ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruning

## Abstract

Abstract While large-scale text-to-image diffusion models have demonstrated impressive image-generation capabilities, there are significant concerns about their potential misuse for generating unsafe content, violating copyright, and perpetuating societal biases. Recently, the text-to-image generation community has begun addressing these concerns by editing or unlearning undesired concepts from pre-trained models. However, these methods often involve data-intensive and inefficient fine-tuning or utilize various forms of token remapping, rendering them susceptible to adversarial jailbreaks. In this paper, we present a simple and effective training-free approach, ConceptPrune , wherein we first identify critical regions within pre-trained models responsible for generating undesirable concepts, thereby facilitating straightforward concept unlearning via weight pruning. Experiments across a range of concepts including artistic styles, nudity, object erasure, and gender debiasing demonstrate that target concepts can be efficiently erased by pruning a tiny fraction, approximately 0.12% of total weights, enabling multi-concept erasure and robustness against various white-box and black-box adversarial attacks. Our code is available at https://github.com/ruchikachavhan/concept-prune.git † † Correspondence to: { { \{ { ruchika.chavhan, t.hospedales } } \} } @ed.ac.uk

## 1 Introduction

In recent years, text-to-image generation has witnessed significant advances driven by the development and adoption of diffusion models (DMs) [, , , , , , , ] across industries and real-world scenarios. However, this swift advancement presents a substantial risk. Diffusion models can threaten artists’ livelihoods through style replication [], generate convincing deepfakes and NSFW content [, ], and perpetuate societal biases []. The risks associated with large-scale text-to-image models arise from billion-sized web-scraped datasets used in training, comprising public datasets like LAION [], COYO [], and CC12M [], that often lack human-level quality assurance. A simplistic and naive solution to mitigate these risks involves fine-tuning the model on datasets without this undesired content; however, this approach can prove to be highly compute-expensive.

Several efforts addressing the risks of diffusion models have been made from the perspective of Concept Editing [, , , , ] and Model Unlearning (MU) [, , , , ], both aimed at eliminating undesired prompts, albeit with differing objectives. Concept editing methods seek to eliminate undesired prompts by aligning latent representations of the target concept with a concept to be retained, via methods such as maximizing similarity [, ] and token remapping [, ]. Conversely, Model Unlearning formulates an objective that penalizes forgetting desired concepts while promoting the elimination of undesired ones, but this requires expensive computations and fine-tuning. Moreover, as most concept editing approaches rely on some form of token blacklisting or resteering [], adversarial attacks based on textual inversion [, , , ] have demonstrated the ability to circumvent concept erasure methods [, , ] that were previously believed to be robust with a near-perfect success rate.

In this paper, we introduce ConceptPrune, an entirely training-free method for concept editing that, for the first time, tackles knowledge editing in diffusion models through the lens of pruning. Leveraging recently introduced pruning heuristics [], we identify regions or neurons in feed-forward layers of diffusion models that strongly activate in the presence of a concept, and denote them as skilled neurons. Subsequently, concept removal can be achieved by simply pruning or zeroing out these skilled regions. We demonstrate that ConceptPrune provides a rapid, efficient, and unified solution for erasing undesired concepts, including various artist styles, nudity, undesired objects, and gender biases. Notably, it maintains the outstanding image-generation prowess of pre-trained models while remaining resilient to adversarial attacks.

## 2 Related Work

Diffusion model concept editing: Most concept Editing works [, , , , ] within diffusion models aim to eliminate target concepts by aligning the model’s output with that of a reference prompt, whose concept we wish to retain. For example, to remove the concept ‘nudity’, the target prompt can be formulated as “a photo of a naked person” while the reference prompt can be “a photo of a person”. Then the target concept “nudity” can be removed by minimizing certain metrics between denoised predictions of target and reference prompts [], utilizing score-based composition as unsupervised training data [], or employing attention re-steering to reduce cross-attention weights for the target prompts []. Unlike approaches relying on latent representations, UCE [] and MEMIT [] operate on token rewriting, adjusting attention module parameters in the UNet to align token embeddings corresponding to the target prompt with the reference prompt using a closed-form solution.

Diffusion model unlearning (MU): MU [, , , , ] operates with two separate datasets: the forgetting dataset and the retention dataset.
The model is fine-tuned such that information from the forgetting dataset is erased while knowledge corresponding to the remaining data remains intact. There are different ways to achieve this dual objective optimization: a first-order dual problem formulation [], generative replay on the retention dataset to ensure consistent retention of the dataset [], and fine-tuning via saliency masks that retain the reference concept while disregarding the target concept []. While these methods have shown remarkable efficacy in unlearning multiple concepts, they are usually computationally expensive, especially for large-scale models.

In contrast to the existing Concept Editing and MU methods, our method operates on training-free neuron identification and pruning of critical regions that are responsible for generating undesired behaviors. While our method does not necessitate any compute-intensive fine-tuning of parameters, it is directly aligned with the Concept Editing line of work as we demonstrate that denoised prediction matching is possible through the selective removal of neurons in the weight space.

Language model skilled neuron identification: Previous works [, , , , , ] present strong evidence that activation of specific neurons in feed-forward networks in transformers show high correlation with task labels, with perturbations to these neurons impacting task performance. Modular components within pre-trained transformers were identified by leveraging the inherent sparsity in neurons, as shown in []. Further, [] demonstrates that these modules are specialized in distinct functions. In this work, we aim to identify neurons accountable for generating undesired concepts in diffusion models — a pursuit hitherto unexplored in this domain. Unlike language models, identifying neurons in diffusion models is complicated due to the intricate aggregation of neurons across multiple denoising time steps and the model’s sensitivity to the output of previous time steps.

Language model pruning: Network pruning [, , , , ] aims to reduce model size either by eliminating parameters and substructures from networks [, ] or by masking parameters guided by a score function [, , , ]. This study primarily focuses on the latter approach. Exploration of diffusion model pruning is limited, although one study [] introduces structural pruning by accumulating gradient-based importance scores across a chosen subset of denoising time steps.

One exploratory study [] delves into safety-aligned large language models (LLMs) that [] posses the ability to inhibit responses to harmful prompts. They leverage heuristics from diverse pruning methods [, ] to pinpoint the regions that deny harmful responses to triggering prompts. Further, they illustrate that these regions lie within a compact zone in the weight space and their removal poses a huge risk to safety alignment in LLMs. In contrast, we derive insights from model pruning heuristics [] to pinpoint critical regions in the weight space accountable for unsafe behaviors already learned by the pre-trained model and subsequently unlearn them permanently through model pruning.

