Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them

T0 review · 4 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Concept erasure in diffusion models causes least collateral damage when the unwanted concept is redirected to a closely related but distinct target, and the paper's AGE method finds such targets automatically.

desk verdict Useful empirical study and a plausible method, but the paper overclaims what its minimax target selection guarantees, and its own appendix supplies a counterexample. read the letter →

arxiv 2501.18950 v3 pith:KBPBKSUJ submitted 2025-01-31 cs.LG cs.AIcs.CV

Anh Bui , Trang Vu , Long Vuong , Trung Le , Paul Montague , Tamas Abraham , Junae Kim , Dinh Phung This is my paper · ORCID
classification cs.LGcs.AIcs.CV
keywords concepterasurediffusionmodelstargetselectionlocalitygraphminimaxoptimizationunlearningNSFW
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Concept erasure in text-to-image diffusion models usually works by redirecting the unwanted concept to a fixed generic target, such as 'a photo' or an empty prompt. This paper argues that the fixed target is the wrong choice because it causes unnecessary damage to benign concepts. Modeling concepts as the nodes of a graph, the authors measure that erasing one concept mainly harms its semantic neighbors, so the ideal target is a closely related but not synonymous concept. They then propose Adaptive Guided Erasure (AGE), a minimax method that picks such a target automatically for each concept to be erased, and report that it preserves other concepts almost as well as the untouched model while still erasing objects, artistic styles, and NSFW attributes.

What carries the argument

The load-bearing object is the concept graph: a graph whose nodes are concepts and whose edge weights are the measured drops in generation capability $\Delta(c_e, c_j) = G_0(c_j) - G_{c_e}(c_j)$ when one concept is erased. The paper's empirical claim about this graph, locality, justifies the method's target prescription: because erasure damage stays within a local neighborhood, the best target is a nearby concept that is not a synonym. That prescription is operationalized by the minimax objective of Eq. 3, whose inner maximization over $c_t$ searches for the concept most sensitive to the model change while ruling out synonyms, and whose outer minimization over model parameters erases the query concept while preserving the chosen target. To keep the search tractable in a large vocabulary, the target is written as a Gumbel-Softmax mixture over concept embeddings (Eq. 4), so the inner problem is solved by gradient ascent in continuous space instead of by enumerating discrete concepts.

What would settle it

Generate the same impact matrix on a structurally different text-to-image model, such as a distilled or transformer-based diffusion model or one trained on a different corpus: if erasing one concept measurably degrades many unrelated concepts, locality is an artifact of the setup rather than a property of the concept space. Alternatively, extract the target concepts AGE converges to on a fixed set of erasure queries and rate them for relatedness and synonymy: if the targets are routinely synonyms, or if random nearby neighbors perform as well as AGE's chosen targets, then the minimax selection is not doing the load-bearing work.

Watch

Extended reading notes

Core claim

The paper's central claim is that the side effects of concept erasure in diffusion models are governed by where the erased concept is redirected, and that the least harmful destination is a concept closely related to the erased one but not a synonym. The evidence is a measurement: on the new NetFive dataset (25 ImageNet concepts in five related groups, 500 generated images each), the drop in generation capability $\Delta(c_e, c_j)$ caused by erasing concept $c_e$ is sparse and localized, hitting mainly semantic neighbors of $c_e$, and the impact graph is asymmetric. Synonym targets change the model least but fail to erase; distant or generic targets match the damage of an empty prompt; and the best erasure with minimal collateral damage comes from targets like 'Clumber Spaniel' for 'English Springer'. The paper then operationalizes this prescription as Adaptive Guided Erasure, solving $$ \min_{\$\theta$'} \mathbb{E}_{c_e \in \mathcal{E}} \max_{c_t \in \mathcal{C}} \left[ \lVert \epsilon_{\$\theta$'}(\tau(c_e)) - \epsilon_{\$\theta$}(\tau(c_t)) \$rVert_2^{2}$ + \$\lambda$ \lVert \epsilon_{\$\theta$'}(\tau(c_t)) - \epsilon_{\$\theta$}(\tau(c_t)) \$rVert_2^{2}$ \right], $$ where the inner maximization selects the target and the outer minimization erases while preserving it, with the target formed as a Gumbel-Softmax mixture over concept embeddings so the search is continuous. Across object, NSFW, and artistic-style tasks, AGE reports preservation close to the unmodified model (PSR-5 of 95.6% versus the original's 97.6%) while erasing as effectively as or better than the compared baselines.

