Pith. sign in

REVIEW 3 major objections 7 minor 62 references

10% of attention heads carry unsafe image semantics

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-08 15:53 UTC pith:PVLWTABP

load-bearing objection Mechanistic head localization for VSA defense works well on SD 1.4 but degrades sharply on FLUX.1 without diagnosis. the 3 major comments →

arxiv 2607.06120 v1 pith:PVLWTABP submitted 2026-07-07 cs.CV

AEGIS: A Mechanism-Guided Defense against Visual Synonym Jailbreaks in Text-to-Image Models

Yuanmin Huang , Zhenfei Zhang , Mi Zhang , Geng Hong , Qinqin He , Jialing Tao , Hui Xue , Min Yang This is my paper
classification cs.CV
keywords unsafevisualconceptsaegisheadsmathbfattacksbenign
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper identifies that visual synonym attacks—where benign-looking prompts like 'spilled red paint' produce prohibited imagery like blood—succeed because both disguised and explicit unsafe prompts route through the same sparse subset (~10%) of attention heads in diffusion model U-Nets. The authors formalize this attack class, trace the dynamic convergence pathway during denoising, and propose AEGIS, an inference-time defense that applies similarity-aware repulsion exclusively at those identified heads. On Stable Diffusion 1.4, the method reduces attack success rates to near-zero for violence and nudity visual synonyms while preserving benign generation fidelity and avoiding over-suppression of visually similar safe concepts like ketchup or mannequins. The approach transfers to SD 2.1 and FLUX.1 after re-identifying critical heads per backbone, though residual attack rates on FLUX.1 remain substantially higher.

Core claim

The central finding is that unsafe visual semantics in text-to-image diffusion models—whether triggered by explicit prompts, adversarial jailbreaks, or stealthy visual synonyms—converge through a sparse set of roughly 10% of attention heads that act as inference-time bottlenecks for prohibited content. By profiling latent trajectory convergence toward a malicious anchor embedding and using Lasso regression to isolate the discriminative heads, the authors show these heads serve as shared pathways across attack paradigms. This localization enables surgical intervention: applying adaptive repulsion only at the identified heads, scaled by activation magnitude and gated by similarity to theUnsafe

What carries the argument

anchor

Load-bearing premise

The method assumes that a single anchor prompt per unsafe concept (e.g., 'A photo of a bloody violent scene') adequately represents the full range of visual variation in that concept, and that the Lasso-identified attention heads capture all pathways an attacker could exploit. The substantially higher residual attack rates on FLUX.1 suggest this assumption may not hold universally across architectures or concepts.

What would settle it

Construct visual synonym attacks that route unsafe semantics through attention heads outside the identified sparse set, or design attacks targeting concepts whose visual manifold is too broad for a single anchor prompt to capture.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If the sparse-convergence finding generalizes, safety auditing of generative models could shift from input filtering to mechanistic pathway profiling, reducing the arms race between attackers and defenders to a localization problem.
  • The observation that visual synonyms and explicit prompts share the same attention heads suggests that text-to-image models encode prohibited concepts at the visual-semantic level rather than the lexical level, which has implications for how safety alignment should be designed.
  • The gap between near-zero ASR on SD 1.4 and 26-40% ASR on FLUX.1 indicates that the sparsity and localization of unsafe pathways may vary with model scale or architecture, warranting further investigation.
  • The white-box adaptive attack experiment showing that suppressing activations at identified heads does not recover unsafe generation suggests the identified heads may be necessary rather than merely sufficient conduits, strengthening the mechanistic claim.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If unsafe semantics must pass through a sparse set of attention heads, an attacker who could distribute the semantic payload across many heads might evade the defense—a strategy not tested in the paper's adaptive attack experiments.
  • The anchor-based approach assumes a single canonical prompt per concept captures the full unsafe semantic manifold. Concepts with broader visual variation (e.g., violence spanning warfare, domestic abuse, gore) may require multiple anchors, which could explain the residual ASR on FLUX.1.
  • The finding that Lasso-identified heads generalize from visual synonyms to explicit and adversarial prompts suggests these heads encode visual concepts rather than text patterns, which could make them discoverable through other interpretability methods and potentially useful for proactive safety auditing before deployment.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. This paper introduces Visual Synonym Attacks (VSA) as a threat paradigm where textually benign prompts elicit unsafe imagery through visual-semantic convergence during diffusion. The authors conduct a mechanistic analysis identifying a sparse subset (~10%) of attention heads ('semantic-injecting heads') that serve as inference-time bottlenecks for prohibited visual semantics, validated via Lasso-based attribution. Building on this, they propose AEGIS, an inference-time defense applying similarity-aware repulsion exclusively at the identified heads. The evaluation spans 16 baselines, two concepts (violence, nudity), four attack paradigms, and three architectures (SD 1.4, SD 2.1, FLUX.1). On SD 1.4, AEGIS reduces VSA ASR to 0.00/0.03 while preserving benign fidelity (FID 66.70, CLIP 30.66) and avoiding over-suppression of hard-negative concepts. The paper also includes ablations, adaptive white-box attacks, and efficiency analysis.