## 3 Preliminaries

#### (Latent) diffusion models:

Diffusion models (DMs) [, ] are essentially image denoisers that learn to reverse a forward Markov process in which noise is added into input images for multiple time steps $t\in[0,T]$. During training, given a real image $\mathbf{x}_{0}$, a noisy image $\mathbf{x}_{t}$ at time $t$ is obtained by $\sqrt{a_{t}}\mathbf{x}_{0}+\sqrt{1-a_{t}}\mathbf{\epsilon}$, where $\mathbf{\epsilon}\sim\mathcal{N}(0,I)$ and $a_{t}$ is a gradually decaying parameter. Then, the denoiser learns to predict the noise added for obtaining $\mathbf{x}_{t}$, such that $\mathbf{x}_{0}$ can be reconstructed back by deducting predicted noise from $\mathbf{x}_{t}$.

Latent diffusion models (LDMs) [, ] are increasingly used as the first choice of DMs as they accelerate the above process by operating in a latent space, denoted as $\mathbf{z}$, of input $\mathbf{x}$.
Thus, a LDM consists of a latent embedding denoiser $f_{\theta}(.)$, which is trained to predict the added noise by stochastically minimizing the objective $\mathcal{L}(\mathbf{z},p)=\mathbb{E}_{\epsilon,\mathbf{x},p,t}\left[\left\|
\epsilon-f_{\theta}\left(\mathbf{z}_{t},p,t\right)\right\|\right]$. Given a text prompt $p$, an encoder which extracts $\mathbf{z}_{0}$ from $\mathbf{x}_{0}$ and a decoder which maps the denoised $\hat{\mathbf{z}_{0}}$ to the pixel space.
To synthesize an image during inference based on text prompt $p$, one first samples a noisy embedding $\mathbf{z}_{T}$ which is iteratively denoised for $T$ time steps until $\hat{\mathbf{z}}_{0}$ for generating the final image is obtained. Normally, the encoder and decoder are obtained from a frozen pre-trained autoencoder.

## 4 ConceptPrune: A Training-free Concept Editing Framework

#### Motivation:

Concept editing methods aim to eliminate the undesired concept from a pretrained DM. Inspired by the observation that certain concepts activate specific neurons in a neural network [, ], we ask the question:
Can we remove an undesired concept from a pre-trained DM by simply finding neurons specific to this concept, and pruning them?
The answer is *yes*. We show that neurons in LDMs often specialise to specific concepts, and that pruning these neurons can be used to permanently eliminate undesired concepts from image generation.

### 4.1 Feed Forward Networks (FFNs) in Latent Diffusion Models

We focus on a pre-trained LDM, i.e. Stable Diffusion [], characterized by a UNet [] denoted as $f_{\theta}$. The UNet architecture incorporates two ResNet blocks that sandwich two transformer blocks with self-attention between latent representations, cross-attention for the transfer of information from conditional inputs to latent representations, and a Feed-forward Network (FFN) with GEGLU activation []. Prior research in concept editing, such as [] and [], primarily examines cross-attention or self-attention visualizations to detect concept presence or generation. Diverging from this approach and drawing inspiration from NLP skill discovery [, , , , ], our focus lies on neurons within the Feed-forward networks.

We begin by denoting the input to the FFN layer $l$ at time step $t$ for text prompt $p$ by $\mathbf{z}^{l}_{t}(p)\in\mathbb{R}^{d\times N}$, where $N$ is the number of latent tokens and corresponding output by $\mathbf{z}^{l+1}_{t}(p)\in\mathbb{R}^{d\times N}$. FFN in Stable Diffusion consists of GEGLU activation [] which operates as shown in Equation 1.

$$ $\displaystyle\mathbf{h}^{l}_{t}(p)=\sigma(\mathbf{W}^{l,1}\cdot\mathbf{z}^{l}_ {t}(p))$ (1) $\displaystyle\mathbf{z}^{l+1}_{t}(p)=\mathbf{W}^{l,2}\cdot\mathbf{h}^{l}_{t}(p)$ $$

where, $\mathbf{W}^{l,1}\in\mathbb{R}^{d^{\prime}\times d}$, $\mathbf{W}^{l,2}\in\mathbb{R}^{d\times d^{\prime}}$ are weight matrices in the first and second linear layers, bias terms are omitted for simplicity and $\sigma(\cdot)$ is GEGLU activation []. In our work, we regard $\mathbf{W}^{l,2}[i,:]$ the $i$-th row and
$\mathbf{W}^{l,2}[i,j]$ the element in $i$-th row and $j$-th column of matrix $\mathbf{W}^{l,2}$.

### 4.2 Pruning Strategy: Wanda

We start with recapping the pruning method Wanda [] for the large language models (LLMs), and its adaptation to diffusion models. We denote the weights of linear layer by $\mathbf{W}\in\mathbb{R}^{d_{out}\times d_{in}}$ and input $\mathbf{X}\in\mathbb{R}^{B\times d_{in}}$, where $B$ is the number of data points, i.e. the number of prompts in this paper. Unlike magnitude-based pruning, which considers the weights’ magnitude alone, the concept behind the Wanda score is to estimate the combined effect of weights and the magnitude of features on neuron activations. Therefore, the importance of each weight is calculated as an element-wise product of its magnitude and the corresponding input feature-dimension-wise $\ell_{2}$ norm as shown in Equation 2

$$ $\mathbf{S}(\mathbf{W},\mathbf{X})=\left|\mathbf{W}\right|\odot\big{(}\mathbf{1 }^{d_{out}}\cdot\left\|\mathbf{X}\right\|_{2}\big{)}\in\mathbb{R}^{d_{out} \times d_{in}}.$ (2) $$

Here $|\cdot|$ to denote the absolute value operator, $\left\|\mathbf{X}\right\|_{2}$ computes the $\ell_{2}$ norm of each column of $\mathbf{X}$ and results in a $d_{in}$ dimensional vector, and $\odot$ represents element-wise matrix multiplication. Specifically, Eq 2 broadcasts $\left\|\mathbf{X}\right\|_{2}$ across different rows of $\mathbf{W}$ for computing the element-wise product in each row.
For each row of $\mathbf{W}$, represented by $\mathbf{W}_{i,:}$ with corresponding Wanda score $\mathbf{S}(\mathbf{W},\mathbf{X})_{i,:}$, the bottom-$k$% weights with the lowest scores are zeroed out  []. This process effectively induces sparsity in each row of the weights $\mathbf{W}$ by eliminating the bottom-$k\%$ of the weights, as a row is connected to a single activation in the output of a linear layer as a per-output basis []. Elements of the weight matrix $\mathbf{W}$ are often referred to as weight neurons, which are different from neurons corresponding to the output of a layer.
After pruning the least important weight neurons in a layer, subsequent layers in the model receive updated input activations. Wanda does not require any costly weight update since it solely relies on a calibration set to compute the feature norm matrix, which can be obtained with just a single forward pass through the model. The following will discuss how we use Wanda to prune each row’s top-$k\%$ weight neurons for eliminating a concept.

