Pith. sign in

REVIEW 3 major objections 7 minor 41 references

SuMa: A Subspace Mapping Approach for Robust and Effective Concept Erasure in Text-to-Image Diffusion Models

T0 review · 3 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Erasing a narrow concept from a diffusion model works best by mapping its learned token subspace onto a nearby general subspace, which keeps adversarial token-recovery attacks below 20 percent while holding image quality close to original.

desk verdict SuMa's subspace-mapping idea is genuinely new and the results are good enough to deserve a serious referee, but the robustness claim needs a diagnostic and variance reporting. read the letter →

arxiv 2509.05625 v1 pith:GA2YMLMJ submitted 2025-09-06 cs.CV

Kien Nguyen , Anh Tran , Cuong Pham This is my paper · ORCID
classification cs.CV
keywords concepterasuretext-to-imagediffusionTextualInversionadversarialrobustnessCCEattacksubspacemappingmodelunlearningnarrowconcepts
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that narrow concepts—a specific celebrity, a copyrighted character like Grumpy Cat, or a painter's style—can be erased from a text-to-image diffusion model in a way that is both resistant to adversarial token-recovery attacks and gentle on image quality. It argues that the right object to erase is not one token but the low-dimensional subspace spanned by several Textual Inversion tokens, and that this subspace should be mapped onto a nearby reference subspace rather than pushed away. If correct, this closes the gap between methods that erase completely but wreck image quality and methods that keep quality but stay vulnerable to attacks.

What carries the argument

The load-bearing mechanism is a two-stage subspace construction and elimination. In the first stage, Concept Ablation is applied repeatedly to the model; after each round, Textual Inversion finds a token for the target concept, and the first three tokens form the target subspace $U_i$ (with tokens from early TI training steps forming the reference subspace $V_i$). In the second stage, the to-k and to-v weight matrices of all cross-attention layers are fine-tuned with loss $L_{\text{sub}} = L_{\text{proj}} + \lambda_{\text{reg}} L_{\text{reg}}$, where $L_{\text{proj}}$ is the squared distance between each target basis vector and its projection onto $V_i$, and $L_{\text{reg}}$ keeps the reference subspace fixed. This is combined with a Concept Ablation loss so the noise prediction is also redirected. The 0.6 cosine-similarity threshold between a token and the target subspace is treated as sufficient for that token to be erased.

What would settle it

Run CCE on the SuMa-erased model for several concepts, collect the returned adversarial token, and compute its cosine similarity to the target subspace span; if an attack token with similarity below 0.6 still regenerates the concept with attack success above 0.2, the subspace hypothesis is refuted. Alternatively, rebuild the target subspace with a fourth TI token; if CCE attack success changes materially, the three-token span is not the full story.

Watch

Extended reading notes

Core claim

SuMa's central claim is that a narrow concept is fully represented by a three-dimensional span of Textual Inversion tokens in the cross-attention transformed embedding space of a concept-erased model, and that projecting this target subspace onto a reference subspace built from early Textual Inversion steps erases the concept while keeping generation quality near its original level. The paper reports attack success rates below 0.2 for both CCE and UnlearnDiff across subclass, identity, artistic style, and instance categories, with FID close to effective-erasure baselines, and a larger quality gap in the instance category.

Load-bearing premise

The paper rests on the empirical subspace hypothesis of Section 3.1: a narrow concept is fully captured by the three-dimensional span of a few Textual Inversion tokens, and any token with cosine similarity above 0.6 to that span is erased along with it; this threshold and dimension come from a toy Concept Ablation experiment rather than a derivation, and an incomplete span would leave a bypass token for attacks like CCE.