Load-bearing premise

The approach rests on the assumption that the locality measured on Stable Diffusion 1.4 with an empty target is a stable property of the concept space itself, and that the minimax search genuinely finds a target that is related to the erased concept without being a synonym.

Editorial extensions

If this is right

  • Any erasure method built on the fixed-target principle can be upgraded to choose a locally related target, so the preservation gains reported for AGE should transfer beyond the specific implementation.
  • Because impact is local and asymmetric, practitioners can predict which concepts will suffer collateral damage before fine-tuning: the semantic neighbors of each erased concept, plus fragile low-generability concepts.
  • The scalability experiment indicates that erasing many concepts at once is practical with adaptive targets, while the strongest baselines degrade sharply as the erasure set grows.
  • The locality observations reproduce on a second model version (Stable Diffusion 2.1), so the behavior is not specific to the single checkpoint used for the main experiments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My read is that the related-but-not-synonym prescription is a general recipe for surgical edits — fairness modifications, style re-mapping, or removing a personalized identity — although the paper only demonstrates erasure.
  • The inner maximization over targets acts much like hard-negative mining; a cheap way to test whether the geometry is the real driver would be to compare AGE against simply picking the nearest non-synonym neighbor in embedding space.
  • The paper concedes that concept mixtures are not smooth linear interpolations, so the continuous target is a proxy for a discrete choice; comparing against a discrete beam search over targets would clarify what the Gumbel-Softmax representation adds.
  • The abnormal concepts that lose generation ability no matter the target suggest an open problem the paper leaves: characterizing what makes a concept fragile to any parameter change.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies concept erasure in text-to-image diffusion models. It introduces NetFive, a 25-concept evaluation set, and empirically analyzes how erasing one concept affects the model's ability to generate other concepts, concluding that the impact is localized in concept space. Based on this observation, the authors propose Adaptive Guided Erasure (AGE), which selects target concepts for each erasure by solving a minimax optimization over a concept vocabulary, representing targets as Gumbel-Softmax mixtures. Experiments on object, NSFW, and artistic-style removal report that AGE preserves unrelated concepts substantially better than previous methods while maintaining competitive erasure performance, and the code is released.

Significance. The paper makes a useful empirical contribution in characterizing the local nature of concept-erasure side effects, and the NetFive dataset provides a concrete evaluation harness. The proposed AGE method achieves strong preservation numbers in the reported settings, and the release of code supports reproducibility. However, the central mechanistic claim—that the minimax objective in Eq. (3) selects targets that are 'closely related but not synonyms'—is not substantiated and is in fact contradicted by the paper's own examples. The locality property also has acknowledged exceptions, and the evaluation relies heavily on classifier-based and CLIP metrics without human validation. If the mechanism claim were corrected and the method's gains were isolated through targeted ablations, the paper would be a solid contribution; in its current form, the explanation of why AGE works is not supported by the evidence.

