Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

CGCE proposes a plug-and-play safety layer that erases unwanted concepts from text-to-image and text-to-video models by detecting and refining unsafe prompts in embedding space, without changing the generative model's weights.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 23:23 UTC pith:AULCZEC2

load-bearing objection A new plug-and-play concept erasure method with strong results on standard benchmarks, but the robustness claim is only tested against non-adaptive attacks and the step size is tuned on the test set. the 4 major comments →

arxiv 2511.05865 v3 pith:AULCZEC2 submitted 2025-11-08 cs.CV cs.AIcs.CR

CGCE: Classifier-Guided Concept Erasure in Generative Models

Viet Nguyen , Vishal M. Patel This is my paper
classification cs.CV cs.AIcs.CR
keywords concept erasuretext-to-image safetyadversarial robustnessclassifier guidanceembedding refinementplug-and-play safeguarddiffusion modelsred-teaming attacks
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper introduces a plug-and-play safety layer for text-to-image and text-to-video models. It trains a lightweight classifier on paired safe/unsafe prompts to detect undesired concepts in the text embedding. At inference, if a prompt is flagged unsafe, the classifier's own gradients are used to iteratively nudge the embedding away from the concept before the generative model sees it. Because only unsafe embeddings are altered and no weights are changed, the base model's output quality on benign prompts is nearly untouched. The paper reports lower attack success rates than existing erasure methods on several red-teaming benchmarks while keeping FID and CLIP scores close to the base model.

Core claim

CGCE claims that robust concept erasure can be achieved without modifying the generative model at all: a small classifier trained on paired safe/unsafe prompts detects the concept in text-embedding space, and gradient descent on the classifier's output with respect to the embedding refines the prompt until it is classified safe. The refinement is localized by token-importance weights and normalized to keep updates stable. This yields attack success rates competitive with or better than weight-editing methods on benchmarks such as P4D, Ring-A-Bell, MMA-Diffusion, and UnlearnDiffAtk, while the FID (16.10 vs 16.79) and CLIP score (31.03 vs 31.31) of the base Stable Diffusion v1.4 model are esse

What carries the argument

The central object is a lightweight binary classifier that takes the prompt embedding (via CLIP or T5) and a concept embedding (e.g., 'sexual, nudity, sex, porn, naked') and uses multi-head cross-attention to score which prompt tokens relate to the concept. An importance-weighted aggregation produces a single probability. At inference, if the probability exceeds 0.5, the classifier's gradient with respect to the embedding is weighted by token importance, normalized by its norm, and scaled by the embedding norm to take a step away from the concept. This procedure is repeated until the classifier output drops below threshold or a step budget is reached; multiple concepts are handled by summing

Load-bearing premise

The whole defense rests on the assumption that reducing the classifier's output probability via a few gradient steps in embedding space moves the prompt into a region the generative model decodes as safe, and that an adversary cannot find embeddings which the classifier calls safe but the generator still renders as unsafe; this is only tested against attacks aimed at the base model, not at the classifier itself.

What would settle it

Run a white-box attack that optimizes prompts directly against the trained CGCE classifier to find embeddings which score below the detection threshold (e.g., below 0.5) but, when passed through CGCE to SD-v1.4 or FLUX, still produce images flagged as unsafe by NudeNet. If such adversarial prompts exist at non-trivial rates, the safeguard can be bypassed.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Safe prompts pass through unchanged, so generative quality on benign content is exactly the base model's own output.
  • A single classifier trained on one text encoder can safeguard every generator using that encoder, demonstrated across CLIP-based and T5-based image and video models.
  • Multi-concept erasure scales by aggregating per-concept classifier gradients, shown for three co-existing concepts on FLUX.1-dev.
  • Training takes roughly 440 seconds on one GPU, versus hours for fine-tuning baselines, and inference adds only a few gradient steps for flagged prompts.
  • Because no weights are edited, the method can be applied post-hoc to already-deployed models without retraining them.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The approach shifts the safety burden from the generator to the classifier, so an adversary who learns the classifier's decision boundary could craft embeddings that are classified safe yet still decode to unsafe content; the paper only evaluates attacks designed against the base model, not against CGCE itself.
  • The method is per-concept rather than per-model: each concept needs a hand-written concept prompt and 1000 generated prompt pairs, so adding a new concept incurs a one-time data-generation and training cost.
  • A false-positive rate of about 7% on COCO means some benign prompts get altered; the paper argues the refinement is gentle on those errors, but the practical impact in sensitive deployments would deserve direct study.
  • Since refinement happens entirely in embedding space, CGCE could be stacked with other safeguards such as image post-processing or prompt filters without retraining.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes CGCE, a plug-and-play concept-erasure framework that trains a lightweight classifier on text embeddings to detect a target concept (e.g., nudity, an artistic style, or an object). When a prompt is flagged unsafe, CGCE iteratively refines the text embedding by gradient descent on the classifier's output, steering the embedding away from the concept while leaving the generative model's weights untouched. The method is evaluated on nudity, artistic style, and object removal across SD-v1.4 and several modern T2I/T2V backbones. The main reported results are strong ASR reductions on standard red-teaming attacks (P4D, RAB, MMAD, UDA) with nearly unchanged FID/CLIP on SD-v1.4.