Editorial extensions

If this is right

  • If SuMa's subspace hypothesis holds, any narrow concept for which Textual Inversion can find tokens fits the same two-stage recipe, not just the four categories tested.
  • Because the final objective combines subspace projection with a base erasure loss, SuMa inherits and improves the base method: it fixes CA's vulnerability to CCE and even helps with concepts CA alone fails on, like Golf Ball and Mickey Mouse.
  • SuMa is designed to work alongside image-space editing approaches: erasing narrow concepts first and then applying DUO to NSFW content yields attack success and FID close to applying DUO alone.
  • The evaluation's 0.2 attack-success threshold gives a concrete operational definition of what 'erased' means against current adversarial token search.
  • The appendices show the mapping variant preserves image quality much better than a pushing variant with similar attack resistance, favoring directional mapping over repulsion in future erasure methods.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 0.6 cosine threshold, if it holds across concepts, gives a testable clustering rule: any token within that similarity of the target span is erased, which could be used to audit erasure coverage before deployment.
  • The three-token span is an empirical choice; varying the subspace dimension and measuring CCE success would reveal whether the span is truly complete or just sufficient for the tested concepts.
  • Because the method inherits Textual Inversion's sensitivity, it likely degrades for concepts where early TI steps already converge to the target, as the paper itself notes for NSFW content; this makes reference-subspace selection the bottleneck.
  • Treating a concept as a linear subspace of cross-attention embeddings is a useful abstraction beyond erasure, e.g., for concept localization or targeted editing, though the paper does not explore those directions.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper introduces SuMa, a concept-erasure method for narrow concepts (subclasses, celebrities, artistic styles, instances) in text-to-image diffusion models. SuMa first constructs a target subspace from three Textual Inversion (TI) tokens recovered from the concept-erased model, and a reference subspace from an early-step TI token, then fine-tunes the cross-attention weights to project the target subspace onto the reference subspace while regularizing the reference. Experiments across four tasks, two attacks (CCE and UnlearnDiff), and several baselines report attack success rates (ASR) below 0.2 for SuMa with FID/CLIP scores close to non-robust baselines, leading the authors to claim the first method that is both robust and effective for narrow concepts.

Significance. If the claims hold, SuMa would be a meaningful advance: it targets narrow concepts such as copyrighted characters and celebrities, which existing robust methods (e.g., STEREO, DUO) handle poorly, and it proposes a novel subspace-mapping loss that balances completeness and image quality. The experimental scope is broad and includes diagnostic toy experiments that motivate the subspace hypothesis. However, the central robustness claim rests on an empirically motivated hypothesis whose transfer to the mapping loss is not directly validated, and the comparisons would be strengthened by variance estimates and release of code.

major comments (3)
  1. [Sec. 3.1 and 3.3, Eq. (4)] The hypothesis that a narrow concept is fully captured by a 3D subspace and that any token with cosine similarity above 0.6 to that subspace is erased is established only in a CA-based toy experiment, not under the proposed mapping objective L_proj. Equation (4) directly penalizes only the collected basis vectors, so the paper's robustness claim relies on an unverified transfer of this empirical observation. The nonzero CCE ASRs in Table 2 (0.05–0.17) are never diagnosed: the paper does not report the cosine similarity between the CCE-recovered tokens and the constructed target subspace, nor the residual norm after projection. This is load-bearing because the headline contribution is robustness against CCE for narrow concepts. I recommend adding diagnostics that measure these quantities for each concept and attack, together with ablations over the subspace size (e.g., 2, 3, 4 tokens) and the similarity threshold (e.g., 0.5, 0.6, 0.7).
  2. [Table 2 and Sec. 4.1] All experimental results are reported as single numbers without variance, multiple seeds, or significance tests. Given that the Instance-category FID for SuMa is 22.34 versus 16.93 for MACE, and several ASR values lie close to the 0.2 threshold (e.g., 0.17 for Instance CCE), the stability of the claimed trade-off is unclear. Moreover, STEREO and DUO are reimplemented rather than run from official code; a mismatch in hyperparameters could bias the comparison. The authors should report mean and standard deviation over at least three seeds, and ideally make the code and trained models available for verification.
  3. [Sec. 4.2, Table 2 (Instance row)] The Instance category exhibits a notable image-quality drop: FID 22.34 (vs. ~17 for MACE) and CLIP 0.29 (vs. 0.31 for MACE), while the ASR is 0.17/0.15, close to the 0.2 threshold. The paper attributes this to using 750 fine-tuning steps, but this is not investigated. The claim that SuMa achieves image quality 'comparable to approaches focused on effectiveness' is overstated for this category. The authors should ablate the number of fine-tuning steps and clarify whether the quality drop is inherent to the method or an artifact of the chosen training duration.
minor comments (7)
  1. [Abstract] There is a punctuation error: 'concept.,' should be 'concept'.
  2. [Sec. 3.3] 'respestively' should be 'respectively'.
  3. [Table 4 caption] 'Regulization' should be 'Regularization'.
  4. [Sec. 3.2] 'Euclid distance' should be 'Euclidean distance'.
  5. [Sec. 4.1, CCE evaluation] Please specify how the 'different set of images' for the CCE attack is chosen and its size, to ensure that the evaluation does not overlap with the subspace-construction images.
  6. [Eq. (5) and reference [3]] The paper cites [3] for the regularization term but presents L_reg as a new formula; please clarify what is taken from [3] and what is novel.
  7. [Appendix D, Table 7] The table shows that applying L_sub alone yields ASR above 50% for Identity and Artistic Style, indicating a heavy reliance on the CA loss. This sensitivity deserves a more detailed explanation in the main text, as it affects the interpretation of the method's robustness.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SuMa's construction, objective, and evaluation are not equivalent by construction; the shared TI mechanism is a test-design feature, not a tautology.

