Circumventing Concept Erasure Methods For Text-To-Image Generative Models
Authors: Minh Pham
Kelly O. Marshall
Niv Cohen
Govind Mittal
Chinmay Hegde
Venue: ICLR 2024 poster (2024)
Keywords: Model Editing
Diffusion Model
Concept Erasure
Primary area: generative models
TL;DR: Post hoc concept erasure in generative models provides a false sense of security.

Abstract: Text-to-image generative models can produce photo-realistic images for an extremely broad range of concepts, and their usage has proliferated widely among the general public. On the flip side, these models have numerous drawbacks, including their potential to generate images featuring sexually explicit content, mirror artistic styles without permission, or even hallucinate (or deepfake) the likenesses of celebrities. Consequently, various methods have been proposed in order to "erase" sensitive concepts from text-to-image models. In this work, we examine seven recently proposed concept erasure methods, and show that targeted concepts are not fully excised from any of these methods. Specifically, we leverage the existence of special learned word embeddings that can retrieve "erased" concepts from the sanitized models with no alterations to their weights. Our results highlight the brittleness of post hoc concept erasure methods, and call into question their use in the algorithmic toolkit for AI safety.

Published as a conference paper at ICLR 2024
CIRCUMVENTING CONCEPT ERASURE METHODS FOR TEXT-TO-IMAGE GENERATIVE MODELS
Minh Pham, Kelly O. Marshall, Niv Cohen, Govind Mittal & Chinmay Hegde New York University
(mp5847, km3888, nc3468, mittal, chi .aleyy.h@ennyue...
ABSTRACT
Text-to-image generative models can produce photo-realistic images for tremely broad range of concepts, and their usage has proliferated widely among the general public. Yet, these models have numerous drawbacks, including their potential to generate images featuring sexually explicit content, mirror artistic styles without permission, or even hallucinate (or deepfake) the likenesses of celebrities. Consequently, various methods have been proposed in order to "erase" sensitive concepts from text-to-image models. In this work, we examine seven recently proposed concept erasure methods, and show that targeted concepts are not fully excised from any of these methods. Specifically, we devise an algorithm to learn special input word embeddings that can retrieve "erased" concepts from the sanitized models with no alterations to their weights. Our results highlight the brittleness of post hoc concept erasure methods, and call into question their use in the algorithmic toolkit for Al safery.
INTRODUCTION
Motivation. Text-to-image models (Chang al., 2023 Gafni al. 2022 Ramesh al. 2021
2022, Saharia et al. 2022; Yu et al.) 2022 Rombach et al.) 2022 Xu et al. 2022) have garnered significant attention due to their exceptional ability synthesize high- qush-qulitty images based on text prompts. Such models, most prominently Stable Diffusion (SD) (Rombach et al. (2022) ) and DALL-E 2 [Ramesh et al. 2022)). have been adopted in a variety of commercial products spanning application realms ranging from digital advertising to graphics to game design. In particular, the open- sourcing of Stable Diffusion has democratized the landscape of image generation technology. This shift underlines the growing practical relevance of these models in diverse real-world applications. However, despite their burgeoning popularity, these models come with serious caveats: they have been shown to produce copyrighted, unauthorized, biased, and potentially unsafe content (Mishkin)
et al. 2022 Rando et al. 2022)
What is the best way
that text-to-image models do produce sensitive or unsafe concepts? Dataset pre-filtering (Al 2022) may present the most obvious answer. However, existing filtering procedures are imperfect and may exhibit a large proportion of false negatives. See the extensive studies reported in Birhane et al. (2021) on how LAION-400M, a common dataset used in training text-image models, contains numerous offensive image samples which persist after applying standard NSFW filters.
Even if perfect data pre-filtering were possible, substantial resources would be required retrain large models from scratch in response to issues unearthed post-training. As a result, several post hoc concept-erasune methods have emerged of late. Some advocate inference guidance (Schramowski et al. 2023 AUTOMATÍCI11) 2022). Others require fine-tuning the weights on an auxiliary subset of training data (/aandikota et al. (2023a); Heng & Soh (2023 Zhang et al. (202))). These may be categorized more practical alternatives to full model-retraining with a stripped-down version of the original training data. Many of these methods are accompanied by public releases of the weights of the "sanitized" models. Such concept erasure methods purported "to permanently remove [targeted concepts] from the weights"; moreover, they are presented as "not easy to circumvent since [the method] modifies weights" (Gandikota et al. 2023a). An array of results several test instances

---

Published as a conference paper at ICLR 2024
across use cases (object removal, artistic style forgetting, avoidance of NSFW content, avoiding likeness of specific people) seem to support the efficacy of these methods.
NSFW Concept
Art Concept
Object Concept
Original SD Medel
SD3 Model
Concept Inversion
Figure I: Concept erasure methods fail to excise concepts from text-to-image models. This figure shows results from ESD (Gandikota al. 2023a), which is variant of Stable Diffusion trained to avoid generating NSFW content, specific artist styles, and specific objects, like trucks (2nd row). We circumvent this method by generating the "erased" concepts (3rd row) by designing special prompts.
Our contributions. Our main contribution in this paper is to show that:
Post hoc concept erasure in generative models provides a false sense of security.
We investigate seven recently announced concept-erasure methods for text-to-image generative
models: (i) Erased Stable Diffusion (Gandikota et al., 2023a)), (ii) Selective Amnesia (Heng & Soh
2023), (iii) Forget-me-not (Zhang et al.) 2023). (iv) Ablating Concepts (Kumari et al.] 2023). (v)
Unified Concept Editing (Gandikota et al. 2023b), (vi) Negative Prompt (AUTOMATICII 2022).
and (vii) Safe Latent Diffusion (Schramowski et al. 2023). All of these were either published or
appeared online in the first months of 2023.
Somewhat surprisingly, show that all seven techniques can be circumvented. In all cases, the very same "concept-erased" models - with zero extra training or fine- tne-tuning- may produce the erased concept with a suitably constructed (soft) prompt. Therefore, the seemingly-safe model may still be used to produce sensitive or offensive content. Overall, our results indicate that there may be a fundamental brittleness post hoc erasure methods. and entirely new approaches for building (and evaluating) safe generative models may be necessary. See Figure T for examples.
Techniques. Our approach stems from the hypothesis that existing concept erasure methods may be, in reality, performing some form of input filtering. More specifically, in these methods. the modified generative models produced by these methods are evaluated on a limited subset of text inputs: the original offenniing/ennsiiive text, and related prompts. However, this leaves the model vulnerable to more sophisticated text prompts. In particular, we design individual Concept Inversion (CI) "attack" techniques to discover special word embeddings that can recover erased concepts when fed to the modified model. Through the application of CI, we provide evidence that these unique word embeddings outmaneuver concept erasure methods across various use cases such as facial likeness, artistic style, object-types, and NSFW concepts. Therefore, it is not the case that these concepts have been permanently removed from the model; these still persist, albeit remapped new embeddings.
Implications.
Our extensive experiments below highlight two key points:
1. Our results call into question the premise that existing erasure methods (fully) excise concepts from the model. Our results show that this premise is not correct and that the results in these previous works on concept erasure should be scrutinized carefully.
2. We call for stronger evaluation methodologies for concept erasure methods. Mcasuring the degree of concept erasure in text-to-image models is tricky, since there potentially vast number of
2

