Pith. sign in

REVIEW 3 major objections 2 minor 73 references

In any text-conditioned visual generator, the value space of attention is where concepts can be erased: projecting text values away from a target direction removes them, with no retraining or weight edits.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 01:49 UTC pith:LKJ2XB5D

load-bearing objection Uni-AdaVD is a serious, broad extension of AdaVD to multiple generative architectures, but the 'universal no-tuning' claim does not yet hold: erasure strength is concept-dependent and the threshold/scale selection protocol is under-specified. the 3 major comments →

arxiv 2607.14521 v1 pith:LKJ2XB5D submitted 2026-07-16 cs.CV

Uni-AdaVD: Universal Concept Erasure for Visual Generation via Orthogonal Value Decomposition

Qifan Zhou , Yuan Wang , Yanbin Hao , Xiang Wang , Kuien Liu , Richang Hong , Meng Wang This is my paper
classification cs.CV
keywords concept erasurevisual generationinference-time interventionattention value spaceorthogonal value decompositiondiffusion transformersautoregressive image generationtext-to-video safety
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to prove that concept erasure can be one universal operation instead of a bespoke fix for each model family. Its claim: every text-conditioned visual generator — U-Net diffusion, DiT diffusion, autoregressive image models, and text-to-video — exposes the same semantic control surface, the value vectors of attention, and projecting those vectors onto the orthogonal complement of a target concept direction suppresses the concept without retraining or weight edits. That would matter because current erasure methods are architecture-specific, and safe deployment needs a mechanism that survives model churn. The method has three parts: an encoder-aware construction of the target direction (CLIP's causal attention concentrates a concept at its last subject token or near the end-of-text, while T5 spreads it across all valid tokens); an orthogonal projection that removes exactly the target-aligned part of each value vector; and a per-layer sigmoid shift that weakens erasure where a value only loosely resembles the target, protecting unrelated content. In the paper's evaluations this recipe handles explicit instances, art styles, celebrities, broad NSFW categories, and multi-concept combinations across all four model families — automated nudity-detection counts on the U-Net baseline fall from 406 to 26 — and it lowers adversarial-attack success rates relative to other inference-time methods.

Core claim

Central claim: the value space of attention is the right place to erase concepts in any text-conditioned visual generator — swapping values flips a 'cat' to a 'dog,' swapping keys changes little. The paper maps target semantics per encoder: CLIP's causal attention puts explicit concepts at the last subject token and implicit ones near the end-of-text token, while T5's bidirectional attention spreads them across all valid tokens. A target direction is built per encoder and each text value's component along it is subtracted, scaled by a per-layer sigmoid so weakly aligned tokens are barely touched. This training-free recipe erases instances, styles, NSFW, and multi-concept targets across U-Net

What carries the argument

The load-bearing mechanism is Orthogonal Value Decomposition (OVD): each text-derived value vector v_i is replaced by its projection orthogonal to the target direction v̂_i, so the aligned component is removed and the residual survives; for multiple concepts, targets are orthonormalized and the whole span is removed. Layer-wise Adaptive Erasing Shift (LAES) scales the removed component by a sigmoid of cosine similarity against a per-layer threshold, so weakly aligned tokens are barely disturbed. Encoder-aware Target Representation Construction (ETRC) fixes where v̂_i comes from: the last subject token for CLIP explicit concepts, the subject-to-end-of-text mean for CLIP implicit concepts, the

Load-bearing premise

The per-layer erasure thresholds are set from the measured gap between target and non-target prompt similarity on the benchmark data, and the universality claim rests on those gaps transferring to unseen prompts, concepts, and architectures without re-tuning.

What would settle it

A direct test of the universality claim: take a generator outside the paper's set (a masked-token image model, or one with a different text encoder), erase a concept using thresholds estimated exactly as described — the per-layer target-versus-non-target similarity gap — then probe a held-out set of prompts and concepts. If erasure stays on target without re-estimating those thresholds, the claim holds; if thresholds must be re-fit per architecture or concept, universality fails. A smaller probe: compare layer-wise thresholds against the fixed ϵ=0.5 on a second concept — the paper shows layer-