Significance. CGCE is a simple, modular, and architecture-agnostic safety filter. Its key strength is that it does not modify the base generative model, so benign prompts should retain the original model's utility. The experiments are extensive, covering multiple concept-erasure tasks and a broad set of baselines, and the SD-v1.4 results are genuinely competitive. However, the central claim of 'state-of-the-art robustness' is currently limited to non-adaptive attacks that are blind to the CGCE classifier, and the utility-preservation claim is not quantified for most of the modern backbones. If the adaptive-robustness gap is addressed and utility metrics are added, this could be a practical contribution to safe generative AI.

major comments (4)
  1. [Sec. 4.2 / Eq. (3), Tables 2, 6, 7] The central robustness claim is established only against non-adaptive adversaries. All six attacks evaluated in Tables 2–7 (P4D, RAB, MMAD, UDA) are designed to bypass the base generative model and do not model the presence of CGCE's classifier f_θ. Because f_θ is a feed-forward network operating on the embedding (Eq. (3), threshold τ=0.5), a white-box adversary can optimize a prompt or soft-prompt to simultaneously keep f_θ(ε_p, ε_c) below τ and preserve unsafe image generation. The refined embedding is itself an adversarial perturbation of the original embedding; there is no reason to expect f_θ's decision boundary to align with the generative model's safety boundary. The paper should include an adaptive attack, e.g., augmenting P4D/UDA with an additional loss to suppress f_θ, and report the resulting ASR. Without this, the headline 'state-of-the-art robustness' is unverified.
  2. [Sec. 4.3, Tables 6 and 7] The utility-preservation claim is only quantified for SD-v1.4 (Table 2). Tables 6 and 7 report ASR for SD-v3, FLUX, Switti-AR, Infinity-2B, CogVideoX, and Hunyuan Video, but no FID/CLIP or other utility metric is given. The abstract and intro claim that CGCE 'maintains high generative utility' and achieves 'a superior balance between safety and performance' across diverse models. Without utility numbers on these backbones, the generality claim is unsupported. Add FID/CLIP or an equivalent utility measure for at least the main models in Tables 6 and 7.
  3. [Sec. 4.1 and Table 9] The step size η is the key hyperparameter and is chosen empirically per task and per model (Table 10 in the appendix). The ablation in Table 9 shows that η changes ASR dramatically (e.g., MMAD from 10.70 at η=0.1 to 1.90 at η=1.0) and also affects FID/CLIP. The final η values are selected based on the same benchmarks used for the SOTA comparison. This constitutes test-set tuning; the reported rankings may not reflect a fixed method's expected performance. The paper should justify η selection with a validation split or report sensitivity over a wider range for each backbone, rather than presenting the best-performing η on the test benchmarks as the method's default.
  4. [Tables 2–7] All ASR numbers are point estimates without error bars, confidence intervals, or significance tests. Several differences between methods are small and likely within noise—e.g., Table 4 (UDA style: CGCE 24.00 vs STEREO 26.00), Table 5 (church: 16.00 vs 20.00), and Table 7 (CogX-5B SafeSora-Sexual: 0.86 vs 0.98). The number of evaluation prompts per benchmark is not stated, and no multiple-seed or bootstrap variability is reported. Without uncertainty estimates, the state-of-the-art ranking is not statistically supported.
minor comments (5)
  1. [Sec. 4.2] The text states that 'our classifier can accurately identify safe and unsafe content, making no changes to safe samples,' but Table 1 reports a 7.18% false-positive rate on COCO-30K. Safe prompts that are false positives do get refined. This overstatement should be corrected, and the impact of false positives on utility should be quantified beyond the qualitative examples in the appendix.
  2. [Table 3] The STEREO citation is listed as [40] in Table 3, but [40] is SAFREE; the correct reference is [32]. Please check all citations for consistency.
  3. [Sec. 3.2 and Algorithm 1] The stopping criterion and the maximum number of refinement iterations K are not specified. Algorithm 1 takes K as input but no default value is given. Also, the classifier's forward pass in Algorithm 1 returns importance scores s^{(k)} and probability, but the computation of s^{(k)} is only described in Sec. 3.1; clarify how these are obtained at inference time.
  4. [Sec. 4.1 / Table 1] The detection accuracy in Table 1 is reported on 'our unsafe nudity dataset' of over 3000 prompts, but the composition of this dataset is not described. Is it a held-out split of the LLM-generated data, or an external benchmark? This is important for interpreting the 99.22% detection rate.
  5. [General] The project page is mentioned, but no code or trained classifiers are provided in the manuscript. Releasing the code, the LLM-generated prompt pairs, and the classifier checkpoints would substantially improve reproducibility.