---

Published as a conference paper at ICLR 2024
prompts that motivated (and moderately well-equipped) attacker step to mitigate this issue, we recommend evaluating models in terms of our CI attacks during evaluation, and not merely limited to evaluating mild variations of the original text prompts.
inputs. As first
Overall, our findings shine a spotlight on the considerable challenges in sanitizing already trained generative Al models (such as Stable Diffusion) and making them safe for wide public use.
2 BACKGROUND
Denoising Diffusion Models. Diffusion models belong to category of generative models that sample from distribution via an iterative Markov-based denoising process (Sohl-Dickstein et al. 2013 Ho et al. 2020 The process begins with sampled Gaussian noise vector, denoted as 2y, and undergoes a series of T denoising steps to ultimately restore the final data, referred to as 2g. In practical applications, the diffusion model is trained to predict the noise e, each timestep, 4, utilized to generate the progressively denoised image, Tt. Latent diffusion models (L.M) (Rombach et al.) 2022) offer improved efficiency by operating in a lower dimensional space learned by an autoencoder. The first component of LDM consists of an encoder & and a decoder D that have been pre-trained on large collection of images. During the training of LDM, for an image æ, the encoder learns to map into a spatial latent code
(x). The decoder maps such latent codes back to the original images such that (x)) = x. The second component is a diffusion model trained to produce codes within the learned latent space. Given conditional input c, the LDM is trained using the following
objective function:
C -eE=--(( [Ie--c(fe
c, c, 1)
Here 2, is the latent code for time I, and Ep is the denoising network. At inference time, a random noise tensor sampled and gradually denoised to produce a latent Eg. which is then transformed into an image through the pre-trained decoder such that x' D(2)).
Ho & Salimans 2022) propose a classifier-free guidance technique is used during inference and requires that the model be jointly trained on both conditional and unconditional denoising. The unconditional and conditional scores are used to create the final latent 2g- There, we start with 2T ~ (0, 1) which is transformed to obtain éo (2e, t) eg c2(2,,) + a(Es(2t, =0(2,, to get -1 This process is repeated sequentially until 2g is produced.
Machine Unlearning. The conventional goal in machine learning is to foster generalization while minimizing reliance on direct memorization. However, contemporary large-scale models possess the capacity for explicit memorization, whether employed intentionally or an inadvertent byprod- uct (Carlini et al. 2023; Somepalli et al. (023b a). The possibility of such memorization has led to the development of many works in machine unlearning (Golatkar et al., 2020a b), the core aim of which is to refine the model to behave as though a specific set of training data was never presented.
Mitigating Undesirable Image Generation. Numerous methods have been proposed to discourage the creation of undesirable images by generative models. One initial approach is to exclude certain subsets of the training data. However, this solution can necessitate the retraining of sarle models from scratch, which can be prohibitive. An alternative put forward by Schramowski et al.] (2023): AUTOMATIC1111 (2022) involves manipulating the inference process in a way that steers the final output away from the target concepts. Yet another approach employs classifiers to alter the output (Rando et al. 2022: Al 2022; Bedapudi 2022). Since inference guiding methods can be evaded with sufficient access to model parameters (SmithMano) 2022), subsequent works (Gandikotal et al. 2023a Heng & Soh 2023 Zhang et al. 2023] Kumari et al. [003] Gandikota et al. (023b) suggest fine-tuning Stable Diffusion models. Qu et al. (2023) study the capability of generating
unsafe images and hateful memes of various text-to-image models.
Diffusion- Inversion. Image manipulation with generative networks often requires inversion (Zhu et al. 2016 Xia et al. 2021). the process of finding a latent representation that corresponds to given image. For diffusion models, (Dhariwal Nichol 2021) demonstrate that the DDIM (Song
et al. 2021) sampling process be inverted in closed form manner, extracting a latent noise map that will produce a given real image. More recent works (Ruiz et al.) 2023)] Gal et al. 2023 Shi et al.)
2023
Han et al. 2023) try invert user-provided concept to pseudo-word in the model's
3

---

Published as a conference paper at ICLR 2024
vocabulary. The most relevant approach for our work is Textual Inversion (Gal et al. 2023 which learns to capture the user user-provided concept by representing it through new "words" " in the embedding space of frozen text-to-image model without changing the model weights. In particular, the authors designate a placeholder string, C.. to represent the new concept the user wishes to learn. They replace the vector associated with the tokenized string with learned embedding v., in essence "injecting" the concept into the model vocabulary. The technique is referred to as Textual Inversion and consists of finding an approximate solution to the following optimization problem:
arg min
[lle Eo (zc, C+, 1)
v
PRELIMINARIES
Basic setup and threat model. For the remainder of the paper, we will leverage inversion techniques to design an "attack" on concept-erased models. We assume the adversary has: (1) access to the weights and components of the erased model, (2) knowledge of the erasure method, (3) access to example images with the targeted concept (say via an image search engine), and (4) moderately significant computational power.
trivial approach to "un-erase" an erased concept would be via fine-tuning a sanitized model on sufficiently many example images. Therefore, we also assume that: (5) the adversary cannot modify the weights of the erased model.
To show that our CI attack is reliable tool for establishing the existence of concepts in model, we conduct two experiments to investigate whether Textual Inversion (TI) by itself can generate a concept that the model has not captured during training. If TI can hallucinate totally novel concepts, then even data filtering before training might not be able to avoid producing harnful/copyrighted content. In the first experiment, we compare TI performance on concepts that are better represented in the training data of Stable Diffusion 1.4, versus those that are likely not present. In the second experiment, we conducted a more controlled study by training two diffusion models on MNIST (LeCun al., 2010) from scratch. We include all the training classes in the first run and exclude one class in the second run. In both experiments, we find that Textual Inversion works significantly worse when the concept is not well represented in the training set of the generative model. See Figure 15 in the Appendix.
4 CIRCUMVENTING CONCEPT ERASURE
4.1 EXPERIMENTAL. SETUP
In this section, examine seven (7) different concept crasure methods. To the best of our knowledge, this list constitutes all the concept crasure methods for Stable Diffusion models published up to September 19, 2023. We design CI procedures tailored to each erasure method that search the space of word embeddings to recreate the (purportedly) erased visual concepts. Importantly, our approach relies solely on the existing components of the post-erasure diffusion models. For these experiments, wherever possible we use the pre-trained models released by the authors unless explicitly stated otherwise; for concepts where erased models were not publicly available, we used public code released as-is by the authors to reproduce their erasure procedure. In each subsection, we start by describing the approach, then show how attack their approach using Concept Inversion. We interleave these with results, and reflect on their implications. Finally, we show evidence that current concept erasure methods are likely performing input filtering, and demonstrate transferability of the learned word embeddings.
Due to page limit constraints, we will focus on results for two fine-tuning- -based methods (ESD, UCE) as well as two siirence-guiding--eee methods (NP, SLD). We refer readers to the full set of results for all seven models in Appendix C
4.2 EVALUATION PROTOCOL
For each concept erasure method that we will be discussing below, we initially deploy it to erase 4 concept categories including art style, object, ID, and NSEW content. We use Stable Diffusion
Our code is available for reproducibility purposes at
github. 1o/CCK/
4

---

Published as a conference paper at ICLR 2024
1.4 (SD 1.4) for all experiments. We assume that the adversary can access small number of examples of the targeted concept from Google Images; see Appendix for details.
Art style: We select 6 styles from modern artists and artistic topics that have been reported to have been captured by SD 1.4: the movie series "Ajin: Demi Human", Thomas Kinkade, Tyler Edlin, Van Gogh, Kelly McKernan, and Tyler Edlin. We generate images from the erased models using the prompt "A painting in the style of [artist name]". After performing CI, we generate images by replacing [artist name] with c, - the special placeholder string associated with the learned word embedding. In addition to qualitative results, we follow Gandikota et al. (2023a) and conduct a human study to measure the effectiveness of our CI methods. particular, for each artist, we collect 10 images of art created by those artists from Google Images. We then generate 10 images from the erased model using the standard concept name, and 10 images using CI per style and per concept erasure method. Participants were shown 5 real reference images from the same artist and another image of the same style (either real, from the erased model or from CT), They were then asked to estimate, on five-point Likert scale, their confidence level that the experimental image has the same style as the reference images. Our study consists of 50 participants, with responses per participant.
Following Gandikota et al. 2023a), investigate the Imagenette (Howard 2019) dataset which comprises ten easily identifiable classes (cassette player, chain saw, church, etc.) We evaluate CI methods by examining the top-1 predictions of ResNet-50 Imagenet classifier on 500 generated images. We generate images from the erased models using the prompt "A photo of [object name]". For CI, generate images by replacing [object name] with the special string C.
Objects:
ID: Following Heng & Soh 2023), we select "Brad Pitt" and "Angelina Jolie" as identity concepts. We then utilize the GIPHY celebrity detector (Giphy) (020) for Concept Inversion evaluation. We generate 500 images from the erased models using the prompt "A photo of a [person name]". For CI, we generate the same number of images by replacing [person name] with the special placeholder string C..
NSFW content: Introduced by Schramowski al. (2023). the I2P dataset comprises 4703 unique prompts with corresponding seeds, which (to date) is the definitive benchmark for measuring the effectiveness of NSFW concept erasure. This process involves generating images using the prompts and seeds and subsequently utilizing NudeNet (Bedapudi) (022) to classify the images into various nudity classes. The I2P benchmark effective as prompts do not necessarily contain words strictly related nudity. Hence, effective erasure method on this benchmark requires some degree of robustness to prompt selection. To evaluate each concept erasure method, we first used SD 1.4 to generate 4703 images using the I2P dataset. We used NudeNet to filter out 382 images with detected exposed body parts, on which we performed Concept Inversion. To measure how well the NSFW concept is recovered, we generated another 4703 images using the erased model by using the I2P prompts with the special placeholder string c, prepended, which are then evaluated by NudeNet.
I
01
Figure 2: Quantitative results of Concept Inversion for artistic concept: Our human study ratings (with + 95% confidence intervals) show that we can recover the erased artistic concept across all models. The CI Likert score is even higher than the images generated by SD 1.4.
4.2.1 ERASED STABLE DIFFUSION (ESD)
Concept Erasure Method Details. Gandikota et al. (2023a) fine-tune the pre-trained diffusion U-Net model weights to remove specific style concept. The authors reduce the probability of
5