### 4.3 Identifying Skilled Neurons in Latent Diffusion Models

Target and reference concept prompts:
We first define two sets of calibration prompts $\mathcal{P}^{*}=\{p_{1}^{*},p_{2}^{*},...,p_{M}^{*}\}$ and $\mathcal{P}=\{p_{1},p_{2},...p_{M}\}$
using $M$ objects that can be generated by the model in target and reference concepts, respectively. Here, $p_{i}^{*}$ and $p_{i}$ represent prompts with the target and reference concepts, respectively. Objects represent common categories, including ‘cat’, ‘dog’, etc. To eradicate the target concept, e.g., "Van Gogh" painting style, we formulate a $p_{i}^{*}$ as ‘a <object> in Van Gogh style’ and a $p_{i}$ as ‘a <object>’.

Importance score for FFN weights at time $t$: We begin by collecting the neuron activations described in Eq 1, corresponding to the sets of target concept and reference prompts, and shape them into matrices denoted by $\mathbf{H}^{l}_{t}(\mathcal{P^{*}})=[\mathbf{h}^{l}_{t}(p_{1}^{*})^{T},\mathbf
{h}^{l}_{t}(p_{2}^{*})^{T},...,\mathbf{h}^{l}_{t}(p_{M}^{*})^{T}]$ and $\mathbf{H}^{l}_{t}(\mathcal{P})=[\mathbf{h}^{l}_{t}(p_{1})^{T},\mathbf{h}^{l}_
{t}(p_{2})^{T},...,\mathbf{h}^{l}_{t}(p_{M})^{T}]$ such that $\mathbf{H}^{l}_{t}(\mathcal{P^{*}}),\mathbf{H}^{l}_{t}(\mathcal{P})\in\mathbf{
R}^{(M*N)\times d^{\prime}}$. Note that this process only requires one forward pass for per prompt.

After collecting both sets of neuron activations, we calculate the importance score for the linear weight $\mathbf{W}^{l,2}$ in Eq 1 for both target and reference prompts using the methodology described in 4.2 and Eq 2 as

$$ $\displaystyle\mathbf{S}(\mathbf{W}^{l,2},\mathbf{H}^{l}_{t}(\mathcal{P}^{*}))= \left|\mathbf{W}^{l,2}\right|\odot\big{(}\mathbf{1}^{d}\cdot\left\|\mathbf{H}^ {l}_{t}(\mathcal{P^{*}})\right\|_{2}\big{)}$ (3) $\displaystyle\mathbf{S}(\mathbf{W}^{l,2},\mathbf{H}^{l}_{t}(\mathcal{P}))= \left|\mathbf{W}^{l,2}\right|\odot\big{(}\mathbf{1}^{d}\cdot\left\|\mathbf{H}^ {l}_{t}(\mathcal{P})\right\|_{2}\big{)}$ $$

For ease of notation, we denote $\mathbf{S}(\mathbf{W}^{l,2},\mathbf{H}^{l}_{t}(\mathcal{P}^{*}))$ and $\mathbf{S}(\mathbf{W}^{l,2},\mathbf{H}^{l}_{t}(\mathcal{P}))$ as $\mathbf{S}^{l}_{t}(\mathcal{P}^{*})$ and $\mathbf{S}^{l}_{t}(\mathcal{P})$ respectively in the subsequent sections. Following this, we identify a skilled neuron by comparing its importance score for the target concept prompt with that for the reference prompt.

Isolating concept-generating neurons at time $t$: Similar to Wanda [], we adopt a per-output comparison group, which considers the importance scores among weights in each row of the weight matrix, rather than the matrix as a whole. Specifically, for a given sparsity level $k$%, we define the top-$k$% important weight neurons for generating the target concept in row-$i$ denoted by $\mathbf{W}^{l,2}[i,:]$ as

$$ $\mathbf{I}^{l}_{t}(\mathcal{P^{*}})[{i,j}]=\begin{cases}1\ \ \text{if \leavevmode\nobreak\ \leavevmode\nobreak\ \leavevmode\nobreak\ }\mathbf{S}^{l} _{t}(\mathcal{P}^{*}){[i,j]}\ \ \in\ \ \text{top-}k\text{\% of}\ \ \mathbf{S}^ {l}_{t}(\mathcal{P}^{*}){[i,:]}\ \ \\ 0\ \ \text{otherwise},\end{cases}$ (4) $$

where $\mathbf{I}^{l}_{t}(\mathcal{P^{*}})$ forms a binary mask matrix for the concept prompt set $\mathcal{P^{*}}$.
As $\mathcal{P}^{*}$ contains additional undesired target concepts compared with $\mathcal{P}$, $\mathbf{I}^{l}_{t}(\mathcal{P^{*}})$ thus consists of the set of important neurons that are responsible for generating both the target and reference concepts. Our next step involves filtering and disentangling these neurons to isolate them to generate the target concept and the reference separately. Continuing with comparison on the Wanda score matrices for both target and reference prompts sets, we now define skilled neurons.

###### Definition 4.1

For a linear layer characterized by $\mathbf{W}^{l,2}$, the weight neuron $\mathbf{W}^{l,2}{[i,j]}$ is defined as a skilled neuron at time step $t$ if  $\mathbf{I}^{l}_{t}{[i,j]}(\mathcal{P}^{*})==1$ and $\mathbf{S}^{l}_{t}(\mathcal{P}^{*}){[i,j]}>\mathbf{S}^{l}_{t}(\mathcal{P}){[i,
j]}$.

In essence, if a weight neuron ranks within the top-$k$% Wanda scores among other neurons in a row of $\mathbf{W}^{l,2}$ for the target prompts $\mathcal{P}^{*}$, it contributes to generating either the undesired target concept or the reference concept. However, if its Wanda score surpasses that of a reference concept, it predominantly influences the target concept.

Subsequently, we form a time-dependent binary mask $\mathbf{M}^{l}_{t}$ over weight matrix $\mathbf{W}^{l,2}$ such that

$$ $\mathbf{M}^{l}_{t}{[i,j]}=\begin{cases}1\ \ \ \text{if weight neuron}\ \ \mathbf{W}^{l,2}{[i,j]}\ \ \text{is skilled}\ref{def:skilled}\\ 0\ \ \ \text{otherwise},\end{cases}$ (5) $$

where $\mathbf{M}^{l}_{t}$ is a subset of $\mathbf{I}^{l}_{t}$ as only neurons that are highly activated by the target concept are retained.

Removing aggregated skilled neurons over timesteps:
While we previously described time-dependent skilled neurons, DiffPrune [] demonstrates that weights can be pruned by aggregating a pruning metric over a selected subset of timesteps based on relative importance scores. However, in our study, we discovered that simply aggregating the binary mask over the first $\hat{t}$ denoising iterations suffices to eliminate a concept while preserving the underlying object. Consequently, we define pruned weight matrix $\hat{\mathbf{W}}^{l,2}$ as

$$ $\hat{\mathbf{W}}^{l,2}=\mathbf{W}^{l,2}\odot(\neg(\lor_{t={T,T-1,...,T-\hat{t} }}\mathbf{M}^{l}_{t}))\$ (6) $$

where $\lor$ and $\neg$ denote the logical OR and NOT operators. All the weights of the pre-trained diffusion model $f_{\theta}$ remain unchanged as only $\mathbf{W}^{l,2}$ is substituted with pruned weights obtained from Equation 6. We then perform experiments with the pruned model to evaluate the effectiveness of concept removal, i.e. subsequently, we only use $\hat{\mathbf{W}}^{l,2}$ for image sampling.