full rationale

The paper's derivation chain is self-contained. SuMa builds a target subspace from Textual Inversion tokens collected on intermediate CA-erased models and a reference subspace from early-step TI tokens (Eq. 2), and defines an explicit algebraic objective L_sub = L_proj + λ_reg L_reg (Eqs. 4–6) that projects the target basis onto the reference basis. Robustness is then measured by running CCE and UnlearnDiff on the final fine-tuned model and reporting ASR (Table 2). Although CCE and the subspace-construction stage both search with Textual Inversion, the evaluation is not circular: CCE optimizes a new token on the final weights, which are different from the intermediate models on which the subspace tokens were collected, so the reported ASR is not forced by the construction. The Sec. 3.1 cosine-similarity threshold (0.6) is an empirical observation from a CA toy experiment used to motivate collecting three tokens; it is not a fitted parameter that mathematically guarantees the later ASR numbers. The method is compared against external baselines with public attack code, and no load-bearing self-citation appears (references [3] and [18] are independent of the present authors). Concerns about whether the 0.6 threshold transfers to the mapping objective are validity and robustness questions, not instances of circularity under the definition used here.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The method introduces no new physical or ontological entities. Its free parameters are the regularization weight, the 0.6 similarity threshold, the subspace size (3 tokens), and the early TI step for the reference subspace. The core axioms are empirical assumptions about the geometry of TI token spaces and the sufficiency of cross-attention modification.

free parameters (4)
  • lambda_reg = 1 (default)
    Coefficient balancing L_proj and L_reg in Eq. 6; only on/off ablation is given, no sensitivity analysis.
  • cosine similarity threshold = 0.6
    Chosen from the toy experiment in Sec. 3.1 to indicate that a subspace covers the target concept; used to justify erasing 3 tokens instead of 2.
  • subspace size (number of TI tokens) = 3 (l=3)
    Sec. 3.1 shows c_t exceeds 0.6 for t >= 3; the method then uses exactly 3 tokens in the target subspace for all concepts.
  • reference token TI step = 50
    Selected via ablation in Sec. 4.3 as the best trade-off; step 30 is too far and step 70 is too close to the target.
assumptions (5)
  • domain assumption A narrow concept is representable as a low-dimensional subspace in the cross-attention transformed token-embedding space.
    Sec. 3.1 hypothesizes this based on TI cosine-similarity observations; it is the foundation for constructing the target subspace.
  • domain assumption Early TI tokens (e.g., step 50) form a reference subspace that is close enough to erase the concept but general enough to preserve image quality.
    Sec. 3.2 and Table 3 support this only empirically for the tested concepts; no theoretical guarantee is given.
  • ad hoc to paper A token whose cosine similarity to the target subspace exceeds 0.6 will be erased along with the subspace.
    The threshold is taken from the authors' own toy experiment rather than derived from first principles.
  • domain assumption Modifying only the cross-attention to-k and to-v weights is sufficient to erase a token when combined with the CA loss.
    Sec. 3.3 and Appendix D show L_sub alone fails for identity and artistic style, so the CA loss is added; this assumption is validated only empirically.
  • domain assumption CCE and UnlearnDiff are adequate models of adversarial attempts to recover an erased concept.
    Evaluation assumes these two attacks span the relevant adversarial search space; no formal completeness argument is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SuMa: A Subspace Mapping Approach for Robust and Effective Concept Erasure in Text-to-Image Diffusion Models." pith.science (2026). https://pith.science/paper/GA2YMLMJ