---

Published as a conference paper at ICLR 2024
Real
SD 1.
ESD
ESD (CI)
UCB
UCE (CT)
NP
NP (C)
SLD-Med
SLD-Med (CD
Themis
Nin Gogg
Figure 3: Qualitative results of Concept Inversion for artistic concept: Columns 4, 6, 8, and 10 demonstrate the effectiveness of concept erasure methods in not generating the targeted artistic concepts. However, we can still generate images of the erased styles using CI.
Table Quantitative results of Concept Inversion for object concept (Acc. % of erased model / Acc. % of CI): Concept erasure methods can cleanly erase many object concepts from SD 1.4, evidenced by significant drop in classification accuracy. Using Concept Inversion, we can generate images of the erased objects, which can be seen by an increase in average accuracy across all methods.
SD 1.4
ESD
UCE
NP
SLD
cassette player
6.4
0.2/6.2
0.072.8
4.0994
1.02.4
chain saw
68.6
0.0/ 64.0
0.0/43.6
4.0 82.8
08/ 86.6
church
79.6
0.8/87.4
10.0/825 82.2
78.4/784
20.6/ 72.0
english springer
93.6
0.2/48.2
0.0/ 69.6
27.0/90.4
24.6/
french
99.3
0.0/81.6
0.499944
62.499900
17.0/976
gurbage truck
83.2
5.8/57.0
16.4
39.48446
19.8
gas pamp
76.6
0.0/73.8
0.0/73.0
18.0/79.6
12.8 75.6
golf hall
96.2
45.2/88.4
parachute
96.2
0.0/94.2
1.6/442
32.8/77.2
52.8/5588
lench
79.6
0.37
0.0/
27.6/
20.6/ 75.4
Average
77.9
28.6/76.2
23.07
generating an image æ based the likelihood described by the textual description of the concept, Pa(x)
Le. Pg-(x) x Pa(c|æ)) where is the updated weights of the diffusion model (U-Net), is the
original weights, 7 is scale power factor, is the target concept to erase, and P(x) represents distribution generated by the original model. Based on Tweedie's 's formula (Efron (201 and the reparametrization trick (Ho al. (2200). the authors derive denoising prediction problem as cg- (It, c, t) + c( t) 77 (Zz, c, t) c0(x,, t)]. By optimizing this equation, the fine-tuned model's conditional prediction steered away from the erased concept when prompted with it. The authors propose two variants ESD: ESD-r and FSD-u, which finetune the cross-attentions and unconditional layers (non-cross-attention modules) respectively.
Concept Inversion Method. We employ standard Textual Inversion on fine-tuned Stable Diffusion models from Gandikota et al. (2023a) learn a new word embedding that corresponds to the concept of the training images. The authors provide pre-trained ESD-z models for all 6 artistic concepts, the pre-trained ESD-u model for NSFW content concept, and training scripts for object concepts. For ID concepts, we train our own ESD-u models prior to CI.
4.2.2 UNIFIED CONCEPT EDITING (UCE)
Concept Erasure Method Details. Latent diffusion models (Rombach et al. 2022 operate on low- dimensional embedding that is modeled with U-Net generation network. The model incorporates conditioned textual information via embeddings derived from a language model. These embeddings are introduced into the system via cross-attention layers. Inspired by Orgad al. (2023) and [Meng et al. (2023). Gandikota et al. (2033b) edit the U-Net of Stable Diffusion models without training using a closed-form solution conditioned on cross-attention outputs. They update attention weights to induce targeted changes to the keys/values that correspond to specific text embeddings for set of edited concepts, while minimizing changes to a set of preserved concepts.
Concept Inversion Method. We employ standard Textual Inversion (Gal et al. 2023) fine-tuned Stable Diffusion models from UCE (Gandikota et al.] 2023b) to learn a new word embedding that corresponds the (identity) concept of the training images. Gandikota et al. 2023h) provide training

---

Published as a conference paper at ICLR 2024
SD 1.4
FSD
ESD (CD
UCF
UCE
NP
NP (C)
SED-Mel
SID-MadiCC
Angeltaa
Jele
Brad
Pint
Figure 4: Qualitative results of Concept Inversion for ID concept: Columns 3, 7, and demonstrate the effectiveness of concept erasure methods in not generating Brad Pitt and Angelina Jolie. However, we can still generate images of the erased IDs using CI.
SD 1.4 ESD
CC SD 1.4 UCE
CCI SD 1P
CcI SD 1.4 MSLD-Md
10a
10a
10a
10
Count
10a
Couitz
102
Count
10
101
10
10
104
100
100
Fraads Beowe
Froude
Froade
(a) Erased Stable Diffusion
(a) Unified Concept Editing
(a) Negative Prompt
[a) Safe Latent Diffusion
Figure 5: Quantitative results of Concept Inversion for NSFW concept: On average, the number of detected body parts from SD 1.4 and the erased models 99.75 (across 4703 images) and 26. (across 4703 images and 7 erasure methods), respectively. Using CI, the average number of detected body parts is 170.93 across 7 methods.
scripts to reproduce their art style, object, and NSFW content concepts. For ID concepts, we adapt their publicly posted code to train our own models.
4.2.3 NEGATIVE PROMPT (NP)
Concept Erasure Method Details. Negative Prompt (NP) is guiding inference technique used in the Stable Diffusion community (AUTOMATICTIT) 2022). Instead of updating the weights of the original model, it replaces the unconditional score with the score estimate conditioned on the erased concept in classifier-free guidance. Gandikota et al. (2023a) illustrate how NP can prevent the image generation of targeted artistic concepts.
Concept Inversion Method. In our experiments, vanilla Textual Inversion was not able to circum- vent NP. We modify the objective function for Textual Inversion to:
v. = arg argmin
[[(,)((),)) + alco(2t, c, t)(
- (ca(2e,, alco(Et, c) - ca(ze, 0))
where e is the target concept. Our method learns a word embedding associated with the special string such that the predicted noise from NP equals the true predicted noise using classifier-fres guidance.
4.2.4 SAFE LATENT DIFFUSION (SLD)
Concept Erasure Method Details. Safe Latent Diffusion (Schramowski et al. 2023) is inference guiding method that is a more sophisticated version of NP, where the second unconditional score term is replaced with safety guidance term. Instead of being constant like NP, this term is dependent on: (1) the timestep, and (2) the distance between the conditional score of the given prompt and the conditional score of the target concept at that timestep. In particular, SLD modifies the score
7

---

Published as a conference paper at ICLR 2024
estimates during inference (I c,t) co(2t, + plle( co( 122,, e, es)]. We refer the reader to the Appendix C and the original work by Schramowski et al. (2023) for a more detailed explanation of (2,, C, Cg). Note that SLD does not modily the weights of the original diffusion models, but only adjusts the sampling process. By varying the hyperparameters of the safety guidance term, the authors propose 4 variants of SLD: SLD- Deak, SLD-Medium, SLD-Strong, and SLD-Max. A more potent variant of SLD yields greater success in erasing undesirable concepts.
Concept Inversion Method. In our experimentation, we encountered an issue akin to the one with Negative Prompt when applying vanilla Textual Inversion. Furthermore, the guidance term of SLD at timestep depends on that at the previous timestep. This recursive dependency implies that in order to calculate the guidance term within our inversion algorithm, it becomes necessary to keep record of the preceding terms for optimization purposes. Given the high number denoising steps involved, such process could result in significant memory usage, presenting an efficiency problem. To address this issue, we propose a new strategy to perform Concept Inversion. Instead of having a constant safety guidance term, SLD requires storing all the guidance terms from step I to step 1 to calculate the one at timestep L. Since doing so will be memory-intensive, we instead approximate by calculating only a subset of guidance terms at evenly spaced timesteps between and t. We can then learn a word embedding that counteracts the influence of the safety guidance term. The pseudocode for our CI scheme can be found in Appendix
SD 1.4
ESD
ESD (CD
UCB
(CI
NP
NP (CI)
SLD-Med
SLD Med (CD
clvin sooW
Figure 6: Qualitative results of Concept Inversion for object concept: Columns 3, 5, 7, and 9 demonstrate the effectiveness of concept erasure methods in not generating the targeted object concepts. However, we can still generate images of the object using CI. We refer the readers to the Appendix for the complete results all object classes.
Table 3: Quantitative results of Concept Inversion for ID concept (Acc. % of erased model / Acc. % of CT): Concept erasure methods can cleanly erase images of Brad Pitt and Angelina Jolie from SD 1.4, evidenced by a significant drop classification accuracy. CI can recover images of the erased IDs, which can be seen by an increase in average accuracy across all methods.
SD 1.4
FSD
UCF
NP
SLD-
Brad Pit
90.2
0.0/61.2
0.0/59.4
43.2/71.4
48/71.8
Angelina Jolie
91.6
0.8 60.1
0.0 65.2
46.2/75.2
5,2/7288
Average
90.9
60.7
0.0 62.3
44.7/73.2
5.0/72.3
4.3 RESULTS AND DISCUSSION
On the plus side, our experiments confirm that whenever the target concept is explicitly mentioned in the input prompt, all sevem concept erasure methods are effective. Therefore, these methods can indeed provide protection against caviiousy-oofensiii text inputs. We confirm this even for concept categories that the methods did not explore in their corresponding publications. However, on the minus side, all seven methods can be fully cireumvented using our CI attacks. In other words, these crasure methods are only effective against their chosen inputs.
For artistic concepts, our human study in Figure 2 shows an average (across all methods) score of 1.31 on Likert rating on images generated by the erased model. This score expectedly increases to 3.85 when Concept Inversion is applied. Figure 3 displays images generated from the erased model and CI Aude-by-sid bi-s,de which shows that CI is effective in recovering the erased style. For object concepts, the average accuracy across all methods of the pre-trained classifier in predicting the erased concept
8