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • The same deployed model can change which concepts are banned on the fly, because erasure is a per-token projection at generation time and never modifies weights.
  • One safety module covers heterogeneous model families — U-Net, DiT, autoregressive, and video — so no architecture-specific erasure method is needed.
  • Explicit instances, artistic styles, identities, and implicit safety concepts all reduce to the same projection once the target value sequence is built for the right encoder, including single-, dual-, and triple-concept targets.
  • Erasure strength scales with token-level alignment to the target, so weakly related tokens are barely affected; on non-target prompts, FID, SSIM, and LPIPS stay at or near the unmodified model's level.
  • Resistance to adversarial prompt attacks improves without adversarial training: the paper reports lower attack-success rates than other inference-time methods on black-box and white-box attack benchmarks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The value-space view suggests the projection should compose with other prompt-side steering — guidance, editing, personalization — since only the injected text stream is altered; the paper does not test such compositions, but they follow directly from the mechanism.
  • The per-layer thresholds are the unstated tuning burden: the paper describes them as tracking the target-versus-non-target similarity gap per layer but gives no exact algorithm, so the true test of universality is whether unseen concepts and prompts erase cleanly with zero threshold re-estimation.
  • The paper's own failure cases — residual sketch textures with a conservative scaling factor, residual nudity with mild settings — suggest the shift factor may ultimately need to depend on concept strength, not just layer and token alignment.
  • Because effective erasure happens in the first six of thirty denoising steps, the framework's early-steps-only default points to a cheap deployment rule for video models, where per-frame inference cost dominates.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The paper proposes Uni-AdaVD, an inference-time concept erasure framework that intervenes in the value space of multimodal attention. It constructs encoder-aware target representations (ETRC), removes target-aligned value components via orthogonal value decomposition (OVD), and modulates erasure strength with a layer-wise adaptive erasing shift (LAES, Eq. 9). The authors claim the same recipe transfers across U-Net, DiT, autoregressive image generators, and text-to-video models, with no training or weight modification, and report experiments on nudity, instance, artistic style, and safety-concept erasure.

Significance. If the universality claim were established with a fully specified, reproducible protocol, this would be a useful contribution: value-space projection is simple, architecture-agnostic, and avoids retraining. The paper also provides a broad set of experiments and, for the first time, applies value-space erasure to autoregressive and video generators. The core OVD computation in Eqs. (6)-(11) is mathematically sound, and the ablation in Table 8 sensibly identifies text-side value intervention as the best trade-off in FLUX. However, the central claim of a single adaptive and universal mechanism is currently weakened by the per-model/per-concept hyperparameter choices in Table S1 and by the absence of a selection protocol for the threshold epsilon_l and scale s.

major comments (3)
  1. [Section 5.1.3 and Tables 1, 3, 5, 6] The 'adaptive' and 'universal' claims are not yet supported by a reproducible parameter-selection rule. LAES depends on s, p, and epsilon_l; Table S1 gives different s values for explicit vs. implicit concepts and across architectures, and epsilon_l is listed as '–' for FLUX, SD v3, and CogVideoX. Section 4.3 says epsilon_l is 'determined based on the difference between the target similarity and the non-target similarity at that layer,' but no algorithm, sample size, or formula is provided, and Fig. S1 only draws a dashed line. More directly, Supplementary Sec. E reports that the default s=5 leaves residual 'Pencil Sketch' style and s=1 leaves residual nudity, with the remedy being manual increases to s=8 and s=1.5. Thus the reported results appear to depend on concept-specific tuning. To support the universality claim, the authors should either provide an automatic, pre-registered proto
  2. [Section 4.3, Fig. S1, and Tables 5/S2] Explicit-concept erasure is measured primarily by CLIP Score, computed with a CLIP text encoder from the same family whose embeddings define the target representation in Eqs. (6)-(9). This creates a circularity risk: a lower CLIP Score between the prompt and the generated image may reflect suppression of the text-embedding direction rather than removal of the actual visual concept. For example, Table 5 reports low CS for 'Snoopy' after erasure, but no independent classifier or human evaluation confirms the visual concept is gone. I recommend adding a separate evaluation that is not based on the same representation family — e.g., a fine-grained image classifier, a retrieval model with a different encoder, or human judgments — at least for a subset of explicit concepts and styles.
  3. [Section 5.6 and Fig. 10/11] The layer-wise thresholds epsilon_l appear to be estimated from the same concepts that are later used for evaluation. Fig. S1 shows target/non-target cosine-similarity distributions for 'Snoopy' vs. 'Mickey' in FLUX, and Table 5 measures erasure of 'Snoopy' while preserving 'Mickey' (and vice versa). If the threshold is chosen from the similarity gap between those exact concepts, then the reported performance is partly a fitting result, not a predictive result. Please specify the calibration set separately from the test set, report the exact rule used to map distribution statistics to epsilon_l, and show thresholds on held-out concepts (e.g., 'SpongeBob', 'Dog') without recalibration.
minor comments (2)
  1. [Section 5.6 and Fig. 10/11] epsilon_l is shown as '–' for DiT-based and video models although Eq. (9) uses epsilon_l. Please clarify whether LAES is applied there with a layer-specific threshold and, if so, report the thresholds or explain why they are omitted.
  2. [Section 5.6 and Fig. 10/11] The ablation of s and p in Fig. 10 is only qualitative. Given that s is a load-bearing hyperparameter, please report quantitative erasure/prior-preservation metrics for the grid of (s, p) values, and specify the exact denoising window used for each model. The main text says 'timesteps 1-6' for FLUX, while the supplement says 'first 40 denoising steps' for video; clarify the protocol per model.