@misc{pith2026250905625,
  author       = {Pith},
  title        = {Pith review of: SuMa: A Subspace Mapping Approach for Robust and Effective Concept Erasure in Text-to-Image Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GA2YMLMJ}},
  note         = {Machine review of arXiv:2509.05625}
}
read the original abstract

The rapid growth of text-to-image diffusion models has raised concerns about their potential misuse in generating harmful or unauthorized contents. To address these issues, several Concept Erasure methods have been proposed. However, most of them fail to achieve both robustness, i.e., the ability to robustly remove the target concept., and effectiveness, i.e., maintaining image quality. While few recent techniques successfully achieve these goals for NSFW concepts, none could handle narrow concepts such as copyrighted characters or celebrities. Erasing these narrow concepts is critical in addressing copyright and legal concerns. However, erasing them is challenging due to their close distances to non-target neighboring concepts, requiring finer-grained manipulation. In this paper, we introduce Subspace Mapping (SuMa), a novel method specifically designed to achieve both robustness and effectiveness in easing these narrow concepts. SuMa first derives a target subspace representing the concept to be erased and then neutralizes it by mapping it to a reference subspace that minimizes the distance between the two. This mapping ensures the target concept is robustly erased while preserving image quality. We conduct extensive experiments with SuMa across four tasks: subclass erasure, celebrity erasure, artistic style erasure, and instance erasure and compare the results with current state-of-the-art methods. Our method achieves image quality comparable to approaches focused on effectiveness, while also yielding results that are on par with methods targeting completeness.

Figures

Figures reproduced from arXiv: 2509.05625 by the authors.

Figure 1
Figure 1. Illustration of current C-CEMs methods trained to erase [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Distribution of cosine similarity scores among TIs in three cases: from the same SD1.4 but different TI training steps, different [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Our proposed framework consists of two main stages. The first stage, [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Qualitative Results. We present qualitative results comparing five methods against the CCE attack and textual erasure. 4. Experiments 4.1. Experimental Setting Dataset. We evaluate SuMa across four tasks: subclass era￾sure, celebrity erasure, artistic style erasure, an…
Figure 5
Figure 5. Figure 5: Visualization of Textual Inversion tokens at different [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Multiple Concept Erasure Result. Regulization Subclass Identity Artistic Instance ✗ ASR: 0.09 ASR: 0.06 ASR: 0.05 ASR: 0.15 FID: 19.21 FID: 20.31 FID: 19.32 FID: 24.57 CLIP: 0.29 CLIP: 0.29 CLIP: 0.30 CLIP: 0.26 ✓ ASR: 0.12 ASR: 0.09 ASR: 0.05 ASR: 0.17 FID: 18.33 FID:…
Figure 7
Figure 7. Figure 7: Cross Attention Map Visualization of NSFW concepts [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Output of DUO method after erase Grumpy Cat. [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Output of the TI token when passed through SD1.4 and [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Output of the TI token at different TI training steps. [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]
Figure 11
Figure 11. Figure 11: Output of the TI token at different rounds of applying method [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]
Figure 12
Figure 12. Figure 12: Output of different methods under CCE attack [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Outputs of different methods for textual prompts [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Result of UnlearnDiff (UD) Attack under diffirent methods. [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 23 canonical work pages

  1. [1]

    An image is worth 16x16 words: Trans- formers for image recognition at scale.arXiv preprint arXiv: 2010.11929, 2020

    Dosovitskiy Alexey. An image is worth 16x16 words: Trans- formers for image recognition at scale.arXiv preprint arXiv: 2010.11929, 2020. 6

    arXiv 2010

  2. [2]

    Removing undesirable concepts in text-to-image generative models with learnable prompts

    Anh Bui, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. Removing undesirable concepts in text-to-image generative models with learnable prompts. arXiv preprint arXiv:2403.12326, 2024. 1

    arXiv 2024

  3. [3]

    Erasing undesir- able concepts in diffusion models with adversarial preserva- tion.arXiv preprint arXiv:2410.15618, 2024