---

Published as a conference paper at ICLR 2024
increases from 13.68 to 68.8 using our attack (Table I. This is supported by qualitative results shown in Figure 6 For ID concepts, the average accuracy across all methods of the GIPHY detector increases from 12.52 to 67.13 in Table For NSFW concepts, Figure [] Jugggests that CI can recover the NSFW concept, which is shown by an increase from 26.2 to 170.93 in the average number of detected exposed body parts.
Among the 7 concept erasure methods, the most challenging one to circumvent is SLD. Our Concept Inversion technique manages to counteract the influence of SLD-Weak, SLD-Medium, and even SLD- Strong under most circumstances. Among the variants, SLD-Max proves to be the most challenging to cireumvent. However, this variant comes with a drawback: has the potential to entirely transform the visual semantics of the generated images. We provide several more results of variants of SLD in the Appendix C our proposed CI scheme for SLDD, we observed that more GPU memory can give us better approximations of the safety guidance terms and therefore counteract their influence.
4.4 TRANSFERABILIT AND USEABILITY OF OUR ATTACKS
Intriguingly. we show that the learned special tokens derived from CI can be applied to the original SD 1.4 model to generate images of the erased concept. Figure 7 demonstrates results. This lends further evidence that current concept crasure methods are merely suppressing the generation of the targeted concept when conditioned on the input embeddings corresponding to the concept text. However, there exist word embeddings that trigger the generation of the erased concept in SD 1.4 that also work on the erased model. This means that some degree of input filtering is occurring. Additionally, we provide evidence that the learned word embeddings through CI are useable in practice. Following Gal et al. (2023) and study the reconstruction effectiveness and editability of these embeddings. In particular, we generate two sets of images using CI with each concept erasure method: first, a set of generated images using the inverted concept; second, a set of generated images of the inverted concept in different scenes. We evaluate using CLIIP (Radford et al.) 2 how well the inverted concepts are produced with the erased models, and how transferable are they to different scenes. In both cases, the erased models achieve performance similar to that of the original
model, pointing to the models are in principle still being able to produce the seemingly erased concepts.
Recostrucion
Editability
FMN MC
FMN NP
PMN
SA
SLD-Med
83
E3D
S1.5
SD
SD
0.7 0.72 0.74
0.18
0.2
0.22
Figure 7: (Left) Reconstruction: A higher score indicates better ability to replicate the provided concept. (Middle) Editability: A higher score indicates a better ability to modify the concepts using textual prompts. (Right) Transferability of learned word embeddings: The original SD model can use the learned word embeddings from the erased model (with Van Gogh style as the erased concept) to generate images of the targeted concept.
5 CONCLUSIONS
As text-to-ine toxt-to-image generative AI models continue to gain popularity and usage among the public, issues surrounding the ability to generate proprietary, sensitive, or unsafe images come to the fore. Numerous methods have been proposed in the recent past that claim to erase target concepts from trained generative models, and ostensibly make them safe(r) for public consumption. In this paper, we take step back and scrutinize these claims. We show that post-hoc erasure methods have not excised the targeted concepts; fairly straightforward "attack" procedures can be used to design special prompts that regenerate the unsafe outputs.
As future work, it might be necessary to fundamentally analyze why the "input filtering" phenomenon seems to be occurring in all these recent methods, despite the diversity of algorithmic techniques involved in each of them. Such an understanding could facilitate the design of better methods that improve both the effectiveness and robustness of concept erasure.

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
The authors were partially supported by the Al Research Institutes Program supported by NSF and USDA-NIFA under grant no. 2021-67021-35329, KM was supported by DoE GAANN fellowship. NC was partially supported by the Israeli data science scholarship for outstanding postdoctoral fellows (VATAT).
REFERENCES
Stability AL. Stable diffusion 2.0 release, 2022. URL pttps://stabllity.all//a
Jul 9, 2023.
AUTOMATICI1I]. Negative prompt, 2022. http:::ggtttuu..oooo
http://hwhh....oo//ATTMMAIIIII11 stable diffusion webuu//wwii/eggtiieeeee..... prompt
Romain Beaumont. Clip retrieval: Easily compute clip embeddings and build a clip retrieval system with them. htttp:://gituub.commm rot::/oommlommommmm/m//mm http:///c.o/oooomm///////lereeee
2022.
Praneeth Bedapudi. Nudenet: Neural nets for nudity detection and censoring, 2022. URL https
//github. ctw.uu...co//ttttttec.... Nauccch/NuNee//////
Abeba Birhane, Vinay Uday Prabhu, and Emmanuel Kahembwe. Multimodal datasets: misogyny, pornography, and malignant stereotypes. CoRR, abs/21 10.01963, 2021.
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. CoRR, abs/2301.13188, 2023.
Huiwen Chang, Han Zhang, Jarred Barber, Aaron Maschinot, José Lezama, Lu Jiang, Ming-Hsuan Yang, Kevin Murphy, William T. Freeman, Michael Rubinstein, Yuanzhen Li. and Dilip Krishnan. Muse: Text-to-image generation via masked generative transformers. CoRR, abs/2301.00704 2023.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems, 2021.
Bradley Efron. Tweedie's 's formula and selection bias. Journal of the American Statistical Association, 106(496);1602-1614, 2011. ISSN 0162-1459.
Oran Gafni, Adam Polyak, Oron Ashual, Shelly Sheynin, Devi Parikh, and Yaniv Taigman. Make- a-scene: Scene-based text-to-image generation with human priors. In European Conference on Computer Vision, 2022.
Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit Haim Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing toxt-to-imagee generation using textual inversion. In International Conference on Learning Representations, 2023.
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. In International Conference on Computer Vision, 2023a.
Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzynska, and David Bau. Unified concept editing in diffusion models. CoRR, abs/2308.14777 2023b.
Giphy. Giphy celebrity detector, 2020.
URL
https: https:://github.ccm///ap
celeb- detection-oss
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Conference on Computer Vision and Pattern Recognition, 2020a.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. In European Conference on Computer Vision, 2020b.
10

---

Published as a conference paper at ICLR 2024
Ligong Han, Yinxiao Li, Han Zhang, Peyman Milanfar, Dimitris Metaxas, and Feng Yang. Svdiff: Compact parameter space for diffusion fine-tuning, International Conference on Computer Vision, 2023.
Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. CoRR, abs/2305. 2023.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In Advances in Neural Information Processing Systems Workshop, 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, 2020.
Jeremy Howard. Imagenette, 2019. URL http:///////ttaaa.ccc////aaaaaae
James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A. Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka BaabskkaBara,skk, Demis Hassabis, Claudia Clopath, Dharshan Kumaran, and Raia Hadsell. Overcoming catastrophic forgetring in neural networks. Proceedings of the National Academy of Sciences, 114(13)3351--352, 2017.
Nupur Kumari, Bingliang Zhang, Sheng- Yu Wang, Eli Shechtman, Richard Zhang, and Jun- Yan Zhu. Ablating concepts in text-to-image diffusion models. In International Conference on Computer Vision, 2023.
Yann LeCun, Corinna Cortes, and Christopher J.C. Burges. Mnist handwritten digit database. ATT Labs [Online]. Available: http://yann. http://anm.lecunn.cm//// www.ll/wwww..ooee//nniniiie 2, 2010.
Kevin Meng, Arnab Sen Sharma, Alex J. Andonian, Yonatan Belinkov, and David Bau. Mass-editing
memory in a transformer. In International Conference on Learning Representations, 2023.
Pamela Mishkin, Lama Ahmad, Miles Brundage, Gretchen Krueger, and Girish Sas-
try. Dall-e 2 preview risks and limitations, 2022. URL https://github
com/
hamn/openai/dalln
(https:
cartee-aadd...m md)
Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov. Editing implicit assumptions in text-to-image diffusion models. International Conference on Computer Vision, 2023.
Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In ACM Conference on Computer and Communications Security, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh. Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning. 2021.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International Conference on Machine Learning. 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with CLIP latents. CoRR, abs/2204.06122. 2022.
Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tramèr. Red-teaming the stable diffusion safety filter. In Advances in Neural Information Processing Systems Workshop, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Conference on Computer Vision and Pattern Recognition, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning to-agge- diffusion models for subject-driven generation. In Confer- ence on Computer Vision and Pattern Recognition, 2023.