major comments (4)
  1. [Section 4, Eq. (3)] The assertion that maximizing L1 and L2 with respect to ct 'ensures' that ct is not a synonym of ce is unsupported. For a synonym s, tau(s) is close to tau(ce), so L1(ct=s) is approximately ||theta'(tau(ce)) - theta(tau(ce))||^2, which becomes large when erasure is effective; similarly, L2(ct=s) is large because erasing ce perturbs theta'(tau(s)). The inner maximization can therefore favor synonyms, contrary to the claim. This is confirmed by the paper's own results: in Appendix D.6 (Figure 18c), AGE with the ChatGPT vocabulary selects 'Chapel' as an intermediate target for 'Church', and Appendix C.3 lists 'chapel' as a synonym of 'church' with 80% top-1 accuracy. The paper needs a fixed-target or synonym-excluded ablation to isolate whether the preservation gains come from the 'related but not synonym' property or from the L2 preservation term and the restriction to the k-nearest search space.
  2. [Section 3.1, Figure 1] The locality property is stated as a general geometric property of the concept space, but the paper itself identifies two 'abnormal' concepts ('Bell Cote', 'Oboe') that are affected by erasing any concept. These exceptions are not integrated into the theoretical claim: if the impact is not confined to a local region for these concepts, the property is not universal. The analysis is also based on a single 25-concept dataset and two model versions (SD 1.4 and 2.1), so the broad abstract claim that 'the influence of erasing a concept is confined to a local region' is too strong. Please either restrict the claim to the measured setting or provide a characterization of when locality holds.
  3. [Section 5, Evaluation Metrics] The evaluation metrics are dominated by classifier-based detection (ResNet-50 top-5) and CLIP scores, which are known proxies with limitations: classifier top-5 can conflate visually similar classes, and CLIP score is sensitive to prompt wording and does not directly measure concept presence. In the artistic-style task, Figure 5 shows AGE on the Pareto frontier but not clearly superior in CLIP; the LPIPS advantage is modest. The paper would be strengthened by a human evaluation on a subset of generated images or by an alternative presence metric such as image-retrieval-based detection.
  4. [Section B and D.3] The method introduces several hyperparameters (lambda, gamma, eta, Niter, k, and the vocabulary choice) that are set to fixed values without a principled justification. The sensitivity analysis in D.3 covers only lambda and gamma over a narrow range, while the vocabulary study in D.2 shows dramatic variation in performance (e.g., ESR-5 ranges from 41.84 with ChatGPT to 93.48 with ImageNet). Without a systematic analysis of eta, Niter, and k, and without a guided default selection, the robustness of the reported gains remains unclear.
minor comments (5)
  1. [Section 1] The sentence 'The widespread accessibility of text-to-image generation models has introduced significant risks' should use 'have introduced' to agree with the plural subject.
  2. [Section 3.2] In the bullet 'Synonym ✗✗✗', the phrase 'it also the least effective in erasing the undesirable concept ce' is missing the verb 'is'.
  3. [Appendix C.3] The sentence 'We then only keep the synonyms that have the top-5 accuracy higher than 50%' uses 'accuracy' ambiguously; it should refer to the top-5 detection score of the generated images, not classifier accuracy.
  4. [Table 7] The table caption contains a broken cross-reference 'Table ??' that should be fixed.
  5. [Algorithm 1] The termination condition 'while Not Converged do' is undefined; please specify a convergence criterion such as a fixed number of iterations or a tolerance.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity: locality is an empirical measurement, AGE is a new optimization objective, and the only self-citations (AP) are non-load-bearing baselines.

full rationale

The paper's derivation chain is empirical rather than definitional. Section 3 measures the drop in generation capability Delta(ce,cj) after empty-target erasure on SD1.4 and concludes that the concept graph is localized; this is a measurement, not a consequence of the AGE objective. Section 4 then introduces AGE by maximizing L1 and L2 over candidate targets, and the method is evaluated on external benchmarks (Imagenette, COCO 30K, I2P) with fixed hyperparameters (lambda=1, gamma=0.1, k=100). The reported PSR/FID/CLIP gains are not forced by construction: the target concepts are not fitted to those evaluation metrics, and the preservation term L2 directly preserves the chosen ct rather than the evaluated classes. The only same-author citation used in the experimental setup is AP (Bui et al., 2024a), quoted as 'Our experiments follow the same setup as in Bui et al. (2024a)'; it serves as a baseline and protocol reference, not as a load-bearing premise, uniqueness theorem, or ansatz. A separate, non-circular weakness exists: Section 4 claims that maximizing L1 in Eq. (3) 'ensures that the solution c*_t is not a synonym of the query concept ce', but the objective does not encode synonym exclusion, and Appendix D.6 shows 'Chapel' being selected for 'Church' under the ChatGPT vocabulary even though Appendix C.3 lists chapel as a synonym. This undermines the stated mechanism but does not make the preservation results a tautology of the loss, so it does not raise the circularity score beyond the minor self-citation level.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The method relies on several hand-chosen hyperparameters and domain assumptions. The central heuristic, that the minimax target selection lands on a related but non-synonym concept, is not proven. The NetFive dataset is a new benchmark, but it is not an invented entity in the sense of a new theoretical construct.