Significance. The paper makes a solid contribution to T2I safety by formalizing VSA and proposing a mechanism-guided, inference-time defense. Key strengths include: (1) a falsifiable mechanistic claim about sparse semantic-injecting heads, supported by payload sensitivity analysis (Table I) and attention visualizations (Fig. 5); (2) strong SD 1.4 results with near-zero ASR across in-domain and OOD attacks while preserving utility; (3) an honest adaptive attack experiment (§VII-F) testing activation-level evasion; (4) a lightweight Lasso attributor requiring only 120 training samples per concept and converging in seconds. The cross-architecture transferability claim is partially supported but reveals a significant gap that needs addressing. The framework is well-motivated and the safety-utility trade-off analysis is thorough.

major comments (3)
  1. §VII-D, Table IV: The FLUX.1 results show VSA ASR of 26.28% (violence) and 39.70% (nudity), which are orders of magnitude above the near-zero rates on SD 1.4 (0.00/0.03). The paper's central mechanistic claim is that ~10% of attention heads serve as universal inference-time bottlenecks for prohibited visual semantics. If this bottleneck were structural, re-identifying heads on FLUX.1 with the same procedure should yield comparable suppression. The paper does not diagnose whether the residual failures route through unidentified heads (insufficient coverage) or through the identified set with insufficient anchor coverage. This is load-bearing because it determines whether the 'bottleneck' is a structural property or an artifact of anchor choice on certain architectures. The authors should add diagnostic analysis (e.g., measuring attribution coverage on FLUX.1, or testing whether residual V
  2. §VII-F: The adaptive attack experiment optimizes prompts to suppress activations along the identified anchor directions, but does not test the more threatening evasion strategy: routing unsafe semantics through alternative heads not in the identified set. The current experiment only tests whether reducing activation on the intervention directions leads to unsafe generation, not whether an attacker can bypass the defense by exploiting non-identified heads. This is load-bearing for the robustness claim because if the sparsity claim understates the true pathway coverage, the defense is bypassable even on SD 1.4. The authors should either (a) add an adaptive attack that optimizes for unsafe content through non-identified heads, or (b) explicitly scope the robustness claim to activation-level evasion and acknowledge this limitation.
  3. §IV-B, Eq. (5) and §V-A: The anchor-based similarity profiling uses a single canonical anchor prompt per concept (e.g., 'A photo of a bloody violent scene'). The method's effectiveness depends on this anchor capturing a sufficient representation of the unsafe semantic manifold. The FLUX.1 results expose this assumption: if the anchor does not span the concept's visual variation, the Lasso identifies heads correlated with the anchor but not with the full unsafe concept. The paper should provide sensitivity analysis varying the anchor prompt (e.g., multiple anchors, or anchors with different phrasings) to show that the identified heads are stable to anchor choice, or explicitly discuss this as a limitation and its implications for the universality claim.
minor comments (7)
  1. §IV-A, Eq. (4): The bound δ on text-domain decoupling is defined but never instantiated or measured in the experiments. Consider reporting δ values for the VSA dataset or removing the formal bound if it serves only as motivation.
  2. Table II: The 'No Alignment' row for SD 2.1 shows VSA ASR of 0.54 for nudity, much lower than SD 1.4's 0.98. This difference is noteworthy and should be briefly discussed, as it affects the baseline difficulty for cross-architecture results.
  3. §VII-E, Table V: The random intervention ablation reports FID > 260 and CLIP < 23, described as 'severe model collapse.' Consider clarifying whether this is model collapse or simply degraded generation, as the distinction has different implications.
  4. Appendix E-B, Table X: The hyperparameter configurations show β = 0.01 for both concepts, which makes the adaptive gate (Eq. 9) nearly binary. This should be noted in the main text, as it means the 'proportional control' regime is effectively unused in practice.
  5. Fig. 9: The axis labels for the hyperparameter ablation use symbols (ρ, α, β) but the legend entries are truncated. Consider using full labels or separate subplots.
  6. §VII-G, Table VII: The efficiency comparison includes SAeUron at 11.60s but omits training-based methods like ESD and AdvUnlearn. A note clarifying that these require offline fine-tuning would make the comparison more complete.
  7. The paper uses 'semantic-injecting heads' as a coined term. Consider adding a brief note on how this relates to similar concepts in prior interpretability works [20], [34], [56].

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for a careful and constructive review. The three major comments all concern the generality and robustness of our mechanistic claims: (1) the FLUX.1 performance gap and whether the bottleneck is structural or anchor-dependent, (2) the adaptive attack not covering routing through non-identified heads, and (3) anchor sensitivity. We agree these are important and will address all three in the revision with new experiments and revised claims.

read point-by-point responses

  1. Referee: §VII-D, Table IV: FLUX.1 results show VSA ASR of 26.28% (violence) and 39.70% (nudity), orders of magnitude above SD 1.4 (0.00/0.03). The paper's central mechanistic claim is that ~10% of attention heads serve as universal inference-time bottlenecks. If structural, re-identifying heads on FLUX.1 should yield comparable suppression. The paper does not diagnose whether residual failures route through unidentified heads (insufficient coverage) or through identified heads with insufficient anchor coverage. Authors should add diagnostic analysis.

    Authors: The referee correctly identifies that the FLUX.1 gap is load-bearing for our structural claim, and we agree that the current manuscript does not diagnose the source of residual failures. We will add the requested diagnostic analysis in the revision. Specifically, we plan to: (1) measure attribution coverage on FLUX.1 by reporting the cumulative weight distribution of the Lasso attributor (analogous to Fig. 4 for SD 1.4), showing what fraction of total semantic attribution the identified heads capture; (2) for residual unsafe generations on FLUX.1, measure activation similarity along the identified heads versus non-identified heads, to determine whether failures route through the identified set (insufficient anchor coverage) or through non-identified heads (insufficient coverage); and (3) test whether expanding the head selection ratio ρ on FLUX.1 reduces residual ASR, which would indicate coverage limitation. We will also revise the language in §IV-E and the conclusion to clarify that the sparsity claim is empirically supported on SD 1.4/2.1 but that FLUX.1's DiT architecture may distribute semantic injection more diffusely, making the bottleneck less concentrated. We agree this distinction between a structural property and an architecture-dependent artifact is important and should be made explicit rather than implied. revision: yes

  2. Referee: §VII-F: The adaptive attack optimizes prompts to suppress activations along identified anchor directions, but does not test routing unsafe semantics through alternative heads not in the identified set. If the sparsity claim understates true pathway coverage, the defense is bypassable even on SD 1.4. Authors should either (a) add an adaptive attack optimizing for unsafe content through non-identified heads, or (b) explicitly scope the robustness claim to activation-level evasion and acknowledge this limitation.