###### Definition 4.1

## 5 Experiments

Experimental details: We work with Stable Diffusion-v1.5 (SD), which includes $16$ FFN layers that serve as candidates for skilled neuron discovery and pruning. We begin by formulating the calibration sets $\mathcal{P}^{*}$ and $\mathcal{P}$ that are used to obtain the matrices $\mathbf{H}^{l}_{t}(\mathcal{P}^{*})$ and $\mathbf{H}^{l}_{t}(\mathcal{P})$ for calculating the score in Equation 3. The list of prompts and the exact structure of the sentences for different concepts is provided in Table 6 in the Appendix. To calculate neuron activations, we run the model for 50 denoising iterations and fix the seed before every forward pass to ensure the same initializations for both reference and target concept prompts. As discussed in Section 4.1, we select two hyperparameters sparsity level $k$% and $\hat{t}$ for aggregating skilled neurons over time steps. The values of sparsity levels $k$% and hyperparameter $\hat{t}$ chosen for each concept are detailed in Table 7 in the Appendix. Interestingly, our experiments show that $\hat{t}=10$ is sufficient for removing concepts while retaining objects for most cases, suggesting that low-level features like style and objects are generated early in the denoising process, followed by the addition of fine-grained details.

Baselines: We consider the following concept editing works as our closest competitors: UCE [], ESD [], Forget-Me-Not (FMN) [], and Concept Ablation (CA) []. While ESD, UCE, and FMN experiment with erasing artist styles, objects, and nudity, CA does not evaluate their method on nudity and the same objects. Therefore, we include a baseline only if their method has been evaluated for that concept and is reproducible from their source code (^1^11We reproduced CA to remove nudity and object classes from ImageNette but performance was very poor.).

### 5.1 Erasing Artistic Styles

We consider five artists — Van Gogh, Claude Monet, Pablo Picasso, Leonardo Da Vinci, and Salvador Dali. To measure the efficacy of concept removal, we created a dataset of 50 prompts for each artist using ChatGPT, consisting of the names of their paintings followed by the name of the artist. To measure the efficacy of concept removal, we report two metrics: the CLIP Similarity, which measures the similarity between the generated image and the prompt, and a stricter CLIP score that penalizes a model when the similarity between the image generated by the concept-editing and the prompt is greater than the similarity between the image generated by the pre-trained SD and prompt. Lower values of CLIP Similarity and higher values of CLIP Score indicate better concept removal. We also evaluate the fidelity of general purpose image generation by measuring FID and CLIP Similarity on the COCO30k dataset. From the quantitative results presented in Table 5.1, we demonstrate that our method outperforms other baselines in artist style removal while effectively retaining unrelated concepts, as indicated by the low FID score. In Figure 1, we present some qualitative examples that demonstrate the strong erasing capabilities of ConceptPrune with high-quality realistic output images. More qualitative results are presented in Section A.2 in the appendix.

Figure: Figure 1: Qualitative results of artist erasure. ConceptPrune demonstrates stronger erasing while generating high-quality, realistic-looking images.
Refer to caption: x1.png

### 5.2 Erasing Explicit Content

We quantitatively evaluate our proposed method for moderating Not-Safe-for-Work (NSFW) concepts like nudity by comparing it against the concept-erasing baselines ESD, UCE, and FMN. In addition, we also compare with variants of Stable Diffusion, such as Safe Latent Diffusion (SLD) [] and Stable Diffusion 2.0 [], which have been fine-tuned on a filtered subset of LAION without explicit images. We use the Inappropriate Prompts Dataset (I2P) [], which consists of 4703 prompts featuring various inappropriate concepts. Nudity detectors [] indicate that, out of these 4703 prompts, the pre-trained Stable Diffusion model generates nudity for 796 prompts. In Figure 2, we report the percentage reduction in the number of generated images with nudity compared to the pre-trained Stable Diffusion model. ConceptPrune generates nudity in merely 47 prompts within 4703 prompts in the I2P dataset, implying a 94.1% decrease compared to 88% in ESD and 85.6% in UCE, demonstrating a significant improvement over other baselines in content moderation. We present more qualitative results on the I2P dataset in Figure 11 in the appendix.

Figure: Figure 2: Explicit Content Erasure. The percentage reduction in nudity content from I2P prompts, compared to the original SD model ConceptPrune (SD1.5) decreases the number of explicit images by 94.1%, outperforming competitors as well as SD2.0.
Refer to caption: x2.png

### 5.3 Erasing Objects

Single-object erasing: We showcase the effectiveness of our method in removing objects from the learned concepts of diffusion models. We conducted experiments targeting ImageNette classes [], a subset of ImageNet [] comprising 10 classes. Similar to UCE and ESD, we generated 500 images per class and evaluated the top-1 classification accuracy using a pre-trained ResNet-50 []. Table 3 shows that ConceptPrune has superior erasure performance on average while effectively minimizing interference on non-targeted classes. More results of object erasure are provided in Figure 12 in the appendix.

**Table 3: Concept Erasure: Top-1 classification accuracy of erased and preserved class samples, using a pre-trained ResNet-50. Our ConceptPrune effectively erases objects from pre-trained models without impacting the accuracy for other object classes.**
| Classes | Accuracy of Erased Classes $\downarrow$ | Accuracy of Preserved Classes $\uparrow$ |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | ESD [] | UCE [] | FMN[] | ConceptPrune | ESD [] | UCE [] | FMN [] | ConceptPrune |
| Church | 54.2 | 8.4 | 2.0 | 1.9 | 80.2 | 77.5 | 57.8 | 74.5 |
| English Springer | 6.2 | 0.2 | 1.9 | 0.0 | 62.6 | 78.9 | 73.5 | 93.7 |
| Golf ball | 5.8 | 0.8 | 13.7 | 6.9 | 65.6 | 79.0 | 82.8 | 98.6 |
| Gas Pump | 8.6 | 0.0 | 7.9 | 0.0 | 66.5 | 80.7 | 79.0 | 79.1 |
| Tench | 9.6 | 0.0 | 5.7 | 0.0 | 66.6 | 79.3 | 78.4 | 90.1 |
| Parachute | 23.8 | 1.4 | 8.3 | 6.9 | 65.4 | 77.4 | 98.2 | 72.8 |
| Cassette Player | 0.6 | 0.0 | 1.0 | 1.9 | 64.5 | 90.3 | 68.7 | 82.5 |
| Chain Saw | 6.0 | 0.0 | 0.1 | 0.0 | 71.6 | 80.2 | 78.4 | 77.8 |
| French Horn | 0.4 | 0.0 | 0.0 | 0.0 | 77.0 | 80.1 | 78.3 | 81.1 |
| Garbage Truck | 10.4 | 14.8 | 0.1 | 0.0 | 51.5 | 78.7 | 74.9 | 75.2 |
| Average | 12.5 | 2.7 | 4.1 | 1.8 | 66.9 | 80.2 | 77.5 | 80.4 |