free parameters (6)
  • lambda = 1.0
    Trade-off between erasure loss L1 and preservation loss L2 in Equation 3; chosen by hand and analyzed in Section D.3.
  • gamma (Gumbel-Softmax temperature) = 0.1
    Controls discreteness of target concept mixture; low value makes the mixture closer to one-hot; chosen by hand.
  • eta (inner-max learning rate) = 0.001
    Learning rate for updating the target concept weights pi in Algorithm 1.
  • Niter = 1
    Number of inner-max iterations per outer step; set for simplicity.
  • k (per-concept search space size) = 100
    Number of closest concepts kept in C_ce, selected by cosine similarity in text embedding space.
  • concept vocabulary choice = ImageNet for object erasure; ChatGPT for style erasure
    The concept space C is task-dependent; the vocabulary choice affects erasure-preservation trade-off (Section D.2).
assumptions (4)
  • domain assumption Pretrained classifier (ResNet-50) detection of concepts in generated images is a valid measure of concept presence
    Used to build NetFive and to compute DS/ESR/PSR metrics (Section 3, Section 5.1).
  • ad hoc to paper Locality of impact measured for SD 1.4 with empty target generalizes to other models and target choices
    The AGE method is justified by the locality property, but the property is measured under a specific erasure procedure (Section 3.1).
  • ad hoc to paper Maximizing L1 and L2 over target concepts yields a concept closely related but not synonymous with the erased concept
    The minimax formulation (Eq. 3) is motivated by this conjecture, with only qualitative evidence in Section 5.2 and Appendix D.6.
  • ad hoc to paper Textual embedding mixtures via Gumbel-Softmax represent meaningful composite target concepts
    Equation 4 assumes a weighted combination of text embeddings is a valid target; Section D.5 shows the interpolation is not always smooth.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them." pith.science (2026). https://pith.science/paper/KBPBKSUJ

@misc{pith2026250118950,
  author       = {Pith},
  title        = {Pith review of: Fantastic Targets for Concept Erasure in Diffusion Models and Where To Find Them},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KBPBKSUJ}},
  note         = {Machine review of arXiv:2501.18950}
}
read the original abstract

Concept erasure has emerged as a promising technique for mitigating the risk of harmful content generation in diffusion models by selectively unlearning undesirable concepts. The common principle of previous works to remove a specific concept is to map it to a fixed generic concept, such as a neutral concept or just an empty text prompt. In this paper, we demonstrate that this fixed-target strategy is suboptimal, as it fails to account for the impact of erasing one concept on the others. To address this limitation, we model the concept space as a graph and empirically analyze the effects of erasing one concept on the remaining concepts. Our analysis uncovers intriguing geometric properties of the concept space, where the influence of erasing a concept is confined to a local region. Building on this insight, we propose the Adaptive Guided Erasure (AGE) method, which \emph{dynamically} selects optimal target concepts tailored to each undesirable concept, minimizing unintended side effects. Experimental results show that AGE significantly outperforms state-of-the-art erasure methods on preserving unrelated concepts while maintaining effective erasure performance. Our code is published at {https://github.com/tuananhbui89/Adaptive-Guided-Erasure}.

Figures

Figures reproduced from arXiv: 2501.18950 by the authors.

