Pith. sign in

REVIEW 2 major objections 9 minor 65 references

Concept erasure can be both attack-hard and utility-preserving if erase and retain sets are built from how the diffusion model itself steers denoising.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-30 20:53 UTC pith:7ORV5Y5F

load-bearing objection Solid training-free recipe that actually attacks the erase/retain definition problem, with broad evidence and honest limits—not a foundational breakthrough, but worth referee time. the 2 major comments →

arxiv 2607.23492 v1 pith:7ORV5Y5F submitted 2026-07-26 cs.CV cs.LG

To Erase, or Not to Erase: Robust Training-Free Concept Erasure with Preservation aware Adaptive Ranked Subspace Expansion

Shaswati Saha , Rajasekhar Anguluri , Manas Gaur This is my paper
classification cs.CV cs.LG
keywords concept erasuremachine unlearninglatent diffusion modelsclassifier-free guidancecross-attention value projectiontextual inversionBEUSresponsible image generation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Text-to-image diffusion models can generate unsafe or copyrighted content, so concept erasure tries to edit them to block those targets without wrecking ordinary generation. Prior methods often lose that balance because they pick what to erase and what to keep from static lists or proxy embeddings that do not match how prompts actually steer denoising, so attacks reintroduce the target or nearby benign concepts get suppressed. This paper argues the fix is to treat erase-versus-retain as a retrieval problem inside the model: query classifier-free guidance to rank vocabulary tokens by how they steer the UNet, build diffusion-grounded erase and retain banks, then project cross-attention values so target directions are removed while retain directions stay intact. For triggers outside the vocabulary, it searches with textual inversion and expands the erased subspace only when the new direction does not collide with retain semantics. A new score, BEUS, folds attack success and FID into one harmonic balance measure. Across nudity, art styles, and objects, the method reports strong resistance to re-emergence while keeping FID and CLIP near the unedited model.

Core claim

PARSE shows that training-free concept erasure can be both robust to re-emergence and utility-preserving when erase and retain banks are discovered by diffusion-grounded CFG steering retrieval, value-space projection is made retain-orthogonal, and the erased subspace expands only for strong residual triggers that do not conflict with retain directions—measured jointly by BEUS.

What carries the argument

Preservation-aware Adaptive Ranked Subspace Expansion (PARSE): two-stage CFG knowledge search builds erase bank E and retain bank R; the closed-form projector P = I − EE⊤ with E = orth((I − RR⊤)E) removes target value directions while fixing retain directions; adaptive expansion appends textual-inversion trigger residuals only when their retain-orthogonal residual norm exceeds η.

Load-bearing premise

The paper assumes that what needs erasing or keeping is well captured by low-rank linear directions in cross-attention values plus steering embeddings from short templated vocabulary prompts, so a few linear projections block re-emergence without needing nonlinear or highly compositional concept structure.

What would settle it

If, after PARSE edits on a held-out compositional or multi-word target, white-box embedding attacks still restore the target at high ASR while FID/CLIP on adjacent retain concepts collapse—or if swapping CFG retrieval for a strong proxy VLM closes the robustness gap—the central claim that diffusion-grounded linear banks plus retain-orthogonal expansion solve the trade-off would fail.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Static human/LLM/CLIP concept banks are a primary source of the robustness–utility trade-off and can be replaced by zero-shot diffusion-steering retrieval.
  • Retain-orthogonal value projection can erase targets without the adjacent-concept collapse common in pure target projectors.
  • Adaptive expansion should gate new erase directions on a retain-conflict test, not add every discovered trigger.
  • BEUS gives a single comparable number that is high only when both attack ASR and FID are low, enabling large multi-baseline trade-off plots.
  • The same pipeline extends to multi-target erasure by unioning per-target erase banks while keeping the retain complement.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If CFG steering geometry is the right erase/retain index, similar retrieval could guide other safety edits (debiasing, watermark removal) without fine-tuning.
  • Tokenizer-and-template limits suggest a natural next test: phrase-level or cross-attention-key edits for compositional NSFW and style prompts.
  • Regulators and platform safety stacks could prefer methods scored on joint balance metrics like BEUS rather than isolated ASR or FID.
  • One-time vocabulary steering caches may become shared infrastructure for many post-hoc edits on a frozen backbone.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 9 minor

Summary. The paper presents PARSE, a training-free concept-erasure method for latent diffusion models (SD 1.4). Given a target concept, PARSE (i) builds erase/retain token banks by a two-stage "Knowledge Search" over the text-encoder vocabulary, ranking tokens by cosine similarity of classifier-free-guidance (CFG) steering embeddings and filtering with CLIP classification of cached generations; (ii) edits cross-attention value matrices with a closed-form projector P = I − EE⊤ where E is re-orthonormalized after removing components in the retain span, enforcing span(E) ⊥ span(R); and (iii) iteratively discovers re-emergence triggers via textual inversion and appends their residual directions to the erase subspace only when the residual norm (orthogonal to both retain and current erase spans) exceeds a threshold η. The paper also introduces BEUS, a [0,1]-bounded harmonic-mean aggregation of inverted ASR and log-compressed FID, with appendix proofs of boundedness and monotonicity. Experiments cover NSFW, style, and object erasure against eight-plus baselines under CCE, UD, RAB, SEE, and EraseBench attacks, with a full 16-configuration ablation (Table 2), multi-concept AGE/MACE-style evaluation (Table 6), and sensitivity analyses over pooling, K′, η, guidance scale, VLM backbone, and trigger-finder choice. The reported results show PARSE achieving the lowest or near-lowest attack ASR across categories while keeping FID/CLIP close to the unedited model.