    Authors: The referee is correct that the current adaptive attack only tests activation-level evasion along the identified directions, not routing through non-identified heads. This is a genuine gap in the robustness evaluation. We will address it through a combination of new experiments and revised scoping. First, we will add an adaptive attack that optimizes for unsafe content through non-identified heads: specifically, we will construct an attacker whose evasion loss encourages high activation similarity to the anchor direction at non-identified heads while suppressing activation at identified heads, testing whether unsafe semantics can be recovered through alternative pathways. Second, regardless of the outcome, we will explicitly scope the robustness claim in §VII-F to distinguish between activation-level evasion (tested) and pathway rerouting (to be tested), and acknowledge in the limitations section that if the sparsity claim understates true pathway coverage, the defense could be bypassed. We note that the payload sensitivity analysis (Table I) provides indirect evidence that non-identified heads have low sensitivity to unsafe concepts (random heads capture only 9-19 unsafe samples out of 100 peak activations), but we agree this does not substitute for a direct adaptive attack test. revision: yes

  3. Referee: §IV-B, Eq. (5) and §V-A: The anchor-based similarity profiling uses a single canonical anchor prompt per concept. The method's effectiveness depends on this anchor capturing a sufficient representation of the unsafe semantic manifold. The FLUX.1 results may expose this assumption. Authors should provide sensitivity analysis varying the anchor prompt or explicitly discuss this as a limitation and its implications for the universality claim.

    Authors: The referee raises a valid concern about anchor sensitivity that the current manuscript does not address. We will add a sensitivity analysis in the revision. Specifically, we will: (1) vary the anchor prompt using multiple phrasings per concept (e.g., for violence: 'A photo of a bloody violent scene,' 'A photo of a violent altercation with injuries,' 'A photo of a gruesome crime scene') and measure whether the Lasso identifies the same heads (Jaccard overlap of identified head sets) and whether AEGIS achieves comparable ASR under each anchor; (2) test multi-anchor profiling where the anchor direction is computed as the average of multiple anchor embeddings; and (3) discuss the implications for the universality claim explicitly. If the identified heads are stable across anchor phrasings, this supports the structural nature of the bottleneck; if they vary, we will scope the universality claim accordingly. We agree that the FLUX.1 results may partly reflect anchor mismatch rather than purely architectural differences, and the diagnostic analysis from Comment 1 will help disentangle these factors. We will add a dedicated limitations paragraph discussing anchor dependence and its interaction with the cross-architecture transferability claim. revision: yes

Circularity Check

0 steps flagged

No significant circularity: the Lasso-to-defense chain is in-domain by design but not tautological, and OOD benchmarks provide independent grounding.

full rationale

The paper's central mechanistic claim—that ~10% of attention heads serve as inference-time bottlenecks for unsafe visual semantics—is identified via a Lasso attributor trained on VSA prompts (Eq. 6), and the defense (AEGIS) repels activations along the anchor direction at those heads (Eq. 8-9). The reader's concern is that the Lasso is trained on VSA and then evaluated on VSA, making the in-domain result partly circular. However, this is not circularity in the strict sense: (1) the Lasso identifies *which heads* to intervene on, while the defense mechanism (similarity-aware repulsion) is a separate algorithmic step with its own hyperparameters (α, β, ρ) that are not fitted to ASR; (2) the paper explicitly acknowledges the in-domain nature ('visual synonym attacks, which serve as the in-domain (IND) setting for our method since our identification is performed with VSA prompts') and provides OOD evaluation on I2P, MMA, and RAB where the method was not trained—these results (ASRs ≤ 0.09 on SD 1.4) are not forced by construction; (3) the anchor prompt is manually chosen, but the repulsion direction is the anchor's activation vector, not a fitted parameter—whether repelling along this direction actually reduces ASR is an empirical question, not a definitional truth; (4) the FLUX.1 results (VSA ASR 26-40%) actually *undermine* a circular interpretation, since if the method were tautologically forced, it would work equally well on all architectures. The self-citation to [22] (Huang et al., 'Perception-guided jailbreak') introduces the VSA concept but is not load-bearing for the defense mechanism itself—it defines the threat, not the solution. No step in the derivation chain reduces to its inputs by construction. The in-domain evaluation is a limitation (acknowledged by the paper) but not circularity. Score 2 reflects the minor self-citation for VSA formalization without independent verification of the attack paradigm, which is not load-bearing for the defense contributions.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 1 invented entities

The free parameters (alpha, beta, rho, gamma, lambda) are all tuned via ablation and Pareto analysis, which is standard for defense methods but means the reported numbers are best-case. The anchor prompt is the most ad hoc choice — a single manually written sentence per concept. The core axiom (sparse shared pathways) is supported by multiple independent validation experiments but not formally proven. No new physical entities or forces are postulated; the 'semantic-injecting heads' are a labeling of existing model components.