---

Published as a conference paper at ICLR 2024
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Seyed Kam- yar Seyed Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-image diffusion models with deep language understanding. In Advances in Neural Information Processing Systems, 2022.
Patrick Schramowski, Manuel Brack, Björn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating mapproppiate degeneration in diffusion models. In Conference on Computer Vision and Pattern Recognition, 2023.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. LAION-5B: an open large-scale dataset for training next generation image-text models. in Neural Information Processing Systems, 2022.
models... In Advances
Jing Shi, Wei Xiong, Zhe Lin, and Hyun Joon Jung. Instantbooth: Personalized text-to-image generation without test-time finetuning. CoRR, abs/2304.03411, 2023.
Hanul Shin, Jung Kwon Lee, Jaehong Kim, and Jiwon Kim. Continual learning with deep generative replay. In Advances in Neural Information Processing Systems, 2017.
SmithMano. Tutorial:
How to remove the safety filter in seconds, 2022.
URL
https: / /wwww rwwdiedddcteooo com wwtedii...co///ffaaaaaaeffiiiioa
http://fss.ooooommmm/////////// Eutorial how_hottttt___o_oooeooe___eeeh hww:_tt__reoveeeee www.rreeeeeeeeaateeeeoeoeee
Jascha Sohl-Dickstein. Eric A. Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised
learning using nonequilibrium thermodynamics. International Conference on Machine Learning Workshop, 2015.
Gowthami
Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Conference on Computer Vision and Pattern Recognition, 2023a.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Understand- ing and mitigating copying in diffusion models. In Advances in Neural Information Processing Systems, 2023b.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- lional Conference on Learning Representations, 2021.
Weihao Xia, Yulun Zhang, Yujiu Yang, Jing-Hao Xue, Bolei Zhou, and Ming-Hsuan Yang. GAN inversion: survey. CoRR, abs/2101.05278, 2021.
Xingqian Xu, Zhangyang Wang, Eric Zhang, Kai Wang, and Humphrey Shi. Versatile diffusion: Text, images and variations all in one diffusion model. CoRR, abs/2211. 1.08332, 2022.
Jiahui Yu, Yuanzhong Xu, Jing Yu Koh, Thang Luong, Gunjan Baid, Zirui Wang, Vijay Vasudevan, Alexander Ku, Yinfei Yang, Burcu Karagol Ayan, Ben Hutchinson, Wei Han, Zarana Parekh, Xin Li, Han Zhang, Jason Baldridge, and Yonghui Wu. Scaling autoregressive models for content-rich text-to-image generation. Transactions on Machine Learning Research, 2022.
Eric Zhang. Kai Wang. Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. CoRR, abs/2303. 11.2303..199.,... 17591, 2023.
Jun-Yan Zhu, Philipp Krähenbühl, Eli Shechtman, and Alexei A. Efros. Generative visual manipula- tion on the natural image manifold. In European Conference on Computer Vision, 2016.
12

---

Published as a conference paper at ICLR 2024
APPENDIX
A LIMITATIONS AND DISCUSSION
The attack scenario described in Section is closer the white-box setting. However, despite limited practicality, our attacks offers valuable insights into the intrinsic limitations and behaviors of current concept erasure methods. Our experimental results suggest that input-filtering is occurring among concept crasure methods. Let be the observed data, i.c. the images containing the concept wish to crase, and be the weights of our conditional generative model. From a likelihood-basee based perspective, believe current erasure methods minimizing the conditional probability Po azly) for only certain inputs y. In order to make the generative model more robust, we may want to directly minimize the marginal probability Pa(=)) which is unfortunately intractable calculate in practice. One possible solution is to perform adversarial training and minimize probability conditioned on the adversarial inputs. Nevertheless, it is also crucial maintain the overall generative performance of the model on unrelated concepts. For instance, Figure 10 demonstrates that the erased models that are more robust against Concept Inversion can create artifacts or generate images not aligned with the prompt.
B TRAINING DETAILS
For the training of Concept Inversion, use samples for art style concept, 30 samples for object concept, and 25 samples for ID concept. For our Concept Inversion experiments, unless mentioned otherwise, perform training
A100 GPU with batch size of 4, and learning rate of 5e 03. We optimize the word embedding for 1,000 steps while keeping the weights of the erased models frozen. The CI training procedure the same across erasure methods and concepts, except for ID concepts we optimize for 5,000 steps, and for SLD we we train for 1,000 steps with batch size
1.
B. ERASED STABLE DIFFUSION (ESD)
For artistic concepts and NSFW concept, used the pre-trained models released by the authors. For object concepts, we trained ESD-u models using the suggested parameters by the authors. For ID concepts, trained ESD-u models using the parameters for object concepts.
B.2 UNIFIED CONCEPT EDITING (UCE)
For artistic concepts, object concepts, and NSFW concept, we trained the erased models using the training script provided by the author. For ID concepts, we used the same script without the preservation loss term.
B.3 SELECTIVE AMNESIA (SA)
For artistic concepts, generated images with photorealism style as the surrogate dataset. We then applied SA finetune the cross-attention layers of SD 1.4 for 200 epochs. We used the default parameters for training. For object concepts, used similar training procedure above but used images of kangaroos (a class in ImageNet) as the surrogate dataset. Morcover, we finetuned the unconditional layers (non-cross -attssnnttnnoion modules) of SD 1.4. For ID concepts and NSFW concept, we used the training script provided by the authors.
B.4 ABLATING CONCEPTS (AC)
For artistic concepts, we used the training scripts provided by the authors to train the erased models. For object concepts, we also used the training script provided by the authors with the anchor distribution set to images of kangaroos. For concepts, we used the training script for object concepts and set the anchor distribution to images of middle-aged aged people. For NSFW concept, used the training script for object concepts and set the anchor distribution to images of people wearing clothes.
13

---

Published as a conference paper at ICLR 2024
B.5 FORGET-ME-NON (FMN)
For artistic concepts, we employed FMN to finetune the cross-attention layers for 5 training steps with a learning rate of 4. The reference images we used are generated paintings with a photorealism style. For object concepts, we finetuned the unconditional layers (non-cross-attention modules) for 100 epochs with a learning rate of 2e 06. The reference images we used are generated photos of kangaroos. For ID concepts, rate of 2e - 06. The reference images we used are generated photos of middle-aged people. For NSFW concept, we finetuned unconditional layers for 100 epochs with learning rate of 2e 06. The reference images we used are generated photos of people wearing clothes. Since the authors do provide any training details, we tuned the number of epochs and learning rate until observed effective erasure.
finetuned the unconditional layers for 120 epochs with a learning
B.6 NEGATIVE PROMPT (NP)
To apply Negative Prompt SD 1.4, changed the negative prompt argument the concept would like to erase during inference using codebase from Hugging Face
B.7 SAFE LATENT DIFFUSION (SLD)
We used authors' public code apply SLD to Stable Diffusion 1.4. During CI, sampled 35 evenly spaced timesteps between and 1000. The range between the smallest and largest timesteps 90. We guidance scale 8y 5000, warm-up step d = O, threshold À 1.0, momentum scale 8m 0.5, and momentum beta 3m = 0.7. This is the hyperparameters for SLD-Max.
C RESULTS ON OTHER CONCEPT ERASURE METHODS
C.I SELECTIVE AMNESIA (SA)
Concept Erasure Method Details. Heng & Soh 2023) pose concept erasure as a problem of continual learning, taking inspiration from Elastic Weight Consolidation (EWC) (Kirkpatrick et al.) 2017) and Generative Replay (Shin et al. 2017). Consider a dataset 'D that can be partitioned as D = D= UD = [mx (m) ) "
) where D, is the data to forget and D, is the data to remember. The underlying distribution of 'D is given by p(æ, c) p(a ())))) In the case of concept erasure, D3 contains the images the concept we would like to erase, and D, consists of images want to preserve the model performance. They maximize the following objective function for concept crasure:
L = - (lgg c)] - >
Pi (0,- 2
0,)² + (oggee e)}, (2)
where F is the Fisher information matrix and the third term is generative replay term to prevent model degradation on samples that do not contain the erased concept. practice, the authors optimize Eq. by substituting the likelihood terms with the standard ELBOs. Moreover, they observe that directly minimizing the ELBO can lead to poor results. Hence, they propose to maximize the log-likelihood of a surrogate distribution of the concept forget, g(xlog) * p(x/ccy) This is done by replacing (e(ccc)p(e)) [logp(z)) (0", c)] with (x(zle)p(es) ) [log p(z]00 c)]- Intuitively, this fine-tuning will result in generative model that will produce images according to the surrogate distribution when conditioned on Cy.
Concept Inversion Method. We employ standard Textual Inversion (Gal et al. 2023) on fine-tuned Stable Diffusion models from Heng & Soh (2023) to learn new word embedding that corresponds to the concept of the training images. The authors provide training scripts for Brad Pitt, Angelina Jolie, and NSFW content concepts. particular, they use images of clowns and middle-aged people the surrogate dataset for ID concepts, and images of people wearing clothes for NSFW content concept. For other concepts, we train our own models by appropriately modifying their training scripts prior to CI.
14