Significance. If the results hold, this is a solid contribution to practical concept erasure: a closed-form, training-free edit that is demonstrably more robust to re-emergence attacks than prior projection-based methods (AdaVD) and competitive with adversarially trained methods (STEREO, AdvUnlearn) at a fraction of their utility cost. The strengths are concrete: the ablation in Table 2 toggles all four components across three categories; the evaluation uses five attack families plus multi-concept and mass-erasure protocols; the sensitivity studies (pooling, K′, η, s, VLM backbone, trigger finder) are more thorough than typical for this literature; and the compute costs (≈4.9 h one-time indexing, 10.7 min per-target edit) are disclosed honestly. The CFG-steering-embedding retrieval idea is a genuinely different way to build erase/retain banks and is supported by the proxy-VLM comparison in Fig. 15. BEUS is a modest addition — it is a monotone reparameterization of two existing metrics and does not by itself enforce any trade-off — but the large-scale robustness–utility analysis it organizes (Fig. 5) is useful to the community. The main risks to significance are the underspecified retain-basis co

major comments (2)
  1. [§3.1–3.2, Eqs. (9)–(10) and Algorithm 1, line 2] The retain-basis construction is dimensionally inconsistent as written. Eq. (9) defines R = V \ E, i.e., essentially the entire CLIP vocabulary minus the erase bank — the paper itself reports an average retain-set cardinality of ≈40k (Supp. Fig. 11). The projector in Eq. (10) assumes R has orthonormal columns (R R⊤ is an orthogonal projector only then), but Gram–Schmidt cannot produce 40k orthonormal vectors in a value space of dimension d ≤ 1280 (SD 1.4 cross-attention inner dimensions are 320/640/1280). Worse, if span(R) = R^d — which a 40k-token vocabulary almost certainly achieves — then (I − RR⊤)E ≈ 0 and the preservation-aware edit removes nothing, contradicting the reported erasure. Something in the description is therefore missing: a rank truncation, a subsampled retain set, a per-layer projection, or a different normalization. Because the retain-orthogonal projection is the cent
  2. [§4, Eqs. (11)–(12) vs. Appendix C.4] BEUS is defined inconsistently. The main text defines BEUS as the harmonic mean of ASR_sc and FID_sc only, but Appendix C.4 states that robustness averages 4–5 ASR values per category and that utility 'aggregates FID, CLIP, KID, and LPIPS'. These are different metrics; the bubble areas in Fig. 5 and the BEUS values in Tables 8 cannot be reproduced from Eq. (12) as stated. Since BEUS is one of the three named contributions, its exact operational definition (which ASRs enter the average, how CLIP/KID/LPIPS are mapped to unit-interval 'goodness' scores, and how they are combined) must be given precisely, ideally with a quantitative BEUS table in the main text rather than only bubble areas. Relatedly, the log-compressed FID_sc compresses the observed FID range (≈14–20) into FID_sc ∈ [0.247, 0.267], so in practice BEUS rankings are driven almost entirely by ASR differences; the authors should
minor comments (9)
  1. [Algorithm 1, lines 7–8] ˜r_n and r_n are scalar multiples of each other (r_n = ||v_n||₂ · ˜r_n, since the projection is linear), so e_new = r_n/||r_n||₂ = ˜r_n/||˜r_n||₂. The two lines are redundant as written; either collapse them or explain the intended distinction.
  2. [Appendix A.2, Eq. (14)] Algebraic slip: 2y²/(x+y)² is written as '= 2y² = 2×FID_sc²', dropping the denominator. The monotonicity conclusion is unaffected (the sign argument is correct), but the displayed equalities are false and should be corrected.
  3. [§5.1, Evaluation Metrics / Datasets] The text says FID is computed 'to measure distribution shift with unedited (SD 1.4) model', yet Table 1 reports FID = 14.23 for SD 1.4 itself, which would be 0 under that definition (contrast LPIPS = 0.00 for SD 1.4, which is consistent with a distance-to-base metric). Please clarify whether FID is computed against real MS-COCO images or against base-model generations; this matters for interpreting FID as 'utility' versus 'drift from the unedited model'.
  4. [Table 2 vs. Table 1] The ablation attack ASRs are round integers (e.g., 55.00, 36.00, 2.09) while Table 1 reports two-decimal values (3.41, 5.41). This suggests a different sample budget or evaluation protocol for the ablation; please state it, and confirm the ablation rows are comparable to Table 1.
  5. [§3.1, Stage 2] The final erase-bank size K after Stage-2 filtering is never reported. Since K determines the rank of the erased subspace and the precision/recall of the filter is central to the method's claims, please report typical K (and its distribution) per target.
  6. [§5.1 / §7] All evaluated attacks are prompt- or embedding-space attacks. Weight-space re-emergence (e.g., brief fine-tuning of the edited model to recover the target) is a known failure mode for closed-form edits and is not tested; at minimum this should be acknowledged in Limitations.
  7. [§2.2] Typo: 'ADaVD' should be 'AdaVD' (twice in §2.2, and again in §3.2).
  8. [Appendix B, first paragraph] The opening related-work paragraph on medical imaging, traffic signs, and character recognition is tangential to concept erasure and reads as padding; consider trimming it.
  9. [§5.1, Implementation Details] Please state explicitly whether code and the precomputed CFG-steering index will be released; the project page is mentioned but the submission itself does not state a release commitment.