free parameters (6)
  • alpha (strength factor) = 4.5 (violence), 6.0 (nudity)
    Controls magnitude of repulsion force in Eq. 8. Tuned per concept via Pareto frontier analysis (Fig. 9).
  • beta (similarity threshold) = 0.01
    Controls gating in Eq. 9. Set low to aggressively block unsafe semantics. Chosen via ablation.
  • rho (injection ratio) = 0.09 (nudity), 0.11 (violence)
    Proportion of attention heads selected for intervention. Tuned via Pareto analysis.
  • gamma (layer selection ratio) = 0.05
    Proportion of layers selected in Stage 1 of identification. Stated in Appendix E-A.
  • lambda (Lasso regularization) = 0.02 (layer), 0.002 (head)
    L1 penalty for sparse attribution. Two values for coarse and fine granularity.
  • anchor prompt = 'A photo of a nude person' / 'A photo of a bloody violent scene'
    Manually chosen canonical prompts defining the repulsion direction. Not fitted but ad hoc.
axioms (4)
  • domain assumption Unsafe visual semantics in diffusion models route through a sparse, identifiable subset of attention heads that serve as shared pathways for both explicit and implicit (visual synonym) unsafe prompts.
    This is the core mechanistic assumption underlying the entire approach. It is supported by the Lasso attribution and validation experiments (Table I, Fig. 5-6) but is not independently proven.
  • ad hoc to paper A single canonical anchor prompt per concept captures a sufficient representation of the unsafe semantic manifold for repulsion to be effective.
    The anchor prompt (e.g., 'A photo of a bloody violent scene') is manually chosen and assumed to represent the full unsafe concept. The FLUX.1 results (26-48% residual VSA ASR) suggest this may not hold universally.
  • domain assumption The L1-penalized logistic regression on cosine similarity features correctly identifies the most safety-relevant attention heads.
    The Lasso is used as a feature selector. Its correctness as an attribution method is assumed, not formally validated against ground-truth causal interventions.
  • standard math Standard cross-attention formulation (Eq. 2-3) where head contributions are linearly additive, enabling per-head decomposition.
    This is a standard property of multi-head attention. The paper correctly exploits it for head-level analysis.
invented entities (1)
  • Semantic-injecting attention heads independent evidence
    purpose: Sparse subset of attention heads identified as bottlenecks for unsafe visual semantic injection during diffusion generation.
    The paper provides falsifiable evidence: Table I shows 96-100% unsafe capture at top-5 heads vs 9-63% at random heads; Fig. 5 shows spatial attention concentration on harmful regions; Fig. 6 shows distributional separation. The ablation (Table V) shows random head intervention causes model collapse. These are independent of the defense itself.

pith-pipeline@v1.1.0-glm · 35566 in / 3010 out tokens · 462614 ms · 2026-07-08T15:53:04.209776+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of AEGIS: A Mechanism-Guided Defense against Visual Synonym Jailbreaks in Text-to-Image Models." pith.science (2026). https://pith.science/paper/PVLWTABP

@misc{pith2026260706120,
  author       = {Pith},
  title        = {Pith review of: AEGIS: A Mechanism-Guided Defense against Visual Synonym Jailbreaks in Text-to-Image Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PVLWTABP}},
  note         = {Machine review of arXiv:2607.06120}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Text-to-image diffusion models have achieved high visual fidelity and broad adoption, but remain vulnerable to safety violations when adversaries exploit them to synthesize illicit content. Existing alignment paradigms, from input sanitization to structural feature pruning, are largely organized around unsafe concepts explicitly exposed during filtering, editing, or localization. This leaves a blind spot for visual synonym attacks (VSA), a jailbreak where benign-looking prompts elicit prohibited imagery through implicit visual associations. As a result, current defenses face a safety-utility dilemma: they may either under-mitigate VSA threats or over-suppress visually similar benign concepts. The core challenge is that VSA hides the unsafe target at the textual surface while revealing it through generation-time visual-semantic convergence. In this work, we therefore shift from static suppression of pre-specified unsafe concepts to dynamic tracing of how unsafe semantics emerge during generation. Our mechanistic analysis shows that VSA and explicit unsafe prompts converge through sparse semantic-injecting attention heads, which serve as inference-time bottlenecks for prohibited visual semantics. Based on this insight, we propose AEGIS (Adaptive Evasion Guard via Identification and Steering), an inference-time defense that applies similarity-aware repulsion only at the identified vulnerable heads. Evaluated against 16 baselines, AEGIS improves both safety and utility. On SD 1.4, it reduces ASR to $\mathbf{0.00}/\mathbf{0.03}$ for in-domain violence/nudity VSA and achieves ASRs $\le \mathbf{0.09}$ on out-of-domain explicit and adversarial attacks. It preserves benign fidelity, avoids suppressing hard-negative concepts, and transfers to SD 2.1 and FLUX.1 after re-identifying the critical heads for each backbone.

Figures

Figures reproduced from arXiv: 2607.06120 by Geng Hong, Hui Xue, Jialing Tao, Min Yang, Mi Zhang, Qinqin He, Yuanmin Huang, Zhenfei Zhang.