---

Published as a conference paper at ICLR 2024
SD 1.4
SA
SA (CD)
FMN
FMN (CI)
AC
AC (CI
Angelina
Jolie
Brad
Figure 8: Concept Inversion (CI) on concept erasure methods for IDs. Columns 3, 5, and demonstrate the effectiveness of concept erasure methods in not generating Brad Pitt and Angelina Jolie. However, we can still generate images of the erased IDs using CI.
Shhows an average of 1.12 Likert score on images generated by the erased models. This score is increased to 3.55 when Concept Inversion is applied. Qualitative results in Figure demonstratee that CI can recover the erased style. When evaluated on object concepts, Table 8 indicates that the average accuracy of the pre-trained classifier increases from 10.6 to 40.3. With respect to ID concepts, the accuracy of GIPHY detector increases from 4.8 67.1 in Table Figure shows that CI can still generate images of Brad Pitt and Angelina Jolie. In the context of NSFW content, the average number exposed body parts detected increases from 2.5 to 5 in Figure [T] While CI is not effective in recovering the NSFW concept, we observe that the performance of the erased model on unrelated concepts is affected.
Experimental Results. For artistic concepts, our human study
C.2 FORGET-ME-NOT (FMN)
Concept Erasure Method Details. Zhang et (2023) propose fin-ttuingg the cross-attentin layers of Stable Diffusion's U-Net to map the erased concept to that of a set of reference images. The authors first locate the word embeddings associated with the forgetting concept. This can be done by tokenizing pre-defined prompt through Textual Inversion. They then compute the attention maps between the input features and these embeddings, and minimize the Frobenius norm of attention maps and backpropagate the network. Algorithm describes the concept erasure process.
Algorithm Foorget-Me-Nar on diffuser
Require: Context embeddings containing the forgetting concept, embedding locations, N of the forgetting concept, reference images R of the forgetting concept. diffuser Ga. diffusson step T.
repeat
Uniform( (L..nm((L...T).).... [I...T])se 1) Ti ~ R;e, Ciny ~ N
Zy - r. Zt Varzo VI- (o(
Cre noise variance schedule
A, all attention maps
L C+ E
||a 10
b attention resteering loss
Update by descending its stochastic gradient VoL. until Concept forgotten
Concept Inversion Method. We employ standard Textual Inversion Gal et al. (203)) on fine-tuned
Stable Diffusion models from Zhang al. (2023) learn a new word embedding that corresponds the concept of the training images. Zhang et al. (2023) only provides training scripts for ID concepts. Hence, we have to train our models on other concepts using their public code prior to CI.
Experimental Results. For artistic concepts, our human study in Figure 2 shows an average of 1.43 Likert score on images generated by the erased models. This score is increased to 3.66 when Concept Inversion is applied. Our qualitative results in Figure 13 also shows that CI can reconstruct the erased artistic concept. When evaluated on object concepts, Table X indicates that the average accuracy of the pre-trained classifier increases from 3.9 to 44.6. In cases where CI is not effective (chain saw, church, english springer), we observe that the erased model has poor performance in generating unrelated images. With respect to ID concepts, the accuracy of GIPHY detector increases
15

---

Published as a conference paper at ICLR 2024
Table 5: Quantitative results of Concept Inversion for ID concept (Acc. % of erased model / Ace. % of CI): Concept crasure methods can cleanly crase images of Brad Pitt and Angelina Jolie from the original SD 1.4 model, evidenced by significant drop in classification accuracy. Using Concept Inversion, we can generate images of the erased IDs, which can be seen by an increase in average accuracy across all methods.
SD 1.4
ESD
FMN
UCE
AC
NP
SLD-Med
SA
Brad Pitt
90.2
0.0/61.2
0.6/52.8
0.0/ 59.4
7.2/
43.2/714
4,8/718
0.0/66. 66.6
Angelina Jolie
91.6
0.8/60.1
0.0/41.2
0.0/65.2
7.6/
46.2/75.2
$.2/728
9.6667.7
Average
90.9
0.4/60.7
0,3747.0
0.0762.3
1,976.6
44.7/73.2
5.07723
4.767.1
from 0.3 to 47.0 in 6 Additionally, in the context of NSFW content, the average number of exposed body parts detected increases from 1.88 to 52.13 in Figure [1
C.3 ABLATING CONCEPTS (AC)
Concept Erasure Method Details. Kumari et al. (2023) perform concept erasure by overwriting the target concept with an anchor weight, which can be a superset or a similar concept. The authors propose two variants erase the target concept, namely Model-based concept ablation and Noise- based concept ablation. In the former method, the authors fine-tune the pre-trained Stable Diffusion U-Net model by minimizing the following objective function:
arg min B ~((=)) (,,,,,, We lea. (z,, c).)ss(() Eq. (=j, .)]B] e. where ne is a time-dependent weight, 0* is initialized with the pre-trained weight, xx is the (generated) images with the anchor concept c", and .sg() is the nop-gradient operation. For the second variant, the authors redefine the ground truth text-image pairs as <a target concept text prompt, image of the anchor concept>. The authors then fine-tune the model on the redefined pairs with the standard diffusion training loss. In addition, they add an optional standard diffusion loss term on the anchor concept image and corresponding texts as a regularization as the target text prompt can consist of the anchor concept. In both variants, the authors propose to fine-tune different parts of Stable Diffusion: (1) cross-attention, (2) embedding: the text embedding the text transformer, (2) full weights: all parameters of U-Net.
Concept Inversion Method. We employ standard Textual Inversion Gal et al. (2023) on fine-tuned Stable Diffusion models from AC ( (Kumari et al. (2023)) to learn new word embedding that corresponds to the (identity) concept the training images. Kumari er al. (2023) provide training scripts for art style and object concepts. Consequently, we extend their public code to erase the remaining concepts.
Experimental Results. For artistic concepts, our human study in Figure 2 shows an average of 1.47 Likert score on images generated by the erased models. This score is increased to 3.84 when Concept Inversion is applied. When evaluated on object concepts, Table g indicates that the average accuracy of the pre- pre-trained classifier increases from 0.04 to 45.5. With respect to ID concepts, the accuracy of GIPHY detector increases from 1.9 76.6 in Table 6 Additionally, in the context of NSFW content, the average number of exposed body parts detected increases from 12.5 to 252.63 in Figure] 11
C.4 SAFE LATENT DIFFUSION (SLD)
Concept Erasure Method Details. Safe Latent Diffusion [Scrammoskii al. (002)) is inference guiding method, in which during inference the score estimates for the r predictioo are modified as:
(3) Where is the concept we would like to steer the generated images away from, is the safety guidance term 7 c, 0s) = ((c, Cs; 85, )) (1t, c, t) cp(x,, t)), and 3 applies a guidance scale 85 element-wise by considering those dimensions of the prompt conditioned estimate that would guide the generation process toward the erased concept: B(c, es; 85, A)
E e, E) f E t) + plea(ae, c, t) <0(x,, t) - 7 c, cs)]
max(1, (0 (1,, - c(I.. cs t)]; otherwise.
where ea co(2,, c, t) e co Cs. X,
0.
16