Circularity Check

0 steps flagged

No significant circularity: CGCE's reported safety metrics come from external detectors, so the central claim does not reduce to the method's own classifier.

full rationale

The paper's derivation chain is not circular. The classifier f_theta is trained on synthetic LLM-generated safe/unsafe prompt pairs (Sec. 3.1), and the inference-time refinement in Eq. 3 minimizes f_theta's output in embedding space. However, all headline safety results are measured with external, independently constructed detectors: NudeNet for nudity ASR, the style classifier from [44] for artistic style, and a ResNet-50 ImageNet classifier for object removal (Sec. 4.1). The evaluation target is therefore not defined by the method's own classifier, so the claim 'prevents harmful content generation' is not self-definitional. The step size eta is described as an empirical, task-specific hyperparameter chosen via ablation (Tables 9, 10); this is a standard hyperparameter selection and, while it creates a risk of benchmark overfitting, it is not a fitted parameter being relabeled as a prediction, because eta alone does not determine the ASR measured by the external detectors. The only self-citation is to STEREO [32], which is used purely as a comparison baseline, not as load-bearing justification for CGCE's assumptions. No uniqueness theorem, ansatz-via-citation, or renaming of a known result is present. The absence of adaptive, defense-aware attacks is a correctness/external-validity concern, not a circularity: the method's outputs are still measured against independent detectors. Thus no step of the claimed derivation reduces to its own inputs by construction.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The method relies on a standard trained classifier module, not on any new physical or conceptual entity. The key free parameters are the step size η and the classifier design choices, which are tuned on the evaluation benchmarks. The load-bearing assumptions concern the reliability of text embeddings as a safety substrate and the representativeness of the synthetic training data and attack suites.

free parameters (4)
  • step size η = 1.0 (nudity, SD-v1.4), 0.15 (Van Gogh), 0.5 (church); varies by model (Tab. 10)
    Chosen empirically on the evaluation benchmarks; controls the trade-off between erasure robustness and utility preservation. Table 9 shows η=1.0 is selected to optimize ASR/FID on the test attacks.
  • detection threshold τ = 0.5
    Fixed default without analysis; the classifier's operating point is assumed to transfer, but it affects which prompts are refined.
  • classifier training set size = 1000 prompt pairs per concept
    Chosen without a sensitivity study; the representativeness of these 1000 pairs for real-world unsafe prompts is not established.
  • classifier architecture dimensions = Hidden dims 256/512/1024 depending on encoder
    Architecture is described, but no ablation shows the effect of these choices on detection/erasure performance.
axioms (4)
  • domain assumption Text embedding space is a sufficient substrate for detecting and erasing semantic concepts.
    The entire method operates on text embeddings; if the concept cannot be localized in this space, the method fails.
  • domain assumption Gradient descent on the classifier output produces embeddings that the generative model maps to safe images without corrupting the image.
    Not proven; the paper shows qualitative similarity for false positives but does not measure embedding drift or manifold constraints.
  • domain assumption LLM-generated prompt pairs are representative of the distribution of unsafe prompts a deployed model faces.
    Training data relies on Gemini/Qwen; if their notion of unsafe differs from real-world usage, detection accuracy will drop.
  • domain assumption Existing red-team attack benchmarks (P4D, RAB, MMAD, UDA) are representative of real adversaries, and non-adaptive evaluation is sufficient.
    The paper does not test adaptive attackers who know about CGCE's classifier; such attackers could craft prompts that bypass the classifier while still generating unsafe content.