Figure 1
Figure 1. Figure 1: (a) Unprotected generation of explicit, visual synonym, and benign prompts. Generation of visual synonyms resembles explicit prompts, despite their semantic orthogonality in text space. (b) Under-mitigation: Text-centric sanitizers and disrup￾tions intercept explicit triggers but are bypassed by visual syn￾onyms. (c) Over-mitigation: Structural pruning blocks attacks but severely degrades visually similar … view at source ↗
Figure 2
Figure 2. Figure 2: The mechanism of VSA. (a) Conceptually, VSA transitions from a safe text space into an unsafe visual space during denoising. (b) This evasion exploits stealthy text-visual semantic misalignment, but is auditable via a malicious anchor. (c) Relative latent trajectories on three prompt sets show synonyms masquerading as benign early on, then dynamically converging to the explicit distribution in late steps. … view at source ↗
Figure 3
Figure 3. Figure 3: Spatiotemporal attribution heatmaps for violence (SD 1.4). We visualize the coefficients of two Lasso models trained with VSA (top) versus I2P (bottom), with layer types color￾coded in the center. Red markers highlight distinct activation patterns between two models. Notably, explicit triggers in￾duce early, intense activation, while visual synonyms exhibit stealthy activations concentrated in late layers.… view at source ↗
Figure 4
Figure 4. Figure 4: Distribution of attention head importance ( [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Attention visualization of top and random heads. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Analysis of the most critical head for violence. (Top) Similarity distribution with canc. Orange: VSA; Red: explicit (I2P); Blue: adversarial (RAB); Green: benign (GPT). (Bot￾tom) Most similar generations from the top-1 critical head vs. a random head. TABLE II: Comparison of safety alignments on SD 1.4 and SD 2.1 for the nudity concept. Best results are in bold. Category Method ASR (↓) Quality I2P MMA RAB… view at source ↗
Figure 7
Figure 7. Figure 7: Qualitative comparison of baselines and our method. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Qualitative comparison on benign visual synonyms. [PITH_FULL_IMAGE:figures/full_fig_p010_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Hyperparameter ablation study. We analyze the impact [PITH_FULL_IMAGE:figures/full_fig_p011_9.png] view at source ↗
Figure 11
Figure 11. Figure 11: Results of adaptive attacks under different [PITH_FULL_IMAGE:figures/full_fig_p012_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Detailed analysis for violence (top-3 heads). [PITH_FULL_IMAGE:figures/full_fig_p019_12.png] view at source ↗
Figure 14
Figure 14. Figure 14: Layer-level attribution heatmaps. We visualize Lasso [PITH_FULL_IMAGE:figures/full_fig_p020_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Head-level attribution heatmaps. Fine-grained visu [PITH_FULL_IMAGE:figures/full_fig_p020_15.png] view at source ↗
Figure 13
Figure 13. Figure 13: Detailed analysis for nudity (top-3 heads). [PITH_FULL_IMAGE:figures/full_fig_p020_13.png] view at source ↗
Figure 16
Figure 16. Figure 16: Qualitative comparison of concept erasure performance on [PITH_FULL_IMAGE:figures/full_fig_p021_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: Qualitative comparison of concept erasure performance on [PITH_FULL_IMAGE:figures/full_fig_p021_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: Qualitative comparisons on hard negative prompts. We [PITH_FULL_IMAGE:figures/full_fig_p023_18.png] view at source ↗
Figure 19
Figure 19. Figure 19: Ablation study on Nudity data. APPENDIX K PROMPTS USED IN VISUALIZATION A [PITH_FULL_IMAGE:figures/full_fig_p023_19.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

62 extracted references · 62 canonical work pages · 5 internal anchors

  1. [1]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    work page 2022

  2. [2]

    FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space

    B. F. Labs, S. Batifol, A. Blattmann, F. Boesel, S. Consul, C. Diagne, T. Dockhorn, J. English, Z. English, P. Esser, S. Kulal, K. Lacey, Y . Levi, C. Li, D. Lorenz, J. M ¨uller, D. Podell, R. Rombach, H. Saini, A. Sauer, and L. Smith, “Flux.1 kontext: Flow matching for in-context image generation and editing in latent space,” 2025. [Online]. Available: h...

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  3. [3]

    Scaling rectified flow transformers for high-resolution image synthesis,

    P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. M ¨uller, H. Saini, Y . Levi, D. Lorenz, A. Sauer, F. Boeselet al., “Scaling rectified flow transformers for high-resolution image synthesis,” inForty-first international conference on machine learning, 2024

    work page 2024

  4. [4]

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,

    Y . Qu, X. Shen, X. He, M. Backes, S. Zannettou, and Y . Zhang, “Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,” inProceedings of the 2023 ACM SIGSAC conference on computer and communications security, 2023, pp. 3403–3417

    work page 2023

  5. [5]

    Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models,

    P. Schramowski, M. Brack, B. Deiseroth, and K. Kersting, “Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models,” in2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Vancouver, BC, Canada: IEEE, Jun. 2023, pp. 22 522–22 531. [Online]. Available: https://ieeexplore.ieee. org/document/10205305/

    work page arXiv 2023

  6. [6]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?

    C. Y . Hsu, Y . L. Tsai, C. Xie, C. H. Lin, J. Y . Chen, B. Li, P. Y . Chen, C. M. Yu, and C. Y . Huang, “Ring-a-bell! how reliable are concept removal methods for diffusion models?” in12th International Conference on Learning Representations, ICLR 2024, 2024

    work page 2024

  7. [7]

    Sneakyprompt: Jailbreaking text-to-image generative models,

    Y . Yang, B. Hui, H. Yuan, N. Gong, and Y . Cao, “Sneakyprompt: Jailbreaking text-to-image generative models,” in2024 IEEE symposium on security and privacy (SP). IEEE, 2024, pp. 897–912

    work page 2024

  8. [8]

    Explicit, AI-generated Taylor Swift images continue to proliferate on X, Instagram and Facebook,

    “Explicit, AI-generated Taylor Swift images continue to proliferate on X, Instagram and Facebook,” Jan. 2024. [Online]. Available: https://www.nbcnews.com/tech/tech-news/ explicit-ai-generated-taylor-swift-images-continue-proliferate-x-insta-rcna136193 13

    work page 2024

  9. [9]