Figure 1
Figure 1. Analysis of the impact of choosing empty concept as the target concept for erasure. Com [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Analysis of the impact of choosing a specific concept as the target concept for erasure. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Top/a: Intermediate results of the search process, with images generated from the most [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figures from the paper (22 more)
Figure 3
Figure 3. Figure 3: Number of exposed body parts counted in all generated images with threshold 0.5 [PITH_FULL_IMAGE:figures/full_fig_p009_3.png]
Figure 5
Figure 5. Figure 5: CLIP and LPIPS scores of the artistic style erasure task. (∗ ) LPIPS at x-axis is scaled by 34 for better visualization. Full results are in [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Sample images generated by the SD model from the NetFive dataset. Each row corre [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]
Figure 7
Figure 7. Figure 7: Sample images generated by the SD model from the NetFive dataset. Each row corre [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Analysis of the impact of choosing empty concept as the target concept for erasure with [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]
Figure 9
Figure 9. Figure 9: Analysis of the impact of choosing the empty concept as the target concept for erasure [PITH_FULL_IMAGE:figures/full_fig_p022_9.png]
Figure 10
Figure 10. Figure 10: Analysis of the impact of choosing the empty concept as the target concept for erasure [PITH_FULL_IMAGE:figures/full_fig_p023_10.png]
Figure 11
Figure 11. Figure 11: Analysis of the impact of choosing the empty concept as the target concept for erasure [PITH_FULL_IMAGE:figures/full_fig_p024_11.png]
Figure 12
Figure 12. Figure 12: Analysis of the impact of choosing a specific concept as the target concept for erasure [PITH_FULL_IMAGE:figures/full_fig_p025_12.png]
Figure 13
Figure 13. Figure 13: Analysis of the impact of choosing the empty concept as the target concept for erasure [PITH_FULL_IMAGE:figures/full_fig_p026_13.png]
Figure 14
Figure 14. Figure 14: Analysis of the impact of choosing a specific concept as the target concept for erasure [PITH_FULL_IMAGE:figures/full_fig_p027_14.png]
Figure 15
Figure 15. Figure 15: Ablation study on the trade-off hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p029_15.png]
Figure 16
Figure 16. Figure 16: Visualization of the output images g(z0,(1 − α)τ (c1) + ατ (c2)) with different α and c2 [PITH_FULL_IMAGE:figures/full_fig_p032_16.png]
Figure 17
Figure 17. Figure 17: Top/a: Intermediate results of the search process, with images generated from the most [PITH_FULL_IMAGE:figures/full_fig_p032_17.png]
Figure 18
Figure 18. Figure 18: Intermediate results of the search process. The first row is generated from the most [PITH_FULL_IMAGE:figures/full_fig_p033_18.png]
Figure 19
Figure 19. Figure 19: Intermediate results of the search process. The first row is generated from the most [PITH_FULL_IMAGE:figures/full_fig_p034_19.png]
Figure 20
Figure 20. Figure 20: Generated images from the original model. Five first rows are to-be-erased objects [PITH_FULL_IMAGE:figures/full_fig_p036_20.png]
Figure 21
Figure 21. Figure 21: Erasing objects using ESD. Five first rows are to-be-erased objects (marked by red text) [PITH_FULL_IMAGE:figures/full_fig_p037_21.png]
Figure 22
Figure 22. Figure 22: Erasing objects using UCE. Five first rows are to-be-erased objects (marked by red text) [PITH_FULL_IMAGE:figures/full_fig_p038_22.png]
Figure 23
Figure 23. Figure 23: Erasing objects using our method. Five first rows are to-be-erased objects (marked by [PITH_FULL_IMAGE:figures/full_fig_p039_23.png]
Figure 24
Figure 24. Figure 24: Erasing artistic style concepts. Each column represents the erasure of a specific artist, [PITH_FULL_IMAGE:figures/full_fig_p040_24.png]
Figure 25
Figure 25. Figure 25: Erasing artistic style concepts (continued). Each column represents the erasure of a [PITH_FULL_IMAGE:figures/full_fig_p041_25.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Rethinking Robust Adversarial Concept Erasure in Diffusion Models

    cs.CV 2025-10 conditional novelty 6.0 of 10

    S-GRACE generates semantically guided adversarial prompts and fine-tunes only the text encoder, reporting stronger concept-erasure robustness and ~90% lower training time than prior adversarial erasure methods.

  2. Automating Evaluation of Diffusion Model Unlearning with (Vision-) Language Model World Knowledge

    cs.LG 2025-07 conditional novelty 5.0 of 10

    A new evaluation tool uses (vision-)language model world knowledge to rank nearby concepts and craft adversarial prompts, showing that diffusion unlearning is incomplete and that semantic similarity correlates with co...

Reference graph

Works this paper leans on

32 extracted references · 25 canonical work pages · cited by 2 Pith papers

  1. [1]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

    Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04248,

    arXiv

  2. [2]

    3https://www.oxfordlearnersdictionaries.com/wordlist/american english/oxford3000/ 28 Published as a conference paper at ICLR 2025 Table 5: Impact of choosing vocabularies on artistic style settings. To Erase To Retain CLIP↓ LPIPS↑ CLIP↑ LPIPS↓ ESD 23.56±4.73 0 .72±0.11 29 .63±3.57 0 .49±0.13 CA 27.79±4.67 0 .82±0.07 29 .85±3.78 0 .76±0.07 UCE 24.47±4.73 0...

    work page 2025

  3. [3]