pith-pipeline@v1.3.0-alltime-deepseek · 18837 in / 9011 out tokens · 81293 ms · 2026-08-03T23:23:54.535676+00:00 · methodology

0 comments
read the original abstract

Recent advancements in large-scale generative models have enabled the creation of high-quality images and videos, but have also raised significant safety concerns regarding the generation of unsafe content. To mitigate this, concept erasure methods have been developed to remove undesirable concepts from pre-trained models. However, existing methods remain vulnerable to adversarial attacks that can regenerate the erased content. Moreover, achieving robust erasure often degrades the model's generative quality for safe, unrelated concepts, creating a difficult trade-off between safety and performance. To address this challenge, we introduce Classifier-Guided Concept Erasure (CGCE), an efficient plug-and-play framework that provides robust concept erasure for diverse generative models without altering their original weights. CGCE uses a lightweight classifier operating on text embeddings to first detect and then refine prompts containing undesired concepts. By modifying only unsafe embeddings at inference time, our method prevents harmful content generation while preserving the model's original quality on benign prompts. Extensive experiments show that CGCE achieves state-of-the-art robustness against a wide range of red-teaming attacks. Our approach also maintains high generative utility, demonstrating a superior balance between safety and performance. We showcase the versatility of CGCE through its successful application to various modern T2I and T2V models, establishing it as a practical and effective solution for safe generative AI.

Figures

Figures reproduced from arXiv: 2511.05865 by Viet Nguyen, Vishal M. Patel.

Figure 1
Figure 1. Figure 1: We present CGCE, an efficient plug-and-play framework for robust and high-fidelity concept erasure. Top: CGCE produces safer and higher-quality results compared to state-of-the-art baselines [8, 11, 32, 40] across diverse T2I erasure tasks, including nudity, artistic style, and object removal. Bottom: The cross-modal safety and versatility of CGCE, which can be seamlessly applied as a safeguard to a range … view at source ↗
Figure 2
Figure 2. Figure 2: Overview of CGCE. Stage 1: LLM is used to create a dataset of paired prompts, each containing a safe prompt and a semantically similar unsafe version. Stage 2: A lightweight classifier is trained on the embeddings of these prompts to distinguish between safe and unsafe content. Stage 3: At inference time, the trained classifier acts as a plug-and-play safeguard. If an input prompt is safe, its embedding is… view at source ↗
Figure 3
Figure 3. Figure 3: Qualitative evaluation of CGCE’s effectiveness in erasing target concepts while preserving unrelated concepts, compared to baseline methods with SD-v1.4 backbone. Sensitive content (*) has been masked for publication. artist styles and LPIPSu for unerased styles. The overall effectiveness is measured by their difference, LPIPSd = LPIPSe − LPIPSu. As shown in Tab. 3, CGCE achieves the best performance with … view at source ↗
Figure 4
Figure 4. Figure 4: Qualitative evaluation of CGCE’s effectiveness in erasing nudity con￾cepts, compared to baseline methods with modern T2I and T2V architectures. Sensitive content (*) has been masked for publication [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Qualitative evaluation of CGCE’s effectiveness in multi-concept erasure with FLUX.1-dev model. Sensitive content (*) has been masked for publication [PITH_FULL_IMAGE:figures/full_fig_p014_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Qualitative comparison of SD-v1.4 and CGCE on safe prompts that were falsely detected as containing nudity. This figure demonstrates that even when our classifier makes an error (a false positive), the subsequent refinement step is gentle and does not degrade the visual quality or alter the content, highlighting our method’s high utility preservation. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Qualitative evaluation of CGCE and other concept erasure methods on the SD-v1.4 backbone. The figure compares performance on nudity erasure, evaluating each method’s ability to remove the target concept while preserving unrelated ones. Sensitive content (*) has been masked for publication. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Qualitative evaluation of CGCE and other concept erasure methods on the SD-v1.4 backbone. The figure compares performance on “Van Gogh” style erasure (left) and “Church” object erasure (right), evaluating each method’s ability to remove the target concept while preserving unrelated ones. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with SD-v3 model. Sensitive content (*) has been masked for publication. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with FLUX.1-dev model. Sensitive content (*) has been masked for publication. 19 [PITH_FULL_IMAGE:figures/full_fig_p019_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with Switti-AR (left) and Infinity-2B (right). Sensitive content (*) has been masked for publication. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with CogVideoX-2B. Sensitive content (*) has been masked for publication. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with CogVideoX-2B. Sensitive content (*) has been masked for publication. 22 [PITH_FULL_IMAGE:figures/full_fig_p022_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with CogVideoX-5B. Sensitive content (*) has been masked for publication. 23 [PITH_FULL_IMAGE:figures/full_fig_p023_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with CogVideoX-5B. Sensitive content (*) has been masked for publication. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with HunyuanVideo. Sensitive content (*) has been masked for publication. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: Qualitative evaluation of CGCE’s effectiveness in erasing nudity concepts, compared to baseline methods with HunyuanVideo. Sensitive content (*) has been masked for publication. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_17.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Cross-Space Distillation: Teaching One-Step Students with Modern Diffusion Teachers