Circularity Check

0 steps flagged

No significant circularity; the OVD derivation is self-contained, with minor caveats about threshold fitting and self-citation to AdaVD.

full rationale

Uni-AdaVD's central operation—orthogonal value decomposition (Eqs. 6–7)—is a direct linear-algebra projection defined within the paper; it does not presuppose the empirical results it is used to explain. The choice of value space as the intervention interface is motivated by the paper's own attention-swapping experiment (Fig. 1) and the general attention formulation in Sec. 3, not by a self-citation. The ETRC anchor construction follows from the paper's own token-masking observations (Fig. 4). The LAES shift (Eqs. 8–11) is a sigmoid gate; although the layer-wise thresholds epsilon_l are estimated from target/non-target similarity distributions (Sec. 4.3, Fig. S1) rather than a fully specified algorithmic rule, this is a calibration/reproducibility issue rather than a case where an output is equal to an input by construction. The main erasure claims are also checked with external classifiers (NudeNet, Q16, SafeSora) and show cross-architecture transfer, so the central claim has independent content. Self-citations to AdaVD are not load-bearing: OVD is a standard mathematical operation and the paper provides its own supporting evidence. Score 2 reflects the minor self-citation and the underspecified threshold fitting, but no significant circularity.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The paper contributes a method, not new physics. The main uncharged inputs are empirical assumptions about where target semantics live in different text encoders and hand-tuned erasure-strength parameters. The universal claim rests on these observations and on the linear-separability assumption in value space.

free parameters (4)
  • LAES scaling factor s = explicit/implicit: SD v1-4 2/1, FLUX 5/2, SD v3 2/1, Switti-AR 1/1, CogVideoX 4/1; failure cases use 8 and 1.5
    Controls the maximum erasing shift in Eq. (9); tuned per model and concept type (Table S1) and manually increased in failure cases (Fig. S14).
  • LAES steepness p = 100 for all settings
    Sharpness of the sigmoid in Eq. (9); fixed by hand; the ablation shows it has limited effect, but it remains a free design choice.
  • Layer-wise similarity threshold epsilon_l = 0.93/0.43 (CLIP explicit/implicit), 0.9/0.4 (AR); layer-specific for DiT (Fig. S1)
    Determines which tokens are erased; estimated from target vs non-target cosine similarity distributions on the evaluated concepts rather than from a stated first-principles rule.
  • Denoising intervention window = first 6 of 30 steps for diffusion; first 40 steps for video
    Ablation in Fig. 11 shows early timesteps are sufficient; the cutoff is chosen empirically to trade erasure, efficiency, and prior preservation.
axioms (4)
  • domain assumption The value space of multimodal attention is a sufficient and universal semantic intervention space for concept erasure across U-Net, DiT, AR, and video generators.
    Motivated by the Cat/Dog swap experiment in Fig. 1 and the shared attention formulation in Eq. (1), but the generalization from specific models to 'universal' is an unproven premise.
  • domain assumption Projecting out the component of a value vector along a target direction removes target semantics while preserving orthogonal content (Eqs. 6-7).
    This assumes concept semantics are linearly separable in value space and that removing one component does not disrupt the weighted-sum attention output in unintended ways. No formal proof is given.
  • ad hoc to paper CLIP explicit concepts concentrate at the last subject token, CLIP implicit concepts accumulate near [EOT], and T5 distributes semantics uniformly over valid tokens (Figs. 3-4).
    These observations directly define the ETRC anchors in Section 4.1, but they are qualitative and not quantitatively validated on a broad set of concepts.
  • domain assumption Intervening only on the text value branch in joint-attention models preserves visual priors better than key or image-side interventions.
    Supported by the FLUX ablation in Table 8, but treated as a general design rule for SD v3, CogVideoX, and other joint-attention models.

pith-pipeline@v1.3.0-alltime-deepseek · 39106 in / 11861 out tokens · 127887 ms · 2026-08-02T01:49:50.551131+00:00 · methodology

0 comments
read the original abstract

Visual generative models inevitably absorb undesirable concepts from uncurated pretraining data, making concept erasure essential for safe deployment. Existing erasure methods, however, are often architecture-specific and struggle to remove target concepts while preserving non-target content and generative priors. We present Uni-AdaVD, a universal inference-time concept erasure framework for visual generation. Uni-AdaVD treats the value space of multimodal attention as a unified intervention space and introduces encoder-aware target representation construction to localize target semantics across heterogeneous text encoders. It further combines orthogonal value decomposition with an adaptive erasing shift to suppress target semantic directions without updating the original model weights. Extensive experiments on U-Net-, DiT-, and autoregressive image generators, as well as text-to-video models, demonstrate strong performance on single- and multi-concept erasure while preserving non-target priors. These results suggest that Uni-AdaVD provides an efficient and adaptable safety mechanism for modern visual generative models. Our code is available at https://github.com/QifanZhou/Uni-AdaVD.