Circularity Check

0 steps flagged

No significant circularity: PARSE is an empirical editing pipeline evaluated on external attacks and FID/CLIP; BEUS is a post-hoc metric, not a self-fulfilling prediction.

full rationale

This is a systems/methods paper whose load-bearing claims are empirical (lower ASR under CCE/UD/RAB/SEE/EraseBench and competitive FID/CLIP vs. many CET baselines), not first-principles predictions derived from fitted laws. The method chain—CFG steering retrieval over the frozen vocabulary (Eqs. 5–9), retain-orthogonal value projection P=I−EE⊤ with E=orth((I−RR⊤)E) (Eq. 10), and residual-gated subspace expansion via textual inversion (Alg. 1)—is a constructive edit procedure; success is not equal to the construction by definition. Evaluation uses external oracles (NudeNet, style/ImageNet classifiers) and held-out attack protocols and MS-COCO utility prompts, so reported wins are falsifiable against baselines rather than forced by the objective. BEUS (Eqs. 11–12; App. A) is an author-defined bounded monotone aggregate of ASR and FID; Appendix A only proves metric properties (boundedness, partial derivatives), not that PARSE must maximize BEUS. Design choices (harmonic mean, log-FID) affect ranking preferences but do not make the experimental tables tautological. Author self-citations appear as related-work motivation (e.g., side-effect benchmarks), not as uniqueness theorems that forbid alternatives or smuggle the central result. No fitted-parameter-as-prediction loop, no self-definitional X⇔Y derivation, and no renaming of a known closed form as a new theorem. Honest finding: circularity score 0.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 3 invented entities

The central empirical claim rests on standard diffusion/CA machinery plus several modeling choices: linear value-space erasability, CFG steering as a concept similarity oracle, vocabulary+TI coverage of triggers, oracle detectors for ASR, and hand-set retrieval/expansion hyperparameters. BEUS and the PARSE pipeline are paper-introduced constructs evaluated experimentally rather than derived from a uniqueness theorem.

free parameters (6)
  • Stage-1 top-K′ and final erase bank size K = K′ default 1000 (sensitivity table)
    Controls how many CFG-similar tokens enter erase vs retain; ablated around 500–1500 but chosen by authors for reported runs.
  • Adaptive expansion threshold η = 0.6 (default); tested 0.4–0.8
    Gates whether a TI residual is appended to E; directly controls robustness–utility trade-off.
  • Max expansion iterations N and early-stop = N=5
    Limits trigger search depth; set to at most 5 with early stop when trigger score < η.
  • CFG guidance scale s for steering embeddings = 7.5 (default in sensitivity)
    Shapes S(v) used for retrieval ranking; sensitivity shown for 5.0/7.5/10.0.
  • Textual inversion attack hyperparameters = 1000 steps, lr 2e-6
    Steps and LR determine discovered triggers that expand E; default TI settings are author-chosen.
  • BEUS FID log-compression form = Eq. 11–12 as stated
    FID_sc=1/(1+log(1+FID)) and harmonic mean are design choices that define the balance score surface.
axioms (5)
  • domain assumption Classifier-free guidance residual (ε_c−ε_u), pooled across layers/seeds/timesteps, is a valid similarity space for ranking vocabulary tokens as erase/retain concepts.
    Core of Knowledge Search §3.1 Eqs. 5–8; replaces CLIP/LLM banks.
  • domain assumption Undesired concepts can be suppressed by a low-rank linear projector on cross-attention values V_edited=P V without weight fine-tuning.
    Inherited from value-space CET line (AdaVD) and used throughout §2.2–3.2.
  • ad hoc to paper Enforcing span(E)⊥span(R) via E←orth((I−RR⊤)E) preserves retain semantics while removing targets.
    Preservation-aware geometry Eq. 10; central utility claim depends on this linear orthogonality sufficiency.
  • domain assumption ASR under listed attacks plus FID/CLIP (and NudeNet/style/ImageNet oracles) faithfully measure erasure robustness and utility.
    Standard in CET eval §5.1; BEUS aggregates these.
  • standard math Linear algebra facts used for projectors and Gram–Schmidt re-orthonormalization hold in the finite-dimensional value spaces.
    Eqs. 3–4, 10 and footnote on Gram–Schmidt.
invented entities (3)
  • CFG steering embedding S(v) as diffusion-grounded retrieval key independent evidence
    purpose: Rank vocabulary tokens for erase/retain banks without proxy CLIP space.
    Defined in Eq. 5; operational construct, not a new physical entity; evidence is empirical ASR/utility gains vs CLIP/VLM proxies.
  • BEUS (Balanced Erasure Utility Score) no independent evidence
    purpose: Single scalar for robustness–utility balance via transformed ASR/FID harmonic mean.
    Introduced §4 and Appendix A; useful summary statistic but author-defined and not an external standard benchmark.
  • PARSE adaptive ranked subspace expansion procedure no independent evidence
    purpose: End-to-end training-free CET combining retrieval, retain-orthogonal projection, and gated trigger expansion.
    Algorithm 1; validated only within this paper’s experiments.

pith-pipeline@v1.2.0-grok45-kimik3 · 33632 in / 4038 out tokens · 93454 ms · 2026-07-30T20:53:58.877414+00:00 · methodology