    In Figure 15b, we observe that as γ increases, the preserving performance declines, though there is no clear trend for erasing performance. It is worth reminding that γ is the temperature parameter in the Gumbel-Softmax operator, which controls the discreteness of the mixed weightG(π) in Equation equation 4, i.e., the lower γ is, the closer G(π) is to the...

    work page 2025

  4. [4]

    Church,” “French Horn,

    Intuitively, we expect the generated images to gradually transition from concept c1 to concept c2 as α increases. In cases like “Church,” “French Horn,” and “Garbage Truck,” this gradual transformation is indeed observable, where the image transitions smoothly from “English Springer” to the target concept as α increases. However, for other concepts like “...

    work page 2025

  5. [7]

    Nudenet: Neural nets for nudity classification, detection and selective censorin

    11 Published as a conference paper at ICLR 2025 Bedapudi Praneet. Nudenet: Neural nets for nudity classification, detection and selective censorin

    work page 2025

  6. [8]

    a photo of a c1 and a c2

    We investigate three different vocabularies for the concept space C in the experiment including the ImageNet (AGE-I), Oxford-3K (AGE-O), and the manually crafted vocabulary (AGE-M), where we leverage the knowledge of the to-be-erased concepts to generate the vocabulary, i.e., which words are semantically related to the to-be-erased concepts, like ”dog”, ”...

    work page 2025

  7. [9]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer

    URL https://blog.adobe.com/en/publish/2023/03/21/ responsible-innovation-age-of-generative-ai . Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684–10695,

    work page 2023

  8. [10]

    doi: 10.18653/v1/2020.acl-main.664

    Association for Computational Linguis- tics. doi: 10.18653/v1/2020.acl-main.664. URL https://aclanthology.org/2020. acl-main.664. SmithMano. Tutorial: How to remove the safety filter in 5 seconds,

    work page doi:10.18653/v1/2020.acl-main.664 2020

Show all 32 references
  1. [11]

    Nonetheless, a weak impact on other concepts can still be detected using complementary metrics

    However, to draw definitive conclusions, we emphasize that the impact of erasing a concept does not strongly propagate to all other concepts but tends to affect only local concepts that are semantically closely related to the erased concept ce. Nonetheless, a weak impact on ot...

    2025

  2. [12]

    Sneakyprompt: Jailbreaking text-to-image generative models

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE Symposium on Security and Privacy (SP) , pp. 123–123. IEEE Computer Society,

    2024

  3. [13]

    Forget-me-not: Learning to forget in text-to-image diffusion models.arXiv preprint arXiv:2303.17591,

    Eric Zhang et al. Forget-me-not: Learning to forget in text-to-image diffusion models.arXiv preprint arXiv:2303.17591,

    arXiv

  4. [15]

    Despite significant efforts in curating training data, pre-processing methods often leave models inadequately sanitized, as shown in Gandikota et al

    further refines this by subdividing the NSFW concept into specific categories and applying individ- ualized detectors. Despite significant efforts in curating training data, pre-processing methods often leave models inadequately sanitized, as shown in Gandikota et al. (2023). ...

    2023

  5. [16]

    to circumvent such filters. 13 Published as a conference paper at ICLR 2025 In-generation guidance methods intervene directly during the image generation process, often using techniques such as handcrafted textual blacklisting (Shi et al.,

    2025

  6. [17]

    or employing large language models for prompt engineering and safety classification. Safe Latent Diffusion (SLD) (Schramowski et al., 2023a) takes an alternative approach by leveraging inappropriate knowledge encoded in pre-trained models for reverse guidance during generation...

    2023

  7. [18]

    Within fine-tuning, there are two main branches of concept erasing techniques: (1) Attention-based, and (2) Output-based or optimization-based

    to learn and regenerate the removed concepts using the sanitized model. Within fine-tuning, there are two main branches of concept erasing techniques: (1) Attention-based, and (2) Output-based or optimization-based. Attention-based methods (Zhang et al., 2023; Orgad et al., 20...

    2023

  8. [19]

    focus on modifying the attention mechanisms within models to remove undesirable concepts. In Latent Diffusion Models (LDMs), for instance, the textual conditions are embedded via a pre-trained CLIP model and injected into the cross-attention layers of the UNet model (Rombach e...