    cs.CV 2026-06 unverdicted novelty 7.0

    Introduces a Bridge latent interface that maps mismatched student latents into teacher space, enabling distillation from modern diffusion teachers to compact one-step students and raising SD 1.5 HPSv3 from 5.4 to 9.4 ...

Reference graph

Works this paper leans on

56 extracted references · 8 linked inside Pith · cited by 1 Pith paper

  1. [1]

    The pri- vacy onion effect: Memorization is relative.Advances in Neural Information Processing Systems, 35:13263–13276,

    Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nico- las Papernot, Andreas Terzis, and Florian Tramer. The pri- vacy onion effect: Memorization is relative.Advances in Neural Information Processing Systems, 35:13263–13276,

  2. [2]

    Prompting4debugging: Red- teaming text-to-image diffusion models by finding prob- lematic prompts

    Zhi-Yi Chin, Chieh-Ming Jiang, Ching-Chun Huang, Pin- Yu Chen, and Wei-Chen Chiu. Prompting4debugging: Red- teaming text-to-image diffusion models by finding prob- lematic prompts. InInternational Conference on Machine Learning (ICML), 2024. 2, 3, 5

    2024

  3. [3]

    Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities.arXiv preprint arXiv:2507.06261, 2025

    Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blis- tein, Ori Ram, Dan Zhang, Evan Rosen, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities.arXiv preprint arXiv:2507.06261, 2025. 4, 11

    Pith/arXiv arXiv 2025

  4. [4]

    Xtuner: A toolkit for efficiently fine-tuning llm.https://github.com/InternLM/ xtuner, 2023

    XTuner Contributors. Xtuner: A toolkit for efficiently fine-tuning llm.https://github.com/InternLM/ xtuner, 2023. 13

    2023

  5. [5]

    Safesora: Towards safety alignment of text2video generation via a human pref- erence dataset.Advances in Neural Information Processing Systems, 37:17161–17214, 2024

    Juntao Dai, Tianle Chen, Xuyao Wang, Ziran Yang, Taiye Chen, Jiaming Ji, and Yaodong Yang. Safesora: Towards safety alignment of text2video generation via a human pref- erence dataset.Advances in Neural Information Processing Systems, 37:17161–17214, 2024. 6

    2024

  6. [6]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 6

    2009

  7. [7]

    Scaling recti- fied flow transformers for high-resolution image synthesis

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas M ¨uller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling recti- fied flow transformers for high-resolution image synthesis. InForty-first international conference on machine learning. 2, 5, 8, 12, 13, 15

  8. [8]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. InProceedings of the IEEE/CVF international con- ference on computer vision, pages 2426–2436, 2023. 1, 2, 5, 6, 7, 8, 13

    2023

  9. [9]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. InProceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision, pages 5111–5120, 2024. 2, 3, 5, 6, 7, 8, 13

    2024

  10. [10]

    Eraseanything: Enabling concept erasure in rectified flow transformers

    Daiheng Gao, Shilin Lu, Wenbo Zhou, Jiaming Chu, Jie Zhang, Mengxi Jia, Bang Zhang, Zhaoxin Fan, and Weiming Zhang. Eraseanything: Enabling concept erasure in rectified flow transformers. InForty-second International Conference on Machine Learning. 2, 7, 8, 15

  11. [11]

    Reliable and efficient concept erasure of text-to- image diffusion models

    Chao Gong, Kai Chen, Zhipeng Wei, Jingjing Chen, and Yu- Gang Jiang. Reliable and efficient concept erasure of text-to- image diffusion models. InEuropean Conference on Com- puter Vision, pages 73–88. Springer, 2024. 1, 2, 3, 5, 6, 7, 8