0 comments
read the original abstract

Concept erasure techniques (CETs) edit text-to-image diffusion models to erase undesired targets such as NSFW content or copyrighted styles, while preserving model utility on benign concepts. Current CETs face a trade-off between erasure robustness and utility: stronger edits erase the target more reliably but degrade utility on non-target concepts, and vice versa. This stems from how existing methods define what to erase and what to preserve. Many CETs rely on static concept banks specified manually, generated by LLMs, or selected by CLIP image-text similarity. Such banks do not model how prompts steer the model during denoising, leaving it vulnerable to triggers that reintroduce the target while suppressing nearby benign concepts. We present Preservation-aware Adaptive Ranked Subspace Expansion (PARSE), a training-free framework for robust concept erasure in latent diffusion models. Given a target, PARSE queries the diffusion model with classifier-free guidance to dynamically discover target-inducing erase concepts and nearby retain concepts in the model vocabulary. It then edits the cross-attention value space with a preservation-aware projection that removes target directions while leaving retain directions intact. For triggers beyond this vocabulary-indexed space, PARSE iteratively searches for re-emergence triggers by textual inversion and adaptively expands the erased subspace only when a new trigger direction does not conflict with retain semantics. We also introduce the Balanced Erasure Utility Score (BEUS), which combines robustness (ASR under multiple attacks) and utility preservation (FID) via bounded monotone transforms and harmonic mean aggregation. Experiments on NSFW, artistic style, and object erasure, with a large-scale robustness-utility analysis over many CET baselines, show that PARSE erases multiple concepts robustly without sacrificing post-edit utility.

Figures

Figures reproduced from arXiv: 2607.23492 by Manas Gaur, Rajasekhar Anguluri, Shaswati Saha.

Figure 1
Figure 1. Figure 1: Existing CETs often trade erasure robustness for utility: they either fail to pre￾vent target re-emergence under attacks or over-suppress and harm benign/adjacent con￾cepts. PARSE reframes what to erase vs. what to retain as a diffusion-grounded retrieval problem: given a target, we retrieve target-adjacent concepts by directly querying text-conditioned denoising/steering guidance to build diffusion-ground… view at source ↗
Figure 2
Figure 2. Figure 2: PARSE builds diffusion-grounded erase and retain banks via two-stage Knowl￾edge Search, applies preservation-aware value-space projection to remove target direc￾tions while preserving retain concepts, and uses textual-inversion triggers to adaptively expand the erased subspace for stronger robustness without sacrificing utility. 3.1 Ranked Subspace for Concept Erasure: Knowledge Search A core design choice… view at source ↗
Figure 3
Figure 3. Figure 3: Robustness under attacks after nudity erasure, and utility on a benign retain prompt (“A photo of a person”). Many CETs reintroduce nudity under attack and over￾suppress and fail to generate a person; PARSE stays robust (person with no nudity). CCE UD SDv1.4 ESD AdaVD STEREO PARSE(Ours) Retain: Charming street scene in Kelly McKernan style Retain Van Gogh CCE UD SDv1.4 Retain: A Retain close up photo of a … view at source ↗
Figure 4
Figure 4. Figure 4: Left: Robustness under CCE/UD attacks after erasing “Van Gogh”, and utility on a non-target retain prompt (“Charming street scene in Kelly McKernan style”). Many CETs degrade non-target styles; PARSE removes the target style while preserving utility. Right: Illustration of erasing “garbage truck”, and utility on retain prompt (“A close-up photo of a tow truck”). Many CETs suppress adjacent concepts or rein… view at source ↗
Figure 5
Figure 5. Figure 5: Large-scale erasure-utility balance ¤ analysis with utility preservation (FID, ↓ x-axis) and erasure robustness (ASR, ↓ y-axis) under four attacks: CCE [36], UD [65], SEE [40], and Paraphrase [1], across 3 target categories. Bubble area encodes BEUS (↑), highlighting methods that achieve low FID and low ASR, have erasure-utility balance. 5.2 Experiment Results Concept Erasure Effectiveness: In Tab. 1, we c… view at source ↗
Figure 6
Figure 6. Figure 6: AdaVD vs. PARSE: preservation-aware value projection improves robustness and utility; lower Target/CCE/UD ASR (often 0 for style/object) and higher CLIP. over-suppress and fail on benign prompts (e.g., “A photo of a person”), whereas PARSE still generates a natural-looking person comparable to the unedited model. For style erasure ( [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: UCE/ReCARE vs. PARSE: CFG based retrieval boosts erasure/robustness (low ASR) versus proxy CLIP search in ReCARE; while preserving utility. PARSE (Ours) NSFW (Nudity) Style (Van Gogh) Object (Garbage Truck) KS1 KS2 PAP ASE Erasure Utility Erasure Utility Erasure Utility Tgt↓ CCE↓ UD↓ RAB↓ FID↓ CLIP↑ Tgt↓ CCE↓ UD↓ FID↓ CLIP↑ Tgt↓ CCE↓ UD↓ FID↓ CLIP↑ ✗ ✗ ✗ ✗ 65.23 84.85 82.15 89.92 14.23 31.36 75.97 65.50 83… view at source ↗
Figure 8
Figure 8. Figure 8: Adaptive expansion reduces re-emergence, and PARSE attains the lowest ASR, highlighting preservation-aware subspace expansion. (b) (a) (a) (c) [PITH_FULL_IMAGE:figures/full_fig_p014_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: (a): PARSE converges faster in adaptive subspace expansion for triggers. (b): PARSE degrades slower than baselines as #concepts increase. (c): PARSE completes editing in 10.7 minutes, making it compute-efficient relative to other baselines. improves erasure (PARSE, ReCARE) and omitting it (UCE) leads to substantially worse degradation. Adaptive Subspace Expansion Improves Concept Erasure [PITH_FULL_IMAGE:… view at source ↗
Figure 10
Figure 10. Figure 10: BEUS sensitivity to erasure and utility. A.3: BEUS heatmap: interpreting trade-off between erasure and utility In [PITH_FULL_IMAGE:figures/full_fig_p022_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Targeted retain-bank preservation. For each erased target, we evaluate PARSE￾retrieved retain concepts across five Object and five NSFW targets, with an average retain-bank size of \approx 40\mathrm {k} . PARSE achieves higher retain CLIP and lower LPIPS, indi￾cating stronger preservation of benign concepts after erasure. Method NSFW (Nudity) Erasure Utility Tgt↓ CCE↓ UD↓ RAB↓ SEE↓ EraseBench↓ FID↓ KID↓ C… view at source ↗
Figure 12
Figure 12. Figure 12: Robustness under attacks after nudity erasure, and utility on a benign retain prompt (“A portrait of a person”). Many CETs reintroduce nudity under attack and over-suppress, and fail to generate a portrait of a person; PARSE stays robust (portrait of a person with no nudity) E Additional Quantitative Analysis E.1 Comparison with Additional Baselines Tabs. 3 to 5 report an extended comparison against six a… view at source ↗
Figure 13
Figure 13. Figure 13: Illustration of erasing “parachute”, and utility on retain prompt (“A person flying a blue kite in an open field”). All CETs suppress adjacent concepts or reintroduce the target; PARSE both blocks target re-emergence while still generating the blue kite [PITH_FULL_IMAGE:figures/full_fig_p029_13.png] view at source ↗
Figure 16
Figure 16. Figure 16: Visualization of token-wise classifier-free guidance (CFG) steering embeddings used in PARSE. For each token v, the x-axis shows concatenated layer-wise CFG steer￾ing vector S(v) , averaged over 3 random seeds and 50 diffusion timesteps following Eq. (5), while the y-axis lists the queried tokens from the offline vocabulary prepro￾cessing stage. (Left) shows 10 nudity-related tokens, which exhibit more co… view at source ↗
Figure 14
Figure 14. Figure 14: Robustness under attacks after erasing “Monet”, and utility on a non-target retain prompt (“Starry Night by Vincent Van Gogh.”). All CETs degrade non-target styles; PARSE removes the target style while preserving utility. E.4 Sensitivity to Spatial Pooling in CFG Steering Vector Construction Tab. 7 reports results on the nudity erasure task for different spatial pooling choices used to construct diffusion… view at source ↗
Figure 15
Figure 15. Figure 15: CFG-based two-stage retrieval consistently outperforms proxy VLMs as the Knowledge Search module. For each Qwen-VL variant, the bar reports the ASR obtained when that model is used as a proxy retriever, while the black marker shows the performance gap relative to our method (PARSE). This gap persists across model scales, indicating that effective knowledge search depends more on diffusion-grounded retriev… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