Figures

Figures reproduced from arXiv: 2607.14521 by Kuien Liu, Meng Wang, Qifan Zhou, Richang Hong, Xiang Wang, Yanbin Hao, Yuan Wang.

Figure 1
Figure 1. Figure 1: Value-space analysis in FLUX joint attention. Swapping the blue [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of our Uni-AdaVD. a. Encoder-aware Target Representation Construction: For T5 [50] encoders, we average the valid tokens excluding padding and end-of-text tokens, tiling the result to the maximum sequence length. For CLIP [51] encoders, explicit concepts use the last subject token, while implicit concepts use the aggregated mean from the last subject to the end-of-text token, with both similarly t… view at source ↗
Figure 3
Figure 3. Figure 3: Visualization of attention maps in different text encoders. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Token masking on value vectors. Settings [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Trade-off between concept era￾sure effectiveness and prior knowledge preservation on SD v1-4. Methods closer to the lower-left corner achieve a bet￾ter balance between stronger target sup￾pression and better preservation of the original generative prior. ASR denotes the Attack Success Rate. SD v1-4 ESD CA MACE AdvUnlearn SalUn SPM STEREO ReCARE UCE RECE NP SLD SAFREE PGCE AdaVD Ours Nudity [PITH_FULL_IMAG… view at source ↗
Figure 6
Figure 6. Figure 6: Qualitative comparison of targeted nudity erasure on the U-Net-based diffusion model, SD v1-4. Top: Evaluation using I2P prompts, where [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Qualitative comparison of targeted nudity erasure on recent DiT-based diffusion models, specifically FLUX (left) and SD v3 (right). Top: I2P [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Visual results on the autoregressive Switti-AR model. Left rows [PITH_FULL_IMAGE:figures/full_fig_p009_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Visual ablation on different intervention spaces within the joint-attention blocks of FLUX. Intervening exclusively in the Text Value space [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Visual ablation of the scaling factor (s) and steepness (p) in FLUX. The rows demonstrate that a higher s (e.g., s = 5) effectively increases erasure strength (“Snoopy”). Concurrently, the columns show that a larger p minimizes spill-over effects to better preserve non-target concepts (“SpongeBob”). TABLE 9 Ablation study on intervention similarity threshold between the fixed value and layer-specific sett… view at source ↗
Figure 11
Figure 11. Figure 11: Visual ablation of temporal intervention phases in FLUX. Restricting the intervention exclusively to the early denoising steps effectively [PITH_FULL_IMAGE:figures/full_fig_p013_11.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

73 extracted references · 9 linked inside Pith

  1. [1]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P . Abbeel, “Denoising diffusion probabilistic models,”Advances in neural information processing systems, vol. 33, pp. 6840–6851, 2020

    2020

  2. [2]

    Score-based generative modeling through stochastic differential equations,

    Y. Song, J. Sohl-Dickstein, D. P . Kingma, A. Kumar, S. Ermon, and B. Poole, “Score-based generative modeling through stochastic differential equations,”arXiv preprint arXiv:2011.13456, 2020

    Pith/arXiv arXiv 2011

  3. [3]

    Denoising diffusion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,”arXiv preprint arXiv:2010.02502, 2020

    Pith/arXiv arXiv 2010

  4. [4]

    Classifier-free diffusion guidance,

    J. Ho and T. Salimans, “Classifier-free diffusion guidance,”arXiv preprint arXiv:2207.12598, 2022

    Pith/arXiv arXiv 2022

  5. [5]

    Flow matching for generative modeling,

    Y. Lipman, R. T. Chen, H. Ben-Hamu, M. Nickel, and M. Le, “Flow matching for generative modeling,”arXiv preprint arXiv:2210.02747, 2022

    Pith/arXiv arXiv 2022

  6. [6]

    Multimodal learning with transformers: A survey,

    P . Xu, X. Zhu, and D. A. Clifton, “Multimodal learning with transformers: A survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 10, pp. 12 113–12 132, 2023

    2023

  7. [7]

    Conditional image generation with pixelcnn decoders,

    A. Van den Oord, N. Kalchbrenner, L. Espeholt, O. Vinyals, A. Graveset al., “Conditional image generation with pixelcnn decoders,”Advances in neural information processing systems, vol. 29, 2016

    2016

  8. [8]