    2024

  12. [12]

    Infinity: Scaling bit- wise autoregressive modeling for high-resolution image syn- thesis

    Jian Han, Jinlai Liu, Yi Jiang, Bin Yan, Yuqi Zhang, Zehuan Yuan, Bingyue Peng, and Xiaobing Liu. Infinity: Scaling bit- wise autoregressive modeling for high-resolution image syn- thesis. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 15733–15744, 2025. 2, 5, 6, 8, 12, 13, 15

    2025

  13. [13]

    Selective amnesia: A contin- ual learning approach to forgetting in deep generative mod- els.Advances in Neural Information Processing Systems, 36: 17170–17194, 2023

    Alvin Heng and Harold Soh. Selective amnesia: A contin- ual learning approach to forgetting in deep generative mod- els.Advances in Neural Information Processing Systems, 36: 17170–17194, 2023. 2

    2023

  14. [14]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium.Advances in neural information processing systems, 30, 2017

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium.Advances in neural information processing systems, 30, 2017. 6

    2017

  15. [15]

    Classifier-free diffusion guidance.arXiv preprint arXiv:2207.12598, 2022

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance.arXiv preprint arXiv:2207.12598, 2022. 3

    Pith/arXiv arXiv 2022

  16. [16]

    Imagen video: High definition video generation with diffusion mod- els.arXiv preprint arXiv:2210.02303, 2022

    Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey Gritsenko, Diederik P Kingma, Ben Poole, Mohammad Norouzi, David J Fleet, et al. Imagen video: High definition video generation with diffusion mod- els.arXiv preprint arXiv:2210.02303, 2022. 2

    Pith/arXiv arXiv 2022

  17. [17]

    Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model

    Changhoon Kim, Kyle Min, and Yezhou Yang. Race: Ro- bust adversarial concept erasure for secure text-to-image dif- fusion model. InEuropean Conference on Computer Vision, pages 461–478. Springer, 2024. 2, 3

    2024

  18. [18]

    Hunyuanvideo: A systematic framework for large video generative models.arXiv preprint arXiv:2412.03603, 2024

    Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models.arXiv preprint arXiv:2412.03603, 2024. 2, 5, 6, 7, 8, 12, 13, 15

    Pith/arXiv arXiv 2024

  19. [19]

    Eraseflow: Learn- ing concept erasure policies via gflownet-driven alignment

    Abhiram Kusumba, Maitreya Patel, Kyle Min, Changhoon Kim, Chitta Baral, and Yezhou Yang. Eraseflow: Learn- ing concept erasure policies via gflownet-driven alignment. arXiv preprint arXiv:2511.00804, 2025. 2, 5, 6, 7, 8, 15

    arXiv 2025

  20. [20]

    Flux.https://github.com/ black-forest-labs/flux, 2024

    Black Forest Labs. Flux.https://github.com/ black-forest-labs/flux, 2024. 2, 5, 6, 8, 12, 13, 15

    2024

  21. [21]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pages 740–755. Springer, 2014. 4, 6

    2014

  22. [22]

    Mace: Mass concept erasure in diffu- sion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffu- sion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6430– 6440, 2024. 5, 6, 13

    2024

  23. [23]

    Nudenet: Neural nets for nudity classification, detection, and selective censoring.https://github

    notAI tech. Nudenet: Neural nets for nudity classification, detection, and selective censoring.https://github. com/notAI- tech/NudeNet, 2024. Accessed: 2024- 11-15. 6

    2024

  24. [24]

    Direct unlearning optimization for robust and safe text- to-image models.Advances in Neural Information Process- ing Systems, 37:80244–80267, 2024

    Yong-Hyun Park, Sangdoo Yun, Jin-Hwa Kim, Junho Kim, Geonhui Jang, Yonghyun Jeong, Junghyo Jo, and Gayoung Lee. Direct unlearning optimization for robust and safe text- to-image models.Advances in Neural Information Process- ing Systems, 37:80244–80267, 2024. 3, 5, 6

    2024

  25. [25]

    Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M ¨uller, Joe Penna, and 9 Robin Rombach. Sdxl: Improving latent diffusion mod- els for high-resolution image synthesis.arXiv preprint arXiv:2307.01952, 2023. 2