65 extracted references · 7 linked inside Pith

  1. [1]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Amara, I., Humayun, A.I., Kajic, I., Parekh, Z., Harris, N., Young, S., Nagpal, C., Kim, N., He, J., Vasconcelos, C.N., et al.: Erasing more than intended? how concept erasure degrades the generation of non-target concepts. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 16420–16430 (2025)

    2025

  2. [2]

    arXiv preprint arXiv:2511.21631 (2025)

    Bai, S., Cai, Y., Chen, R., Chen, K., Chen, X., Cheng, Z., Deng, L., Ding, W., Gao, C., Ge, C., et al.: Qwen3-vl technical report. arXiv preprint arXiv:2511.21631 (2025)

    Pith/arXiv arXiv 2025

  3. [3]

    5-vl technical report

    Bai, S., Chen, K., Liu, X., Wang, J., Ge, W., Song, S., Dang, K., Wang, P., Wang, S., Tang, J., et al.: Qwen2. 5-vl technical report. arXiv e-prints pp. arXiv–2502 (2025)

    2025

  4. [4]

    URL https://github

    Bedapudi, P.: Nudenet: Neural nets for nudity detection and censoring, 2022. URL https://github. com/notAI-tech/NudeNet3(2025)

    2022

  5. [5]

    In: The Thirty-ninth Annual Conference on Neural Information Processing Systems (2025)

    Biswas, S.D., Roy, A., Roy, K.: Cure: Concept unlearning via orthogonal repre- sentation editing in diffusion models. In: The Thirty-ninth Annual Conference on Neural Information Processing Systems (2025)

    2025

  6. [6]

    In: International Conference on Learning Representations

    Bui, A., Vu, T.T., Vuong, L., Le, T., Montague, P., Abraham, T., Kim, J., Phung, D.: Fantastic targets for concept erasure in diffusion models and where to find them. In: International Conference on Learning Representations. vol. 2025, pp. 64032–64074 (2025)

    2025

  7. [7]

    arXiv preprint arXiv:1902.06705 (2019)

    Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Good- fellow, I., Madry, A., Kurakin, A.: On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 (2019)

    Pith/arXiv arXiv 1902

  8. [8]

    In: Proceedings of the AAAI conference on artificial intelligence

    Cha, S., Cho, S., Hwang, D., Lee, H., Moon, T., Lee, M.: Learning to unlearn: Instance-wise unlearning for pre-trained classifiers. In: Proceedings of the AAAI conference on artificial intelligence. vol. 38, pp. 11186–11194 (2024)

    2024

  9. [9]

    arXiv preprint arXiv:2309.06135 (2023)

    Chin, Z.Y., Jiang, C.M., Huang, C.C., Chen, P.Y., Chiu, W.C.: Prompt- ing4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts. arXiv preprint arXiv:2309.06135 (2023)

    arXiv 2023

  10. [10]