    Taming transformers for high-resolution image synthesis,

    P . Esser, R. Rombach, and B. Ommer, “Taming transformers for high-resolution image synthesis,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 12 873–12 883

    2021

  9. [9]

    Maskgit: Masked generative image transformer,

    H. Chang, H. Zhang, L. Jiang, C. Liu, and W. T. Freeman, “Maskgit: Masked generative image transformer,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 11 315–11 325

    2022

  10. [10]

    Visual autore- gressive modeling: Scalable image generation via next-scale pre- diction,

    K. Tian, Y. Jiang, Z. Yuan, B. Peng, and L. Wang, “Visual autore- gressive modeling: Scalable image generation via next-scale pre- diction,”Advances in neural information processing systems, vol. 37, pp. 84 839–84 865, 2024

    2024

  11. [11]

    Autoregressive model beats diffusion: Llama for scalable image generation,

    P . Sun, Y. Jiang, S. Chen, S. Zhang, B. Peng, P . Luo, and Z. Yuan, “Autoregressive model beats diffusion: Llama for scalable image generation,”arXiv preprint arXiv:2406.06525, 2024

    Pith/arXiv arXiv 2024

  12. [12]

    Generative adversarial networks in computer vision: A survey and taxonomy,

    Z. Wang, Q. She, and T. E. Ward, “Generative adversarial networks in computer vision: A survey and taxonomy,”ACM Computing Surveys (CSUR), vol. 54, no. 2, pp. 1–38, 2021

    2021

  13. [13]

    Diffusion models beat gans on image synthesis,

    P . Dhariwal and A. Nichol, “Diffusion models beat gans on image synthesis,”Advances in neural information processing systems, vol. 34, pp. 8780–8794, 2021

    2021

  14. [14]

    High-resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P . Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    2022

  15. [15]

    Scalable diffusion models with trans- formers,

    W. Peebles and S. Xie, “Scalable diffusion models with trans- formers,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 4195–4205

    2023

  16. [16]

    Sdxl: Improving latent diffu- sion models for high-resolution image synthesis,

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. Müller, J. Penna, and R. Rombach, “Sdxl: Improving latent diffu- sion models for high-resolution image synthesis,” inInternational Conference on Learning Representations, vol. 2024, 2024, pp. 1862– 1874

    2024

  17. [17]

    Scaling rectified flow transformers for high-resolution image synthesis,

    P . Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boeselet al., “Scaling rectified flow transformers for high-resolution image synthesis,” inForty-first international conference on machine learning, 2024. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE, VOL. XX, NO. XX, MONTH 2026 14

    2024

  18. [18]

    Diffusion model-based image editing: A survey,

    Y. Huang, J. Huang, Y. Liu, M. Yan, J. Lv, J. Liu, W. Xiong, H. Zhang, L. Cao, and S. Chen, “Diffusion model-based image editing: A survey,”IEEE Transactions on Pattern Analysis and Ma- chine Intelligence, 2025

    2025

  19. [19]

    Freeedit: Mask-free reference-based image editing with multi-modal instruction,

    R. He, K. Ma, L. Huang, S. Huang, J. Gao, X. Wei, J. Dai, J. Han, and S. Liu, “Freeedit: Mask-free reference-based image editing with multi-modal instruction,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  20. [20]

    Video diffusion models,

    J. Ho, T. Salimans, A. Gritsenko, W. Chan, M. Norouzi, and D. J. Fleet, “Video diffusion models,”Advances in neural information processing systems, vol. 35, pp. 8633–8646, 2022

    2022

  21. [21]

    Stable video diffusion: Scaling latent video diffusion models to large datasets,

    A. Blattmann, T. Dockhorn, S. Kulal, D. Mendelevitch, M. Kilian, D. Lorenz, Y. Levi, Z. English, V . Voleti, A. Lettset al., “Stable video diffusion: Scaling latent video diffusion models to large datasets,” arXiv preprint arXiv:2311.15127, 2023

    Pith/arXiv arXiv 2023

  22. [22]

    Video gen- eration models as world simulators,

    T. Brooks, B. Peebles, C. Holmes, W. DePue, Y. Guo, L. Jing, D. Schnurr, J. Taylor, T. Luhman, E. Luhmanet al., “Video gen- eration models as world simulators,”OpenAI Blog, vol. 1, no. 8, p. 1, 2024

    2024

  23. [23]

    Diffusion models in vision: A survey,

    F.-A. Croitoru, V . Hondru, R. T. Ionescu, and M. Shah, “Diffusion models in vision: A survey,”IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 9, pp. 10 850–10 869, 2023

    2023

  24. [24]

    Depth-aware gener- ative adversarial network for talking head video generation,

    F.-T. Hong, L. Zhang, L. Shen, and D. Xu, “Depth-aware gener- ative adversarial network for talking head video generation,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 3397–3406