    Anh Bui, Long Vuong, Khanh Doan, Trung Le, Paul Mon- tague, Tamas Abraham, and Dinh Phung. Erasing undesir- able concepts in diffusion models with adversarial preserva- tion.arXiv preprint arXiv:2410.15618, 2024. 5, 8

    arXiv 2024

  4. [4]

    Muse: Text- to-image generation via masked generative transformers

    Huiwen Chang, Han Zhang, Jarred Barber, AJ Maschinot, Jos´e Lezama, Lu Jiang, Ming-Hsuan Yang, Kevin Murphy, William T Freeman, Michael Rubinstein, et al. Muse: Text- to-image generation via masked generative transformers. In Proceedings of the 40th International Conference on Ma- chine Learning, pages 4055–4075, 2023. 1

    work page 2023

  5. [5]

    Prompting4debugging: Red- teaming text-to-image diffusion models by finding problem- atic prompts.arXiv preprint arXiv:2309.06135, 2023

    Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin- Yu Chen, and Wei-Chen Chiu. Prompting4debugging: Red- teaming text-to-image diffusion models by finding problem- atic prompts.arXiv preprint arXiv:2309.06135, 2023. 3

    arXiv 2023

  6. [6]

    An image is worth one word: Personalizing text-to- image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patash- nik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text-to- image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022. 1, 3

    arXiv 2022

  7. [7]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 1, 2, 4, 6, 8

    work page 2023

  8. [8]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision, pages 5111–5120, 2024. 8

    work page 2024

Show all 41 references
  1. [9]

    Giphy celebrity detector, 2022

    Nick Hasty, Ihor Kroosh, Dmitry V oitekh, and Dmytro Kor- duban. Giphy celebrity detector, 2022. 6

    2022

  2. [10]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 6

    2016

  3. [11]

    Classifier-free diffusion guidance.arXiv preprint arXiv:2207.12598, 2022

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance.arXiv preprint arXiv:2207.12598, 2022. 2

    2022 arXiv

  4. [12]

    Fastai: a layered api for deep learning.Information, 11(2):108, 2020

    Jeremy Howard and Sylvain Gugger. Fastai: a layered api for deep learning.Information, 11(2):108, 2020. 6

    2020

  5. [13]

    Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021. 2

    2021 arXiv

  6. [14]

    Ai art and its impact on artists

    Harry H Jiang, Lauren Brown, Jessica Cheng, Mehtab Khan, Abhishek Gupta, Deja Workman, Alex Hanna, Johnathan Flowers, and Timnit Gebru. Ai art and its impact on artists. InProceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pages 363–374, 2023. 1

    2023

  7. [15]

    Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model.arXiv preprint arXiv:2405.16341, 2024

    Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model.arXiv preprint arXiv:2405.16341, 2024. 1, 3, 6, 7, 4, 5

    2024 arXiv

  8. [16]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 1, 2, 3, 4, 6, 7, 5

    2023

  9. [17]

    Visual instruction tuning.Advances in neural information processing systems, 36, 2024

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning.Advances in neural information processing systems, 36, 2024. 6

    2024

  10. [18]

    Mace: Mass concept erasure in diffu- sion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffu- sion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6430– 6440, 2024. 1, 2, 4, 5, 6, 7

    2024

  11. [19]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Re...

    2024

  12. [20]

    Glide: Towards photorealis- tic image generation and editing with text-guided diffusion models

    Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Mcgrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealis- tic image generation and editing with text-guided diffusion models. InInternational Conference on Machine Learning, pa...

    2022

  13. [21]

    Direct unlearning optimization for robust and safe text- to-image models

    Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text- to-image models. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. 2, 3,...