---

Published as a conference paper at ICLR 2024
SD
Weak
SLD Med
SLD Swroeg
Ma
ISLD Weak)
CIUSDD Medi
CT USE D Stronge
GSLD Modt
Den
Thvrss Kineds
Figure 9: Concept Inversion (CI) SLD for art concept. Columns 2 to 5 demonstrate the effectiveness of erasing artistic styles for each SLD variant. Concept Inversion can recover the style most consistently for SLD-Wet De-a and SLD-Strong, In most cases, we observe recovery for even SLD-Strong.
Larger threshold and 8y lead to more substantial shift away from prompt text and in the opposite direction of the erased concept. Moreover, to facilitate balance between removal of undesired content from the generated images and minimizing the changes introduced, the authors introduce two modifications. First, they accelerate guidance over time by utilizing momentum term i for the safety guidance ry. In particular, "t, denoting 7 c, cs), is defined as:
= (c,, cs: ss, A)(Ea(z e, t) eø (xt, f)) + Sm.
with 8m E [0, 1] and U++1 Sm + (1 Sm Here, Up 0 and 8m E 10, 1), with larger Çm resulting in less volatile changes in momentum. Note that SLDD does not modify the weights of the original diffusion models, but only adjusts the sampling process. By varying the hyperparameters, authors propose variants of SLD: SLD-Weak, SLD-Medium, SLD-Strong, and SLD-Max.
Concept Inversion Method. The pseudocode for our CI method on SLD is shown in Alg. 2
Algorithm 2 Concept Inversion for SLD
Require: Concept placeholder string erased concept number of iterations N
for i to N do
Sample 3o from training data, Randomly select m 2 and n S T
~ . (0, 1); zo t E(zo): 7(20, m, es) + 0; Um <- 0 b iterating from m to with an increment of
for = m to n by k do
L. +
(E) a(eo(z,, ea (2, t)) (co(#,, + plea(zi,, c,,t) co(x.,
72 c, cs)
M++1 En + (1- Cm)
Te+1 < B(c, cs: cs; ()(Ee( c, eo t)) + km Update u. by descending stochastic gradient V., L
end for
end for
17

---

Published as a conference paper at ICLR 2024
C.5 FAILURE CASES FOR CI
In our experiments, observed small handful of cases where CI not able recover the erased concepts. However, as shown in Figure [0] these models can have poor image generation quality even prompts not related the erased concepts. Hence, this shows that while they robust to CI, such models are not very useful in real-world applications.
(erasing NSPW)
FMN Kemasing sow)
FMN (crasing church)
IMN (eraeing English Syringer)
SLD Max
Thomas Kitkade)
Figure 10: Samples from erased models where CI struggles. We generate images using the prompt "A painting the style of Van Gogh". The output images do contain the targeted artistic style and contain artifacts.
Table 7: Quantitative results of Concept Inversion (CI) on concept erasure methods for objects.
(Acc. % of erased model / Acc. % of CT). Concept erasure methods can cleanly erase many object concepts from a model when the object is mentioned in the prompt, evidenced by a significant drop in classification accuracy. Using Concept Inversion, we can generate images of the erased objects. which can be seen by an increase in average accuracy across all methods.
SD
ESD
FMN
UCE
NP
SLD-Med
chain player
6.4
0.266.2
0.27888
0.02288
00/4.2
4.0/9.4
1./244
0.6/6.2
68.6
0.0/64.0
0.0/0.2
4.0/436
0.0/17.8
4.0/
0.8 86.6
0.0/2.0
church
79.6
0.8/87.4
0.0/0.0
10.0/822
0.46
25.4/
20.6/72.0
56.2/65.6
english springer
93.6
0,2/48.3
0.0/0.0
0.0/ 69.6
0.0/ 32.6
27.0 90.4
24.6/96.4
0.0/8.2
french born
99.3
0..
0.0/59.0
0.499
0.0/ 66.6
62.4 99.0
17.0/97.6
0.2/870
gurbage truck
83.2
0.8
6.4
16.
0.0/ 7..4
39.4 84.6
19.8
12.6 35.4
gas pump
76.6
0.0/73.8
7.8/804
0.0/
0.0/
79.6
12.8/75.6
0.6 54,8
polf ball
96.2
0.06
74,4
0.0/2 28.4
45.2/88.4
60.2/98.8
purachute
79.6
0.3/
6.466006
0.0/
27.6 72.6
20.6/75.4
10.2
Average
0.2 60.1
4.9/
2.94
45.5
28.6 76.2
23.0/79.5
10.6
ne SD 1.4 FMN
[ 14
109
102
10a
Count
102
Count
10A
10a
100
100
100
Paoude Becons
Fermde
Fumile
Forget-Me-Nol
Ablating Concepls
Selective Amnesia
Figure 11: Quantitative results of Concept Inversion for NSFW concept: On average, the number of detected body parts from SD 1.4 and the erased models 99.75 (across 4703 images) and 26.21 (across 4703 images and 7 erasure methods), respectively. Using CI, the average number of detected body parts is 170.93 across 7 methods.
18

---

Published as a conference paper at ICLR 2024
Red
ESD
ESD (CD)
UCE
UCE
(CT
SLD-Med
SLD Med KCT
Donn hura
Cras
Figure 12: Qualitative results Concept Inversion on Erased Stable Diffusion, Unified Concept Editing, Negative Prompt, and Safe Latent Diffusion for artistic concept: Columns 4, 6, 8, and 10 demonstrate the effectiveness of concept crasure methods not generating the targeted artistic concepts. However, can still generate images of the erased styles using CI.
Ajen Dani Human
Thomas Kunlade
TON Eallo
Van Grogh
Keily M. Koiiin
Figure 13: Qualitative results of Concept Inversion on Selective Amnesia, Forget-Me-Not, and
Ablating Concepts for artistic concept: Columns 4, 6, and demonstrate the effectiveness of concept erasure methods in not generating the targeted artistic concepts. However, we can still generate images the erased styles using CI.
19

---

Published as a conference paper at ICLR 2024
coosette player
chain
church
lench
garbage truck
english springer
godr ball
parachute
fench hom
50 L
ESD
LOC
UCE (CBECC
NP
NP CC
SLL LLD-MN (C)
SA
SA (30)
FXNN
FMO (CD
AC
ACACO
Figure 14: Concept Inversion (CI) on concept erasure methods for objects. Odd rows (except demonstrate the effectiveness of erasure methods in erasing object concepts. However, Concept Inversion can recover the objects.
20

---

Published as a conference paper at ICLR 2024
Sjálomma
Gwea Stayy Mils Mardes
Soakc
Thated Inueem Cla (diidsooo)
Real
Tound Inseisico
Figure 15: (Left) Qualitative results of Textual Inversion on film character concepts: TI works significantly worse for concepts not abundant in the LAION 5-B (Schuhmann et al. (2022) Spiderman 2099 and Gwen Stacy compared to Miles Morales and Sonic, both of which we observed many duplicates. Refer to the Appendix D to how check for existence of these concepts in LAION 5-B. (Right) Qualitative results of Textual Inversion on MNIST: Textual Inversion works worse when excluding class 0 from the training dataset.
) such as
D DETAILS: CHECKING FOR EXISTENCE OF CONCEPTS
To check for the concepts' existence in LAION-5B, we utilize CLIP Retrieval ( (Beaumont (2022) to search for images nearest to the concept image in the CLIP image embedding space. Our searches indicate that the images of Sonic and Miles Morales appear a lot with multiple duplicates, while images of Gwen Stacy and Spiderman 2099 appear few to none.
Figure 16: Images of the character Miles Morales appear with many duplicates in our search using ht /ttt::://rom500/0 504. github..h...... hop.iprrrreerrrreeeelllllll
21

---

Published as a conference paper at ICLR 2024
Figure 17: Images of the character Sonic appear with many duplicates in our search using https co/ciip
Figure 18: Images of the character Gwen Stacy appear only few in our search using https www.l554...ithhaao httphhh.....llppptteeeeeeeeeeeee
22

---

Published as a conference paper at ICLR 2024
Figure 19: Images of the character Spiderman 2099 does not appear in our search using https 7/rom1504 504. github.
retrievall This is reasonable since the character was intro- duced in a film released after the release of LAION-5B.
E ADDITIONAL QUALITATIVE RESULTS
Redl
5014
FSD
ESDNCO
UCE
LIC
D-D-M
ST
Deam harn
Kilan
Figure 20: Qualitative results of Concept Inversion on Erased Stable Diffusion, Unified Concept
Editing, Negative Prompt, and Safe Latent Diffusion for artistic concept: Columns 4, 6, and 10 demonstrate the effectiveness of concept erasure methods in not generating the targeted artistic concepts. However, we can still generate images of the erased styles using CI.
23

---

Published as a conference paper at ICLR 2024
Kcol
SI 1.4
SA
SA (CT)
FMN
FMI (CI)
ACC (CI)
Ajin Demi Humsnn
XITO
Thomas Kinkede
Tyler Ealln
Vin Grull
Kelly Mckeman
Figure 21: Qualitative results of Concept Inversion on Selective Ammesia, Forget-Me-Not,, and Ablating Concepts for artistic concept: Columns 4, 6, and 8 demonstrate the effectiveness of concept erasure methods in not generating the targeted artistic concepts. However, we can still generate images of the erased styles using CI.
(CD
(C)
Angsiina Anlie
Broit
Pict
Figure 22: Qualitative results of Concept Inversion for ID concept: Columns 3, 5, 7, and demonstrate the effectivvneess of concept erasure methods in not generating Brad Pitt and Angelina Jolie. However, we can still generate images of the erased IDs using CI.
SD 1.4
(AD
FMN
FMN
AC (CI)
Angelina
Julie
Brad
Figure 23: Concept Inversion (CT) on concept erasure methods for IDs. Columns 5, and demonstrate the effectiveness of concept erasure methods in not generating Brad Pitt and Angelina Jolie. However, we can still generate images of the erased IDs using CI.
24

