Pith. sign in

REVIEW 4 major objections 4 minor 55 references

PEAK: Precise and Persistent Concept Erasure via k-Sparse Autoencoders

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that erasing a concept from a text-to-image diffusion model can be made precise and persistent by localizing it as a small set of k-sparse autoencoder features and suppressing those features in the model weights.

desk verdict A genuinely new kSAE-guided parameter-level erasure method with strong results, but the persistence claim is softer than the abstract suggests (UnlearnDiffAtk Post-ASR 16.10%); worth a serious referee. read the letter →

arxiv 2608.10985 v1 pith:RB4DS3QN submitted 2026-08-11 cs.CV

Man Jiang , Ouxiang Li , Weibao Xue , Zhenhua Tang , Yuan Wang , Shuo Wang , Yanbin Hao This is my paper · ORCID
classification cs.CV
keywords concepterasuretext-to-imagediffusionmodelsk-sparseautoencodersfeaturelocalizationparameteroptimizationadversarialrecoveryinterpretablefeaturesmodelediting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that concept erasure in text-to-image diffusion models becomes precise and persistent once the target concept is localized as a compact set of $k$-sparse autoencoder features and those features are suppressed directly in the model weights. The difficulty it addresses is the usual trade-off: erasure that is too broad damages unrelated semantics, while erasure that leaves internal knowledge intact lets adversarial prompts recover the concept. PEAK trains a frozen kSAE on cross-attention activations, selects target-specific features by contrasting matched target and non-target prompts on both activation strength and frequency, then fine-tunes the diffusion model so selected features are driven down while all other features are distilled toward the original model. Because the erasure is internalized in parameters, no inference-time intervention is needed, and the paper reports that NudeNet detections on I2P drop from 582 to 6 while the average adversarial attack success rate falls from 96.52% to 5.63%, with near-zero KID on MS-COCO. If true, this gives a general recipe for removing unsafe or copyrighted concepts without giving up generation quality or leaving an open-source bypass.

What carries the argument

The machinery has two stages. First, a frozen kSAE (a sparse autoencoder that reconstructs dense activation vectors using only $k$ active features per sample) is trained on cross-attention activations from a chosen U-Net block, using a BatchTopK training objective and an AuxK auxiliary loss to reduce dead latents. Second, target-feature selection scores each latent by the product of mean activation strength and activation frequency across denoising timesteps, then keeps features above a percentile threshold for target prompts and at or below a threshold for matched non-target prompts. The selected features feed two losses on on-trajectory rollouts: $L_{\mathrm{erase}}$ drives their squared activations to zero, and $L_{\mathrm{pres}}$ matches all complementary features to the frozen reference model, with total objective $L_{\mathrm{PEAK}} = L_{\mathrm{erase}} + \lambda L_{\mathrm{pres}}$. These losses carry the argument because 'what to erase' and 'what to preserve' are both specified in the same sparse feature space, turning interpretability into a gradient signal.

What would settle it

Search a much wider set of paraphrased or adversarially optimized prompts than the 100 matched pairs against a PEAK-fine-tuned model; if any of these prompts regenerates the target concept at rates near the original model, the persistence claim fails. As a second check, zero out exactly the selected features in the frozen original model; if the concept still appears, the selected set was not causally sufficient.

Watch

Extended reading notes

Core claim

On its own terms, PEAK's central discovery is that the internal visual space of a diffusion denoiser contains a sparse, interpretable coordinate system in which the target concept and everything else are separable enough to drive parameter optimization. A kSAE trained with BatchTopK and AuxK decomposes activations at a selected cross-attention block into about 1,280 sparse features; contrasting activations from 100 matched prompt pairs yields a small set of features that are both strongly and consistently activated for the target concept and not for its non-target counterpart. Fine-tuning then minimizes the squared energy of exactly those features on real denoising trajectories while matching all complementary features to the frozen reference model. The result is a parameter-level erasure: after training, neither the kSAE nor the reference model is needed, the concept is suppressed under regular and adversarial prompts, and unrelated semantics are largely unchanged. The paper supports this with category-level NudeNet counts, zero RAB recoveries, low MMA and UnlearnDiffAtk success rates, and recognition-accuracy tests for Snoopy, Van Gogh, and unseen concepts like Mario.

Load-bearing premise

The load-bearing premise is that the kSAE feature set selected from 100 matched prompt pairs is causally sufficient and separable: suppressing exactly those features extinguishes the target concept, and no unselected entangled feature can regenerate it or carry collateral semantic damage.