    2022

  25. [25]

    Cogvideox: Text-to-video diffusion models with an expert transformer,

    Z. Yang, J. Teng, W. Zheng, M. Ding, S. Huang, J. Xu, Y. Yang, W. Hong, X. Zhang, G. Fenget al., “Cogvideox: Text-to-video diffusion models with an expert transformer,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 83 048– 83 077

    2025

  26. [26]

    Erasing concepts from diffusion models,

    R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau, “Erasing concepts from diffusion models,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 2426–2436

    2023

  27. [27]

    Ablating concepts in text-to-image diffusion models,

    N. Kumari, B. Zhang, S.-Y. Wang, E. Shechtman, R. Zhang, and J.-Y. Zhu, “Ablating concepts in text-to-image diffusion models,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 22 691–22 702

    2023

  28. [28]

    Mace: Mass con- cept erasure in diffusion models,

    S. Lu, Z. Wang, L. Li, Y. Liu, and A. W.-K. Kong, “Mace: Mass con- cept erasure in diffusion models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 6430–6440

    2024

  29. [29]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications,

    M. Lyu, Y. Yang, H. Hong, H. Chen, X. Jin, Y. He, H. Xue, J. Han, and G. Ding, “One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 7559–7568

    2024

  30. [30]

    Editing implicit assump- tions in text-to-image diffusion models,

    H. Orgad, B. Kawar, and Y. Belinkov, “Editing implicit assump- tions in text-to-image diffusion models,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 7053–7061

    2023

  31. [31]

    Unified concept editing in diffusion models,

    R. Gandikota, H. Orgad, Y. Belinkov, J. Materzy ´ nska, and D. Bau, “Unified concept editing in diffusion models,” inProceedings of the IEEE/CVF winter conference on applications of computer vision, 2024, pp. 5111–5120

    2024

  32. [32]

    Reliable and efficient concept erasure of text-to-image diffusion models,

    C. Gong, K. Chen, Z. Wei, J. Chen, and Y.-G. Jiang, “Reliable and efficient concept erasure of text-to-image diffusion models,” in European Conference on Computer Vision. Springer, 2024, pp. 73–88

    2024

  33. [33]

    Fantastic targets for concept erasure in diffusion models and where to find them,

    A. Bui, T.-T. Vu, L. Vuong, T. Le, P . Montague, T. Abraham, J. Kim, and D. Phung, “Fantastic targets for concept erasure in diffusion models and where to find them,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 64 032–64 074

    2025

  34. [34]

    Safe latent diffusion: Mitigating inappropriate degeneration in diffu- sion models,

    P . Schramowski, M. Brack, B. Deiseroth, and K. Kersting, “Safe latent diffusion: Mitigating inappropriate degeneration in diffu- sion models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 22 522–22 531

    2023

  35. [35]

    Safree: Training- free and adaptive guard for safe text-to-image and video gener- ation,

    J. Yoon, S. Yu, V . R. Patil, H. Yao, and M. Bansal, “Safree: Training- free and adaptive guard for safe text-to-image and video gener- ation,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 56 439–56 465

    2025

  36. [36]

    Groce: Graph- guided online concept erasure for text-to-image diffusion models,

    N. Han, Z. Ge, F. Han, Y. Sun, C. Li, and J. Chen, “Groce: Graph- guided online concept erasure for text-to-image diffusion models,” arXiv preprint arXiv:2511.12968, 2025

    Pith/arXiv arXiv 2025

  37. [37]

    Speed: Scalable, precise, and efficient concept erasure for diffusion models,

    O. Li, Y. Wang, X. Hu, H. Jiang, T. Liang, Y. Hao, G. Ma, and F. Feng, “Speed: Scalable, precise, and efficient concept erasure for diffusion models,”arXiv preprint arXiv:2503.07392, 2025

    arXiv 2025

  38. [38]

    Trce: Towards reliable malicious concept erasure in text-to-image diffusion models,

    R. Chen, H. Guo, L. Wang, C. Zhang, W. Nie, and A.-A. Liu, “Trce: Towards reliable malicious concept erasure in text-to-image diffusion models,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 18 927–18 936

    2025

  39. [39]

    Cure: Concept unlearning via orthogonal representation editing in diffusion models,

    S. D. Biswas, A. Roy, and K. Roy, “Cure: Concept unlearning via orthogonal representation editing in diffusion models,”Advances in Neural Information Processing Systems, vol. 38, pp. 82 539–82 563, 2026

    2026

  40. [40]

    Eraseanything: Enabling concept erasure in recti- fied flow transformers,

    D. Gao, S. Lu, W. Zhou, J. Chu, J. Zhang, M. Jia, B. Zhang, Z. Fan, and W. Zhang, “Eraseanything: Enabling concept erasure in recti- fied flow transformers,” inForty-second International Conference on Machine Learning, 2025