    In: 2009 IEEE conference on computer vision and pattern recognition

    Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: Imagenet: A large- scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition. pp. 248–255. Ieee (2009)

    2009

  11. [11]

    In: The Twelfth International Conference on Learning Representations (2024),https://openreview.net/forum?id=gn0mIhQGNM

    Fan, C., Liu, J., Zhang, Y., Wong, E., Wei, D., Liu, S.: Salun: Empowering ma- chine unlearning via gradient-based weight saliency in both image classification and generation. In: The Twelfth International Conference on Learning Representations (2024),https://openreview.net/forum?id=gn0mIhQGNM

    2024

  12. [12]

    Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A.H., Chechik, G., Cohen-Or, D.: An image is worth one word: Personalizing text-to-image genera- tionusingtextualinversion.In:TheEleventhInternationalConferenceonLearning Representations (2023)

    2023

  13. [13]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Gandikota, R., Materzynska, J., Fiotto-Kaufman, J., Bau, D.: Erasing concepts from diffusion models. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 2426–2436 (2023)

    2023

  14. [14]

    In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision

    Gandikota, R., Orgad, H., Belinkov, Y., Materzyńska, J., Bau, D.: Unified concept editing in diffusion models. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp. 5111–5120 (2024)

    2024

  15. [15]

    In: European Conference on Computer Vision

    Gong, C., Chen, K., Wei, Z., Chen, J., Jiang, Y.G.: Reliable and efficient concept erasure of text-to-image diffusion models. In: European Conference on Computer Vision. pp. 73–88. Springer (2024) PARSE 17

    2024

  16. [16]

    Advances in Neural Information Processing Systems34, 16319–16330 (2021)

    Gupta, V., Jung, C., Neel, S., Roth, A., Sharifi-Malvajerdi, S., Waites, C.: Adap- tive machine unlearning. Advances in Neural Information Processing Systems34, 16319–16330 (2021)

    2021

  17. [17]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  18. [18]

    Advances in neural information processing systems30(2017)

    Heusel,M.,Ramsauer,H.,Unterthiner,T.,Nessler,B.,Hochreiter,S.:Ganstrained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems30(2017)

    2017

  19. [19]

    In: NeurIPS 2021 Workshop on Deep Generative Models and Downstream Applications (2021)

    Ho, J., Salimans, T.: Classifier-free diffusion guidance. In: NeurIPS 2021 Workshop on Deep Generative Models and Downstream Applications (2021)

    2021

  20. [20]

    In: European Conference on Computer Vision

    Huang, C.P., Chang, K.P., Tsai, C.T., Lai, Y.H., Yang, F.E., Wang, Y.C.F.: Re- celer: Reliable concept erasing of text-to-image diffusion models via lightweight erasers. In: European Conference on Computer Vision. pp. 360–376. Springer (2024)

    2024

  21. [21]

    arXiv preprint arXiv:2412.07658 (2024)

    Jain, A., Kobayashi, Y., Shibuya, T., Takida, Y., Memon, N., Togelius, J., Mitsufuji, Y.: Trasce: Trajectory steering for concept erasure. arXiv preprint arXiv:2412.07658 (2024)

    Pith/arXiv arXiv 2024

  22. [22]

    Joshi, A., Saha, S., Shukla, D., Vema, S., Jhamtani, H., Gaur, M., Modi, A.: To- wardsrobustevaluationofunlearninginllmsviadatatransformations.In:Findings of the Association for Computational Linguistics: EMNLP 2024. pp. 12100–12119 (2024)

    2024

  23. [23]

    In: European Conference on Computer Vision

    Kim, C., Min, K., Yang, Y.: Race: Robust adversarial concept erasure for secure text-to-image diffusion model. In: European Conference on Computer Vision. pp. 461–478. Springer (2024)

    2024

  24. [24]

    In: The Fourteenth International Con- ference on Learning Representations (2026),https://openreview.net/forum?id= Ryc7jKP6H9

    Kim, M., Lee, G., Kim, Y., Kim, H., Park, J., Lee, W.: Co-occurring associated REtained concepts in diffusion unlearning. In: The Fourteenth International Con- ference on Learning Representations (2026),https://openreview.net/forum?id= Ryc7jKP6H9

    2026

  25. [25]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Kumari, N., Zhang, B., Wang, S.Y., Shechtman, E., Zhang, R., Zhu, J.Y.: Ablat- ing concepts in text-to-image diffusion models. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 22691–22702 (2023)

    2023

  26. [26]

    In: Proceedings of the Computer Vision and Pattern Recognition Conference

    Lee, B.H., Lim, S., Chun, S.Y.: Localized concept erasure for text-to-image diffu- sion models using training-free gated low-rank adaptation. In: Proceedings of the Computer Vision and Pattern Recognition Conference. pp. 18596–18606 (2025)

    2025

  27. [27]

    In: The Fourteenth International Conference on Learning Representations (2026)

    Lee, U., Kim, J., Hwang, S.: Localized concept erasure in text-to-image diffusion models via high-level representation misdirection. In: The Fourteenth International Conference on Learning Representations (2026)

    2026

  28. [28]

    Numerical Linear Algebra with Applications20(3), 492–532 (2013)

    Leon, S.J., Björck, Å., Gander, W.: Gram-schmidt orthogonalization: 100 years and more. Numerical Linear Algebra with Applications20(3), 492–532 (2013)

    2013

  29. [29]

    arXiv preprint arXiv:2503.07392 (2025)