Editorial extensions

If this is right

  • If the central claim holds, erasure no longer requires a safety filter or feature-steering pass at generation time, so a user sharing the fine-tuned weights cannot trivially revert the erasure by ignoring an inference wrapper.
  • The preservation loss should keep general generation quality close to the original model; the paper measures KID $0.0000$, FID $41.59$, and a higher CLIP score than any compared erasure method on MS-COCO.
  • Adversarial persistence becomes a property of the parameters, and the paper reports zero RAB attack success, a $0.8\%$ MMA success rate, and a $16.10\%$ post-attack rate under UnlearnDiffAtk.
  • The same feature-space localization transfers to object, artistic-style, violence, multi-concept, and unseen-concept erasure, and to SDXL and FLUX architectures, suggesting the procedure is not tied to one concept or one model family.
  • Because the kSAE remains frozen, the feature space is reusable across concepts and across models, so erasing additional concepts later does not require retraining the autoencoder.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If causal separability holds beyond the tested prompts, the same contrast-and-suppress recipe could be used for other surgical model edits, such as removing a specific person's likeness, debiasing a protected attribute, or blocking style mimicry; PEAK's objective is a generic erase-this-keep-everything-else signal in feature space.
  • The feature set is chosen from 100 matched prompt pairs, so the stability of selection under broader paraphrase coverage is an open empirical question; a test that varies prompt language, composition, and concept phrasing would show whether the selected features are concept-stable or context-bound.
  • Because erasure is written into weights, any later operation that mixes or merges fine-tuned weights with original ones could in principle resurrect the concept; testing PEAK-erased models under weight interpolation or model merging would map the true boundaries of persistence.
  • The strong preservation numbers are measured on MS-COCO; a finer probe on prompts that are semantically adjacent to the target concept would clarify whether 'precision' holds at the boundary or only for unrelated captions.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes PEAK, a two-stage concept-erasure framework for text-to-image diffusion models. In the first stage, a k-sparse autoencoder (kSAE) is trained on internal activations of a frozen diffusion model, and a compact set of target-specific sparse features is selected by contrasting activation strength and frequency between matched target and non-target prompt sets (Eqs. (5)–(10)). In the second stage, the diffusion model is fine-tuned so that the selected features are suppressed while all complementary features are distilled back to the original model's responses (Eqs. (13)–(16)). The authors claim this yields precise and persistent erasure without inference-time intervention. Experiments on Stable Diffusion v1.4 report a reduction in I2P NudeNet detections from 582 to 6, strong preservation metrics on MS-COCO, low attack success rates on RAB and MMA, and a Pre-ASR of 0.85% on UnlearnDiffAtk; additional experiments cover object/style erasure, multi-concept erasure, unseen-concept generalization, and cross-architecture results on SDXL and FLUX.

Significance. If the claims hold, PEAK is a useful step beyond inference-time SAE interventions: it converts kSAE-localized features into permanent parameter-level erasure and explicitly preserves complementary features, which addresses a recognized limitation of prior SAE-based methods. The method is clearly specified, the ablations support the feature-selection and preservation design choices, and the authors release code and models. The main results are competitive with or better than existing erasure methods on several benchmarks. However, the central persistence claim is only partially supported: the paper's own UnlearnDiffAtk Post-ASR is 16.10%, and the abstract's headline average of 5.63% omits this residual. The feature-selection mechanism is correlation-based and derived from only 100 matched prompt pairs, so its causal sufficiency is not established. Reproducibility is also incomplete because key selection hyperparameters are not reported.