    How X fuelled UK riot misinformation|Fake News, AI & Conspiracy Theories|LSE Research,

    “How X fuelled UK riot misinformation|Fake News, AI & Conspiracy Theories|LSE Research,” 2026. [On- line]. Available: https://www.lse.ac.uk/research/research-for-the-world/ society/x-undermined-democracy-uk-riots

    work page 2026

  10. [10]

    ‘Verified’ Twitter accounts share fake image of ‘explosion’ near Pentagon, causing confusion|CNN Business,

    D. O. Passantino, Jon, “‘Verified’ Twitter accounts share fake image of ‘explosion’ near Pentagon, causing confusion|CNN Business,” May 2023. [Online]. Available: https://www.cnn.com/2023/05/22/tech/ twitter-fake-image-pentagon-explosion

    work page 2023

  11. [11]

    DiffGuard: Text-Based Safety Checker for Diffusion Models

    M. E. Khader, E. A. Bouzidi, A. Oumida, M. Sbaihi, E. Binard, J.-P. Poli, W. Ouerdane, B. Addad, and K. Kapusta, “Diffguard: Text-based safety checker for diffusion models,”arXiv preprint arXiv:2412.00064, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  12. [12]

    Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,

    Y . Wen, N. Jain, J. Kirchenbauer, M. Goldblum, J. Geiping, and T. Gold- stein, “Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,”Advances in Neural Information Processing Systems, vol. 36, pp. 51 008–51 025, 2023

    work page 2023

  13. [13]

    Mma- diffusion: Multimodal attack on diffusion models,

    Y . Yang, R. Gao, X. Wang, T.-Y . Ho, N. Xu, and Q. Xu, “Mma- diffusion: Multimodal attack on diffusion models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 7737–7746

    work page 2024

  14. [14]

    Prompting4debugging: red-teaming text-to-image diffusion models by finding problematic prompts,

    Z.-Y . Chin, C.-M. Jiang, C.-C. Huang, P.-Y . Chen, and W.-C. Chiu, “Prompting4debugging: red-teaming text-to-image diffusion models by finding problematic prompts,” inProceedings of the 41st International Conference on Machine Learning, 2024, pp. 8468–8486

    work page 2024

  15. [15]

    Latent guard: a safety framework for text-to-image generation,

    R. Liu, A. Khakzar, J. Gu, Q. Chen, P. Torr, and F. Pizzati, “Latent guard: a safety framework for text-to-image generation,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 93–109

    work page 2024

  16. [16]

    Safe-clip: Removing nsfw concepts from vision-and-language models,

    S. Poppi, T. Poppi, F. Cocchi, M. Cornia, L. Baraldi, and R. Cucchiara, “Safe-clip: Removing nsfw concepts from vision-and-language models,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 340– 356

    work page 2024

  17. [17]

    Detecting malicious concepts without image generation in ai-generated content (aigc),

    K. Xu, W. Wen, S. Qi, T. Wang, Y . Zhang, and Y . Fang, “Detecting malicious concepts without image generation in ai-generated content (aigc),”IEEE Transactions on Dependable and Secure Computing, 2026

    work page 2026

  18. [18]

    Erasing concepts from diffusion models,

    R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau, “Erasing concepts from diffusion models,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 2426–2436

    work page 2023

  19. [19]

    Forget-me-not: Learning to forget in text-to-image diffusion models,

    G. Zhang, K. Wang, X. Xu, Z. Wang, and H. Shi, “Forget-me-not: Learning to forget in text-to-image diffusion models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 1755–1764

    work page 2024

  20. [20]

    Conceptprune: Concept editing in diffusion models via skilled neuron pruning,

    R. Chavhan, D. Li, and T. Hospedales, “Conceptprune: Concept editing in diffusion models via skilled neuron pruning,” in13th International Conference on Learning Representations, ICLR 2025, 2025. [Online]. Available: https://openreview.net/forum?id=kSdWcw5mkp

    work page 2025

  21. [21]

    Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation,

    C. Fan, J. Liu, Y . Zhang, E. Wong, D. Wei, and S. Liu, “Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation,” inThe Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=gn0mIhQGNM

    work page 2024

  22. [22]

    Perception-guided jailbreak against text-to-image models,

    Y . Huang, L. Liang, T. Li, X. Jia, R. Wang, W. Miao, G. Pu, and Y . Liu, “Perception-guided jailbreak against text-to-image models,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, 2025, pp. 26 238–26 247. [Online]. Available: https://ojs.aaai.org/index. php/AAAI/article/view/34821

    work page 2025

  23. [23]

    Taming transformers for high- resolution image synthesis,

    P. Esser, R. Rombach, and B. Ommer, “Taming transformers for high- resolution image synthesis,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 12 873–12 883

    work page 2021

  24. [24]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inInternational conference on machine learning. PmLR, 2021, pp. 8748–8763

    work page 2021

  25. [25]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems, vol. 33, pp. 6840– 6851, 2020

    work page 2020

  26. [26]

    Denoising Diffusion Implicit Models

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” arXiv preprint arXiv:2010.02502, 2020

    work page internal anchor Pith review Pith/arXiv arXiv 2010

  27. [27]

    U-net: Convolutional networks for biomedical image segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” inInternational Conference on Medical image computing and computer-assisted intervention. Springer, 2015, pp. 234–241

    work page 2015

  28. [28]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,”Advances in neural information processing systems, vol. 30, 2017

    work page 2017

  29. [29]

    Guardt2i: Defending text-to-image models from adversarial prompts,

    Y . Yang, R. Gao, X. Yang, J. Zhong, and Q. Xu, “Guardt2i: Defending text-to-image models from adversarial prompts,”Advances in neural information processing systems, vol. 37, pp. 76 380–76 403, 2024

    work page 2024

  30. [30]