    2022

  9. [20]

    for each individual concept, combining them with the closed-form solution from TIME (Orgad et al., 2023). This category has two main advantages: (1) the Tikhonov regularization form of the objective function 5 allows for a closed-form solution, as demonstrated in (Orgad et al....

    2023

  10. [21]

    Unlike attention-based methods, this approach requires intermediate imageszt sampled at various time steps t during the diffusion process

    focus on optimizing the output image by minimizing the difference between the predicted noise ϵθ′ (zt, t, ce) and the target noise ϵθ(zt, t, ct). Unlike attention-based methods, this approach requires intermediate imageszt sampled at various time steps t during the diffusion p...

    2023

  11. [22]

    Limitation

    Visualizations of the mixture of concepts can be found in Section D.5, and the process of searching for optimal target concepts is discussed in Section D.6. Limitation. A crucial aspect of our method is the concept space C, which is used to search for the optimal target concep...

    2025

  12. [23]

    Beside Figure 6, we also provide a failed sample from the ”Oboe” concept in Figure 7 for reference. C.2 M ETRIC TO MEASURE THE GENERATION CAPABILITY OF THE MODEL In image generative models, while common metrics such as FID and Inception Score are used to evaluate the quality o...

    2025

  13. [24]

    Bell Cote

    This metric indicates how confident the model is when generating the concept cj. A higher score means that the concept cj is more likely to appear in the generated images. It is worth noting that the confident score is designed to prefer a model that can generate more low-conf...

  14. [30]

    Church”. Each column represents different fine-tuning steps in increasing order. Each subfigure represents for different vocabularies. [“Chapel,

    These experiments follow the same setup as in Section 5.1, exploring the effect of using various vocabularies including CLIP, Oxford, ChatGPT, and ImageNet, as introduced in Section D.2. In each subfigure, the first row depicts images generated from the most sensitive concepts...

    2025

  15. [31]

    First, the SD-org and SD-syn represent the results of the original model using the original concepts and their synonyms, respectively. Notably, the PSR-1 score for SD-syn is only 58.5%, indicating that out of 100 images generated from synonyms of a concept like ”Trash Truck,” ...

  16. [32]

    Erasing Artistic Concepts Figures 24, 25 show the results of erasing artistic style concepts using our method compared to the baselines

    effectively erases the objects while maintaining the quality of the preserved objects. Erasing Artistic Concepts Figures 24, 25 show the results of erasing artistic style concepts using our method compared to the baselines. Each column represents the erasure of a specific arti...

    2025

  17. [2009]

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or

    doi: 10.1109/CVPR.2009.5206848. Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint arXiv:2208.01618,

    2009

  18. [2017]

    Erasing undesirable concepts in diffusion models with adversarial preservation

    Anh Bui, Long Vuong, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. Erasing undesirable concepts in diffusion models with adversarial preservation. NeurIPS, 2024a. Anh Tuan Bui, Khanh Doan, Trung Le, Paul Montague, Tamas Abraham, and Dinh Phung. Hiding and...

    2025

  19. [2018]

    16 C.2 Metric to measure the generation capability of the model

    12 Published as a conference paper at ICLR 2025 Appendix Table of Contents A Related Work 13 B Further Details on the Adaptive Guided Erasure Method 15 C Experimental Settings 16 C.1 NetFive Dataset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 C.2 Met...

    2025

  20. [2020]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685,

    arXiv

  21. [2021]

    Hierarchical text- conditional image generation with clip latents

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 1(2):3,

    arXiv

  22. [2022]

    Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi

    URL https://stability.ai/blog/ stable-diffusion-v2-release . Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasediff: Erasing data influence in diffusion models. arXiv preprint arXiv:2401.05779,

    arXiv

  23. [2023]

    Minh Pham, Kelly O Marshall, and Chinmay Hegde

    doi: 10.1109/ICCV51070.2023.00649. Minh Pham, Kelly O Marshall, and Chinmay Hegde. Circumventing concept erasure methods for text-to-image generative models. arXiv preprint arXiv:2308.01508,

    2023

  24. [2024]

    Editing implicit assumptions in text-to-image diffusion models

    Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. Editing implicit assumptions in text-to-image diffusion models. In IEEE International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pp. 7030–7038. IEEE,

    2023

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.