major comments (4)
  1. [§3.2, Eq. (10); §3.3, Eq. (15)] The persistence claim is not fully supported by the reported results. Table 2 reports a UnlearnDiffAtk Post-ASR of 16.10% for PEAK, which is far from zero and indicates that the target concept can still be recovered through some residual pathway after fine-tuning. The abstract's statement that PEAK 'lowers the average attack success rate (ASR) from 96.52% to 5.63%' appears to average over RAB, MMA, and the Pre-ASR of UnlearnDiffAtk, thereby hiding the Post-ASR value. Please report the Post-ASR alongside any average, define what Pre-ASR and Post-ASR mean in the attack protocol, and provide an analysis of the successful adversarial recoveries: in particular, do those recovered images activate the selected feature set F_C after erasure? If they do not, then Eq. (13) is not sufficient to silence all concept-generating pathways, and the manuscript should state this limitation explicitly or extend the method to close the gap.
  2. [§3.2, Eq. (10); §3.3, Eq. (15)] The causal sufficiency of the selected feature set F_C is assumed rather than demonstrated. F_C is obtained by contrasting activation strength and frequency over only 100 matched prompt pairs, which yields correlational, prompt-distribution-specific features. Eq. (15) then freezes the complement F_C^c to the original responses, so any causally relevant feature that also activates under non-target prompts, or that appears only under adversarial prompts, is either excluded or preserved by construction. The manuscript needs a direct empirical test of sufficiency: for example, after PEAK fine-tuning, run successful adversarial attacks and check whether the recovered images activate F_C; or perform an inference-time intervention that additionally silences F_C on the fine-tuned model and show whether the residual 16.10% Post-ASR disappears. Without such evidence, the central claim that suppressing F_C embeds persistent erasure into the parameters is not fully established.
  3. [§3.2, Eqs. (7) and (9); Appendix D] Two load-bearing hyperparameters of the feature-selection stage are not reported anywhere in the paper: the percentile p used in Eq. (9) to define the threshold tau_q, and k_step used in Eq. (7) to select the prominent features per timestep. The implementation details in Appendix D list kSAE training and concept-erasure hyperparameters, but not these values or their sensitivity. Since the entire feature set F_C depends on p and k_step, and since the paper ablated other design choices (Tables 5–7) but not these, the main results are not reproducible as written. Please report the values and include an ablation or sensitivity analysis for both.
  4. [§4.4, Tables 5–7] The experimental validation has methodological weaknesses that affect the strength of the comparative claims. The preservation weight lambda (Table 5) and the feature-selection criterion (Table 7) are selected using the same evaluation benchmarks on which the final results are reported, and all main experiments use a single random seed (Appendix D.3). This makes it difficult to know whether the reported margins over baselines are significant and whether the chosen hyperparameters generalize. Please add multiple seeds with error bars, or at minimum a train/validation split for hyperparameter selection, and report the variance of the key metrics (I2P detections, ASR, CS, FID, KID) across runs.
minor comments (4)
  1. [Table 1] The STEREO row reads '2 2 1 0 0 0 1 06', which appears to be a formatting error for '0 6'; please fix the alignment and separate the total column clearly.
  2. [Appendix A] The appendix states that Tables 5–7 report RAB and MMA as counts over 285 and 1,000 attack trials, while Table 2 reports ASRs in percentages; please make this distinction explicit in each table caption so readers do not compare counts with percentages.
  3. [Tables 1–2, KID] The text says all KID values are multiplied by 100, yet RECE and PEAK report exactly 0.0000. An exact zero is implausible; please report the actual numerical values with sufficient precision or state rounding thresholds.
  4. [§3.2, Eq. (8)] The importance score S_q^f is a product of activation strength and frequency; the notation is clear, but the definition of the positive-activation set I_q^t in Eq. (6) silently drops features with non-positive activation. Please state explicitly that features with negative or zero activation are treated as absent for the purpose of scoring.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: erasure results are empirically measured, not definitionally entailed by the feature-selection equations.

full rationale

PEAK's derivation chain is not circular. The target feature set F_C is selected in Eq. (10) from activation strength and frequency statistics over matched prompt pairs, not from the reported benchmark outcomes. The optimization losses in Eqs. (13) and (15) suppress F_C and preserve its complement, but whether this changes generated images is an empirical question; the paper measures it with NudeNet detections, adversarial attack success rates, and CS/FID/KID. Persistence is tested with RAB, MMA, and UnlearnDiffAtk, none of which appear in the training objective or feature-selection procedure. The paper's own UnlearnDiffAtk Post-ASR of 16.10% is a limitation of the persistence claim, but a failed prediction is evidence against the claim, not evidence of circularity. Some design choices (preservation weight, kSAE block, feature-selection criteria) are ablated on the same evaluation benchmarks, which raises a benchmark-selection or overfitting concern, but that is not a definitional reduction of the measured results to the method's inputs. No load-bearing self-citation or imported uniqueness theorem is used. The central claim is therefore self-contained and empirically falsifiable.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The framework rests on the kSAE reconstruction quality, the causal interpretability of its sparse features, the matched-pair contrast, and hand-tuned selection thresholds. No new physical or conceptual entities are postulated beyond learned dictionary elements.