    2025

  41. [41]

    Differential vector erasure: Unified training-free concept erasure for flow matching models,

    Z. Zhang, X. Zhong, Y. Sun, S. Sun, B. Chen, S.-T. Xia, and X. Wang, “Differential vector erasure: Unified training-free concept erasure for flow matching models,”arXiv preprint arXiv:2602.01089, 2026

    arXiv 2026

  42. [42]

    Precise, fast, and low-cost concept erasure in value space: Orthogonal complement matters,

    Y. Wang, O. Li, T. Mu, Y. Hao, K. Liu, X. Wang, and X. He, “Precise, fast, and low-cost concept erasure in value space: Orthogonal complement matters,” in2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2025, pp. 28 759– 28 768

    2025

  43. [43]

    Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation,

    C. Fan, J. Liu, Y. Zhang, E. Wong, D. Wei, and S. Liu, “Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation,” inInternational Con- ference on Learning Representations, vol. 2024, 2024, pp. 53 643– 53 673

    2024

  44. [44]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models,

    Y. Zhang, X. Chen, J. Jia, Y. Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu, “Defensive unlearning with adversarial training for robust concept erasure in diffusion models,”Advances in neural information processing systems, vol. 37, pp. 36 748–36 776, 2024

    2024

  45. [45]

    Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models,

    K. Srivatsan, F. Shamshad, M. Naseer, V . M. Patel, and K. Nan- dakumar, “Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models,” inProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025, pp. 23 765–23 774

    2025

  46. [46]

    Co-occurring associated REtained concepts in diffusion unlearning,

    M. Kim, G. Lee, Y. Kim, H. Kim, J. Park, and W. Lee, “Co-occurring associated REtained concepts in diffusion unlearning,” inThe Fourteenth International Conference on Learning Representations, 2026

    2026

  47. [47]

    Prototype-guided con- cept erasure in diffusion models,

    Y. Cai, J. Lu, H. Shi, Y. Zhou, and H. Lu, “Prototype-guided con- cept erasure in diffusion models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026, pp. 16 509–16 519

    2026

  48. [48]

    black-forest-labs/flux,

    Black Forest Labs, “black-forest-labs/flux,” https://github.com/ black-forest-labs/flux, 2024

    2024

  49. [49]

    Z-erase: Enabling concept erasure in single- stream diffusion transformers,

    N. Jiang, Z. Fan, B. Wang, D. Gao, J. Cheng, J. Guo, Y. Qin, Y. Jin, H. Zheng, F. Wuet al., “Z-erase: Enabling concept erasure in single- stream diffusion transformers,”arXiv preprint arXiv:2603.25074, 2026

    Pith/arXiv arXiv 2026

  50. [50]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P . J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”Journal of machine learning research, vol. 21, no. 140, pp. 1–67, 2020

    2020

  51. [51]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agar- wal, G. Sastry, A. Askell, P . Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inInternational conference on machine learning. PmLR, 2021, pp. 8748–8763

    2021

  52. [52]

    Switti: Designing scale-wise transformers for text- to-image synthesis,

    A. Voronov, D. Kuznedelev, M. Khoroshikh, V . Khrulkov, and D. Baranchuk, “Switti: Designing scale-wise transformers for text- to-image synthesis,”arXiv preprint arXiv:2412.01819, 2024

    Pith/arXiv arXiv 2024

  53. [53]

    Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis,

    J. Han, J. Liu, Y. Jiang, B. Yan, Y. Zhang, Z. Yuan, B. Peng, and X. Liu, “Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025, pp. 15 733–15 744

    2025

  54. [54]

    Ear: Erasing concepts from unified autoregressive models,

    H. Fan, S. Zhang, Baohunesitu, Z. Guo, and H. Zhang, “Ear: Erasing concepts from unified autoregressive models,” 2025

    2025

  55. [55]

    Vce: Safe autoregressive image generation via visual contrast exploitation,

    F. Han, C. Gong, Z. Wei, J. Chen, and Y.-G. Jiang, “Vce: Safe autoregressive image generation via visual contrast exploitation,” arXiv preprint arXiv:2509.16986, 2025

    arXiv 2025

  56. [56]

    Key-locked rank one editing for text-to-image personalization,

    Y. Tewel, R. Gal, G. Chechik, and Y. Atzmon, “Key-locked rank one editing for text-to-image personalization,” inACM SIGGRAPH 2023 conference proceedings, 2023, pp. 1–11

    2023

  57. [57]

    Zeroscope v2 576w,

    cerspense, “Zeroscope v2 576w,” https://huggingface.co/ cerspense/zeroscope_v2_576w, 2023

    2023

  58. [58]