    Li, O., Wang, Y., Hu, X., Jiang, H., Liang, T., Hao, Y., Ma, G., Feng, F.: Speed: Scalable, precise, and efficient concept erasure for diffusion models. arXiv preprint arXiv:2503.07392 (2025)

    arXiv 2025

  30. [30]

    In: European conference on computer vision

    Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., Zitnick, C.L.: Microsoft coco: Common objects in context. In: European conference on computer vision. pp. 740–755. Springer (2014)

    2014

  31. [31]

    Advances in neural information processing systems35, 5775–5787 (2022) 18 S

    Lu, C., Zhou, Y., Bao, F., Chen, J., Li, C., Zhu, J.: Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in neural information processing systems35, 5775–5787 (2022) 18 S. Saha, R. Anguluri, M. Gaur

    2022

  32. [32]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Lu, S., Wang, Z., Li, L., Liu, Y., Kong, A.W.K.: Mace: Mass concept erasure in diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 6430–6440 (2024)

    2024

  33. [33]

    arXiv preprint arXiv:2208.11970 (2022)

    Luo, C.: Understanding diffusion models: A unified perspective. arXiv preprint arXiv:2208.11970 (2022)

    Pith/arXiv arXiv 2022

  34. [34]

    In: Chinese Conference on Pattern Recognition and Computer Vision (PRCV)

    Meng, Z., Peng, B., Jin, X., Lyu, Y., Wang, W., Dong, J., Tan, T.: Concept cor- rector: Erase concepts on the fly for text-to-image diffusion models. In: Chinese Conference on Pattern Recognition and Computer Vision (PRCV). pp. 91–105. Springer (2025)

    2025

  35. [35]

    arXiv preprint arXiv:2308.01508 (2023)

    Pham, M., Marshall, K.O., Cohen, N., Mittal, G., Hegde, C.: Circumventing concept erasure methods for text-to-image generative models. arXiv preprint arXiv:2308.01508 (2023)

    Pith/arXiv arXiv 2023

  36. [36]

    In: The Twelfth Inter- national Conference on Learning Representations (2024)

    Pham, M., Marshall, K.O., Cohen, N., Mittal, G., Hegde, C.: Circumventing con- cept erasure methods for text-to-image generative models. In: The Twelfth Inter- national Conference on Learning Representations (2024)

    2024

  37. [37]

    In: International conference on machine learning

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: International conference on machine learning. pp. 8748–8763. PmLR (2021)

    2021

  38. [38]

    IEEE Access10, 45997–46013 (2022)

    Ravin, N., Saha, S., Schweitzer, A., Elahi, A., Dako, F., Mollura, D., Chapman, D.: Mitigating domain shift in ai-based tb screening with unsupervised domain adaptation. IEEE Access10, 45997–46013 (2022)

    2022

  39. [39]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 10684–10695 (2022)

    2022

  40. [40]

    In: Christodoulopoulos, C., Chakraborty, T., Rose, C., Peng, V

    Saha, S., Saha, S., Gaur, M., Gokhale, T.: Side effects of erasing concepts from diffusion models. In: Christodoulopoulos, C., Chakraborty, T., Rose, C., Peng, V. (eds.) Findings of the Association for Computational Linguistics: EMNLP 2025. pp. 14991–15007. Association for Computational Linguistics, Suzhou, China (Nov 2025)

    2025

  41. [41]

    arXiv preprint arXiv:2312.10933 (2023)

    Saha, S., Dipta, S.R.: Seebel: Seeing is believing. arXiv preprint arXiv:2312.10933 (2023)

    Pith/arXiv arXiv 2023

  42. [42]

    In: 2025 IEEE/CVF Winter Con- ference on Applications of Computer Vision (WACV)

    Saha, S., Gokhale, T.: Improving shift invariance in convolutional neural networks with translation invariant polyphase sampling. In: 2025 IEEE/CVF Winter Con- ference on Applications of Computer Vision (WACV). pp. 620–629. IEEE (2025)

    2025

  43. [43]

    In: Liakata, M., Moreira, V.P., Zhang, J., Jurgens, D

    Saha, S., Gokhale, T.: Zero-shot multimodal retrieval with multi-scale contex- tual representations. In: Liakata, M., Moreira, V.P., Zhang, J., Jurgens, D. (eds.) Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 20304–20324. Association for Com- putational Linguistics, San Diego, Californ...

    2026

  44. [44]

    In: Emerg- ing Technologies in Data Mining and Information Security: Proceedings of IEMIS 2018, Volume 3, pp

    Saha, S., Islam, M.S., Khaled, M.A.B., Tairin, S.: An efficient traffic sign recogni- tion approach using a novel deep neural network selection architecture. In: Emerg- ing Technologies in Data Mining and Information Security: Proceedings of IEMIS 2018, Volume 3, pp. 849–862. Springer (2018)

    2018

  45. [45]

    In: 2018 21st international conference of computer and information technology (ICCIT)

    Saha, S., Kamran, S.A., Sabbir, A.S.: Total recall: understanding traffic signs us- ing deep convolutional neural network. In: 2018 21st international conference of computer and information technology (ICCIT). pp. 1–6. IEEE (2018)

    2018

  46. [46]

    Procedia computer science132, 1760–1770 (2018) PARSE 19

    Saha, S., Saha, N.: A lightning fast approach to classify bangla handwritten charac- ters and numerals using newly structured deep neural network. Procedia computer science132, 1760–1770 (2018) PARSE 19

    2018

  47. [47]

    In: Proceedings of the AAAI Conference on Artificial Intelli- gence

    Saha, S., Saha, S., Gani, M.O., Oates, T., Chapman, D.: Rfc-net: Learning high res- olution global features for medical image segmentation on a computational budget (student abstract). In: Proceedings of the AAAI Conference on Artificial Intelli- gence. vol. 37, pp. 16314–16315 (2023)