free parameters (6)
  • preservation weight lambda = 0.02
    Chosen by ablation on the same I2P, RAB, MMA, CS, and FID metrics used for final evaluation (Table 5); balances erasure and preservation.
  • percentile p for feature threshold = not specified in main text
    Controls strictness of target feature selection in Eq. (9) and Eq. (10); selected by hand or ablation, value not given.
  • k_step (top features per timestep) = not specified in main text
    Number of prominent sparse features retained at each timestep in Eq. (7); a free design choice affecting which features are scored.
  • kSAE sparsity k and latent dimension n = k=32, n=1280
    Architecture choices for the autoencoder that determine feature granularity and affect how well the target concept is localized.
  • kSAE block selection = up.1.1 for objects and nudity, up.1.2 for styles
    Selected by block-wise ablation on target attribute degradation (Appendix B.2), then used for erasure evaluation of that same attribute.
  • rollout depth r = uniform from {1,...,8}
    Training detail determining which denoising timesteps provide on-trajectory supervision for the erasure loss.
assumptions (6)
  • standard math ReLU k-sparse autoencoders with BatchTopK sparsity faithfully reconstruct diffusion activations (Eqs. 1-4).
    The method inherits the reconstruction and sparsity behavior of prior SAE work (Bricken et al. 2023; Gao et al. 2025; Bussmann et al. 2024) without re-deriving it.
  • domain assumption Cross-attention outputs in the U-Net upsampling path specialize in distinct visual attributes.
    Section 4.1 justifies kSAE placement on up.1.1 and up.1.2 by citing mechanistic studies (Basu et al. 2024a,b); if this localization premise fails, the selected features may not control the target concept.
  • domain assumption Sparse features learned on diffusion activations are semantically meaningful and causally linked to generated image content.
    The whole erasure mechanism assumes that zeroing a feature's activation weakens the corresponding visual concept, as tested by the feature-intervention ablation in Table 4.
  • domain assumption The 100 matched prompt pairs differ only in the target concept, so activation contrasts isolate target-specific features.
    Section D.2 describes GPT-5.5-generated pairs; any residual confounding between target and non-target prompts would contaminate the selected feature set.
  • ad hoc to paper The strength-times-frequency importance score and percentile threshold define a target-specific feature set.
    Eqs. (8)-(10) introduce a heuristic selection rule without a principled derivation; the authors validate it through ablation rather than theory.
  • ad hoc to paper The L_erase plus lambda L_pres objective embeds erasure permanently into model parameters.
    Eq. (16) is assumed to transfer feature-level suppression into persistent parameter changes; persistence is only demonstrated empirically on three attack benchmarks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PEAK: Precise and Persistent Concept Erasure via k-Sparse Autoencoders." pith.science (2026). https://pith.science/paper/RB4DS3QN

@misc{pith2026260810985,
  author       = {Pith},
  title        = {Pith review of: PEAK: Precise and Persistent Concept Erasure via k-Sparse Autoencoders},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RB4DS3QN}},
  note         = {Machine review of arXiv:2608.10985}
}
read the original abstract

Erasing concepts from large-scale text-to-image (T2I) diffusion models has become increasingly crucial due to the growing concerns over copyright infringement, privacy violations, and offensive content. Existing approaches struggle to achieve both precise and persistent concept erasure: inaccurate localization of concept-related representations may cause unintended semantic interference, while incomplete removal of the underlying concept knowledge allows adversarial recovery. To address this dilemma, we propose PEAK, a \textbf{\textit{precise}} and \textbf{\textit{persistent}} concept erasure framework via k-Sparse Autoencoders (kSAEs). PEAK first trains a kSAE on internal activations of the diffusion denoising network to decompose dense representations into interpretable sparse features. By contrasting sparse activations induced by target and non-target prompts, PEAK identifies a compact set of target-specific features according to both activation strength and frequency. These localized features are then used for parameter optimization, where PEAK selectively suppresses target-related activations while preserving complementary non-target ones towards the original model. This feature-guided optimization embeds concept erasure directly into diffusion parameters, eliminating the need for additional inference-time intervention and facilitating effective persistence against adversarial attacks. Extensive experiments demonstrate that PEAK achieves effective and robust concept erasure. On the I2P benchmark, PEAK reduces NudeNet detections from 582 to 6, lowers the average attack success rate (ASR) from 96.52\% to 5.63\%, and preserves general generation quality on MS-COCO with a near-zero KID. Our code and models are available at: https://github.com/manmanTAT/PEAK

Figures

Figures reproduced from arXiv: 2608.10985 by the authors.