    2024

  14. [22]

    Circumventing concept erasure meth- ods for text-to-image generative models

    Minh Pham, Kelly O Marshall, Niv Cohen, Govind Mittal, and Chinmay Hegde. Circumventing concept erasure meth- ods for text-to-image generative models. InThe Twelfth In- ternational Conference on Learning Representations, 2023. 1, 2, 3, 6

    2023

  15. [23]

    Hierarchical text-conditional image gener- ation with clip latents.arXiv preprint arXiv:2204.06125, 1 (2):3, 2022

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image gener- ation with clip latents.arXiv preprint arXiv:2204.06125, 1 (2):3, 2022. 1

    2022 arXiv

  16. [24]

    Stable diffusion v1-4 model card., 2022

    Robin Rombach. Stable diffusion v1-4 model card., 2022. 1, 7, 4, 5

    2022

  17. [25]

    Stable diffusion 2.0 release., 2022

    Robin Rombach. Stable diffusion 2.0 release., 2022. 1

    2022

  18. [26]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 1

    2022

  19. [27]

    Imagenet large scale visual recognition challenge.International journal of computer vision, 115:211–252, 2015

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, San- jeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge.International journal of computer vision, 115:211–252, 2015. 6 9

    2015

  20. [28]

    Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information processing systems, 35:36479–36494, 2022

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information ...

    2022

  21. [29]

    Large-scale classifica- tion of fine-art paintings: Learning the right metric on the right feature

    Babak Saleh and Ahmed Elgammal. Large-scale classifica- tion of fine-art paintings: Learning the right metric on the right feature. arxiv 2015.arXiv preprint arXiv:1505.00855,

    2015 arXiv

  22. [30]

    Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in Neural In- formation Processing Systems, 35:25278–25294, 2022

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in Neural In- fo...

    2022

  23. [31]

    Glaze: Protecting artists from style mimicry by{Text-to-Image}models

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by{Text-to-Image}models. In32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023. 1

    2023

  24. [32]

    Diffusion art or digital forgery? investigating data replication in diffusion models

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. InPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6048–6058, 2023. 1

    2023

  25. [33]

    Stereo: A two- stage framework for adversarially robust concept erasing from text-to-image diffusion models

    Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer, Vishal M Patel, and Karthik Nandakumar. Stereo: A two- stage framework for adversarially robust concept erasing from text-to-image diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pag...

    2025

  26. [34]

    Celebrity-1000 datasets, 2022

    Tonyassi. Celebrity-1000 datasets, 2022. 6

    2022

  27. [35]

    Ring-a-bell! how reliable are concept removal meth- ods for diffusion models?arXiv preprint arXiv:2310.10012,

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia- You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. Ring-a-bell! how reliable are concept removal meth- ods for diffusion models?arXiv preprint arXiv:2310.10012,

    arXiv

  28. [36]

    Diffusion model align- ment using direct preference optimization

    Bram Wallace, Meihua Dang, Rafael Rafailov, Linqi Zhou, Aaron Lou, Senthil Purushwalkam, Stefano Ermon, Caiming Xiong, Shafiq Joty, and Nikhil Naik. Diffusion model align- ment using direct preference optimization. InProceedings of the IEEE/CVF Conference on Computer Vision an...

    2024

  29. [37]

    Scaling autoregressive models for content-rich text-to-image generation.Transac- tions on Machine Learning Research, 2021

    Jiahui Yu, Yuanzhong Xu, Jing Yu Koh, Thang Luong, Gun- jan Baid, Zirui Wang, Vijay Vasudevan, Alexander Ku, Yin- fei Yang, Burcu Karagol Ayan, et al. Scaling autoregressive models for content-rich text-to-image generation.Transac- tions on Machine Learning Research, 2021. 1

    2021

  30. [38]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models.arXiv preprint arXiv:2405.15234, 2024

    Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. Defensive unlearning with adversarial training for robust concept erasure in diffusion models.arXiv preprint arXiv:2405.15234, 2024. 2, 3, 6, 7, 4, 5

    2024 arXiv

  31. [39]

    naked” concept to a “dressed in

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Con- ference on Computer Vision, pages 385–40...

    2025

  32. [40]

    Overall, we can see that compared to Subspace Mapping, Subspace Pushing performs slightly better in terms of pro- tecting the model against adversarial attacks, but at the cost of significantly reducing image quality. D. Modify Cross-Attn Only We provide an ablation study by a...

  33. [41]

    So, in conclusion, our work could be combined with DUO to eliminate all kinds of concepts and advance the development of a safe text-to-image model

    Second, we found that after erasing one narrow concept based on our method, we can still apply DUO afterward, with results very close to applying DUO directly, as shown in Table 8. So, in conclusion, our work could be combined with DUO to eliminate all kinds of concepts and ad...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.