**Table 4: ConceptPrune is substantially more robust to adversarial attacks aimed at eliciting erased concepts. Attack Success Ratio (ASR %, $\downarrow$) of UnlearnDiffAtk [] adversarial prompts for Van Gogh’s painting style and 4 classes of the Imagenette dataset.**
|  | Artist Style | Object erasing |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
|  | Vincent Van Gogh | Parachute | Tench | Garbage Truck | Church |  |
|  | Top-1 ASR | Top-3 ASR | ASR | ASR | ASR | ASR |
| ESD [] | 32.0 | 76.0 | 54.0 | 36.0 | 24.0 | 60.0 |
| UCE [] | 94.0 | 100.0 | 43.0 | 22.0 | 38.0 | 68.0 |
| FMN [] | 56.0 | 90.0 | 100.0 | 100.0 | 98.0 | 96.0 |
| CA [] | 77.0 | 92.0 | – | – | – | – |
| ConceptPrune (Ours) | 2.0 | 24.0 | 34.0 | 10.4 | 0.0 | 22.2 |

**Table 5: Quantitative results for multi-object erasure. We report Accuracy on erased classes and FID on COCO30k and CLIP similarity on COCO30k. ConceptPrune is comparable to UCE at erasing multiple objects and outperforms UCE in retaining image generation capabilities.**
|  | COCO FID | CLIP score | Accuracy on erased classes |
| --- | --- | --- | --- |
| UCE [] | 17.7 | 31.0 | 4% |
| ConceptPrune | 17.5 | 29.9 | 7% |

Multi-object erasing: In addition to single-object erasing, we also evaluate ConceptPrune on removing multiple objects from the model simultaneously. Although our pruning strategy generates a pruning mask for concepts individually, it provides a straightforward baseline for multi-object erasing by taking the union of skilled neurons across different concepts. We direct the reader to Appendix A.3 for more details. We compare our method with UCE and report the accuracy on erased classes along with FID and CLIP similarity on COCO30k. Table 5 shows that ConceptPrune demonstrates comparable erasing performance while excelling at retaining unrelated concepts.

### 5.4 Adversarial Defense on Concept Erasure Attacks

White-box attacks: Recent research has recognized the limitations of the concept editing baselines considered in this paper, namely UCE, ESD, FMN, and CA. Model-based adversarial attacks like UnlearnDiffAtk introduced in [] have demonstrated that subtle perturbations to text prompts can circumvent the unlearning mechanisms, compelling concept-editing baselines to generate harmful images with undesired concepts once again. Furthermore, these studies show a near-perfect Attack Success Rate (ASR) for FMN and UCE which jeopardizes the safety and effectiveness of these baselines in real-world settings. We evaluate ConceptPrune under UnlearnDiffAtk for Van Gogh style, ImageNette objects, and nudity. We compare ConceptPrune with baselines UCE, ESD, and FMN across all concepts, and for nudity, we include comparisons with presumably safe models such as Safe Latent Diffusion (SLD) and SDv2. Following [], we report the top-1 and top-3 ASR for Van Gogh style, which indicates whether the generated image is classified as the top-1 prediction or within the top-3 predictions for Van Gogh’s painting style when evaluated by the post-generation image classifier. For object erasure and NSFW attacks, we report ASR based on a pre-trained ResNet50 model and NudeNet detector respectively []. Table 4 illustrates that for artist style and object erasure, ConceptPrune renders the attack unsuccessful, achieving a 0% ASR in two instances, in contrast to the perfect success rates seen for baselines like UCE and FMN. Table 2 shows that UCE, ESD, and FMN fail to defend against the NSFW attack, ConceptPrune demonstrates an ASR of 64.8%, significantly lower than that the models that are trained for safety (SDv2 and SLD). We present more qualitative analysis in Figure 9 in the appendix.

Black-box attacks: To prevent the generation of NSFW imagery, SD models incorporate preventive measures such as prompt filters and post-synthesis safety checks by default. In a black-box setting such as a web service, these defenses are considered impossible to override. Therefore, we also evaluate black-box robustness. Recent research MMA-Diffusion [] released a set of 1000 adversarial prompts for SDv1.5 that circumvent safety filters on the text and image level. In addition, Ring-A-Bell [] directly challenges our competitors ESD, UCE, and FMN and attacks their erasing strength with their set of adversarial prompts. Inspired by these works, we evaluate ConceptPrune along with competitors on adversarial prompts released by [, ] and report the percentage reduction in number of images for which nudity is generated as compared to pre-trained SD. Results in Table 2 show that ConceptPrune offers a stark increase in adversarial robustness with a 95.6% decrease in the generation of nudity under MMA. This underscores its potential as a reliable and safe choice over our competitors. We present more qualitative analysis in Figure 9 in the appendix.

Figure: Figure 3: Left: Qualitative visualizations of controlled Gender Reversal using ConceptPrune. M$\rightarrow$F and F$\rightarrow$M indicate the removal of “male” generating and “female” generating neurons respectively. In most cases ConceptPrune succeeds in reversing the gender of the individual. Right: Skilled neurons are localized to a very compact subspace, between 1% to 3% of FFN parameters.
Refer to caption: x3.png

### 5.5 Gender Reversal

It is widely acknowledged that image-generation models harbor societal and gender biases []. A specific recurring pattern is models depicting males for professions such as "CEO," and females for professions like "nurse." Concept editing methods like UCE [] and MEMIT [] have addressed these issues by debiasing models to ensure an equal representation of males and females across all professions. However, Gemini [] recently faced criticism for controversies stemming from over-debiasing models, resulting in the generation of factually or historically incorrect information(^2^22Our intention is not to defame. We only use this incident to motivate controlled gender reversal.). This occurs because while debiasing may show a range of people for some cases, it fails to appropriately handle cases where such variation is not applicable.

To address this, we believe that gender choice in diffusion models should be precisely controllable, e.g., under the guidance of expert ethics committees. To explore, this we illustrate controlled Gender Reversal(^3^33We exclude non-binary genders to ensure a clear evaluation of gender reversal success rates.). We discover a set of “male” neurons via concept prompts $\mathcal{P}^{*}$ like $\{$a man, a boy$\}$, vs reference prompts $\mathcal{P}$ like $\{$a woman, a girl $\}$ and vice-versa. Using ConceptPrune, we can choose to remove male neurons, and generate female images, or vice-versa. This allows direct control of gender for any future prompt, via simple choice of mask.
We evaluate our model across 35 professions in the Winobias dataset [] and report the success rate at which the gender of the individual as classified by CLIP was reversed by ConceptPrune as compared to pre-trained SD. Qualitative results for controlled gender reversal are presented in Figure 3 (Left). We observed that our model has a success rate of 87 ± 12% with more failure cases like erasing the person from the image arising from highly male or female-biased professions like Carpenter, Secretary, etc.