Figure 1
Figure 1. Two key characteristics of PEAK for concept erasure in diffusion models. (a) Precise: PEAK removes the target concept [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The main pipeline of the proposed PEAK. (a) A frozen kSAE encodes diffusion-model activations induced by matched [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. (a) The selected features maintain high ROC-AUC [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Qualitative comparison of different prompt types. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Number of active features per image sample. The [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 9
Figure 9. Figure 9: Feature-wise ROC-AUC analysis of selected kSAE [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 11
Figure 11. Figure 11: Visualization and intervention of violence-related [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]
Figure 12
Figure 12. Figure 12: Multi-concept erasure results. (a) Qualitative re [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]
Figure 13
Figure 13. Figure 13: Erasure of the unseen Mario concept. PEAK re [PITH_FULL_IMAGE:figures/full_fig_p014_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 23 canonical work pages

  1. [1]

    Forty-second International Conference on Machine Learning , year=

    SAeUron: Interpretable Concept Unlearning in Diffusion Models with Sparse Autoencoders , author=. Forty-second International Conference on Machine Learning , year=

  2. [2]

    International Conference on Machine Learning (ICML) , year=

    SAEmnesia: Erasing Concepts in Diffusion Models with Supervised Sparse Autoencoders , author=. International Conference on Machine Learning (ICML) , year=

    work page

  3. [3]

    Advances in neural information processing systems , volume=

    Denoising diffusion probabilistic models , author=. Advances in neural information processing systems , volume=

  4. [4]

    32nd USENIX Security Symposium (USENIX Security 23) , pages=

    Glaze: Protecting artists from style mimicry by \ Text-to-Image \ models , author=. 32nd USENIX Security Symposium (USENIX Security 23) , pages=

    work page

  5. [5]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  6. [6]

    32nd USENIX security symposium (USENIX Security 23) , pages=

    Extracting training data from diffusion models , author=. 32nd USENIX security symposium (USENIX Security 23) , pages=

  7. [7]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Forget-me-not: Learning to forget in text-to-image diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  8. [8]

    Proceedings of the IEEE/CVF winter conference on applications of computer vision , pages=

    Unified concept editing in diffusion models , author=. Proceedings of the IEEE/CVF winter conference on applications of computer vision , pages=

Show all 55 references
  1. [9]

    International Conference on Learning Representations , volume=

    Sparse autoencoders find highly interpretable features in language models , author=. International Conference on Learning Representations , volume=

  2. [10]

    2023 , journal=

    Towards Monosemanticity: Decomposing Language Models With Dictionary Learning , author=. 2023 , journal=

    2023

  3. [11]

    2025 , eprint=

    Concept Steerers: Leveraging K-Sparse Autoencoders for Test-Time Controllable Generations , author=. 2025 , eprint=

    2025

  4. [12]

    2025 , eprint=

    Sparse Autoencoder as a Zero-Shot Classifier for Concept Erasing in Text-to-Image Diffusion Models , author=. 2025 , eprint=

    2025

  5. [13]

    2021 , eprint=

    LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairs , author=. 2021 , eprint=

    2021

  6. [14]

    Advances in neural information processing systems , volume=

    Laion-5b: An open large-scale dataset for training next generation image-text models , author=. Advances in neural information processing systems , volume=

  7. [15]

    2023 , eprint=

    SneakyPrompt: Jailbreaking Text-to-image Generative Models , author=. 2023 , eprint=

    2023

  8. [16]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Erasing concepts from diffusion models , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  9. [17]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Ablating concepts in text-to-image diffusion models , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  10. [18]

    Nudenet: Neural nets for nudity classification, detection and selective censoring , author=

  11. [19]

    International Conference on Learning Representations , volume=

    Localizing and editing knowledge in text-to-image generative models , author=. International Conference on Learning Representations , volume=

  12. [20]

    Forty-first International Conference on Machine Learning , year=

    On mechanistic knowledge localization in text-to-image generative models , author=. Forty-first International Conference on Machine Learning , year=

  13. [21]

    2024 , eprint=

    Interpreting Attention Layer Outputs with Sparse Autoencoders , author=. 2024 , eprint=

    2024

  14. [22]

    International Conference on Learning Representations , volume=

    Scaling and evaluating sparse autoencoders , author=. International Conference on Learning Representations , volume=

  15. [23]

    2014 , eprint=

    k-Sparse Autoencoders , author=. 2014 , eprint=

    2014

  16. [24]

    2024 , eprint=

    BatchTopK Sparse Autoencoders , author=. 2024 , eprint=

    2024

  17. [25]