    Pith/arXiv arXiv 2023

  26. [26]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. InInternational conference on machine learning, pages 8748–8763. PmLR, 2021. 4, 12, 13

    2021

  27. [27]

    Exploring the limits of transfer learning with a unified text-to-text transformer.Journal of machine learning research, 21(140):1–67, 2020

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer.Journal of machine learning research, 21(140):1–67, 2020. 4, 12, 13

    2020

  28. [28]

    Six-cd: Benchmarking concept removals for benign text-to-image diffusion models, 2025

    Jie Ren, Kangrui Chen, Yingqian Cui, Shenglai Zeng, Hui Liu, Yue Xing, Jiliang Tang, and Lingjuan Lyu. Six-cd: Benchmarking concept removals for benign text-to-image diffusion models, 2025. 5

    2025

  29. [29]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, 2022. 2, 5, 6, 7, 12, 13, 15

    2022

  30. [30]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 2, 3, 5, 6, 8, 13

    2023

  31. [31]

    Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in neural in- formation processing systems, 35:25278–25294, 2022

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training next generation image-text models.Advances in neural in- formation processing systems, 35:25278–25294, 2022. 2

    2022

  32. [32]

    Stereo: A two- stage framework for adversarially robust concept erasing from text-to-image diffusion models

    Koushik Srivatsan, Fahad Shamshad, Muzammal Naseer, Vishal M Patel, and Karthik Nandakumar. Stereo: A two- stage framework for adversarially robust concept erasing from text-to-image diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 23765–23774, 2025. 1, 2, 3, 5, 6, 7, 8, 15

    2025

  33. [33]

    Qwen2.5: A party of foundation models, 2024

    Qwen Team. Qwen2.5: A party of foundation models, 2024. 4, 11

    2024

  34. [34]

    Attention is all you need.Advances in neural information processing systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017. 4

    2017

  35. [35]

    Switti: De- signing scale-wise transformers for text-to-image synthesis

    Anton V oronov, Denis Kuznedelev, Mikhail Khoroshikh, Valentin Khrulkov, and Dmitry Baranchuk. Switti: De- signing scale-wise transformers for text-to-image synthesis. arXiv preprint arXiv:2412.01819, 2024. 5, 6, 8, 12, 13, 15

    Pith/arXiv arXiv 2024

  36. [36]

    Video- eraser: Concept erasure in text-to-video diffusion models

    Naen Xu, Jinghuai Zhang, Changjiang Li, Zhi Chen, Chunyi Zhou, Qingming Li, Tianyu Du, and Shouling Ji. Video- eraser: Concept erasure in text-to-video diffusion models. arXiv preprint arXiv:2508.15314, 2025. 3

    Pith/arXiv arXiv 2025

  37. [37]

    Mma-diffusion: Multimodal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024. 3, 5

    2024

  38. [38]

    Cogvideox: Text-to-video diffusion models with an expert transformer.arXiv preprint arXiv:2408.06072, 2024

    Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang, Wenyi Hong, Xiao- han Zhang, Guanyu Feng, et al. Cogvideox: Text-to-video diffusion models with an expert transformer.arXiv preprint arXiv:2408.06072, 2024. 2, 5, 6, 7, 8, 12, 13, 15

    Pith/arXiv arXiv 2024

  39. [39]

    T2vunlearning: A concept erasing method for text-to-video diffusion models.arXiv preprint arXiv:2505.17550, 2025

    Xiaoyu Ye, Songjie Cheng, Yongtao Wang, Yajiao Xiong, and Yishen Li. T2vunlearning: A concept erasing method for text-to-video diffusion models.arXiv preprint arXiv:2505.17550, 2025. 3, 6, 8, 15

    arXiv 2025

  40. [40]

    Safree: Training-free and adaptive guard for safe text-to-image and video generation.ICLR, 2025

    Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation.ICLR, 2025. 1, 2, 3, 5, 6, 7, 8

    2025

  41. [41]

    Ring-a-bell! how reliable are concept removal methods for diffusion models? InThe Twelfth International Conference on Learning Representations, 2024

    Chulin Xie Chih-Hsun Lin Jia-You Chen Bo Li Pin-Yu Chen Chia-Mu Yu Chun-Ying Huang Yu-Lin Tsai*, Chia-Yi Hsu*. Ring-a-bell! how reliable are concept removal methods for diffusion models? InThe Twelfth International Conference on Learning Representations, 2024. 2, 3, 5

    2024

  42. [42]

    Forget-me-not: Learning to for- get in text-to-image diffusion models

    Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to for- get in text-to-image diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1755–1764, 2024. 2

    2024

  43. [43]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 586–595, 2018. 6

    2018

  44. [44]

    To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yi- hua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To gener- ate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Con- ference on Computer Vision, pages 385–403. Springer, 2024. 2, 3, 5, 6, 7 10 CGCE : Classifier-Guided Concept Erasure in ...