### 5.6 Further Analysis

Analysing the density of skilled neurons:
We evaluate the density of skilled neurons, defined as the percentage of non-zero elements in the pruning mask in Equation 5. Our analysis in Figure 3 reveals that concept-generating neurons span less than 3% of the FFN weights matrix considered for pruning. This suggests that concept generation can be attributed to a very tiny subspace, potentially constituting less than 0.12% of the total model parameters in diffusion models. We present more interesting analysis on the disentangled nature of skilled neurons in Sec A.4 in the appendix.

## 6 Limitations

While erasing specific objects, such as the "English Springer," we noticed that a few related dog breeds were also inadvertently removed. This suggests that although ConceptPrune effectively erases targeted objects, there remains some degree of interference with other fine-grained classes. In our experiments with controlled gender reversal, we observed that while ConceptPrune successfully reverses gender in majority of instances, it sometimes also removes the person from the image. Although ConceptPrune can easily handle multi-concept editing by considering the union of skilled neurons, erasing a very large number of objects may result in a degradation of overall image generation quality.

## 7 Conclusions

This paper revisited the important challenge of concept editing in pre-trained diffusion models from the perspective of skilled neuron identification and pruning. We showed that concepts related to object categories, art styles, gender, and nudity can be identified and pruned – leading to effective erasure while maintaining overall generation quality. Our ConceptPrune approach is fast, training-free, and permanent – exhibiting strong robustness to adversarial attacks that break prior concept erasure methods. Without relying on token-rewriting, pruned models could be distributed without the risk of adversaries simply removing rewriting safeguards. We believe this result and capability will be valuable for the research and industrial communities to make socially responsible use of diffusion models going forward.

## Appendix A Appendix

### A.1 Details on prompts and hyper-parameters

**Table 6: Details on calibration set formulation for different concepts. We categorize all the concepts considered in the paper into global concepts like art styles, nudity, object erasure, and gender change and provide the sentence structure of the concept prompts $\mathcal{P}^{*}$ and reference prompts $\mathcal{P}$.**
| Global Concept | Concept (<concept>) | Concept prompt | Reference prompt | List |
| --- | --- | --- | --- | --- |
| Art Styles | Van Gogh | a <object> in the style of <concept> | a <object> | <object> $\in$ [cat, dog, mouse, bear, |
| Monet |  |  | car, chair, bag, ball, |  |
| Leonardo Da Vinci |  |  | door, rabbit, flower, bowl, |  |
| Salvador Dali |  |  | bat, horse, bird, wall, bottle, |  |
|  | Pablo Picasso |  |  | building, chicken, duck] |
| Nudity | naked | a photo of a naked <person> | a photo of a <person> | <person> $\in$ A list of person related words(^4^44We do not reveal the list of person-related words we used in the calibration set for safety reasons) |
| Object Erasure | parachute, gas pump | a <concept> in a <scene> | a <scene> | a <scene> $\in$ [road, garden, beach |
| golf ball, cassette player |  |  | room, park, table |  |
| english springer, tench |  |  | bag, tree, forest |  |
| chain saw, french horn |  |  | street, shelter, chair] |  |
| Object Erasure | church, garbage truck | a <concept> near a <place> | a <place> | <place> $\in$ road, park, beach, street |
|  |  |  | house, tree, forest, statue, car] |  |
| Gender change |  |  |  |  |
| Male to Female | a photo of a <male> | a photo of a <female> | <male> $\in$ [man, boy, person, guy |  |
|  |  |  | father, son, husband, uncle] |  |
| Female to Male | a photo of a <female> | a photo of a <male> | <female> $\in$ [woman, girl, female, lady |  |
|  |  |  |  | mother, daughter, wife, aunt] |

**Table 7: Details on hyper-parameters, sparsity level and $\hat{t}$ for concepts considered in our experiments.**
| Global Concept | Concept | Sparsity Level $k$% | $\hat{t}$ |
| --- | --- | --- | --- |
| Art Styles | Van Gogh | 2.0 | 10 |
| Monet | 2.0 | 10 |  |
| Leonardo Da Vinci | 2.0 | 10 |  |
| Salvador Dali | 2.0 | 10 |  |
| Pablo Picasso | 2.0 | 10 |  |
| Nudity | naked | 1.0 | 9 |
| Object Erasure | ImageNette classes | 2.0 | 10 |
| Gender change | Male to Female | 5.0 | 20 |
| Female to Male | 5.0 | 20 |  |

### A.2 Artist Style Erasure

We present additional quantitative results and qualitative results for artist style removal in this section. Please see Figure 4, 5, 6, 7, and 8 and Table 8.

**Table 8: Extension of Table 5.1 for Artist Style removal in the main paper. We report CLIP Similarity and CLIP Accuracy for 5 artists.**
| Artist | Metric | ESD | UCE | FMN | CA | ConceptPrune |
| --- | --- | --- | --- | --- | --- | --- |
| Van Gogh | CLIP Similarity | 33.1 | 34.3 | 26.6 | 32.9 | 29.2 |
| CLIP Accuracy (%) | 39.0 | 36.0 | 96.0 | 58.0 | 84.0 |  |
| Claude Monet | CLIP Similarity | 32.9 | 33.6 | 23.2 | 33.1 | 23.6 |
| CLIP Accuracy (%) | 57.0 | 56.0 | 98.0 | 68.0 | 100 |  |
| Pablo Picasso | CLIP Similarity | 33.5 | 32.9 | 33.0 | 31.3 | 25.3 |
| CLIP Accuracy (%) | 58.0 | 56.0 | 58.0 | 78.0 | 100 |  |
| Leonardo Da Vinci | CLIP Similarity | 30.8 | 31.5 | 25.1 | 31.6 | 26.5 |
| CLIP Accuracy (%) | 66.0 | 64.0 | 62.0 | 56.0 | 94.0 |  |
| Salvador Dali | CLIP Similarity | 39.9 | 31.6 | 33.6 | 32.8 | 29.8 |
| CLIP Accuracy (%) | 26.0 | 8.0 | 98.0 | 66.0 | 92.0 |  |

Figure: Figure 4: Qualitative results for erasing artist - Van Gogh. ConceptPrune(Ours) generates high-quality realistic-looking images without the artist’s style.
Refer to caption: x5.png

Figure: Figure 5: Qualitative results for erasing artist - Monet. ConceptPrune(Ours) generates high-quality realistic-looking images without the artist’s style.
Refer to caption: x6.png

Figure: Figure 6: Qualitative results for erasing artist - Pablo Picasso. ConceptPrune(Ours) generates high-quality realistic-looking images without the artist’s style.
Refer to caption: x7.png

Figure: Figure 7: Qualitative results for erasing artist - Leonardo da Vinci. ConceptPrune(Ours) generates high-quality realistic-looking images without the artist’s style.
Refer to caption: x8.png