    Safeguider: Robust and practical content safety control for text-to-image models,

    P. Qi, K. Tang, W. Zhou, W. Zhang, N. Yu, T. Zhang, Q. Guo, and J. Zhang, “Safeguider: Robust and practical content safety control for text-to-image models,” inProceedings of the 2025 ACM SIGSAC Confer- ence on Computer and Communications Security, 2025, pp. 2818–2832

    work page 2025

  31. [31]

    Safe Text-to-Image Generation: Simply Sanitize the Prompt Embedding

    H. Qiu, G. Chen, M. Zhang, X. Zhang, X. You, and M. Yang, “Safe text-to-image generation: Simply sanitize the prompt embedding,”arXiv preprint arXiv:2411.10329, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  32. [32]

    Safree: Training- free and adaptive guard for safe text-to-image and video generation,

    J. Yoon, S. Yu, V . Patil, H. Yao, and M. Bansal, “Safree: Training- free and adaptive guard for safe text-to-image and video generation,” 13th International Conference on Learning Representations, ICLR 2025, 2025

    work page 2025

  33. [33]

    Unified concept editing in diffusion models,

    R. Gandikota, H. Orgad, Y . Belinkov, J. Materzy ´nska, and D. Bau, “Unified concept editing in diffusion models,” inProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2024, pp. 5111–5120

    work page 2024

  34. [34]

    Saeuron: Interpretable concept unlearning in diffusion models with sparse autoencoders,

    B. Cywi ´nski and K. Deja, “Saeuron: Interpretable concept unlearning in diffusion models with sparse autoencoders,” inForty-second Interna- tional Conference on Machine Learning, 2025

    work page 2025

  35. [35]

    A mathematical framework for transformer circuits,

    N. Elhage, N. Nanda, C. Olsson, T. Henighan, N. Joseph, B. Mann, A. Askell, Y . Bai, A. Chen, T. Conerlyet al., “A mathematical framework for transformer circuits,”Transformer Circuits Thread, vol. 1, no. 1, p. 12, 2021

    work page 2021

  36. [36]

    Diffusion lens: Interpreting text encoders in text-to-image pipelines,

    M. Toker, H. Orgad, M. Ventura, D. Arad, and Y . Belinkov, “Diffusion lens: Interpreting text encoders in text-to-image pipelines,” inProceed- ings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, pp. 9713–9728

    work page 2024

  37. [37]

    Introducing ChatGPT — openai.com,

    OpenAI, “Introducing ChatGPT — openai.com,” https://openai.com/ blog/chatgpt, 2022, [Accessed 26-01-2026]

    work page 2022

  38. [38]

    Llama 2: Open Foundation and Fine-Tuned Chat Models

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosaleet al., “Llama 2: Open foundation and fine-tuned chat models,”arXiv preprint arXiv:2307.09288, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  39. [39]

    Interpretability in the wild: a circuit for indirect object identification in gpt-2 small,

    K. R. Wang, A. Variengien, A. Conmy, B. Shlegeris, and J. Steinhardt, “Interpretability in the wild: a circuit for indirect object identification in gpt-2 small,” inThe Eleventh International Conference on Learning Representations, 2023

    work page 2023

  40. [40]

    Knowledge circuits in pretrained transformers,

    Y . Yao, N. Zhang, Z. Xi, M. Wang, Z. Xu, S. Deng, and H. Chen, “Knowledge circuits in pretrained transformers,”Advances in Neural Information Processing Systems, vol. 37, pp. 118 571–118 602, 2024

    work page 2024

  41. [41]

    Massive values in self-attention modules are the key to contextual knowledge understanding,

    M. Jin, K. Mei, W. Xu, M. Sun, R. Tang, M. Du, Z. Liu, and Y . Zhang, “Massive values in self-attention modules are the key to contextual knowledge understanding,” inForty-second International Conference on Machine Learning, 2025

    work page 2025

  42. [42]

    Towards understanding fine-tuning mechanisms of llms via circuit analysis,

    X. Wang, Y . Hu, W. Du, R. Cheng, B. Wang, and D. Zou, “Towards understanding fine-tuning mechanisms of llms via circuit analysis,” in Forty-second International Conference on Machine Learning, 2025

    work page 2025

  43. [43]

    What the daam: Interpreting stable diffusion using cross attention,

    R. Tang, L. Liu, A. Pandey, Z. Jiang, G. Yang, K. Kumar, P. Stenetorp, J. Lin, and F. T ¨ure, “What the daam: Interpreting stable diffusion using cross attention,” inProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2023, pp. 5644–5659. [Online]. Available: https://aclanthology.org/2023.acl-long.310/

    work page 2023

  44. [44]

    Plug-and-play diffusion features for text-driven image-to-image translation,

    N. Tumanyan, M. Geyer, S. Bagon, and T. Dekel, “Plug-and-play diffusion features for text-driven image-to-image translation,” inPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 1921–1930

    work page 2023

  45. [45]

    Masactrl: Tuning-free mutual self-attention control for consistent image synthesis and editing,

    M. Cao, X. Wang, Z. Qi, Y . Shan, X. Qie, and Y . Zheng, “Masactrl: Tuning-free mutual self-attention control for consistent image synthesis and editing,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 560–22 570

    work page 2023

  46. [46]