    Aiml-tuda/i2p,

    AIML-TUDA, “Aiml-tuda/i2p,” https://huggingface.co/ datasets/AIML-TUDA/i2p, 2023. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE, VOL. XX, NO. XX, MONTH 2026 15

    2023

  59. [59]

    Safesora: Towards safety alignment of text2video generation via a human preference dataset,

    J. Dai, T. Chen, X. Wang, Z. Yang, T. Chen, J. Ji, and Y. Yang, “Safesora: Towards safety alignment of text2video generation via a human preference dataset,”Advances in Neural Information Processing Systems, vol. 37, pp. 17 161–17 214, 2024

    2024

  60. [60]

    Microsoft coco: Common objects in context,

    T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P . Perona, D. Ramanan, P . Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inEuropean conference on computer vision. Springer, 2014, pp. 740–755

    2014

  61. [61]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?

    Y.-L. Tsai, C.-Y. Hsu, C. Xie, C.-H. Lin, J. Y. Chen, B. Li, P .-Y. Chen, C.-M. Yu, and C.-Y. Huang, “Ring-a-bell! how reliable are concept removal methods for diffusion models?” inInternational Conference on Learning Representations, vol. 2024, 2024, pp. 41 543–41 554

    2024

  62. [62]

    Mma- diffusion: Multimodal attack on diffusion models,

    Y. Yang, R. Gao, X. Wang, T.-Y. Ho, N. Xu, and Q. Xu, “Mma- diffusion: Multimodal attack on diffusion models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2024, pp. 7737–7746

    2024

  63. [63]

    Prompting4debugging: Red-teaming text-to-image diffu- sion models by finding problematic prompts,

    Z.-Y. Chin, C.-M. Jiang, C.-C. Huang, P .-Y. Chen, and W.-C. Chiu, “Prompting4debugging: Red-teaming text-to-image diffu- sion models by finding problematic prompts,”arXiv preprint arXiv:2309.06135, 2023

    arXiv 2023

  64. [64]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now,

    Y. Zhang, J. Jia, X. Chen, A. Chen, Y. Zhang, J. Liu, K. Ding, and S. Liu, “To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now,” in European Conference on Computer Vision. Springer, 2024, pp. 385– 403

    2024

  65. [65]

    Clip- score: A reference-free evaluation metric for image captioning,

    J. Hessel, A. Holtzman, M. Forbes, R. Le Bras, and Y. Choi, “Clip- score: A reference-free evaluation metric for image captioning,” inProceedings of the 2021 conference on empirical methods in natural language processing, 2021, pp. 7514–7528

    2021

  66. [66]

    Nudenet: Lightweight nudity de- tection,

    P . Bedapudi and contributors, “Nudenet: Lightweight nudity de- tection,” https://github.com/notAI-tech/NudeNet, 2024

    2024

  67. [67]

    Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content?

    P . Schramowski, C. Tauchmann, and K. Kersting, “Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content?” inProceedings of the 2022 ACM confer- ence on fairness, accountability, and transparency, 2022, pp. 1350–1361

    2022

  68. [68]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochre- iter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,”Advances in neural information processing systems, vol. 30, 2017

    2017

  69. [69]

    Image quality assessment: from error visibility to structural similarity,

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P . Simoncelli, “Image quality assessment: from error visibility to structural similarity,” IEEE transactions on image processing, vol. 13, no. 4, pp. 600–612, 2004

    2004

  70. [70]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P . Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 586–595

    2018

  71. [71]

    Videoeraser: Concept erasure in text-to-video diffusion models,

    N. Xu, J. Zhang, C. Li, Z. Chen, C. Zhou, Q. Li, T. Du, and S. Ji, “Videoeraser: Concept erasure in text-to-video diffusion models,” inProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025, pp. 5965–5994

    2025

  72. [72]

    Neighbor- aware localized concept erasure in text-to-image diffusion mod- els,

    Z. Shi, A. D. Farashah, R. de Vries, and G. Farnadi, “Neighbor- aware localized concept erasure in text-to-image diffusion mod- els,”arXiv preprint arXiv:2603.25994, 2026

    arXiv 2026

  73. [73]

    Pixart-σ: Weak-to-strong training of diffusion transformer for 4k text-to-image generation,

    J. Chen, C. Ge, E. Xie, Y. Wu, L. Yao, X. Ren, Z. Wang, P . Luo, H. Lu, and Z. Li, “Pixart-σ: Weak-to-strong training of diffusion transformer for 4k text-to-image generation,” inEuropean Confer- ence on Computer Vision. Springer, 2024, pp. 74–91. IEEE TRANSACTIONS ON PATTERN ANAL YSIS AND MACHINE INTELLIGENCE, VOL. XX, NO. XX, MONTH 2026 16 Supplementary...

    arXiv 2024