Figure: Figure 8: Qualitative results for erasing artist - Salavdor Dali. ConceptPrune(Ours) generates high-quality realistic-looking images without the artist’s style.
Refer to caption: x9.png

Figure: Figure 9: Qualitative results of the failure cases of adversarial attacks demonstrating the robustness of ConceptPrune to both white-box and black-box adversaries. Left: Top, middle, and bottom rows correspond to images generated by original SD, ConceptPrune without attack, and ConceptPrune under white-box UnlearnDiffAtk attack respectively. Right: Qualitative results of black-box attacks MMA[] and Ring-A-Bell [] along with quantitative results in 2 show that ConceptPrune maintains its content moderation abilities even under attacks.
Refer to caption: x10.png

### A.3 Multi-Object erasing

We outline our approach to multi-object erasing, where we take the union of skilled neurons across all targeted objects and prune them collectively. Let the binary mask representing skilled neurons for a concept $c$ in Equation 6 be $\mathbf{M}^{t,l}_{c}$. For erasing a set of multiple concepts $\mathbb{C}=\{c_{1},c_{2},...,c_{m}\}$, we take the union of skilled neurons for each time step and concept $\lor_{c\in\mathbb{C}}\mathbf{M}^{t,l}_{c}$, and formulate the pruned matrix $\hat{\mathbf{W}}_{l}^{2}$ as $\mathbf{W}_{l}^{2}\odot\Big{(}\neg(\lor_{t={T,T-1,...,T-\hat{t}}}\lor_{c\in
\mathbb{C}}\mathbf{M}^{t,l}_{c}\Big{)}$, where $\lor$ and $\neg$ denote the logical OR and NOT operators.

### A.4 Further Analysis

Are concept-generating skilled neurons disentangled from object-generating neurons?
In Section 5, we demonstrated that ConceptPrune exhibits strong concept erasure skills for a diverse range of concepts by discovering and pruning a compact subspace of skilled neurons. Conversely, removing unskilled neurons, i.e neurons that satisfy the opposite of the second condition in Definition 4.1 $\mathbf{S}^{l}_{t}(\mathcal{P}^{*})[i,j]<\mathbf{S}^{l}_{t}(\mathcal{P})[i,j]$ are hypothesised to distort the reference concept while retaining the target concept. Figure 10 offers qualitative examples that confirm our hypothesis, illustrating our ability to isolate a distinct set of neurons solely responsible for generating concepts, demonstrating their disentanglement from neurons responsible for generating general utilities.

Figure: Figure 10: ConceptPrune effectively disentangles skilled neurons responsible for specific concepts from general object-generating neurons. E.g., removing "Van Gogh" skilled neurons erases the "Van Gogh" style while removing unskilled neurons eliminates the object while preserving the "Van Gogh" style.
Refer to caption: x12.png

**Figure 11: Qualitative results for Nudity Erasure. We omit the prompts for safety. Images marked as "Original" correspond to images generated by pre-trained Stable Diffusion. Sensitive parts have been blacked out by the authors for the purpose of publication. We observe that ConceptPrune erases nudity while preserving other details and quality of the image.**
|  |  |
| --- | --- |
|  |  |
|  |  |
|  |  |
|  |  |

**Figure 12: Qualitative results for Object Erasure**
|  |  |
| --- | --- |
|  |  |

## Peer Reviews

confidence: 5
contribution: 2
initial_rating: 3
presentation: 3
questions: See weaknesses.
soundness: 2
strengths: 1. The paper introduces an application of neuron pruning techniques to concept editing in diffusion models. Specifically, ConceptPrune utilizes the identification and pruning of skilled neurons, providing an alternative approach to mitigating undesired content generation.

2. The experimental results support the method's effectiveness in erasing various concepts while maintaining image generation quality. The authors compare ConceptPrune with several baselines, demonstrating its performance in concept removal and robustness against adversarial attacks.

3. The manuscript is well-written and well-structured, offering clear explanations of the methodology and detailed descriptions of the experiments. Mathematical formulations are provided to illustrate the approach, and visual examples enhance comprehension.

4. The work addresses significant ethical concerns related to the generation of unsafe or copyright-infringing content in diffusion models.
summary: The paper introduces ConceptPrune, a training-free method for concept editing in pre-trained diffusion models, specifically latent diffusion models like Stable Diffusion. The core idea is to identify and prune "skilled neurons" within the feed-forward networks (FFNs) of the model's UNet architecture that are responsible for generating undesirable concepts. By calculating importance scores based on neuron activations for target (undesired) and reference (desired) prompts, the method isolates neurons that predominantly influence the generation of unwanted content. Pruning these neurons effectively erases the target concepts while preserving the model's ability to generate unrelated content. The authors demonstrate the efficacy of ConceptPrune across various concepts, including artistic styles, nudity, object erasure, and gender biases, showing that pruning approximately 0.12% of the model's weights suffices. Additionally, the method exhibits robustness against both white-box and black-box adversarial attacks aimed at circumventing concept removal.
weaknesses: 1. The method seems relatively straightforward and may be considered incremental in light of existing works [1,2] that also employ pruning techniques for unlearning in diffusion models. It would strengthen the contribution of the paper to clearly delineate the differences between the proposed approach and these related methods. Specifically, methods such as [1,3] have achieved state-of-the-art results in diffusion model unlearning tasks. Including these methods as baselines in the experimental comparisons would provide a more comprehensive evaluation and help illustrate the effectiveness of the proposed scheme.

2. The experimental validation is conducted solely on Stable Diffusion, which may limit the generalizability of the proposed method. To address this potential limitation, it is recommended that the effectiveness of the approach be demonstrated on additional diffusion models, such as [4,5]. This would provide evidence that the method is not tightly coupled to a specific architecture and can be broadly applied to other models in the domain.

3. The choice of focusing on the second layer of the feed-forward networks (FFN-2) for pruning appears to be based on empirical observations and may depend significantly on the architecture of Stable Diffusion. Is there theoretical justification or empirical evidence supporting this selection as the optimal pruning target? Providing analytical insights or additional experiments on different architectures would help ascertain whether this observation holds true universally or is specific to the model under consideration.

4. The decision to aggregate skilled neurons over the last 10 timesteps for pruning seems somewhat arbitrary. Could the authors elaborate on the reasoning behind selecting this particular range of timesteps? It may be beneficial to reference insights from related literature [6,7] that discuss the importance of different timesteps in the denoising process. A more thorough explanation or an exploration of how varying the number of timesteps affects the results would enhance the understanding of this methodological choice.

5. The evaluation of unlearning effectiveness in the context of artistic style erasure relies on CLIP-based similarity metrics. However, CLIP-based metrics consider redundant factors, not only the style but also the object content, arrangement, etc. It is potentially confounding the assessment of style erasure alone. This approach may not effectively isolate the stylistic elements from other irrelevant factors. It is recommended to employ a dedicated style classifier for evaluation (e.g., classifier in [8]) to more accurately measure the degree of style removal. This would provide a more reliable and focused assessment of the method's effectiveness in erasing artistic styles.