    2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=

    Precise, fast, and low-cost concept erasure in value space: Orthogonal complement matters , author=. 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=. 2025 , organization=

    2025

  18. [26]

    European conference on computer vision , pages=

    Microsoft coco: Common objects in context , author=. European conference on computer vision , pages=. 2014 , organization=

    2014

  19. [27]

    , author=

    The meaning and use of the area under a receiver operating characteristic (ROC) curve. , author=. Radiology , volume=

  20. [28]

    European Conference on Computer Vision , pages=

    Race: Robust adversarial concept erasure for secure text-to-image diffusion model , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  21. [29]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Mace: Mass concept erasure in diffusion models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  22. [30]

    European Conference on Computer Vision , pages=

    Reliable and efficient concept erasure of text-to-image diffusion models , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  23. [31]

    Advances in neural information processing systems , volume=

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models , author=. Advances in neural information processing systems , volume=

  24. [32]

    2026 , eprint=

    Co-occurring associated retained concepts in Diffusion Unlearning , author=. 2026 , eprint=

    2026

  25. [33]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Stereo: A two-stage framework for adversarially robust concept erasing from text-to-image diffusion models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  26. [34]

    International conference on machine learning , pages=

    Learning transferable visual models from natural language supervision , author=. International conference on machine learning , pages=. 2021 , organization=

    2021

  27. [35]

    Advances in neural information processing systems , volume=

    Gans trained by a two time-scale update rule converge to a local nash equilibrium , author=. Advances in neural information processing systems , volume=

  28. [36]

    Bińkowski, Mikołaj and Sutherland, DJ and Arbel, M and Gretton, A , year =

  29. [37]

    International Conference on Learning Representations , volume=

    Ring-a-bell! how reliable are concept removal methods for diffusion models? , author=. International Conference on Learning Representations , volume=

  30. [38]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Mma-diffusion: Multimodal attack on diffusion models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  31. [39]

    arXiv preprint arXiv:2210.04610 , year=

    Red-teaming the stable diffusion safety filter , author=. arXiv preprint arXiv:2210.04610 , year=

    arXiv

  32. [40]

    2023 , howpublished =

    2023

  33. [41]

    2023 , month = mar, howpublished =

    Dana Rao , title =. 2023 , month = mar, howpublished =

    2023

  34. [42]

    2026 , url=

    Ouxiang Li and Yuan Wang and Xinting Hu and Houcheng Jiang and Tao Liang and Yanbin Hao and Guojun Ma and Fuli Feng , booktitle=. 2026 , url=

    2026

  35. [43]

    2025 , eprint=

    A Single Neuron Works: Precise Concept Erasure in Text-to-Image Diffusion Models , author=. 2025 , eprint=

    2025

  36. [44]

    International Conference on Learning Representations , volume=

    Easier Painting Than Thinking: Can Text-to-Image Models Set the Stage, but Not Direct the Play? , author=. International Conference on Learning Representations , volume=

  37. [45]

    2026 , eprint=

    OrthoEraser: Coupled-Neuron Orthogonal Projection for Concept Erasure , author=. 2026 , eprint=

    2026

  38. [46]

    2025 , eprint=

    TraSCE: Trajectory Steering for Concept Erasure , author=. 2025 , eprint=

    2025

  39. [47]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  40. [48]

    Forty-second International Conference on Machine Learning , year=

    Eraseanything: Enabling concept erasure in rectified flow transformers , author=. Forty-second International Conference on Machine Learning , year=

  41. [49]

    2026 , eprint=

    Concept Unlearning via Cross-Attention Activation Projection for Diffusion Models , author=. 2026 , eprint=

    2026

  42. [50]

    2024 , howpublished=

    Black Forest Labs , title=. 2024 , howpublished=

    2024

  43. [51]

    SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis , url =

    Podell, Dustin and English, Zion and Lacey, Kyle and Blattmann, Andreas and Dockhorn, Tim and M\". SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis , url =. International Conference on Learning Representations , editor =

  44. [52]

    2026 , eprint=

    Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet , author=. 2026 , eprint=

    2026

  45. [53]

    2022 , howpublished =

    Stable Diffusion v1-4 Model Card , author =. 2022 , howpublished =

    2022

  46. [54]

    and Ba, Jimmy , title =

    Kingma, Diederik P. and Ba, Jimmy , title =. International Conference on Learning Representations (ICLR) , year =

  47. [55]

    2019 , eprint=

    Decoupled Weight Decay Regularization , author=. 2019 , eprint=

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.