---

Published as a conference paper at ICLR 2024
cuosette player
chain
church
lench
garbage truck
english springer
godr ball
parachute
fench hom
SD 1.4
ES0
1550 190CC
LOC
UCB CCEECC
NV
NV CC
SX
SA (33)
FXO
FME (CD
AC
ACACU
Figure 24: Concept Inversion (CI) on concept erasure methods for objects. Odd rows (except demonstrate the effectiveness of erasure methods in erasing object concepts. However, Concept Inversion can recover the objects.
25

---

Published as a conference paper at ICLR 2024
F
ADDITIONAL RESULTS FOR STABLE DIFFUSION 2.0
SD 2.0
AC
(CD)
SLD-Med
SLD-Mel (CI)
Brau
Fiu
Van Geigh
Figure 25: Concept Inversion (CI) concept erasure methods for IDs and art styles SD 2.0. For Brad Pitt concept, the classification accuracy is 96.6% for SD 2.0. This accuracy drops to 17.4% and 28.2% when AC (Kumari et al. (223)) and SLD (Schramowski et al. (2023) are applied, respectively. When is applied, the accuracy increases to 89.8% and 54.4%.
26


Reviews:
[{"review_id": "Sj3s0Qcglb", "reviewer": "Reviewer_iwRd", "summary": "This paper examines seven concept erasure methods in text-to-image models, and show that the targeted concepts that are supposedly erased from the models can be retrieved using an algorithm which learns special input word embeddings. In this way, this paper shows more thoughts and efforts are needed when coming up with concept erasure methods in text-to-image models.", "questions": "None.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper addresses an important problem that is often not looked upon in text-to-image generation models. \n\nVisual illustrations are presented well. It is also good that both quantitative and qualitative results are shown. \n\nDetailed appendix is also helpful.", "weaknesses": "Only 1 version of Stable Diffusion (version 1.4) is presented. Is there any reason to choose this? Will the results be similar in later versions of Stable Diffusion?\n\nThough the paper exposes that the seven recently proposed concept erasure methods can be broken, the paper does not address in detail how these can be fixed. A detailed discussion section on this will be useful and make the paper stronger.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CphELy7Ugf", "reviewer": "Reviewer_PvZ8", "summary": "The paper reveals that seven recent concept erasure methods in text-to-image models are ineffective, as erased concepts can be regenerated with specialized prompts. It demonstrates the methods' vulnerability and the need for stronger evaluation approaches to truly sanitize models from sensitive content.", "questions": "Please refer weakness part.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is clear and well-structured.\n2. Experiments are well-executed.\n3. The authors have provided the accompanying code.", "weaknesses": "1. The paper evaluates black-box methods using a white-box approach. For example, Kumari et al. [1] already acknowledged their limitation in the white-box setting.\n\n2. Clarification is needed regarding the attack scenarios presented. Specifically, it is unclear why an adversary with white-box access would seek to bypass a black-box model.\n\n3. Assumption 5 in section 3 appears inconsistent with a white-box setting, particularly when considering Assumption 4, which grants the adversary computational resources. It raises the question of why an adversary could not alter the weights of the \"erased\" model under these conditions.\n\n4. Regarding the practicality of the proposed attack method, it is important to note that widely-used public services such as Stability AI and DALL-E 3 do not currently accept text-embedding inputs to my knowledge. This may render the evaluation less critical, especially considering that existing methods effectively erase explicitly mentioned words. \n\n[1] Kumari et al., Ablating Concepts in Text-to-Image Diffusion Models ICCV 2023", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zjAEhQNrt5", "reviewer": "Reviewer_YpMN", "summary": "This paper presents a comprehensive analysis of concept erasure techniques in the context of text-to-image diffusion models. The authors investigate the effectiveness of seven existing methods, which encompass both fine-tuning-based and inference-guiding-based approaches. Through their proposed concept inversion technique, the authors demonstrate that these current methods fall short in completely removing target concepts.", "questions": "1. There is curiosity about the behavior of the learned concept placeholder embedding in comparison to the embedding of the original concept name. This comparison could provide valuable insights into the effectiveness of the proposed approach.\n\n2. Typo: inconsistency in the caption of Figure 7, which does not align with the order of the figure.\n\n3. confusion regarding Section 4.4 \n\n* How to understand ‘remapping the concept in token space’? Since the original text encoder and the embedding of the original text tokens are not updated, right?\n\n* how the authors conducted experiments to demonstrate the editability, as the left figure of Figure 7 does not appear to clearly showcase this aspect?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The motivation and storyline are reasonable and novel. The organization and most of the writing are clear, ensuring easy comprehension. The inclusion of preliminary experiments on Text Inversion is appreciated, as it demonstrates that the text inversion is not able to introduce additional knowledge to the model.\n\n2. The authors conduct extensive experiments on the existing 7 works of erasure methods. The paper presents both qualitative and quantitative results, further enhancing its robustness.", "weaknesses": "1. While the concept inversion attack in this paper assumes full access to the diffusion model and erasure method, which may be seen as a relatively strong assumption, the reviewer acknowledges that the current setting still represents a significant advancement towards enhancing the safety of text-to-image (T2I) models. Therefore, this limitation can be considered a minor weakness rather than a significant drawback.\n\n2. In Section 4.4, there are several points of misunderstanding that arise, pls see questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FveW3pM21k", "reviewer": "Reviewer_cgR8", "summary": "Text-to-image generative models, widely adopted by the general public, present significant risks. These models can be exploited to generate sexually explicit content, mirror artistic styles without authorization, or even fabricate celebrity likenesses. A variety of methods have been proposed to \"erase\" sensitive concepts from these text-to-image models, some of which claim to \"permanently remove targeted concepts from the weights.\" Empirical evidence across multiple test instances and use-cases like object removal and artistic style forgetting seem to support the efficacy of these erasure methods. However, the authors demonstrate that such post hoc concept erasure techniques are flawed and can be circumvented. They argue that these techniques essentially perform a form of input filtering, rendering them vulnerable to some more sophisticated text prompts. The authors introduce the \"Concept Inversion\" attack technique to recover erased concepts, effectively defeating seven recently announced hoc concept erasure methods across multiple use-cases. Their study calls into question the effectiveness of existing erasure methods and introduces a strong new evaluation methodology for future concept erasure research.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors offer a comprehensive introduction to the background, maintaining clear logic throughout the paper. Through diverse and reasonable experimental settings and evaluation methods that cover four different attack scenarios, the overall experiments are highly convincing, backed not only by objective numerical data but also by subjective evaluations from volunteers.\n\n2. The experimental section of the article is detailed. The authors clearly expound on the principles behind the latest seven post hoc concept erasure methods and introduce adaptive concept inversion methods tailored for each. Each attack scenario is deeply analyzed, with proposed attack methods that are both clear and logical.\n\n3. The authors' concept inversion method is effective, successfully circumventing most of the advanced Post hoc concept erasure methods. Even in instances where they could not break the SLD-Max method, as depicted in Appendix Figure 9, they provide a reasonable explanation in Appendix B.5.", "weaknesses": "1. The authors propose their attack methods under relatively lenient conditions, as evidenced by assumptions (1) and (2) in the PRELIMINARIES section. These assumptions are closer to a white-box setting. However, for most MLaaS (Machine Learning as a Service) platforms, attackers would not have access to the internal details of the model, let alone the ability to add new tokens to its dictionary for executing Concept Inversion attacks. The TRANSFERABILITY method outlined by the authors in Appendix 4.4 also seems to be non-transferable to a black-box environment due to the inability of the attacker to modify the model's internal dictionary. Therefore, the current CI attacks appear to still have limited effectiveness in a black-box setting.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OOcxSfyPcl", "reviewer": "Reviewer_h1Qn", "summary": "This paper proposes that the existing erasure methods do not fully excise concepts from the generative models. Special prompts can be used as attack procedures to regenerate the unsafe outputs.", "questions": "See Weaknesses", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The target issues of the paper are meaningful and worth exploring. This submission gives a valuable implementation of such an idea and presents good results. Existing work rarely explores the failure cases of concept erasure methods, while it is valuable.\n2. The paper is generally well-written, clearly structured, and quite easy to follow.\n3. Many experiments are conducted to verify the viewpoints.", "weaknesses": "1. The CI attack method is straightforward. Basically, this paper uses the existing methods, such as Textual Inversion (Gal et al., 2023), for the Concept Inversion Method. The CI methods lack insightful and novel design.\n2. It seems that this paper only shows a number of image cases. The experiments conducted on large-scale datasets are favored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)