    2024

  45. [45]

    The al- gorithm iteratively refines a prompt’s text embeddingε p, overKsteps

    Algorithm Details Algorithm 1 presents the complete pseudocode for our si- multaneous multi-concept embedding refinement. The al- gorithm iteratively refines a prompt’s text embeddingε p, overKsteps. In each step, it checks the prompt againstL different concept classifiers. If any classifiers detect their re- spective concepts, their normalized and weight...

  46. [46]

    Prompt Template To ensure training data of our classifier diversity, we utilized multiple LLMs, including Gemini 2.5 Pro [3] and Qwen2.5- 7B-Instruct [33]

    Additional Experimental Details 7.1. Prompt Template To ensure training data of our classifier diversity, we utilized multiple LLMs, including Gemini 2.5 Pro [3] and Qwen2.5- 7B-Instruct [33]. Each LLM was instructed with a specific system prompt for each target concept, as detailed below. Prompt Template forVan GoghConcept Create exactly 1000 unique pair...

  47. [47]

    A safe prompt - either with no artistic style or with a different artistic style (like Picasso, Rem- brandt, Warhol, or Caravaggio)

  48. [48]

    Van Gogh

    A minimally modified version of the safe prompt that naturally incorporates the word “Van Gogh”. The prompts within each pair should be as similar as possible in structure and content, with the main difference being the natural inclusion of “Van Gogh”. Examples: Safe: A man cooking in the kitchen, Picasso style. Unsafe: A man cooking in the kitchen,Van Go...

  49. [49]

    A safe, appropriate prompt

  50. [50]

    The prompts within each pair should be as similar as possible in structure and content, with the main difference being thesexualelements

    Asexual, unsafe version that is similar but con- tainssexualcontent. The prompts within each pair should be as similar as possible in structure and content, with the main difference being thesexualelements. Examples: Safe: A woman cooking in the kitchen. Unsafe: Anudewoman cooking in the kitchen. Safe: A man gardening in his backyard. Unsafe: Atoplessman ...

  51. [51]

    A safe prompt: a description that does not con- tain “church” anywhere

  52. [52]

    church”. The prompts within each pair should be as similar as possible in structure and content, with the main difference being the natural inclusion of “church

    A minimally modified version of the safe prompt that naturally incorporates the word “church”. The prompts within each pair should be as similar as possible in structure and content, with the main difference being the natural inclusion of “church”. Examples: Safe: A tall building with a bell tower. Unsafe: Achurchwith a bell tower. Safe: A woman praying i...

    2048

  53. [53]

    Image in the style of{artist name}

    Multi-Concept Erasure We evaluate artistic style removal following the benchmark setting from MACE [22]. This benchmark uses a dataset of 200 artists, which is divided into an erasure group of 100 artists and a retention group of 100 artists. Prompts are generated using a template, such as “Image in the style of{artist name}”. We evaluate performance usin...

  54. [54]

    Fig- ure 6 provides a qualitative comparison for these scenarios

    Impact of False Positives on Utility A critical test of our method’s utility is its behavior during misclassification, specifically on false positive detections where a safe prompt is incorrectly flagged as unsafe. Fig- ure 6 provides a qualitative comparison for these scenarios. We show outputs from the base SD-v1.4 model alongside outputs fromCGCEfor th...

  55. [55]

    As shown in Tab

    Ablation Study on Importance Scores We conduct an ablation study to validate the importance of using the token importance scoresin our refinement pro- cess. As shown in Tab. 14, we compare our full method, which uses the weighted gradient (s⊙ ∇fθ), against a vari- 13 Figure 5. Qualitative evaluation ofCGCE’s effectiveness inmulti-concepterasure with FLUX....

  56. [56]

    Van Gogh

    Extended Visual Results Figure 7 provides further qualitative results for nudity re- moval on the SD-v1.4 backbone [29], comparingCGCEto other methods. Our method successfully erases the unsafe content from the generated image. Crucially, for safe, unre- lated prompts, it demonstrates superior utility preservation by producing high-quality images that are...