mildenhall, B., Henzler, P., Park, K., Gao, R., Watson, D., Srinivasan, P. P., Verbin, D., Barron, J. T., Poole, B., et al. Reconfusion: 3d reconstruction with diffusion priors. In CVPR, pp.\ 21551--21561, 2024

    2024

  43. [51]

    Paint by example: Exemplar-based image editing with diffusion models

    Yang, B., Gu, S., Zhang, B., Zhang, T., Chen, X., Sun, X., Chen, D., and Wen, F. Paint by example: Exemplar-based image editing with diffusion models. In CVPR, pp.\ 18381--18391, 2023 a

    2023

  44. [52]

    When all we need is a piece of the pie: A generic framework for optimizing two-way partial auc

    Yang, Z., Xu, Q., Bao, S., He, Y., Cao, X., and Huang, Q. When all we need is a piece of the pie: A generic framework for optimizing two-way partial auc. In ICML, pp.\ 11820--11829, 2021

    2021

  45. [53]

    Revisiting auc-oriented adversarial training with loss-agnostic perturbations

    Yang, Z., Xu, Q., Hou, W., Bao, S., He, Y., Cao, X., and Huang, Q. Revisiting auc-oriented adversarial training with loss-agnostic perturbations. TPAMI, pp.\ 15494--15511, 2023 b

    2023

  46. [54]

    Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models

    Ye, H., Zhang, J., Liu, S., Han, X., and Yang, W. Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models. arXiv, 2023

    2023

  47. [55]

    and Lu, J

    Ye, S. and Lu, J. Sequence unlearning for sequential recommender systems. In Australasian Joint Conference on Artificial Intelligence, pp.\ 403--415, 2023

    2023

  48. [56]

    and Lu, J

    Ye, S. and Lu, J. Robust recommender systems with rating flip noise. ACM Transactions on Intelligent Systems and Technology, pp.\ 1--19, 2024

    2024

  49. [57]

    Towards safe machine unlearning: A paradigm that mitigates performance degradation

    Ye, S., Lu, J., and Zhang, G. Towards safe machine unlearning: A paradigm that mitigates performance degradation. In Proceedings of the ACM on Web Conference 2025, pp.\ 4635--4652, 2025

    2025

  50. [58]

    Scaling autoregressive models for content-rich text-to-image generation

    Yu, J., Xu, Y., Koh, J., Luong, T., Baid, G., Wang, Z., Vasudevan, V., Ku, A., Yang, Y., Ayan, B., Hutchinson, B., Han, W., Parekh, Z., Li, X., Zhang, H., Baldridge, J., and Wu, Y. Scaling autoregressive models for content-rich text-to-image generation. arXiv, 2022

    2022

  51. [59]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Zhang, G., Wang, K., Xu, X., Wang, Z., and Shi, H. Forget-me-not: Learning to forget in text-to-image diffusion models. In CVPR Workshops, pp.\ 1755--1764, 2024 a

    2024

  52. [60]

    Adding conditional control to text-to-image diffusion models

    Zhang, L., Rao, A., and Agrawala, M. Adding conditional control to text-to-image diffusion models. In ICCV, pp.\ 3836--3847, 2023

    2023

  53. [61]

    Long-tailed diffusion models with oriented calibration

    Zhang, T., Zheng, H., Yao, J., Wang, X., Zhou, M., Zhang, Y., and Wang, Y. Long-tailed diffusion models with oriented calibration. In ICLR, 2024 b

    2024

  54. [62]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models

    Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., Hong, M., Ding, K., and Liu, S. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. In NeurIPS, 2024 c

    2024

  55. [63]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., and Liu, S. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In ECCV, pp.\ 385--403, 2024 d

    2024

  56. [64]

    Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts

    Zhi-Yi, C., Chieh-Ming, J., Ching-Chun, H., Pin-Yu, C., and Wei-Chen, C. Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. In ICML, pp.\ 8468--8486, 2024

    2024

  57. [65]

    Shifted diffusion for text-to-image generation

    Zhou, Y., Liu, B., Zhu, Y., Yang, X., Chen, C., and Xu, J. Shifted diffusion for text-to-image generation. In CVPR, pp.\ 10157--10166, 2023

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.