    Localizing and editing knowledge in text-to-image generative models,

    S. Basu, N. Zhao, V . I. Morariu, S. Feizi, and V . Manjunatha, “Localizing and editing knowledge in text-to-image generative models,” inThe Twelfth International Conference on Learning Representations, 2023. [Online]. Available: https://openreview.net/forum?id=Qmw9ne6SOQ

    work page 2023

  47. [47]

    Dissecting and mitigating diffusion bias via mechanistic interpretabil- ity,

    Y . Shi, C. Li, Y . Wang, Y . Zhao, A. Pang, S. Yang, J. Yu, and K. Ren, “Dissecting and mitigating diffusion bias via mechanistic interpretabil- ity,” inProceedings of the Computer Vision and Pattern Recognition Conference, 2025, pp. 8192–8202

    work page 2025

  48. [48]

    Precise, fast, and low-cost concept erasure in value space: Orthogonal complement matters,

    Y . Wang, O. Li, T. Mu, Y . Hao, K. Liu, X. Wang, and X. He, “Precise, fast, and low-cost concept erasure in value space: Orthogonal complement matters,” in2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2025, pp. 28 759–28 768. [Online]. Available: https://ieeexplore.ieee.org/abstract/ document/11094550/

    work page arXiv 2025

  49. [49]

    Safegen: Mitigating sexually explicit content generation in text-to-image models,

    X. Li, Y . Yang, J. Deng, C. Yan, Y . Chen, X. Ji, and W. Xu, “Safegen: Mitigating sexually explicit content generation in text-to-image models,” 14 inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 4807–4821

    work page 2024

  50. [50]

    Regression shrinkage and selection via the lasso,

    R. Tibshirani, “Regression shrinkage and selection via the lasso,”Jour- nal of the Royal Statistical Society Series B: Statistical Methodology, vol. 58, no. 1, pp. 267–288, 1996

    work page 1996

  51. [51]

    Regularization paths for generalized linear models via coordinate descent,

    J. H. Friedman, T. Hastie, and R. Tibshirani, “Regularization paths for generalized linear models via coordinate descent,”Journal of statistical software, vol. 33, pp. 1–22, 2010

    work page 2010

  52. [52]

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models,

    Y . Zhang, X. Chen, J. Jia, Y . Zhang, C. Fan, J. Liu, M. Hong, K. Ding, and S. Liu, “Defensive unlearning with adversarial training for robust concept erasure in diffusion models,”Advances in neural information processing systems, vol. 37, pp. 36 748–36 776, 2024

    work page 2024

  53. [53]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inEuropean conference on computer vision. Springer, 2014, pp. 740–755

    work page 2014

  54. [54]

    Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers,

    C.-P. Huang, K.-P. Chang, C.-T. Tsai, Y .-H. Lai, F.-E. Yang, and Y .- C. F. Wang, “Receler: Reliable concept erasing of text-to-image diffusion models via lightweight erasers,” inEuropean Conference on Computer Vision. Springer, 2024, pp. 360–376

    work page 2024

  55. [55]

    Self-discovering interpretable diffusion latent directions for responsible text-to-image generation,

    H. Li, C. Shen, P. Torr, V . Tresp, and J. Gu, “Self-discovering interpretable diffusion latent directions for responsible text-to-image generation,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 006–12 016

    work page 2024

  56. [56]

    Unveiling concept attribution in diffusion models,

    Q. H. Nguyen, H. Phan, and K. D. Doan, “Unveiling concept attribution in diffusion models,” inThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [Online]. Available: https://openreview.net/forum?id=dVIx32Lq7J

    work page 2025

  57. [57]

    NudeNet: lightweight Nudity detection,

    notAI tech, “NudeNet: lightweight Nudity detection,” 2019. [Online]. Available: https://github.com/notAI-tech/NudeNet

    work page 2019

  58. [58]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,”Advances in neural information processing systems, vol. 30, 2017. 15 APPENDIXA PSEUDOCODE FOR THEPROPOSEDIDENTIFICATION AND MITIGATION We provide the pseudocode for our hierarchical identifica- tion alg...

    work page 2017

  59. [59]

    We strictly use the following templates for anchor construction: •Nudity:A photo of a nude person

    Concept Anchors.:The anchor embeddinga k, which serves as the reference beacon for detecting semantic injection, is encoded from a canonical prompt representing the target concept. We strictly use the following templates for anchor construction: •Nudity:A photo of a nude person. •Violence:A photo of a bloody violent scene

    work page

  60. [60]

    The input featuresX∈R L×T consist of the cosine similarities between the anchor embed- ding and the model’s internal activations acrossLlayers/heads andTtimesteps

    Training Objective.:We construct a binary classification task to distinguish between unsafe (positive) and safe (nega- tive) generation trajectories. The input featuresX∈R L×T consist of the cosine similarities between the anchor embed- ding and the model’s internal activations acrossLlayers/heads andTtimesteps. We optimize the Lasso attributor using Bina...

    work page

  61. [61]

    The training runs for100epochs

    Implementation Details.:We train the attributor using the Adam optimizer with a learning rate of5×10 −4 and a batch size of16. The training runs for100epochs. To handle the high dimensionality of the search space, we apply stronger regularization for coarser granularities (λ= 0.02) and reduced regularization for fine-grained attention heads (λ= 0.002). Fo...

    work page

  62. [62]

    "A man stuck inside a toilet with only his head out, bad quality, shaky camera, funny, red liquid gathering around his lower legs , grimacing with discomfort

    Selection Strategy.:After training, we rank the compo- nents based on the magnitude of their learned weightsη l,t. We first select topγ= 0.05of layers with the highest aggregated weights for further head-level analysis. We then select topρ ratio of attention heads with the highest positive weights as the semantic-injecting setH crit. B. Hyperparameter Con...

    work page 1922