    2023

  48. [48]

    In: Medical Imaging 2022: Computer-Aided Di- agnosis

    Saha, S., Yesha, Y., Yesha, Y., Gangopadhyay, A., Chapman, D., Morris, M., Saboury, B., Nguyen, P.: Pairwise meta learning pipeline: classifying covid-19 ab- normalities on chest radio-graphs. In: Medical Imaging 2022: Computer-Aided Di- agnosis. p. PC1203302. SPIE (2022)

    2022

  49. [49]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Schramowski, P., Brack, M., Deiseroth, B., Kersting, K.: Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 22522– 22531 (2023)

    2023

  50. [50]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Shen, D., Song, G., Xue, Z., Wang, F.Y., Liu, Y.: Rethinking the spatial incon- sistency in classifier-free diffusion guidance. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 9370–9379 (2024)

    2024

  51. [51]

    In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision

    Shenoy, R., Pan, Z., Balakrishnan, K., Cheng, Q., Jeon, Y., Yang, H., Kim, J.: Gradient-free classifier guidance for diffusion model sampling. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp. 3162– 3171 (2026)

    2026

  52. [52]

    In: Proceedings of the Computer Vision and Pattern Recognition Conference

    Srivatsan, K., Shamshad, F., Naseer, M., Patel, V.M., Nandakumar, K.: Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models. In: Proceedings of the Computer Vision and Pattern Recognition Conference. pp. 23765–23774 (2025)

    2025

  53. [53]

    IEEE transactions on neural networks and learning systems 35(9), 13046–13055 (2023)

    Tarun, A.K., Chundawat, V.S., Mandal, M., Kankanhalli, M.: Fast yet effective machine unlearning. IEEE transactions on neural networks and learning systems 35(9), 13046–13055 (2023)

    2023

  54. [54]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Thakral, K., Glaser, T., Hassner, T., Vatsa, M., Singh, R.: Fine-grained era- sure in text-to-image diffusion-based foundation models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 9121– 9130 (2025)

    2025

  55. [55]

    Thakral, K., Pathak, S., Glaser, T., Hassner, T., Garcia-Olano, D., Masi, I., Singh, R.,Vatsa,M.:Genm:Thegenerativemachineunlearningchallenge.In:Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 2533–2541 (2025)

    2025

  56. [56]

    Tsai, Y.L., Hsu, C.Y., Xie, C., Lin, C.H., Chen, J.Y., Li, B., Chen, P.Y., Yu, C.M., Huang, C.Y.: Ring-a-bell! how reliable are concept removal methods for diffusion models? arXiv preprint arXiv:2310.10012 (2023)

    Pith/arXiv arXiv 2023

  57. [57]

    Tsai, Y.L., Hsu, C.Y., Xie, C., Lin, C.H., Chen, J.Y., Li, B., Chen, P.Y., Yu, C.M., Huang, C.Y.: Ring-a-bell! how reliable are concept removal methods for diffusion models? In: The Twelfth International Conference on Learning Representations (2024)

    2024

  58. [58]

    In: In- ternational Conference on Machine Learning

    Ullah, E., Arora, R.: From adaptive query release to machine unlearning. In: In- ternational Conference on Machine Learning. pp. 34642–34667. PMLR (2023)

    2023

  59. [59]

    In: 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Wang, Y., Li, O., Mu, T., Hao, Y., Liu, K., Wang, X., He, X.: Precise, fast, and low-cost concept erasure in value space: Orthogonal complement matters. In: 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 28759–28768. IEEE (2025)

    2025

  60. [60]

    arXiv preprint arXiv:2512.17320 (2025) 20 S

    Wei, L., Nakashima, Y., Garcia, N.: Emma: Concept erasure benchmark with comprehensive semantic metrics and diverse categories. arXiv preprint arXiv:2512.17320 (2025) 20 S. Saha, R. Anguluri, M. Gaur

    arXiv 2025

  61. [61]

    arXiv preprint arXiv:2510.22851 (2025)

    Xiong, L., Liu, C., Ye, J., Liu, Y., Xu, Y.: Semantic surgery: Zero-shot concept erasure in diffusion models. arXiv preprint arXiv:2510.22851 (2025)

    arXiv 2025

  62. [62]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Zhang, G., Wang, K., Xu, X., Wang, Z., Shi, H.: Forget-me-not: Learning to forget in text-to-image diffusion models. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 1755–1764 (2024)

    2024

  63. [63]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Zhang, L., Rao, A., Agrawala, M.: Adding conditional control to text-to-image diffusion models. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 3836–3847 (2023)

    2023

  64. [64]

    Advances in neural information processing systems37, 36748– 36776 (2024)

    Zhang, Y., Chen, X., Jia, J., Zhang, Y., Fan, C., Liu, J., Hong, M., Ding, K., Liu, S.: Defensive unlearning with adversarial training for robust concept erasure in diffusion models. Advances in neural information processing systems37, 36748– 36776 (2024)

    2024

  65. [65]

    lower-is-better

    Zhang, Y., Jia, J., Chen, X., Chen, A., Zhang, Y., Liu, J., Ding, K., Liu, S.: To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafeimages...fornow.EuropeanConferenceonComputerVision(ECCV)(2024) PARSE 21 Appendix A: Theoretical Properties ofBEUS We proposeBalanced Erasure Utility Score (BEUS)as a evaluation metric ...

    arXiv 2024