> [1] Wu, Jing, and Mehrtash Harandi. "Scissorhands: Scrub Data Influence via Connection Sensitivity in Networks." arXiv preprint arXiv:2401.06187 (2024).
>
> [2] Yang, Tianyun, Juan Cao, and Chang Xu. "Pruning for Robust Concept Erasing in Diffusion Models." arXiv preprint arXiv:2405.16534 (2024).
>
> [3] Fan, Chongyu, et al. "Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation." arXiv preprint arXiv:2310.12508 (2023).
>
> [4] Podell, Dustin, et al. "Sdxl: Improving latent diffusion models for high-resolution image synthesis." arXiv preprint arXiv:2307.01952 (2023).
>
> [5] Saharia, Chitwan, et al. "Photorealistic text-to-image diffusion models with deep language understanding." Advances in neural information processing systems 35 (2022): 36479-36494.
>
> [6] Balaji, Yogesh, et al. "ediff-i: Text-to-image diffusion models with an ensemble of expert denoisers." arXiv preprint arXiv:2211.01324 (2022).
>
> [7] Georgiev, Kristian, et al. "The journey, not the destination: How data guides diffusion models." arXiv preprint arXiv:2312.06205 (2023).
>
> [8] Zhang, Yihua, et al. "Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models." arXiv preprint arXiv:2402.11846 (2024).

---

confidence: 5
contribution: 3
initial_rating: 6
presentation: 3
questions: In Table 5, the FID metric is missing, and the performance of the base model (SD) should be included for greater clarity.
soundness: 3
strengths: 1. The experiments cover all diffusion model unlearning tasks, including artistic styles, nudity, and specific objects.
2. Consider ASR against different attacks while simultaneously evaluating FID and CLIP score to assess model utility.
3. The proposed method requires no additional training.
summary: To prevent the misuse of text-to-image diffusion models, this paper proposes a training-free approach using weight pruning for unlearning undesired concepts, such as artistic styles, nudity, and specific objects.
weaknesses: 1. The chosen diffusion model baselines are weak and not state-of-the-art methods, so the comparison does not effectively demonstrate true superiority. To defend against adversarial prompt attacks, a stronger baseline, such as AdvUnlearn [1], should be considered.
2. More visualization examples are needed, as the current version only includes visualizations for the style unlearning task.

[1]  Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models, NeurIPS’24

---

confidence: 4
contribution: 2
initial_rating: 6
presentation: 3
questions: 1. Could you please add discussions on the recent SOTA methods and relevant baselines as highlighted in the weaknesses section?

2. How did you determine the optimal pruning ratio for skilled neurons? Please describe the considerations or criteria used in selecting a suitable pruning ratio.
soundness: 3
strengths: Strengths:
- The investigation into how specific weights influence certain abilities in text-to-image (T2I) models is intriguing and provides valuable insights into the inner workings of these models.
- The paper presents extensive experiments demonstrating the effectiveness of the proposed method across various editing targets, including nudity, artistic style, and specific objects.
- Additionally, the paper is well-structured with a clear logical flow, making it easy to follow and understand.
summary: The paper introduces ConceptPrune, a method for editing concepts in pre-trained diffusion models by pruning neurons associated with undesired concepts, like specific artistic styles, nudity, and biases. This approach identifies "skilled neurons" within diffusion models, such as Stable Diffusion, that activate in response to specific target concepts. By selectively pruning these neurons, the method effectively removes the unwanted concepts without the need for extensive fine-tuning, maintaining the model's overall performance on unrelated tasks. ConceptPrune demonstrates significant resistance to both black-box and white-box adversarial attacks, showing promise as a scalable and robust approach to safer model deployment.
weaknesses: - **Limited Comparison with Recent SOTA Methods**: The paper lacks sufficient discussion and comparison with recent state-of-the-art methods. For instance, [1] appears to be a strong baseline, demonstrating both high robustness in concept erasure and good utility preservation. While it’s acceptable if this paper does not outperform [1], it would be beneficial to include [1] as a baseline and discuss potential improvements for the current approach in light of their findings.

- **Insufficient Discussion on Related Concept Pruning Work**: The paper lacks sufficient background on concept pruning and similar work. Several studies ([2, 3, 4]) have explored the relationship between weight importance and model abilities during unlearning and editing tasks. Incorporating these works would help situate this paper within the broader landscape and highlight how ConceptPrune builds on or differs from these existing approaches.

[1] Zhang, Yimeng, et al. "Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models." arXiv preprint arXiv:2405.15234 (2024).
[2] Fan, Chongyu, et al. "Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation." arXiv preprint arXiv:2310.12508 (2023).
[3] Wu, Jing, and Mehrtash Harandi. "Scissorhands: Scrub Data Influence via Connection Sensitivity in Networks." arXiv preprint arXiv:2401.06187 (2024).
[4] Foster, Jack, Stefan Schoepf, and Alexandra Brintrup. "Fast machine unlearning without retraining through selective synaptic dampening." Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 11. 2024.

---

confidence: 5
contribution: 2
initial_rating: 3
presentation: 2
questions: 1. Could the authors add more baselines by comparing their method with recently published machine unlearning methods in diffusion models?

2. Could the authors include experiments on the robustness of machine unlearning? Specifically, experiments involving adversarial prompts or similar robustness tests would be valuable.
soundness: 3
strengths: 1. The paper is clearly written and well-structured. 
2. It offers an innovative approach to unlearning by employing model pruning techniques.
summary: This paper addresses the risks of large-scale text-to-image diffusion models, including misuse for unsafe content, copyright violations, and bias perpetuation. Traditional methods for removing undesired concepts from these models often require intensive fine-tuning or token remapping, which remain vulnerable to adversarial jailbreaks. To tackle these issues, the authors propose ConceptPrune, a training-free approach that locates key regions in pre-trained models linked to unwanted concepts and applies weight pruning for efficient concept unlearning. Experiments show ConceptPrune effectively erases specific styles, nudity, and objects by pruning only 0.12% of weights, allowing multi-concept removal with resilience to adversarial attacks.
weaknesses: 1. There is a lack of adequate baselines. The authors only compare their method to a few early baselines in machine unlearning within diffusion models. As far as I know, many more effective methods have emerged recently, but these were not included in the comparison.

2. The robustness of the method is insufficiently studied. According to recent research, machine unlearning can be vulnerable to adversarial prompts. Without a robust evaluation, it remains unclear whether pruning-based unlearning is indeed resilient against such attacks.

Meta-review: The authors provided a detailed response that most reviewers found useful, as it partially or mostly addressed their concerns. Reviewer uDZE, who gave the lowest rating, did not actively participate in the discussion phase. The remaining reviewers maintained a positive stance on this submission. I agree that the paper's strengths significantly outweigh its weaknesses, and I therefore recommend acceptance.

Decision: Accept (Poster)